{ "Event": { "published": true, "date": "2026-07-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-12", "timestamp": 1783900982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9afb248c-aee1-41b0-ae2f-de6f0b1ff76d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6a8f78-7dd3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783848188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848188, "uuid": "d508af74-2cf5-4362-8cb7-1b069209dcba", "comment": "Malware payload (Mirai)", "value": "5bf693743559d762514214eed3415cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848188, "uuid": "8c5076cb-1b31-4cc2-982a-6810986fc7d0", "comment": "Malware payload (Mirai)", "value": "001a1c23a494756f8aa26b53e297fa2752108378feaed654a8c21008fd479b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848188, "uuid": "a97a3674-5a38-42c8-97ae-1525c8c65e3a", "comment": "Malware payload (Mirai)", "value": "25cef9689c587ea087626d966cbdb1fda590b0c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848188, "uuid": "cbdae3c9-10bd-448f-97b1-dce0dd3c9f71", "comment": "Malware payload (Mirai)", "value": "97f82da69ec879ea86efab123b97c5050f4e404c1f819eb14f8e63b38cb2c4a0de7caeb80121012db6f46c706c8f9a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848188, "uuid": "151b451a-e954-423b-8f1c-8c15c0efa0ca", "value": "T143E2E06464BC150FF25CE339637A886468F93B440ADA880869EE0DF79E5B97F6341C39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848188, "uuid": "86f4f182-a81d-4d38-abdc-c3a9dad4cb09", "value": "768:QOak9MbuaQlyL0aTnuz5zBlSBUK+hPo1cgDyGxoTFYBi4B:QOL9MbAELh6zBlSBhGIcgDyG6TFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783848188, "uuid": "c15870dc-327a-4b00-99c7-1037ad21ce8c", "value": 33964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783848188, "uuid": "bac9b23f-3da2-449a-bfd9-ad553862e545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848188, "uuid": "e7594f0c-b075-467f-9834-5f8cae3172d8", "value": "XDx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa6c80c-7dd3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783848186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848186, "uuid": "df9b6ea3-f2ac-496c-8705-8366cc0f5a14", "comment": "Malware payload", "value": "f0db08954de1c96bd386ca16616464e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848186, "uuid": "dd729344-20d5-4d6a-8d4d-703c0be8d5c2", "comment": "Malware payload", "value": "018cf3ae7bad69c5f1ebf0bdc0746008e8cfc9e616bdf54daf6bcedf4656774b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848186, "uuid": "1fd00884-2641-4cd6-ab35-ef5b7b26fba4", "comment": "Malware payload", "value": "ffa41ed94396a0861fc381d571b9cd8557e43357", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848186, "uuid": "cbd27ee4-e0b4-4b60-997c-ed130ff82e06", "comment": "Malware payload", "value": "9fd94bc84b95b48deb8546d341566afba9792ec01f048f879cba84faa1471be785a18c36c84b54b658072a4e24bae6f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848186, "uuid": "538762da-4485-464d-8c69-d7aad2abbab6", "value": "T16F337C551A857C249A99C9361D7F2F0CB8AD43E6320492DE7FCB3CF28C4AA9DE11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848186, "uuid": "c945032a-ff70-441a-bd4b-3e12fe5327e1", "value": "768:uVEJVIhtMg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:MEJ2MdcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783848186, "uuid": "77ed017d-d034-4fed-9932-eb6b59bb90e7", "value": 50374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783848186, "uuid": "10079c1c-4358-40d7-bae5-c4b8794d68ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848186, "uuid": "b41527ac-3d80-4d37-ad3d-a914635d1eb4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc31da-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823791, "uuid": "0a624b5a-ffe6-447c-9b24-0939ad88031d", "comment": "Malware payload (Mirai)", "value": "efb1721958b04808ca280ccbb541acab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823791, "uuid": "55be21a6-ef6d-4e80-99de-09aad86a3f37", "comment": "Malware payload (Mirai)", "value": "01c727469c703060764c88239e7a02fbc9582ba31a3a4a44c958958521bcad58", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823791, "uuid": "6ac6c75a-4723-4e73-af54-24a95cf75c41", "comment": "Malware payload (Mirai)", "value": "b324bce98608c9dabf5fa206fa6fba4978387c33", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823791, "uuid": "341baece-18a4-4a84-8c0d-68c9d3fd4758", "comment": "Malware payload (Mirai)", "value": "4ca6deb9a9e60b641780e00b958b089b0a62ddbb056bcdc9c8dae2eeb40ce6865be12c6b0b7ec0c7270262f2a29e9726", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823791, "uuid": "09784319-6cd5-4a78-a64e-aa04ae6ad478", "value": "T11C315084053489CEDD47CE88F76680D0DE0916A7FDC37A1ED986095AE41CA38F4DFAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823791, "uuid": "35d4e233-1639-4f2e-acd8-f59b90bf8e89", "value": "24:HEUFzkehdJTBoCRcwhEEwXkaxbOxTejU6qLtM6:kUFzkWdJTBoMcwhgXkaxbOxTeA6qLtM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823791, "uuid": "f19e824e-8e8c-44a8-98b1-ae00a25a8762", "value": 1481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823791, "uuid": "77035880-fca3-4369-b277-344d09dbe2f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823791, "uuid": "f18c771b-7c80-4fb3-b8ba-5ed5f4f62068", "value": "callaputa.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8696cd-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823817, "uuid": "0d6c3130-6c8c-473c-a512-4b637bd87b08", "comment": "Malware payload (Mirai)", "value": "b2e57ceb077251f9db228ad6de4aef57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823817, "uuid": "4ba5c38f-fa87-43c7-9a29-2712961e63f8", "comment": "Malware payload (Mirai)", "value": "01dd3eeddc0ff280ab0ae9272d20a807c80f10afe4b1394fa68e427a87cebadd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823817, "uuid": "1592cab1-63ef-48fc-b8b6-f78f0713a246", "comment": "Malware payload (Mirai)", "value": "42655ff9c03f6ab8531c5f5913c7bcdd6c429cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823817, "uuid": "614c794c-624e-4d56-8be1-6f000fbb35d3", "comment": "Malware payload (Mirai)", "value": "b8c196613f55a6ed342eea4e803e845175349b91be54b5da8d892679552071e9edea10ed83676c2c9973c9922d26cddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823817, "uuid": "ec6af1ab-19d5-43a3-896e-64c441936880", "value": "T14833F153E24A6829EE975CF47C92DAD563F805926D6A4DE30A84DBC13C43FA63302CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823817, "uuid": "5491fb3e-7c18-4d43-877c-c4218c9c328e", "value": "1536:arlSzHDyb3Ws1vdVebb4DhbMqbP64u+qgw0ra:IlSzHDe3WoeX2hMqbP64u+qgwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823817, "uuid": "a84d2440-f7db-44d8-8667-a1f7ec430663", "value": 53168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823817, "uuid": "e48dc163-b0a8-4900-aa2c-a47a3d3bfc5f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823817, "uuid": "6e166931-bd63-4010-8f37-bf1190c8fb35", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf8271f-7dc4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842015, "uuid": "8faa673f-d4f9-42de-aacb-f6ab0504cee9", "comment": "Malware payload (Mirai)", "value": "4af44a00eaf904dbd1024031b0b86034", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842015, "uuid": "cffb8aaa-ec34-4b0b-9638-e3e6678f33bb", "comment": "Malware payload (Mirai)", "value": "022cfc39fb54a53e4012b7cab8f4b0a3752419f14281e00f236faf16ba5853ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842015, "uuid": "575b567d-a383-433e-8068-8b89b01aa979", "comment": "Malware payload (Mirai)", "value": "677f1d1dfe639182134db45555076dfb6d920bea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842015, "uuid": "659190ef-7e2a-4621-a8e3-04402da90030", "comment": "Malware payload (Mirai)", "value": "65d59872a2a8413ed2495d009348716c3a1dfd09fd36c0a96e3f40d59dd52988659670f8eb35a49303cd62db15ec4a43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842015, "uuid": "43112008-59e4-41ab-9f48-555de099adc3", "value": "T15B51C9DAE22187FAEC65C916B2FA750CF4B140D6A4CE3E7B55EE39F4589DE04B300642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842015, "uuid": "18710270-8b7a-4865-ad85-b27555e9c954", "value": "24:ItfsZOtnSsDSFOmJsquL8DNIiks9zGs/eBRedbeuyv:iUZOtjDSFOksquL0J9zGs/qWbbyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842015, "uuid": "16435db3-fe73-4991-8ff5-574b4b0a5a84", "value": 2969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842015, "uuid": "2deb1b32-8917-40aa-942a-5e61bf688dff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842015, "uuid": "50256781-b2c6-46ff-8601-383308023154", "value": "ar15.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c9e5d5-7e32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783888999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888999, "uuid": "35da8983-3c51-48cc-be96-82b1b874f0dc", "comment": "Malware payload (ArkeiStealer)", "value": "8fe2e83308493424f55c45a0e46846bc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888999, "uuid": "db8f9a72-b09a-463b-a72a-ce990214c487", "comment": "Malware payload (ArkeiStealer)", "value": "05235d0287744075e70663a98f429178b4410ea82c0710fd50e756ca6e273d1e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888999, "uuid": "dcff9175-3710-4469-9d36-7580b861aecf", "comment": "Malware payload (ArkeiStealer)", "value": "53a7721024e086647dfd36a6bf99029321cc8e2a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888999, "uuid": "d287eaf0-6183-4611-9c1f-fda109a57291", "comment": "Malware payload (ArkeiStealer)", "value": "1162aa270feb2b826ebde29af94c6132ffc4dc24ff83991813a69c93bc45c3ba1488aa8c0565531eea6f11f3d4f32ae3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888999, "uuid": "a9fef575-8769-402a-9d4b-78a5214b488c", "value": "T1EA06AD07AC814DA5C45A537249BB12617B3CBC188B3A7BE72E50B67A3F323D49C36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888999, "uuid": "707ad09a-1caa-4435-bf96-e1e06b1e635b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888999, "uuid": "7748ac58-0bd1-424f-8005-46674259c038", "value": "98304:JWPAo0RmfG2zr8a/BlWR54ab8yq1Nw3x6:JWYTQfG2zr8yfWRKab8yq1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783888999, "uuid": "00af1854-c777-4d52-b0af-f025a70ab1c6", "value": 3726192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783888999, "uuid": "19ce3501-d157-4d23-abbd-6207a87f19be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888999, "uuid": "bff1aece-c0ec-45c0-b80d-6eea2126f93e", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28fd774-7e4c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783900330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900330, "uuid": "0ba360fa-e285-4397-92b2-d230e5b92555", "comment": "Malware payload", "value": "308e5edf5571d41dcafc02c64b768bdb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900330, "uuid": "aba61c67-4a8f-4495-8833-c71955bd5a1a", "comment": "Malware payload", "value": "05b70f3f4f9bda0e2efae7d7c3c33afc86f3962124d92692e7db279b49768356", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900330, "uuid": "00c09d1d-61c0-4ded-9f5c-cc1fdb0ad55f", "comment": "Malware payload", "value": "199cae35735258460c0026e890fb5e03a1bb835e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783900330, "uuid": "5f22c287-8087-4a2b-a56a-ab049ed092dd", "comment": "Malware payload", "value": "e859a34ac76438bed42d173fc10aa295e864486686881786e4a749ba3423a3f2c77fdaa9c5372c81af56b9e4fbf1983b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900330, "uuid": "8669c255-ed75-4a38-ad99-bcb08e4015a6", "value": "T195E63329AEE412FDD5774039EEE199D2E678B8311B31C99F139C86325E232D01E3D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900330, "uuid": "e96c5c43-d2cc-4b7d-80aa-016daa81c76e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900330, "uuid": "a3400440-80d4-4d2f-92ba-f74fc3627f1b", "value": "393216:G6ox7Yps+ID+u+KbmSyXMCHWUjXccuI3/PGTAI:GSlID+uwSyXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783900330, "uuid": "c1509887-ea24-4cc0-9340-cf5b6d835c4a", "value": 14285793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783900330, "uuid": "e5d2a670-2b6b-45e1-9804-a0ac2fc9059b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783900330, "uuid": "9873c959-1e29-4805-8460-132cce770802", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301dcd23-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843847, "uuid": "4a11e049-4fd3-43c7-b3a1-46ed5c5598c8", "comment": "Malware payload (Mirai)", "value": "d213e72b077fd043ffe5d8b4c25b727f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843847, "uuid": "79993d03-6269-469a-9ac6-f9103759f42e", "comment": "Malware payload (Mirai)", "value": "0720fb474e91276c2445e0d0d97839db3a5357599a86c3af1c0ef10705ea7971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843847, "uuid": "6f7b8131-1ecd-4bd6-9735-9d1b5ada0877", "comment": "Malware payload (Mirai)", "value": "3e13701072884af796cc8fc41b4dece6d2149990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843847, "uuid": "9fd13e6a-9a1c-4f87-a264-a24e11ad7a34", "comment": "Malware payload (Mirai)", "value": "1136122664c1e5b0377d6c0eb3c54872e552140ab1880186343bb73c1904b509b3af1740887879b95c9e0467e46c9660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843847, "uuid": "aebd82a9-172d-4094-9217-97591738550b", "value": "T130931945BCA1CA29CAC023BBBB2E629D331293E8D3EB3103AD28177C56CA55D5F37545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843847, "uuid": "546f7961-e45c-45af-b492-cd1e8393273f", "value": "1536:Iy5nU/9z5XEfJtDdSPTHNQEBj5nu6y5M4ITMh9kP7JuDyZdrI130I+qs+Iwj5Oa5:TQzZEfM+6jJgilm1tsmjs/972IsGbLWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843847, "uuid": "5ca42fef-5ca0-4ec8-bf8c-79ae735d15f3", "value": 95788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843847, "uuid": "777d8397-4041-4616-8206-3fd859a3f64c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843847, "uuid": "47f75af1-0b9b-424e-8987-16ec96049e34", "value": "Ares.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f991c5-7dec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1783859136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859136, "uuid": "0b30f635-89d3-4c61-b5a3-6bd642f07eb1", "comment": "Malware payload (DiscordTokenStealer)", "value": "d446a406a71e804e00ef7dc9010a6a6d", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859136, "uuid": "0b1d62e6-20a0-4392-8e8a-fa0ba6671286", "comment": "Malware payload (DiscordTokenStealer)", "value": "0a31641b50287de2bce780316c8ac05f41a24262877a46ac25ef468e3da9381b", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859136, "uuid": "4b29b174-d4f2-467e-baf2-6e615f1271fc", "comment": "Malware payload (DiscordTokenStealer)", "value": "bb95d38ae9697265d2a33a440d02a4fbe1500b4b", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859136, "uuid": "565993a0-95fc-4dee-920c-1fa81a3184e7", "comment": "Malware payload (DiscordTokenStealer)", "value": "2e9a315e628c5e510de25c74d93f11334a124270b82fd49e70971a8641ca3fff15e302089976dea20dca55f394a06e25", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859136, "uuid": "005f7e65-1ae2-4ad2-a77c-a046e1361c89", "value": "T1FDA3190AE9A2247EC3A78036CB462545EAA07C5947985EFB63C1CDF64CF19A07F3D613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859136, "uuid": "27b056d5-0901-4065-809b-ec5b37fd0020", "value": "20c55d66e9ef9cc9de77a7f537597372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859136, "uuid": "9f9e613b-1e07-4437-9de6-2c438e356ae0", "value": "1536:NlMtV4u/x4Zyb9m8wM/vuhWt9roQTie754T0vkdlOON0FCn6f9woAPhTZ0bAsb7K:OKJSOpoOfc0slQNuJN5kFDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783859136, "uuid": "b851cfac-2c25-4d1c-8ca7-30997bd89fc1", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783859136, "uuid": "0cc9446c-f2de-4b9d-9528-085d92285fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859136, "uuid": "42d40b68-a7b2-476b-b3ad-36feca990df1", "value": "fortnitecheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7235be64-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783843958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843958, "uuid": "2a13e66b-0d90-4af4-8db7-acbaad4d1404", "comment": "Malware payload (Vidar)", "value": "e2bf0c363effd71ba037480cf6f8d19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843958, "uuid": "e2b9b54a-8b06-4efe-ad83-99259569d88f", "comment": "Malware payload (Vidar)", "value": "0a8f1fa93f96182e78f5b95abd940d98bf53f06dc1fbe172bb913f821a3647d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843958, "uuid": "25f0f9ea-4a73-4294-a6b0-e54759c9c559", "comment": "Malware payload (Vidar)", "value": "dcc7482c8d972e89173fe6ccb0b5817d2b113f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843958, "uuid": "9d1b4016-34ea-4c60-a633-bbf256de7c30", "comment": "Malware payload (Vidar)", "value": "61a37418397f47fe4ec1cf0795b8a5034cd97f79025cdb6ddcdcb41df11588bf7bbe05073925a6ac318a17c6a5351004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843958, "uuid": "77ab7b78-5f95-4b78-971c-d8e3e38737e8", "value": "T121E59D07BDE169EAC49AA23189B215957B36BC481F3323D72F9073782E72BC05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843958, "uuid": "31800169-3bd5-427c-9e62-772eb98b5818", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843958, "uuid": "f7a68654-b1f4-4037-89ae-79145a297d7b", "value": "49152:UcU5GNGqDZvyZzdIfWctl9AEf5iwP7KmSZZRSEYT4VFvoEqaXCy77RN:Uc5+IuGd2mSRhFoVu7lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843958, "uuid": "4c3ea4e2-a246-4496-8e8c-6e5a266c4e58", "value": 3282808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843958, "uuid": "5b7135c3-c6d0-402b-93e4-1d7adc559279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843958, "uuid": "3e6dda3f-e7ee-44ce-b7a0-2ea5532d9ee3", "value": "09d688a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3840d3-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843872, "uuid": "d69d58a3-c35e-4312-8092-db2e524f128b", "comment": "Malware payload (Mirai)", "value": "1839feb8faea8d3be8f84a042dc1d3ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843872, "uuid": "0ce060b2-8133-4010-aec0-1d20c1538125", "comment": "Malware payload (Mirai)", "value": "0ef2f579f40186b8e2a07bb8deecdff9417f5544d1bc2fea9ab8f07121c4fc1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843872, "uuid": "c64d45f0-5165-4d82-8bdb-254a3d2054c2", "comment": "Malware payload (Mirai)", "value": "0902f429234327c7470b320c8535e46ce93c87c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843872, "uuid": "c8019588-35cb-4d62-80cc-11f76fbb62e2", "comment": "Malware payload (Mirai)", "value": "5c68e758bb997703573405b3166da526fc416d59a55caa7fa7d691ffca21efed5578a3f34e90b2bf3e20faeba78ffa74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843872, "uuid": "c1ed08e2-714f-4c97-950f-77d82c21a274", "value": "T10BD3C50D6E315F7CF7AC823407B78E345794379622F1D684E26CE9255EB428E242EF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843872, "uuid": "e36c0353-2cdb-49e6-a4d2-d3a28ea6ebf5", "value": "3072:szxUWO5TiOB15156SSzoU616RfCqTKTITeK4G2bBfHyRnJ:sK5mOzh4oMfCqTKTIOG4BHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843872, "uuid": "7ccc1314-e98b-47b3-8cbd-dc7bdf2ba7d0", "value": 134052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843872, "uuid": "9df71943-92a3-4a11-89e8-2fdd43410078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843872, "uuid": "9ce50017-184a-4e43-bba6-509feff38443", "value": "Ares.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d4b85f-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843996, "uuid": "e343fb6a-75f6-466c-a6ab-d0a371dbb217", "comment": "Malware payload (Mirai)", "value": "685a04f518e9d5a4f1e1f7d1fda44455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843996, "uuid": "1a6c72ca-7d23-4814-b276-d18b53c038e6", "comment": "Malware payload (Mirai)", "value": "10a3056f1ef1aee4da79fd98c291caa713d2fceb1007fda4d92b5b4e6a3b1400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843996, "uuid": "7383ef82-0834-4f1f-85eb-4c8a938db8ae", "comment": "Malware payload (Mirai)", "value": "44b466d3799c49b39b89ca427f253d2bdd4d0290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843996, "uuid": "d59a3071-255a-4cd5-a23f-d9cd04319fec", "comment": "Malware payload (Mirai)", "value": "c4ee2f61893bc0ff675535349bc567f16bdf05830f7589d2be2ccb2f4a1b6f404f29401cd6bdfbe7a7d9db8b31fe836c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843996, "uuid": "1b1b5d0e-9284-4213-80a7-85f39855e370", "value": "T1A3E40A0AAF400EFBD82FCD3705A91A1635CCA49732A53B753538DA14BE5E54AC9E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843996, "uuid": "75d44639-6f92-4866-a42e-e0eaa4eb7f64", "value": "6144:qObmo2f6gIbm53XLZh1Z6PdYaMUbBaZmJYthS4JDF/CgTdWP29BomSZdTN:qObkLbf1+YaMUbBaZmqqECgO295SzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843996, "uuid": "6dd9f239-e455-4162-883c-b1bc9e8ffb27", "value": 694208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843996, "uuid": "d90473de-0ea3-4953-8fb3-98fab5e48271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843996, "uuid": "7ea348ca-909b-47e4-9366-986fffc3ba30", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8653bc4f-7dcc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783845280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845280, "uuid": "e0f1c97a-0ad9-4f26-8bee-4bf68f49c35b", "comment": "Malware payload (Mirai)", "value": "746c9ffc9f7b811648f55fdbab5c846e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845280, "uuid": "1591ca8d-9fd8-44e4-a3b8-d3b41929f1a4", "comment": "Malware payload (Mirai)", "value": "112de443b125f855f4b57211feba4f9e1081896c632fe606fc2330ca2f0b3368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845280, "uuid": "a4bdf9c1-fc05-4efc-8622-054cd13182f1", "comment": "Malware payload (Mirai)", "value": "bd0475bac53ac15c22c852446f5341ba6cdef618", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845280, "uuid": "48d9191e-b55b-4602-9e53-b37c1996e291", "comment": "Malware payload (Mirai)", "value": "8b5fc5f83fe532bb34b4965e7dcb60f949cf02caffc588d9a14b8c9c87a6816bb0b76eb5b3f50c905c28baf1faaf06f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845280, "uuid": "4dcdd7d1-d639-449d-bb5e-fb64cb0d12fa", "value": "T10BB31899B8D2AA62C6C316BFFA4F428D773663E4E3DF7107DD145B21328751B0E6A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845280, "uuid": "4e1ea5db-60e9-47b1-92e3-6e05fa6c7be8", "value": "3072:FweJCIziMYITzciU5Ta98AcFUtPQjWba/BnbE:FwecsZzciojAc2tP3adE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783845280, "uuid": "242ed788-e45d-4754-9dc6-1ca54549b51a", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783845280, "uuid": "95f20bce-8c68-4cc8-a997-4076153b8326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845280, "uuid": "b512af28-3e69-401f-929d-ffa723e52fd6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fe22b3-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840959, "uuid": "9236c8b9-f184-4816-8979-23e717a0d939", "comment": "Malware payload (RemusStealer)", "value": "6adea3d32ee70316c9f97f13e69acbdf", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840959, "uuid": "189aabe4-066e-41b0-a28b-240858ad5bfe", "comment": "Malware payload (RemusStealer)", "value": "116e6d06ce45806d7b1a59b3cfb7544fd0be3ec345d62a02cbac11ca4275e086", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840959, "uuid": "a621a172-c084-4df1-a7e1-d3ed1844dcb7", "comment": "Malware payload (RemusStealer)", "value": "816882dfc72cc823a94388424e9714fb2c7da455", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840959, "uuid": "1c7dde76-c694-492a-81a3-54ae480c2842", "comment": "Malware payload (RemusStealer)", "value": "906d0c2fa35b4d45316ff8a3ac5d6ae7a4a8fca175f855fec06fe947f67a2191b2e7d23df6a9bba01b9b5c358ee48633", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840959, "uuid": "f19604b3-d8c4-44c0-be57-70db5379a178", "value": "T19FC54907BDA149E9C09EA23199B751A67B75BC080F3223EB2E90B7782F727D05C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840959, "uuid": "a165950d-9a06-46d0-a2d5-2506509c8cd5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840959, "uuid": "2dfd4d0f-6d95-401b-b3ae-58199e827112", "value": "24576:h72cxcIwmf//fnLoomuwYITBiLlf5TLzY6sC7vdtb2eqYDEbxvA2Bele5rK2y0H9:h72wcWfvnAeYeXLzY6RdDqX/8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840959, "uuid": "71793a79-9e2a-4d46-bea5-f9017ad5e61e", "value": 2557824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840959, "uuid": "d143dc39-ff70-4e19-ad10-ce71c0c46b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840959, "uuid": "e0c70eb3-88ee-4f5b-aef3-fdcec1b4baa1", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f86ce9-7dee-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783859772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859772, "uuid": "e8489d99-e19e-48fc-a29d-380e85d218f8", "comment": "Malware payload", "value": "14402402239e857edd35b74feb72c46d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859772, "uuid": "2bff729c-4ff6-4755-9c92-533a7a4f7845", "comment": "Malware payload", "value": "1245f226ac47f6154e6f925df907c269a984a7f8702f9170afd0043882f19c47", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859772, "uuid": "919e8096-d4f2-4a67-b59b-34c008f7c0e2", "comment": "Malware payload", "value": "6717a5ee94796b05bbdf3e81cebc7229b41f6bb9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859772, "uuid": "98db80ba-9a40-479b-974e-0172126742b3", "comment": "Malware payload", "value": "f86c453269dc31092ea7a406ca97eb11c5c3f291453b378fd805e0e65b46035c16f7418e367a2255a0fe3aa610574d49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859772, "uuid": "86e9c73c-6afe-41d2-8f99-332ae83f610c", "value": "T148336D6516857C14AA99C8365D7F2F0CBCAD43E6314491EE7FCE3CF28C4AA9CA21971C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859772, "uuid": "8c2dd4c6-6ec1-4dda-b8a8-4d7040659f60", "value": "768:Ar9NyXsZztC39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:uHusZtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783859772, "uuid": "2d4166e1-250c-4dc7-b7a0-3037eee48dd6", "value": 50370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783859772, "uuid": "deba499a-1112-4cca-9345-dd4ee0a1ac88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859772, "uuid": "77d3fcd4-9f75-43fa-bde0-6275a006331b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80cb9a1-7de1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783854410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854410, "uuid": "9aa34447-cd7e-4a04-8701-0fc602d11585", "comment": "Malware payload (ValleyRAT)", "value": "ebdd0e721fb6f9203abb7ad686059584", "object_relation": "md5", "Tag": [ { "name": "134-122-128-135", "colour": "#180E4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854410, "uuid": "de8889b9-0d82-4976-b7bf-4585bcf88cf3", "comment": "Malware payload (ValleyRAT)", "value": "15015ac752a84281d406e0ddf814688dcae0e803394491368b479be4c73fe58f", "object_relation": "sha256", "Tag": [ { "name": "134-122-128-135", "colour": "#180E4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854410, "uuid": "70c67796-e454-430a-986b-b6a331a5fbab", "comment": "Malware payload (ValleyRAT)", "value": "df71a778a15c254d83614a4781d36b6830d6fa2b", "object_relation": "sha1", "Tag": [ { "name": "134-122-128-135", "colour": "#180E4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854410, "uuid": "7e98fcf7-1985-45fa-9dfa-ae2663aff8b1", "comment": "Malware payload (ValleyRAT)", "value": "823875e499992f3cb97aa588f62532fd79dd92bef7770ebac7edfaa1d488de55f8ef9c76643b1dd6236be2bdf1d0080d", "object_relation": "sha3-384", "Tag": [ { "name": "134-122-128-135", "colour": "#180E4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854410, "uuid": "20457d8a-9c9b-4e7b-868f-f84788cd7bd3", "value": "T183863399879770081E87A1BD6083472CD2BAB647FF6CC8936AD526B3E3C1747344E768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854410, "uuid": "7a7a9654-e8ec-4c2e-a4e1-d7de428c78ee", "value": "196608:w+FERbq2rAG8Rbq2HRbq2fRbq2fPT82F1B/GKRbq2eRbq2gE:w+iRP05RPHRPfRPfo2HdTRPeRPgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854410, "uuid": "21d19d0f-ada2-4c40-9dff-3b80c694f499", "value": 7957462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854410, "uuid": "c54d6cab-4dd2-4ba3-a8dc-57931c8c57da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854410, "uuid": "1216718d-006d-4d31-9835-181b236a102b", "value": "HUIYIJIYAO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef354f05-7dc6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842879, "uuid": "547c9571-87ce-4698-8c91-55cf395ccbf8", "comment": "Malware payload (Mirai)", "value": "27bc670432811c1e1d0b81c74d9854db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842879, "uuid": "d28ff529-c8ca-410f-9098-d55ea130b90b", "comment": "Malware payload (Mirai)", "value": "162b851bde34e6d97b00ccaf54959528ba7e9b5bac5320f893387a497ebc32e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842879, "uuid": "90346070-dccf-4e55-8be0-0a09351fd65b", "comment": "Malware payload (Mirai)", "value": "fd02d2afb06c8d22f4434192ebf5e7d48f42b7c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842879, "uuid": "409b59c3-267e-46b1-803d-568c621320ec", "comment": "Malware payload (Mirai)", "value": "051568ba87fc37c1f5c1f1951b42368b88dd812ae556db673604c2e0465aa171677ed339a5a5b4dac162d6233381127b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842879, "uuid": "98fe8e7a-b16e-4a3e-8f6b-f46f352735f5", "value": "T13413288BF482993FC9D4837AFA6E614E7312F3E4D1DB371BCD088B55228710A999B940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842879, "uuid": "573e527b-9ed4-4884-8bdf-a7c82dde4cac", "value": "768:Qh+qq98PO52eJR1ZxFi7npI8hagcE9axgQNvP42MDAS4/vzRioS:QhAvLFInpIDIaxgMn42MW/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842879, "uuid": "fdbbba51-233a-4617-b6a1-09572d97ae82", "value": 42300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842879, "uuid": "bf001a75-0f96-4e22-b34d-0b63699853e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842879, "uuid": "c4f04745-f972-4cca-a800-cbfb29d4f29b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c90b0f5-7e1b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783879194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879194, "uuid": "69f48080-af58-4e11-b3a2-2f95ed2448ef", "comment": "Malware payload", "value": "81f01c3bb6c0330bf6030771a96f4907", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879194, "uuid": "08edf3b2-2672-4c9e-9fa4-7d2c60719352", "comment": "Malware payload", "value": "173a31b134df06802874ab7c0073d8dfed090544dad98eea4cc35958fdc3ac18", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879194, "uuid": "bafdebf8-0c6d-41d8-b3a4-c589c8659082", "comment": "Malware payload", "value": "2911e7f3b2cf6fe7566b77f02e217151ceb7c560", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879194, "uuid": "e3bc655c-c0e8-42c7-90a2-c8d74563e477", "comment": "Malware payload", "value": "4c275098eea973a32c68d252709a3f6f919462eed6766157ebb2891fd5803586501f7fe08df27cbd003fbec9f988fcf5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879194, "uuid": "db030175-a66f-4dbe-84a1-2d9c139662be", "value": "T1D5E633045BF011FEE5B3513CEEA24261E1A4B4A25732C5DB1BA887E5BD431E20D7EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879194, "uuid": "fb349d3f-1f61-4f3a-92b9-f813e4cc5808", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879194, "uuid": "4ec100ef-a640-46d2-b576-e10dc1a9ac0e", "value": "393216:TgAPinLvKQwC3e80H5HvfvVXMCHWUjXBcuI3/PGTAI:TgAP6LvKg3evJvVXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783879194, "uuid": "71f4a471-2b38-4c5e-a37f-98988f376d1d", "value": 14282679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783879194, "uuid": "405f5457-3dd9-42be-9d36-cfe70cdf267c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879194, "uuid": "23231e91-c6fb-42d2-8057-88ff039e915f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809623cc-7db4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783834963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834963, "uuid": "fc1a4ae7-a7b4-4c08-bf70-f66d2e037702", "comment": "Malware payload", "value": "395498b40ec00b4c1065c23f2decad44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834963, "uuid": "444af22e-1a51-45b4-a9ed-8a17118250a6", "comment": "Malware payload", "value": "180200603ddf010ef57ac1d721a88ffa5caf4bc391e4c47728e6cd50791bddf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834963, "uuid": "05040ce9-b344-4b83-9435-306a06a8bab9", "comment": "Malware payload", "value": "10cdaec35efca53213f954aa56862cbbc40760ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834963, "uuid": "a7492a4e-0e4a-4e53-a997-4fc7880d2bc2", "comment": "Malware payload", "value": "d8f3e697038b6c7120da3b188fde158255a68811e7ff3d0e52073ef3f39a49167a5fbd8be199f48e08f8643b36426802", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834963, "uuid": "2f012ddb-8e52-48bd-a1a1-868dd865bda9", "value": "T1B9336C5516857C249A99C9361D7F2F0CB8AD43E6320492EEBFCB3CF28C4AA9DD11971C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834963, "uuid": "2baf0b9a-fce8-4d38-a0a6-fe533d4162f6", "value": "768:fVEJVIhtMDe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:9EJ2MDLcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783834963, "uuid": "19ff3662-1297-4667-9fc9-73c3e7eca639", "value": 50394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783834963, "uuid": "93c0a900-0805-41f6-8674-4588f937b6bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834963, "uuid": "a802a144-329f-41fd-97ca-5cbf691b75c5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d891df-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843850, "uuid": "1ce74c53-12ff-4cf5-a3d5-6ba277160c38", "comment": "Malware payload (Mirai)", "value": "ad0c8f0705d290ae09a474d5952fa4be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843850, "uuid": "a1029fde-7e91-47c9-9192-8e878d465628", "comment": "Malware payload (Mirai)", "value": "18f037ce0b9c048bc7db9984047c7ccca2d6e71239f0a5fa2c108ddcf06f616b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843850, "uuid": "2ffee723-8197-4a3e-82b9-f98134ad8d3a", "comment": "Malware payload (Mirai)", "value": "92bc14005d2d90a3674d1f6ff2a8a065b43171f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843850, "uuid": "7ae40a62-1cab-4499-8c5e-68750b4c1937", "comment": "Malware payload (Mirai)", "value": "ca2e8c90885b52bfffd92fb1931754ffe83e13e5a37a50508dddc49742cc6dc9b830d90f5b8b0d655c635826ee859c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843850, "uuid": "c37e812a-dd45-4373-bc67-c369685adad7", "value": "T19B631334F6D13462CB5039B39DED88C2BB6C5EB569AED41B24EF100C32D06976E35A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843850, "uuid": "932b7076-6096-4288-9dfe-1c7cc25dac87", "value": "1536:htYSqvyGe/TdTHZpMDU/qMCKLLNFOXOgL8B9LlNQ:XYLyGe/T97mU3lvNFOXOgLK1fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843850, "uuid": "0dfce696-1175-4718-8954-2cb2c29c9508", "value": 67420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843850, "uuid": "8f5e9108-90ea-4386-b927-491f7c13afbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843850, "uuid": "f33a386e-3992-4d43-9568-756116d59856", "value": "ar15.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac725e87-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823869, "uuid": "65a39269-430b-4493-bd02-18c43dabf1c1", "comment": "Malware payload (Mirai)", "value": "4768f2aa106a18a13ded44b3b19b6dc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823869, "uuid": "677d1133-9f12-4450-ae80-bcbc59159d8c", "comment": "Malware payload (Mirai)", "value": "19fca0c2200f6443cd0bcb954503a677eaef23bb5edf3025690e768d67255f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823869, "uuid": "0f53c79d-69cc-4731-859f-00ce5b8f7d18", "comment": "Malware payload (Mirai)", "value": "5b64e10fac9b776909f0a2f4063721404eea8621", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823869, "uuid": "b7c3c11c-2d51-463b-9e50-69d165757869", "comment": "Malware payload (Mirai)", "value": "ca383ddb32c8d5661e18bef372ed26ee556047ac5867e59c944354d6bf30fa6d8a2fad43d1ae12913d94cf9e5c164531", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823869, "uuid": "63c822d5-8bba-486d-99c2-a8c3f659c076", "value": "T145D32A41BD982BEBC81FCE34C92DC34A01E7A49F61D5F2BE663CCD4C749E61A19A3494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823869, "uuid": "f5052027-e47e-44dd-883a-90c5e94b4046", "value": "1536:nPa3rs086wrEwtTPjSwQj4zUy9faWyL1aZspvVxQkHle3gvHK93Bb7gj3ksAwZQC:nP6rB87trpy3xQ19329AvfA1De", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823869, "uuid": "e68d0458-830b-4e6b-837d-0d6e0312e8e3", "value": 142640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823869, "uuid": "9fc4b263-2662-4265-9ca4-15ee7dcba422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823869, "uuid": "ad8dc1d5-70fe-4d64-a15b-ea74dc8f2336", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c02bb12-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823788, "uuid": "fbd39264-3856-4872-a380-47456ab2c2f3", "comment": "Malware payload (Mirai)", "value": "d6e4a17d0c32cf7b94e351d4aaccb993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823788, "uuid": "966e4bf9-3827-4ffb-b2ed-44a887d7a95a", "comment": "Malware payload (Mirai)", "value": "1a200226e352bb22c9009bebcbaaabc755a3d56d03ba97152a7c6277c09ef8ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823788, "uuid": "4f81899d-9569-458e-9d3c-fe3969b45c22", "comment": "Malware payload (Mirai)", "value": "a5d4a4fc5263d06566a6745865bf1967ec1ea357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823788, "uuid": "b6b4282e-7aab-4cf3-ad10-15accbfb1636", "comment": "Malware payload (Mirai)", "value": "0cb3574fee0c0e7fbdd01e4c9fd1480a63c4ad22214f7eec6d05889f775f435e77f8b6a22b09b54a118679d8e728663c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823788, "uuid": "26f4e000-1e67-4bce-af8d-fcc9657b419a", "value": "T1D123F10123D82D10FAA8793F855DD845F5958FB863FA79235F28C8DE8AF191523B21CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823788, "uuid": "31203cf8-ba7e-4e16-9b1e-02ea92a0d4b8", "value": "768:1Cl4xEN2MsH5l7X5HDjWZa4kLCdtnwCmY3vqhj2nLQS7R4S73U03wfP:1VB9lljjX4YEtvm+ywP7RpafP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823788, "uuid": "466c196b-f18c-4d0a-8d4d-f06f68acbf32", "value": 46276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823788, "uuid": "4e9d2828-06e0-450a-bee9-455c04123849", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823788, "uuid": "6779a85b-6faf-4744-887d-0590ea8a9be1", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7213d29-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844100, "uuid": "cdd35841-a58e-4239-ba2f-a382617228f8", "comment": "Malware payload (Mirai)", "value": "185dc868bb68ea18eba34a697eacd85d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844100, "uuid": "855e8456-2d7d-4929-8aff-d48684359d5a", "comment": "Malware payload (Mirai)", "value": "1a319959cf6087e535c903c173e9bdd045d0037a305ac006fc252c0fd6797783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844100, "uuid": "e5334c37-afbd-42b9-8ebe-75f2baa07667", "comment": "Malware payload (Mirai)", "value": "6a2511be7aee2eaf760b7a45ab8c7a003a643bdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844100, "uuid": "4f026ab0-f3e1-482a-821e-2c6c7a57998b", "comment": "Malware payload (Mirai)", "value": "0ed1fe068bb9c67c1ae086d4b74e89f9e928a0bc24795af24d5164c5aef88c95c47e8d44c52b7b98ce29afa5ff28cf2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844100, "uuid": "25114601-bc9f-49d9-b076-1f4a9c82aea7", "value": "T13504A75E2F224F7EFAB8863447B38E20975923D627D1D684D1ACD2111F2025E651FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844100, "uuid": "c3bef9a2-57ee-41a2-b63a-6e33e05ae372", "value": "3072:0ClNwNbGoOcJFhylFv1anh+mtu8H7lZPZ9c6P91lc4B:pKFhylFv1anh+ePP4s93zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844100, "uuid": "8ac06ba4-e56e-4ec7-827c-3321a3a90eb6", "value": 184148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844100, "uuid": "c59bd77d-773a-4d21-8bf0-b726f4fdd543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844100, "uuid": "2f5fd7ea-6957-4207-abfb-08f367824594", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dc2dea-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843875, "uuid": "bd325b44-3c8d-4a4d-ad2d-e81defe09ffb", "comment": "Malware payload (Mirai)", "value": "bf17615ec28807c87cc8b4cff401b651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843875, "uuid": "a689b283-e9fc-47fc-8f45-bed5d043d484", "comment": "Malware payload (Mirai)", "value": "1b041f585eeacf5e8587c1f7de0ab69adf4a214219f27b0dc11f96e5eb11d693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843875, "uuid": "0ef9e154-cc0f-46fa-af2a-a70e7dfec931", "comment": "Malware payload (Mirai)", "value": "76a51a90e1ee71ba7a7dc93e8a4a02df995731aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843875, "uuid": "822b3201-489b-4613-a99d-0727c01a98e8", "comment": "Malware payload (Mirai)", "value": "c8373406074c745fdfca2daa6c5bfb319bfaa56a6d8a3b6f9e7be3385d4b5207348b99b4ea3c4aef3f2c06e3eef5f7ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843875, "uuid": "eaef84aa-b5b4-4776-a484-435c85d6a7ae", "value": "T183B33C46BCE1C921CAC522B7FB2D518D331653ECD2EF7102AE282B7826CA56D1F3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843875, "uuid": "145f5ea8-b10d-4e46-b3a1-36eca785f817", "value": "1536:W2IbI1QKq5id0WqgVXIernuQ7Lt5/EL+KBB54U3pC10TR9zDpS5M24fJxV2rk1lx:swqsd0WqaIe18fM0b4VWl2rSlcETh1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843875, "uuid": "209ef5ed-c4b4-4b98-a96a-ee5771b6278e", "value": 107700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843875, "uuid": "78769723-db53-4435-9ad8-33ad8148175f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843875, "uuid": "115112f0-6182-47ea-8bfe-6efe8a3e9b12", "value": "Ares.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6ee743-7df0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783860700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860700, "uuid": "73eb0337-2831-4f15-a9f8-0c3a99c97391", "comment": "Malware payload (Mirai)", "value": "9d1d9b6b87a1b42d209bc90bbc8fc760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860700, "uuid": "85c75281-56cf-479e-b06d-ff4c2d985dc1", "comment": "Malware payload (Mirai)", "value": "1c3dd2df833307040ddea68767faab876b4817e5160f2f5b8f1a76248833f51c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860700, "uuid": "8083bab0-7de3-4510-8b80-e99274d968c7", "comment": "Malware payload (Mirai)", "value": "e418a05ac471dbc484c5d7c1fd6221d5e682a9c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860700, "uuid": "fe50fdf1-95ef-459d-bd6b-d16f38a704d1", "comment": "Malware payload (Mirai)", "value": "18b456f562ad59abbe106395e19de9673783d8bbfcb496930ad3502caffdb98d9760124c7648598d3e3951d63d299207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860700, "uuid": "0cb3cb4d-5d53-4af7-9c1c-312c496c7fdd", "value": "T1EBF3D517EF601EF7D8ABCC3791B9870924DC655A22A83BB57534E428B64B44F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860700, "uuid": "ee9e4a47-0b4c-4362-a074-4b53a0ba57f3", "value": "3072:GlXYtQ9UCfh4knCCBV9PMSiG6bGEoABnb7:oEoUCfykbBV9NiG6P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783860700, "uuid": "39efd781-862c-4ccf-94bd-dbbb3941a197", "value": 159324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783860700, "uuid": "14b4409d-5743-4e03-a062-72bcf279b310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860700, "uuid": "403f4580-c55e-4b54-abc4-4270173c0290", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6d6d4b-7db4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783835014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835014, "uuid": "f285da52-0b5f-4a07-bdd1-163c365dcb04", "comment": "Malware payload (Mirai)", "value": "35be86360e4750c1e3f6476ef6c25476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835014, "uuid": "7a192920-cb4f-4e69-b9cc-80a40ceadc90", "comment": "Malware payload (Mirai)", "value": "1c4b85bc16c940ddebd1bdfca61d7eb152f2d24b8738abbc042cad63abd388ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835014, "uuid": "e2c5569f-b697-4f69-a687-9c98992c57f4", "comment": "Malware payload (Mirai)", "value": "22da04d31c3b58fb1dd65820794e1cf96c84ca25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835014, "uuid": "cae772a3-d3fb-4253-b6cd-a4fd9523815e", "comment": "Malware payload (Mirai)", "value": "ac8551f5fcffcd02d2d775af439116bc5a8f32fda7706cc000f75cfd6f9775442f6cb61425c07042d0f33323f0004b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835014, "uuid": "e2718677-aff6-4e62-a934-e3662a9ac093", "value": "T1FA632991BC815613C6D022BBFB5E428E372663A8D3EE72079D256F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835014, "uuid": "ab62710c-856c-4525-951a-6870d6768d1d", "value": "1536:azC1uwL8SX08q025jg/r8UT7aAouhEBPBiV/hD:azCLw5M/rV+qhaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783835014, "uuid": "5bda0d48-e572-4602-8c19-e26d2d8d0f51", "value": 71900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783835014, "uuid": "96af96e0-3a97-4e12-b106-85a3f942bf03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835014, "uuid": "f9ac56af-be6f-437e-bef6-04bcc901593f", "value": "XDarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f42c4b8-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892137, "uuid": "839ed631-9c95-4543-9e64-2c735641c44d", "comment": "Malware payload (Mirai)", "value": "c40a8c0a44a315b3a080a114b056f4e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892137, "uuid": "5cbb70fb-5dcb-4f56-803e-a88bdd603ee7", "comment": "Malware payload (Mirai)", "value": "1d788f673ebf143b06d995ffa8fe88877765a50f68b80afb0401c2b66668d0a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892137, "uuid": "2cfc4e1d-f62b-46ad-adcd-55d762020533", "comment": "Malware payload (Mirai)", "value": "5f7199426181df61deff1a026956e2feb6efa114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892137, "uuid": "c584f4ea-bccf-4577-acdd-483511e4ae66", "comment": "Malware payload (Mirai)", "value": "8fb947250905b108bc067a06955f8ef777f99e509e0a0ded8d8498a28ec3d07695b66108a7341b6f88bfe2041c17da75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892137, "uuid": "c6168b07-799e-4888-be79-ced590f09f27", "value": "T1AD13F153B1DB7B08D26F30B92083AAEF24959635043807CBF16279239C76B2773BC566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892137, "uuid": "7a3ce085-7b5e-4c79-91c7-322d85f56b13", "value": "768:FHsX72oAEJB73CwsgQk+uDHlhoUxW2LOVp7crnDn68f5dn8UnbcuyD7UHQRjZ:Fi7QEJB7VsgQkBDHlho0W2LOVpwrLt56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892137, "uuid": "3c89ce5d-334f-4df5-b332-549de51ffed9", "value": 43036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892137, "uuid": "43fd12d9-f095-4d84-a996-32adbb6dbdaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892137, "uuid": "a470398b-9fc9-4b65-b41b-a6bdeb282370", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77aa373-7d8f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783819163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783819163, "uuid": "d6f8a029-5735-473f-8c66-0abde2d9f7b6", "comment": "Malware payload (Stealc)", "value": "01884408262c5d3133feb6c35ab61812", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783819163, "uuid": "99c8e43e-66da-4e5c-87c3-b501be72f252", "comment": "Malware payload (Stealc)", "value": "1e10e0f923b8dfd4097bd4aeb69f1e27ba444b6b5d88c2a0b0240c81d7dc1498", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783819163, "uuid": "e39fec2e-f59b-4047-9ccd-2f44a7c98e2a", "comment": "Malware payload (Stealc)", "value": "63386381d6f09dd8c4ddd92629a78f27b63a1831", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783819163, "uuid": "6adb3188-bffd-465b-9101-c9ae182a290f", "comment": "Malware payload (Stealc)", "value": "2122cb8af7626b852bc89f95b1cd1dc2caa7cc62b22c48e785da496814d726c6c446e25d90d5626481e7c909370740a1", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783819163, "uuid": "c845650a-3e69-41ef-ac38-af5e25c743b8", "value": "T162B523050AE49065F6B0433D19F152A78E31BC6687AC9BEF2680B5BD4F328E1ED75B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783819163, "uuid": "af1dd237-d5c7-41c5-b5b5-6e8fdd44469e", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783819163, "uuid": "469710b5-cc9e-4e76-ad2a-d0e4d233b8fd", "value": "49152:R6ZeX6oSml55Gx/KqH+Z9cy3rDZihOfnyx35sOhYVGHMGP8U:R365SM/KR3cybD7naJsOWGHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783819163, "uuid": "52d35857-e283-4263-a845-6fd945e8dc07", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783819163, "uuid": "d1698564-b5e2-4ece-9889-05795af4e7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783819163, "uuid": "6bd335e2-d55f-4b49-96ca-bb40f2a3228b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3544bb8d-7dbb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783837843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837843, "uuid": "04630cda-b9ea-4ab2-bf06-def894edc130", "comment": "Malware payload", "value": "20e6800bcbeffdf721484d0ebb7436cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837843, "uuid": "ac5327ed-2c92-429d-a8be-4a66463cd518", "comment": "Malware payload", "value": "1f9e3afdb5a29f8140d8fcc64f4e4ca39806171cd692846db660266cd30b1701", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837843, "uuid": "00d87304-9b1d-429a-9897-5680c48ad51c", "comment": "Malware payload", "value": "d155ab1171da7b31c98e4909b333f4229c3aa5bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837843, "uuid": "2f599f57-86f7-49a6-8b6c-9e8f3c7d94ee", "comment": "Malware payload", "value": "4e864a5ea5ceccbd4c33531646bafd1f52fdbe193615752e4b315d4a7d5eca711dc9d5852ce312f271edc78c99134b7b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837843, "uuid": "b164242a-7ed6-44d0-99f7-381a9ec4ef8f", "value": "T1E1E0C2A5579AD8EE04BE49C4B4730500D7206373FE04862C3BCEF990BA78224B85F499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837843, "uuid": "40ced369-b66b-4be4-a1e6-85c163bc18c8", "value": "6:hoFmAi3rHIdOjXu7i2ovH6UFxcFs7smI9//PwfQ//D7B/+bZJbKXFs7Yjs:KmAi3rHIGXYzovH6KPoTsJbKKEjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783837843, "uuid": "5d63f00c-5a4b-4110-b29d-c6b59fc3934e", "value": 303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783837843, "uuid": "ec198a01-bcde-4e54-9f93-5e5732127ec9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837843, "uuid": "4c6efd6c-b8fb-4632-afb2-ff0f07e6788c", "value": "bwwg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0cd134-7e1a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783878821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878821, "uuid": "23346f18-bc33-4a92-aedb-258443b06482", "comment": "Malware payload", "value": "347bfeab8027c66c041521b9ddd468f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878821, "uuid": "ef5fc267-baef-4e95-847b-81ffb1308ddf", "comment": "Malware payload", "value": "20ebc97afd3af41565d112c201bac8ad87c75ff32580a75a32b171218a19a132", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878821, "uuid": "2d7515da-6398-409b-bcb6-e02bbbfc1e66", "comment": "Malware payload", "value": "314df32552ab4b10c45550f7169f643dd7e0d3a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878821, "uuid": "c51bc33a-ef1f-426e-92cc-9a8ff1db8dde", "comment": "Malware payload", "value": "d252c4af58fdccd7570a0c1fa79934e2dd0d2b8845e881647ee52a433658ac3f1a01f8d82c3975014ef4dc676aacbd22", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878821, "uuid": "11dbe98d-cdc6-4b9d-9d33-9eb0e48b581f", "value": "T1AEC27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878821, "uuid": "110ee5c5-592a-400b-90a2-1e0a0c34164d", "value": "768:F8vCB+25j6es8Rf9FYpMSUpi+20qUpi+20YQX:F8l25Jpd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783878821, "uuid": "457a1f07-d522-468a-b86d-01689f5299cf", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783878821, "uuid": "b6f161f6-1502-4191-8931-916999a7668b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878821, "uuid": "db928304-0d6c-46bb-ae7f-545d2af29c79", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c6bd08-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843877, "uuid": "518bb6f5-958b-4276-80fb-127df3acd237", "comment": "Malware payload (Mirai)", "value": "62a34ce383a5fff35a3f896c81f36257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843877, "uuid": "0bfc78be-e6a7-4566-a3a3-e7704b9a6be1", "comment": "Malware payload (Mirai)", "value": "20f4ef3d93a56c23f38a52f76007b3e4c6d0672f14b185a017e958eaea2170fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843877, "uuid": "280f8ac5-9141-45bf-acab-74e03933643c", "comment": "Malware payload (Mirai)", "value": "9e2ae1affde9c1a4f9318010a8f802ab366f20c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843877, "uuid": "2b5cfb17-83c9-49f4-a8fd-fc69ba63a438", "comment": "Malware payload (Mirai)", "value": "7a673936015789fdcc8513f2465c0450ed0510b7b4c912145d9c2810e9d793c46ff1a2b50c98f4a59d6e3a83e528ae08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843877, "uuid": "f7109b58-f571-4846-adaf-1820e90f461b", "value": "T1915423456F96AD32E48A7CFA664F0DCD7C64BCA843DC02E37FE841200679FB524A5B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843877, "uuid": "c4bcf4b0-82e7-4fa5-b0a1-d016500cb44b", "value": "6144:IUExipaCF5bkbLCGouWptHvaIGLURtKYWi82vZqf2flmefygkL:IdCFxFGAP6UPKbvdijf7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843877, "uuid": "a7ee5a43-5d0d-4c2e-b16a-aa79c79b8e8f", "value": 292496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843877, "uuid": "4845ef09-efdc-4e12-ace1-5e2ca7c281a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843877, "uuid": "4e10c39b-4cf2-451c-8a40-60225ba3a08c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b57f05f-7e29-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783885044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885044, "uuid": "22632854-9817-47b4-9c64-4610f9a49b96", "comment": "Malware payload (Stealc)", "value": "c15e8c4aa190f2f7a0e2c58af492e9c0", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885044, "uuid": "daf14ac0-03a9-4b14-b5fb-bef8aa45b495", "comment": "Malware payload (Stealc)", "value": "2206ca98d1c523aa6b5fc27efd7918a596be8be6b0e8e64861977a4bc69a8d84", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885044, "uuid": "58190408-898e-4666-bc93-deb6e09a2e34", "comment": "Malware payload (Stealc)", "value": "27118ab6795cd18ae868f8902d3f88b129e2cd6c", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885044, "uuid": "fbfedf88-7981-4dbd-aae2-f6dd95e327bf", "comment": "Malware payload (Stealc)", "value": "8a140e5e25591dd4ac0de2ceba27d4576b0b492c5f431e914f651a6d8cf8c9db8b4328bacfb3987bb979531a778646fd", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885044, "uuid": "3afc5d18-2934-4cbf-8d97-40454908a761", "value": "T1F6A53305E1C6C4BAEC70973098F767CB1F317CD10A78B7977B99A54E2832AC1557A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885044, "uuid": "f19d5f2c-76ba-4c34-ba5e-a9e0158adf94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885044, "uuid": "f2d531d5-fda4-4829-a790-63c09c382e5a", "value": "49152:j49IiVPBrDYzX1fFODG2nglOpqGF7yWhG8Q05kNjVTV3L:y55r0XVuG2nglOpR7yB8hklVBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783885044, "uuid": "0e178886-5a2f-42eb-b6f0-05569a46cb9a", "value": 2190336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783885044, "uuid": "79144053-2a2e-4d4f-8115-217deb3a8858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885044, "uuid": "ec2463f9-7a5e-4f6b-8882-833a71577c5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f43c75-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843961, "uuid": "a1948801-3579-4484-ab4e-e88d5cc9ba40", "comment": "Malware payload (Mirai)", "value": "0dd57285a905cd2021f242f6e49fd8fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843961, "uuid": "e7681f7d-8e57-4956-bd19-f2130474227d", "comment": "Malware payload (Mirai)", "value": "23680297a0facec5fbfc8d0c9beb2533b69acc75cfb96d35180776386c0956ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843961, "uuid": "f9419d53-4e5f-4ab6-8161-ce56a4caa145", "comment": "Malware payload (Mirai)", "value": "67ec70ed8ab470ca291b5196dc01a24a789841de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843961, "uuid": "021b8b55-06ec-4cb7-9ca4-d554b5695f17", "comment": "Malware payload (Mirai)", "value": "4647b15c15fbfba6f543ec48799f39c231816171565b9a2b51a8d414c7f4ed141da81435aa8409207a5df3795dfe9f78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843961, "uuid": "2776ad56-0c25-403c-a1d1-cc78953a3023", "value": "T11EF3AF98DA0EAC83D6C7E3BE9C590F66703734B40165D1B75D00929DEADAED9C8F2132", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843961, "uuid": "63b32ade-7b02-499b-b4e8-1ed1e304de90", "value": "3072:hvDW5bYonVu02O4qpBucsL5WxVPWTnjdKVPR8VSs+gAzwkYKhRqctd:tne83dtp05WrZKVPuduzwdK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843961, "uuid": "c1166194-1193-44c2-b941-472e74fdfe6b", "value": 169888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843961, "uuid": "0ce29419-4e18-404b-8236-f64e8f466594", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843961, "uuid": "867e9f80-ee25-4953-8c0a-c80306d4699e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa734a49-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823866, "uuid": "ae4cc78e-c292-498f-8ded-6f00641b3e7f", "comment": "Malware payload (Mirai)", "value": "e4bdb4d95851223de861274eadce1f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823866, "uuid": "d929ba40-243a-4bed-8f31-f6632afdd030", "comment": "Malware payload (Mirai)", "value": "24c1f320e51df5849f6b1dffe253a72558117e911c2ba210ec085cd15ec42ca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823866, "uuid": "b78cf507-5f1a-4ccc-9ff9-0b7437b0bf5e", "comment": "Malware payload (Mirai)", "value": "11d69ab1e083b8a9331cb99c190aa5ae66b3d76b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823866, "uuid": "c78862d2-d117-4513-a4e4-f06a19ee39dc", "comment": "Malware payload (Mirai)", "value": "25a74904cbb89939d2c08db7aa46bcb157d1a4e15417d5ca6a046c74fb14534c8890764c99102c56a38f321b7584d17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823866, "uuid": "eba90b5d-fec1-4d4f-9d15-0a9f1f3d5f7e", "value": "T1A1B329A9F880DE52C6D4267AFB5D014D33231778C3DE7109CE209E346BEB95A0E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823866, "uuid": "08c801f5-393a-4937-9958-efb0b28a064e", "value": "3072:E1mTrBKGyuEHVB+P9Nt9vJpUcYEEU8s7140QZjyBBx7UWKSzf1D:E1m3B2fy7UcYEEU8s7e0KOBBx4Sz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823866, "uuid": "7ae91a12-6fb0-4b08-aca4-14910f33d240", "value": 107964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823866, "uuid": "daf5718c-ab19-4f24-a116-da704f8a3b20", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823866, "uuid": "4c0fe838-db68-4ed2-a763-3e860cb6c7e6", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03805686-7e2c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783886292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783886292, "uuid": "e2dd4c8c-6b32-48a1-aeae-666bad1a6eb3", "comment": "Malware payload", "value": "215bddfda9e5eab496ef186c10803574", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783886292, "uuid": "3b2a1086-4e02-4fbd-b61e-e716da07b7d4", "comment": "Malware payload", "value": "25dc7b62a1279a348ae26707e43dbaa637c8fd9f64a433c43611b0f4830ce97d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783886292, "uuid": "43b6badf-1337-4f9b-a579-84ac5400befc", "comment": "Malware payload", "value": "60fcc66657b6481bc0934ed37fbe5b826f3680a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783886292, "uuid": "644586e2-a626-4463-a6f7-4edb3453f55d", "comment": "Malware payload", "value": "ff77414bad78dd5311f7b3afa517558e7b60f87388597756f502305a1222974a89dd9c952181269586995b0b88496e8f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783886292, "uuid": "6857f12b-4e0d-43c8-8df8-0efe082db725", "value": "T10A236C551A857C149A99C4371D7F2F0CB9AD43E6320852EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783886292, "uuid": "2746cd64-27d5-4a4d-a015-91a269c07732", "value": "768:1VEJVIhtMT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:7EJ2M0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783886292, "uuid": "1c78c4f4-9ea4-468e-82b3-2bfb2dcad2db", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783886292, "uuid": "faeb1b30-ad6e-4bcb-a517-6552cb7ce711", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783886292, "uuid": "48e39352-d0fa-4afe-b47f-43b25b911811", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88e2deb-7e1d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783880261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880261, "uuid": "3c43ffed-b4a5-4fa6-90c2-5d8ac24bdd4d", "comment": "Malware payload", "value": "4eb918517e9f85bf50f0c6ebd9e0ff31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880261, "uuid": "c432d86a-1e60-436d-a3d6-985f284a3ee3", "comment": "Malware payload", "value": "26d0c4e0bd932de9cd2ea3e5544d559448ac549fc5e77d8034638cb3818a9361", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880261, "uuid": "19a70082-7285-4bf8-a7ba-01b2800d6bbb", "comment": "Malware payload", "value": "f3c5f906858420630ecc8c45a954099a04da1a1b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880261, "uuid": "27050fc1-fcb5-4294-bca7-9a56a8404f95", "comment": "Malware payload", "value": "06485b8054def739becf49ec81e022747f0b961adce604daeb06eb60d86b3cf2919fdc5a861d9d531e39260e630f843a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880261, "uuid": "59d8cd47-4b44-4b8e-af1f-cb2e8bfefa5a", "value": "T12B236C551A857C14AE98C4361D7E2F0CB9AD43E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880261, "uuid": "03e078a8-e882-40b7-9151-179a17018ec3", "value": "768:OVEJVIhtM99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:sEJ2Mecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783880261, "uuid": "01c6c023-2015-45bc-846d-5dfb47faac69", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783880261, "uuid": "3033afc1-c0af-471d-ac70-e15c92d8ab3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880261, "uuid": "159c8554-bd2b-4f73-906c-7d8ff663ec04", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0d405f-7dc3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783841236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841236, "uuid": "0ffc249e-a8ed-480e-a03a-5d566b2bf104", "comment": "Malware payload", "value": "56b68224f8dd811c583ecc3cb1096065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841236, "uuid": "7467e3a4-3462-4860-9e8e-4007a1758830", "comment": "Malware payload", "value": "288bb389e2c9642019c6bfd8c2268bddf60984fcc644e1563f703d4541931ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841236, "uuid": "c05d212d-9660-4b92-9acf-e83e978a4140", "comment": "Malware payload", "value": "355ad64ce12ba9186a27f5e0c9fa1e9d3f4b050b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841236, "uuid": "98e0a135-c8a6-4f7e-89e7-a96fe8459e55", "comment": "Malware payload", "value": "5bf67247a92c658ee6ee2c90b2dd442738f4c83c68b875fed80f9348d55f05041ef24f3876f9d83a2f84ccd4fe770cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841236, "uuid": "2edec7b1-7adc-4b34-9142-eec10305d45a", "value": "T1A0282B7F7582B95AD058E47C99E9ECB810F0BD54AE1F931B34D4AF3B68A3B09012E1C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841236, "uuid": "24bbc103-ef80-4a0d-b80a-358eeb3648a6", "value": "dc6e24f7857d02c10fc1490b2b17f2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841236, "uuid": "21941d74-8d34-47bd-aaa3-2536f160b7e4", "value": "1572864:ca37JllCELeJfcnmmfFeb2aj0Y5HPhc3kTFv08gI:TDlzgrEebzYYFm0TFv0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783841236, "uuid": "9a7ef6b5-c9f6-4ecf-8498-a3e1a8417893", "value": 95980032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783841236, "uuid": "e946ed43-18ed-4840-8880-826e5cccfca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841236, "uuid": "e767e5c2-d733-48ba-a7fd-88d3f7ff423f", "value": "x359849.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa9029d-7de5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783855818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855818, "uuid": "e1a9b91e-20b8-46e6-9933-367a28a9d731", "comment": "Malware payload", "value": "5d2b40ec5f241937c13fa0560fd3b030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855818, "uuid": "34a830d0-9169-4d1b-80c2-6e1d4ddb2ff2", "comment": "Malware payload", "value": "29fa93bbeae684352dd1dac335cb1ac7c9ba82bf862782a38a25514db8a20f73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855818, "uuid": "3f86e34b-00bd-4962-b11b-86d211fc77e7", "comment": "Malware payload", "value": "5e42366dd9a60d7da06ab7c709dbd6ba3bf3561f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855818, "uuid": "8b30eef2-de89-49fb-ac2a-8e9c87496d10", "comment": "Malware payload", "value": "f10ef684d4b9e6610903700ee82ab2c8e10c6791faf4aeef5849aedc0d944877c97f44f8814e67175ec022d1bdd976cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855818, "uuid": "ed9d2856-04f2-44a5-8948-43a1e8e6f5ba", "value": "T170967C73945224D8E1A9C9B4D51416527DB83C8B573873CBBAC472F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855818, "uuid": "5a23fc6e-7277-43c7-9d31-cc2cda5908cf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQi:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783855818, "uuid": "96cb71fc-287b-4ba3-8f1d-7d8a38df6bce", "value": 9011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783855818, "uuid": "0b266d48-dedb-47e0-85c1-951cd56e72e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855818, "uuid": "5a0bbe35-b517-4f62-bc88-2e7ebc4bb64f", "value": "29fa93bbeae684352dd1dac335cb1ac7c9ba82bf862782a38a25514db8a20f73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3508c345-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843855, "uuid": "b88059b8-1c0b-42f9-9ad5-8e10f9c7beaf", "comment": "Malware payload (Mirai)", "value": "6ba328ebf667b0821ba11e7789a9ccda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843855, "uuid": "f517b334-42cb-4488-9264-354400287fb5", "comment": "Malware payload (Mirai)", "value": "2a34e5240cbbcfe5f8ddea174f0a7689bcd482e52041dc32bc3db33b7ea9287c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843855, "uuid": "0328eaab-c8a9-499a-ad43-f3784a868547", "comment": "Malware payload (Mirai)", "value": "a5b55ad8e4e70c9fd695b061b298a2743db79c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843855, "uuid": "d60d86fc-5240-499f-b661-fc0bee9b709d", "comment": "Malware payload (Mirai)", "value": "2531364690db059f73d48d141d32ae73310263e5e52673b6223c9660347f45a8217a48fda3f4cb8f6d530665712aa011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843855, "uuid": "9d33fe5a-35a3-4135-ac1a-023f4ca93f26", "value": "T1FF042A85B9819A17C6D612BBFB4E428D372A63A8D3EE3103DD255F2137CB95B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843855, "uuid": "f0928e37-1b99-456e-bd41-98bc515b24ef", "value": "3072:ahvbNLbMkrlmSk6beZDdOWGx4uxlpZPCGJLrqwrRg3:cMO+7Cx4u3pQaLrtrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843855, "uuid": "297a798d-f251-4e9b-8f48-af511ad09690", "value": 183200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843855, "uuid": "f61e51be-8d32-42ef-8fd4-a7cbbbdff874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843855, "uuid": "05443e03-ea1e-481e-8649-b15c13199945", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6e49ad-7dc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842418, "uuid": "89245c45-a1e0-4ffb-8c9c-43dc41b86de5", "comment": "Malware payload (Mirai)", "value": "effd041b3011e8332880dff6c2f210b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842418, "uuid": "fcdc1c47-0d37-4175-8d3b-591d3cca52b0", "comment": "Malware payload (Mirai)", "value": "2ca12358c8db68f292a5e4175bd3b28f09ca9d8a37bebca53c5e813f8c3b4f5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842418, "uuid": "e7081f63-67cf-45ca-83aa-0b90a37de969", "comment": "Malware payload (Mirai)", "value": "5c829b0404e49ee98debc4536e32a7892d0850a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842418, "uuid": "525da129-8e16-46a8-96e6-f21b2b218b1f", "comment": "Malware payload (Mirai)", "value": "362dbf5fa9859942aac086cbfd934b34004222bc3a5e1362a0c94ad0e7a6970708a11e2a4ffee54d2685fcf914f07ff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842418, "uuid": "c9bcbefa-559a-42f6-9be4-1be868be0dc1", "value": "T16333F272F1499AF18F515131FA623DCF3D5A4B71C2E03EB02AA05FEABA50C13257DA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842418, "uuid": "cbfa1901-8222-4bc7-ad35-ce229c5512e0", "value": "768:r3FB1sOop4wbrvqcfwfMy7OtDrH9+lA7LvaD9Mr6wC3R0HSx+8poYnfVS3SGs3US:ZPopB3feMFHd+lA/vrfOR+SxOYI3Kz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842418, "uuid": "b217ab92-9ac7-4b2b-8713-38cb684ddc86", "value": 50860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842418, "uuid": "9bafcc39-84a9-46b8-99e2-4aa98efd0267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842418, "uuid": "d7772de6-7f08-463a-aaf7-6c52ebd5640f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac52430-7df3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783861904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861904, "uuid": "43a8dd52-674a-45a1-9334-b8665e81da65", "comment": "Malware payload (Mirai)", "value": "e828b075e472f7c3965a18bd7fad6aef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861904, "uuid": "fb088fb6-1f65-4822-b787-877d0a0c5480", "comment": "Malware payload (Mirai)", "value": "2d5016f7e20fddb622fd86611ee2f900dcba5dd4cdfcd48462a69f680d45094b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861904, "uuid": "a2c8278a-5062-48f9-a745-609ed1286fe9", "comment": "Malware payload (Mirai)", "value": "8a46cac6a27a3e53171e7f3c2923b5cee4ed34e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861904, "uuid": "9489fc88-bca5-4669-9f90-517adb2f9305", "comment": "Malware payload (Mirai)", "value": "dddb44b189225025cf8d7e33cfb6f99b9f4df8acc190072d57f2bde2a07477dbac2d9f55cf3cd07892eab6495d3b2ed1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861904, "uuid": "4c0317c7-ec85-441c-9527-fa4967cf7fc2", "value": "T197A33AC9EA03D8F0E8516E71187BA7368BB5D4764136FB81FB613BB16C12710A506BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861904, "uuid": "7a112640-bcf2-40e0-99b1-ee17955ceaff", "value": "1536:GHFvokXk/vAyDh3zCnTY7y5Zu+mAvNjPIKgGgpxCyqSkd5h0rAHRr0+9l9yxJW:4FQrQSzCnTY7gZ3g9p0Ssz0h+cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783861904, "uuid": "79c6f48a-0d17-4d80-85d3-6e69e79ea8b5", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783861904, "uuid": "7842bd13-ec7b-40f8-84a5-c70446f16222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861904, "uuid": "e275229c-4046-4516-bb2f-b0c8a2baac8c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455e3282-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843883, "uuid": "ec9c7de2-5884-46ba-a8ee-cfeeda0108ac", "comment": "Malware payload (Mirai)", "value": "9551ca17d78cb92963a372714bb4e7a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843883, "uuid": "5523f3e6-c769-4251-9077-f9d2695f5737", "comment": "Malware payload (Mirai)", "value": "2d77ce88624515429d7392dc7f5fc873cc2818fddda99fd736883fc0ba58bba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843883, "uuid": "65fbd52b-dd1f-4fd3-8f1c-794605d2d6f7", "comment": "Malware payload (Mirai)", "value": "8edd2a36f05db7031a2ff2dd250f7ef01bc9f467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843883, "uuid": "ec729acc-7cd4-41f7-a4de-d9fb4c25eff5", "comment": "Malware payload (Mirai)", "value": "0acd3403efcb421a6c6771b04b41d00642d6d7dc9e6c35acf652d88dc2ffaae613461a18222a6f9e1771d139478b36c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843883, "uuid": "e5718306-6b08-4f2b-9d24-33b596ebb9cb", "value": "T11313E1EBE19D98E0D5501C3E86748CCC3F2E9BFD5574313A115BB430B30A5AA4A65E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843883, "uuid": "e3944f84-9e60-4955-a1f4-972463bb80a1", "value": "768:YrFEE/YwN7+EkbH2sOsrt+h/IbDi+nsq281te6581Bew0xUs3Uoz4:gFEExNy/bH9t+hAbDJR1teBYxxz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843883, "uuid": "70f1b289-a545-44f9-9320-a01753320ee0", "value": 41636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843883, "uuid": "aec29408-1b76-4d36-b2a2-4ee1ae875f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843883, "uuid": "e07dad45-539a-42a8-b5e2-7ac73782e332", "value": "ar15.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0307476-7df2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783861779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861779, "uuid": "c9772a5a-a4a9-41cb-857b-a1e23f96472b", "comment": "Malware payload (Mirai)", "value": "572f02a5fd7075196f22cb69505920ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861779, "uuid": "63cba3aa-f34a-4d7e-9f66-a0b0144dc119", "comment": "Malware payload (Mirai)", "value": "2fec9e0b2f970164ab4890848295904d4ae372c136aa25ccba5dab27e446b2c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861779, "uuid": "fd5079a6-a69e-44c2-9b23-6feaa713ff2f", "comment": "Malware payload (Mirai)", "value": "531b2c23e837a5bc548c59c137eced8f0b9c926a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783861779, "uuid": "73ebc917-05b1-446c-8ddd-5f679664dc73", "comment": "Malware payload (Mirai)", "value": "0866eec427fdd46e9e3c3127ac2634838feb33700bf71a0ba43f4f596fc5889968840d4651bd46c5802f860527347602", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861779, "uuid": "3d6497e0-2e31-43c4-83d8-1498c5a05fe2", "value": "T16151C6B8A96397F39FD9CF4460615A19B40BEAC634B28EDC9C9E34F495BC484F830516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861779, "uuid": "5cedfe7a-b581-4d39-8c54-1d58378d0c62", "value": "24:r05pELMk0aC5EMy0MBswdA+jKXRCxx3V+o7TgHqgH2vJFKXVHIKRJ55DfCizIKXH:rMpzaC566+jK9HVH2LOKTBLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783861779, "uuid": "0c0c864d-152b-4612-ac9f-4cc0e3bd075a", "value": 2762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783861779, "uuid": "bed6cdf8-b0c0-4fe3-a797-86f8006ac43a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783861779, "uuid": "c8c9b050-42e0-46f5-b76e-93c7c61c354c", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1144fa7e-7da5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783828333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783828333, "uuid": "395bebab-61e2-49af-89fc-cc35b92c0947", "comment": "Malware payload (Efimer)", "value": "cd28045cb9ffb91331a4ffbc206b3e31", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783828333, "uuid": "f86f8977-7bba-49a1-8d57-8f11c3b09731", "comment": "Malware payload (Efimer)", "value": "3059240b64dcdb773b76b64d9a7a70e51b50720025b3275deda1e34350d252b1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783828333, "uuid": "e0f18a0c-74a1-44c3-b613-abac0523ee04", "comment": "Malware payload (Efimer)", "value": "bc39db0d45e00c290ae4d600117ca7da4e8692d4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783828333, "uuid": "d0248773-ec47-4d3e-a09c-8f062601119c", "comment": "Malware payload (Efimer)", "value": "62ffa58dca9d2d12d10c751f4147a33b92fd6482cf6088c59f185553378befbd322d00eefad5fc9b8b1bbf9c032f6eb6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783828333, "uuid": "5bd9bc7d-0f16-4141-bdf0-5a193e0330fc", "value": "T141E6334C94E416FFE5B3223997C1AA11D4E974710BB2C8DB17A4CBB26E831A18D3C767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783828333, "uuid": "a67e73d9-15d7-4b65-aecf-eb110b6afa00", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783828333, "uuid": "898332d2-2acc-47eb-878c-1727e12a3e72", "value": "393216:yqeGQGzChEdh9wqWWALQOaoXMCHWUjX/cuI3/PGTAI:yMddXwAOvaoXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783828333, "uuid": "23daa9e6-a1d3-4206-a95c-0abd5bc0cce3", "value": 14305498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783828333, "uuid": "04052448-76b2-4b83-97a1-8ece59d79c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783828333, "uuid": "9f5fa82b-9033-4228-b869-b2d065580fa9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b6f57b-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783840793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840793, "uuid": "30a55ee8-e188-423f-bff6-f5b1ec1267f8", "comment": "Malware payload (QuasarRAT)", "value": "13de55a938154017fe1125cd022c87e0", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840793, "uuid": "f49f9b74-3657-4d9f-a013-f8f0ef6566fc", "comment": "Malware payload (QuasarRAT)", "value": "308c4dfa19d1c4a47c9fbe46bb174b97e6deb192e78de2db02a7e09734d65279", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840793, "uuid": "a2a868f9-566e-477a-a3f1-1f9fcef3c6dd", "comment": "Malware payload (QuasarRAT)", "value": "de14cd506a04614ecb6415570241418bf2e5f90b", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840793, "uuid": "126a9186-d67e-42bd-9a5f-3a76a4c682a8", "comment": "Malware payload (QuasarRAT)", "value": "260d0dfa812f0b8362280351e1609608de9d389ad27c7db73078018e0e409fd797a6fd0ba0c8251b7b0bc5c3e35f98e9", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840793, "uuid": "f16007a9-affa-4cbe-a445-9c89739d4bf5", "value": "T109748D1373A8E53BD1BE173AF43606154BB1D547BA16F38F9A5896B82C133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840793, "uuid": "a3c6517c-801a-4662-921f-d46d88f951d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840793, "uuid": "e0cf7978-a6c7-46c1-8704-442c8989371a", "value": "6144:eN6bPXhLApfp1SEpmWtbHRdoWux91f6kveycii:+mhApz55xkfcii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840793, "uuid": "93631788-85a0-40f0-bf72-91ab229428a7", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840793, "uuid": "55953036-df6f-4594-8ab9-c481c01c629d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840793, "uuid": "8f3a7541-3e9f-4039-b847-6b3da34aa5af", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6c8a0f-7dbb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783837964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837964, "uuid": "cfef3f2e-b461-44c4-ba84-b03761fefbf6", "comment": "Malware payload (Mirai)", "value": "a4984a37705bdcd70ab15e8b27a4eb12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837964, "uuid": "f9817f7f-958c-44de-9664-43e94896d128", "comment": "Malware payload (Mirai)", "value": "32c936986cee2a1560ae74c73bc9f43532be2178f7b186ff5b52823e27b9a722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837964, "uuid": "1466f41d-cd38-4c8e-b74a-e8eb338a0038", "comment": "Malware payload (Mirai)", "value": "8b0477dd19a8441f8e9a7bf58d6b01309a985b66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837964, "uuid": "b3dad0a8-2bbb-49de-b344-01c5bdb9b4d6", "comment": "Malware payload (Mirai)", "value": "d262fdaec8067bdd9c0ad2b70f7344f2ec10992091a97221d9c58993f12e2d170e80573a8c52b00bfbd90d290ed2ae3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837964, "uuid": "2471b0cf-e377-4a78-8bf9-66d7b633020f", "value": "T1A1530210558C4BBADFD05876C9DE8D93A70AAF24940A1E434F3E4AA4B135444B9FDED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837964, "uuid": "bd8c8686-02e5-4f48-af5e-6c5ef6a8f0ee", "value": "1536:6ngef9U0+eVenlamea4AVbN6jbYKlwX/LaEI/mraKzfrAcus:W7fLpCr6jbJqL9I/mrlfrHus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783837964, "uuid": "a24f8305-1a70-499a-bb8c-14b84019a3d5", "value": 63096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783837964, "uuid": "8dc100c4-e04a-4d43-9b6c-66965d1da282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837964, "uuid": "2abae902-a83b-49b6-bc47-4b3bd85671dc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3804aa9c-7dd4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783848585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848585, "uuid": "633a7ea5-ee2b-47ac-b389-f7cb07fa2605", "comment": "Malware payload (Mirai)", "value": "3fe88d974d59bf55c005e0080f35714c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848585, "uuid": "9daf6124-3c89-4dc3-b2b4-6eefe6418b8f", "comment": "Malware payload (Mirai)", "value": "3401ccc976f39cf024fc916982bd1f0b3ca7ed37b9c81180168d03006b7331c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848585, "uuid": "d24f007c-142a-4a70-86c8-a21773b0ee35", "comment": "Malware payload (Mirai)", "value": "aa88c9373c43800a740fcf3ea627e86bfa621fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848585, "uuid": "a3b77a0b-f301-4269-902c-6684a9e9fac3", "comment": "Malware payload (Mirai)", "value": "12d7e7246b1c6e64f56031a88a96c03a3988185cb75f7ffad44f7bdda1622326c0c1623e4c17975c090a8c9591b5a4f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848585, "uuid": "331dfa80-ef0f-43e7-b5dc-7915980ecfea", "value": "T1DFD38E5C9D1E7DC2C2C3F2FEAD450F56312675744A68C3F62900A2CEE79EED698B1422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848585, "uuid": "f0e54af3-7464-43cb-897e-5bbd72dbbef5", "value": "3072:RzbTfuJMNYFQdeUO9YkUnAmp8xlDFg47xCKhR2Jj:R3iqaqMUnbpuDL7kK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783848585, "uuid": "caf3d824-2ee0-468a-99be-9ae7245f4ae3", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783848585, "uuid": "203653ac-9401-4b1b-b670-83b87ac39e27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848585, "uuid": "068d5270-887b-454b-8426-92a7ecae4949", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e62610a-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892136, "uuid": "87f13cbe-4d53-473b-9a96-562246aa1915", "comment": "Malware payload (Mirai)", "value": "87eed0c7b549c8d3e976d687cd1bf1e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892136, "uuid": "031dd753-13ad-480e-80aa-7a06f0996e69", "comment": "Malware payload (Mirai)", "value": "370b799b34c7742a17d2cb41b80ba995abd5867d4d85f8710728e8d485579f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892136, "uuid": "09112b51-f9dd-470f-bd8d-1755b491ba01", "comment": "Malware payload (Mirai)", "value": "ded481d19ca08d29694466ac6d916badb6440595", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892136, "uuid": "32433617-5c38-4b1d-9dd5-fcfbf26b7398", "comment": "Malware payload (Mirai)", "value": "3767069859ae59121b4c42ffff26441915470aa36af60f8ff9faabc54a63dff7019f390a4fdfc90ded6fbe52543b5f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892136, "uuid": "7cab66d3-6f94-489b-93d1-f20fdfdd4eae", "value": "T1F3134B1355BD6607C0F8A67D02B39717B2DA775C90949B1FBE3A0ECBBA413901F2A670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892136, "uuid": "c8d0c297-1e98-43eb-af25-89e422bad482", "value": "768:ImiujdRTLGkD1Sxu1qU8eCx9xwGW+R2/kPTnbz4zTlG986jOMGj4QLAOYPZJ:ImiujdAkpSw1qReCJXrR6kPTbz4zvXAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892136, "uuid": "2e0dd5b4-c2d4-4a58-bb28-f18b600d32f7", "value": 42876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892136, "uuid": "3495924b-45c4-4200-b413-f888b1684c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892136, "uuid": "1a355d4d-8e13-4e56-9c6e-5b1aaf6a6d9d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537aa948-7dfd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783866240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783866240, "uuid": "bd2c15e6-62b5-424e-ac96-a6751bab33ea", "comment": "Malware payload (Stealc)", "value": "b0e9f10d8fdf31ba3f922fa9e56b0510", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783866240, "uuid": "2e5b3c75-1db6-471a-9d57-fbcd510540b5", "comment": "Malware payload (Stealc)", "value": "37f17d0c6adf3a64e516d2a5bdd7114ca7d475b09172f28878ae7d663cb40714", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783866240, "uuid": "161d4b13-00a9-4dc5-a87e-8b87c7a63be1", "comment": "Malware payload (Stealc)", "value": "6732e61cf38546cc061a5796542fe17145f9a5b3", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783866240, "uuid": "9fa20d29-ef85-4a1c-9175-27fe8e693037", "comment": "Malware payload (Stealc)", "value": "686342d1b5c58fcd50d9022e80659f36e35681043b5fafa16c708137b464ffcc4af6491d69ec25c248c4c16b8f678473", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783866240, "uuid": "280e064e-4ad5-4164-b99d-f5445e955a41", "value": "T102867B06BCE508E9C0AEA33189F795A27B34BC190B3627D72E50BBB82E727D05D31755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783866240, "uuid": "97c531cb-ba27-4b04-949c-7eee1a8ccbbe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783866240, "uuid": "7eaec4e6-d359-4de7-8a35-6418b5891a12", "value": "49152:um+DzCLhnC3Yn8y/INDYydwA89jcIN2MLp/ohZ:uwD/EEV9jj22W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783866240, "uuid": "cfcf568e-0088-4943-9583-184a4fc10cbb", "value": 8263032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783866240, "uuid": "eace0e01-59cb-49fb-a615-de4d24262230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783866240, "uuid": "31d6dfab-48ea-47b1-839b-e3830c9c7d86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5ff96f-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843871, "uuid": "1477a1a4-92bf-43a0-9cc2-cbe1036c4df7", "comment": "Malware payload (Mirai)", "value": "ee46383677cd9d4ef958ece8eb4f2439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843871, "uuid": "72f6e1ce-f876-45ef-bd0b-536efe1362a7", "comment": "Malware payload (Mirai)", "value": "38dc2b779475cec6020e9b2152d663eff4632d779eefe240ad9c7753d136d258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843871, "uuid": "6530f558-3cdf-4401-af95-48965224c08c", "comment": "Malware payload (Mirai)", "value": "e4e2a94ea0bd2435a4e08e65f3ed6a681f63cf5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843871, "uuid": "b0486fea-cc1d-4fcd-a6d6-6311ec96331a", "comment": "Malware payload (Mirai)", "value": "3224d1f06341a51ba28efed62090c449556f0c33fa3f0e385f4db031da17cdfc7d8e0bf3988175f0b7e497f6ca6651d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843871, "uuid": "ee08f951-c97e-4d03-9d86-a8861b7b5756", "value": "T127B2D160A9594E30E27049B1EA7CC1C3EADB7BB490E9373A366023B4D7D121958BD5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843871, "uuid": "8890da9b-fff1-4587-b4e4-be7bf4bca659", "value": "768:4OZD5KWQ1MXrkmRkxETVkrrbQPVTNlKs3UozMsB:4OZD54CXPSPbQ1XzZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843871, "uuid": "014e99fb-2ea8-4e1d-bd20-37010c2d2736", "value": 25120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843871, "uuid": "3e179132-10dd-40ae-85f7-a5ada810f962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843871, "uuid": "42c43b5a-3f25-4ddd-81e2-6ef13bd62deb", "value": "ar15.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb64ccfa-7e22-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783882333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783882333, "uuid": "a4feacee-acad-4c9a-9337-f69d1f56e972", "comment": "Malware payload", "value": "2a0829eca0aa9164397e02af2b45342a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783882333, "uuid": "017d131a-4db5-49ea-abe5-030cc57a8e3f", "comment": "Malware payload", "value": "3918884cded211caa7589f453458a946cace632a7e8872b9d5e10917c6343e8c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783882333, "uuid": "aeed385a-55a6-40e8-83d3-22770108b19b", "comment": "Malware payload", "value": "a56c72fc63f2b02165d84a1de8d7bb91ac0ad661", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783882333, "uuid": "7d665583-eddc-4504-8481-67eb98d74b0a", "comment": "Malware payload", "value": "2bac7a00201bb27bfd68d212324c83404f7a1eca09cbc0f99016d9a20c7dc83dfe62529b080c6077d3281f1498bc50e8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783882333, "uuid": "f2de2811-0e89-4e83-bb20-0b1835324818", "value": "T11AE633246AE111F8F9B3017DEDE196E5F4B578760B33C98F47A887676CA32900D3A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783882333, "uuid": "07f82849-55f5-4eb3-9f37-6ce0b7db1430", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783882333, "uuid": "3f9914b6-d969-4819-820b-554e5825c10a", "value": "393216:0/i7uLwvSaRSBOAwEYPXMCHWUjXacuI3/PGTAI:0D9ISBOlEWXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783882333, "uuid": "83401801-69f8-45f4-af64-82c5ed67f7be", "value": 14279687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783882333, "uuid": "68a90214-62ad-435d-8a75-800439159665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783882333, "uuid": "6e3fea9d-4254-45ac-ba07-6c310593d9c0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f915ea-7e2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783887776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887776, "uuid": "49a8acc8-44f3-4ee0-a628-eb47e2c4b13e", "comment": "Malware payload (Vidar)", "value": "b9f4df4baeebdf5f17700cb8eee7cdb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887776, "uuid": "7cbd4b96-c55d-4af1-ae3c-cc4d6c3b4f23", "comment": "Malware payload (Vidar)", "value": "398c754446396f89ad511e95760c90f9b72e1ce96b105b642b1f853b874f80c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887776, "uuid": "ed25e0f1-a42c-42d8-b428-06715465fab7", "comment": "Malware payload (Vidar)", "value": "e4157bb32a7fae91e47b5e096d8965467a29aa84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887776, "uuid": "e3c89e0c-7ced-4407-857e-95624837ab57", "comment": "Malware payload (Vidar)", "value": "1d79c9f468751a953743f35a518b2ddcb982838d61289f9e0a368f46c755e73b5a8bc214cb00e1c85961bb35ddbe7c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887776, "uuid": "dba68b49-a40f-449f-8f06-b3a209a5d634", "value": "T192F58C07BDA549EAC09E923288B752A57B75BC495F3223E72E50B7382F32BD04D35B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887776, "uuid": "8a1eeb4f-2198-44d5-b69a-ef4d8cbf690e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887776, "uuid": "90053a9c-9843-46ca-9cc8-ac57a7bb652a", "value": "49152:oZ1k9nrY29aa0hQzy4C+6yCho3GboSDqCeVmK8RQsDI8gl:owG0u4j6HuGbQC3OuIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783887776, "uuid": "b8e2bd68-1cb5-4cda-9882-269d7bab366d", "value": 3412336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783887776, "uuid": "bfbd5e4f-710a-4acb-a245-9649d38dd58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887776, "uuid": "7d19f97b-570d-4675-9ae4-a29b392fa05e", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c1f709-7dcf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783846643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846643, "uuid": "d5bb49d3-0825-443a-92cc-6c9c780b9db1", "comment": "Malware payload (Mirai)", "value": "997f2a1e812d52988b444a853dea114c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846643, "uuid": "35dd7b0b-7aef-4ffa-9950-ca1645a78234", "comment": "Malware payload (Mirai)", "value": "3aeb99a253ad771a75eac152743228cbfc2a3a57404df11d0b8f0c00a0b4e010", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846643, "uuid": "09bf6d33-d9cb-46e7-92c4-87d7e02b67cc", "comment": "Malware payload (Mirai)", "value": "528bdfe85e1ca625e8034bebda81d4c74a6d96c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846643, "uuid": "409e3323-738b-4a13-959f-06c362f72aa5", "comment": "Malware payload (Mirai)", "value": "90fe4e4195c773de93fa110a13af5a4f67ea0020e59da2082193b76df89b074f43f78989364574ffdcbe26d1387fcecb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846643, "uuid": "22d5f45d-f0b1-472a-8a06-48b09615d97b", "value": "T18E4302302339BD65C6BD4A3AAC79A844BDE9AFF030EBD37032140FA45EC58D559AD583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846643, "uuid": "6b08a083-0f12-4ff9-91b1-5d9898ab1330", "value": "1536:pvE70F8qFmAPtqYtjHmHar/px6HDt2v9fFOLa:igOitlh4ihmZkGLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783846643, "uuid": "9cbf960c-d0b5-4675-aaae-f9d6c79011e2", "value": 55960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783846643, "uuid": "aa514002-02ee-4b9c-b387-93d35a2c727d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846643, "uuid": "d9972d7c-7cb3-43f1-8c78-b72f93c7cb4f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d4d16d-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783840900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840900, "uuid": "b218aa62-c6ce-4645-8e05-af02152c25b6", "comment": "Malware payload", "value": "07e3f2a60b09d2b81e978920369fa756", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840900, "uuid": "574bb949-20d5-443e-a460-9f477ee14dcb", "comment": "Malware payload", "value": "3c436b73d57a9a1cbf53eda41af08626b8c96a418f2959763702b0686a516c07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840900, "uuid": "2043fcc7-3e90-4e18-993e-1da5d8d5874f", "comment": "Malware payload", "value": "3b419d6b3312c35b54cea79cd7b969dc5dc98424", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840900, "uuid": "8348c294-cfdb-4800-9e4c-2f1aa9fdb2af", "comment": "Malware payload", "value": "dabb73d198fb88a64a74433fb90db29cee68dfca2e4eea6822cd522c9f8910762ed655e974563290822179d452e23a01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840900, "uuid": "5d8bed49-97cd-46a4-be24-70d8923ed03b", "value": "T11EC51227B56224ACE51BC434878EC1B2EA39B46502257B3B7BD4D6313E39C768F1E712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840900, "uuid": "8a69daa7-ad67-466e-bb6c-664927a5819a", "value": "49152:gTDZHKimHGuSDiFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvL:Aqimm8UvmMy5qUVkf3xQa52+3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840900, "uuid": "6769b773-8b6d-4320-83e0-a20d7c22a05d", "value": 2740936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840900, "uuid": "d0932b27-c2b3-4cb9-ba16-0d024317744d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840900, "uuid": "7e0469f3-8c99-4906-962d-8d9292be361d", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03f534d-7e0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783872919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872919, "uuid": "6c06643f-3ac5-407e-b03a-aaed373c0667", "comment": "Malware payload (WannaCry)", "value": "2eb8f13afb5adc3b92034da6311dd700", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872919, "uuid": "843e750c-6e75-45f5-b731-30c3d141ac1e", "comment": "Malware payload (WannaCry)", "value": "3d00cff108f59b705efcdba34bf429142b95170e6e876093609a1b44d8ae7fe9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872919, "uuid": "f7760a1f-5350-4dc1-a793-44b91a3e7218", "comment": "Malware payload (WannaCry)", "value": "6810cd28bd3899e97ce9329d5d83abd08a4c38fb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872919, "uuid": "2876c948-b49e-43f6-9f69-8d8c356bdd17", "comment": "Malware payload (WannaCry)", "value": "43af94ef0e1081d7d83956311b4a8b228afdb502c329b908fe542c3be497b6ff331b79de658a514609c8a7a45e718978", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872919, "uuid": "2a2fa4f4-c061-4cf0-abdb-ef5acf3c5483", "value": "T1C0362349327881FCC10A597484A78D26F3737CAA52FE5B0F8B548A6A1E53B51FB70B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872919, "uuid": "7c6d80d9-8de9-4ef6-862e-38534db054e0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872919, "uuid": "4b3b4595-33d5-45e1-9456-562ccbd57a23", "value": "49152:jnsnsQqMSPbcBVTx+TSqTdX1HkQo6SAARdhnv:DM/qPoBVxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783872919, "uuid": "5ab0532e-f13f-4f7a-8acf-6560536425fc", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783872919, "uuid": "e09cdb76-18cc-4219-9ed6-6e1099fce9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872919, "uuid": "114d824f-eba2-4721-beaa-e3d7aea19e99", "value": "3d00cff108f59b705efcdba34bf429142b95170e6e876093609a1b44d8ae7fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa36cc7b-7e30-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783888290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888290, "uuid": "d1374194-34ca-47d0-ac45-7a4900825270", "comment": "Malware payload", "value": "68c0124d0a75f289ca24fc578db71b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888290, "uuid": "c03ef500-2a04-4893-bd92-2f3c993e52a9", "comment": "Malware payload", "value": "3d23a06ec67a2a49f8703d8f67deab3af226e8045a7866b81821945194479a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888290, "uuid": "db4107ee-8d02-48e3-91e2-7013eb471bf1", "comment": "Malware payload", "value": "25dab14774df204362a3ecfaf73db7c4ccc3a439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888290, "uuid": "f8a3996c-205c-4aac-b390-d4cb053ceb23", "comment": "Malware payload", "value": "aae6393928cad80ef614fb06df3d6f303b45af91839c1b21e9c19187c7223e4b106c53bc5a65fa18e3f6122f972a8042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888290, "uuid": "4bd716d3-42de-4774-84cf-60300b6f112d", "value": "T1F212AF9DBF05FADAE9545CF3186D05FC49DBD26E089B307048D5B90DCA0A4AB0A5E3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888290, "uuid": "84c20da6-6ada-4e6f-baa8-d2f6868299a6", "value": "192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1zIi:flzEBkDOvTCZuQEkymy/GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783888290, "uuid": "b2fd105f-51f4-4470-909a-6362eacee991", "value": 9108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783888290, "uuid": "3f06c38e-1057-488f-b465-44d38fa92b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888290, "uuid": "833f07f2-5071-4508-8c24-4e41eddf3869", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b090da-7e3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783894517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783894517, "uuid": "c103b712-4f26-44b4-92d2-fc8f2b69ee40", "comment": "Malware payload (WannaCry)", "value": "776fc765041a985b5e30f281975ae6b7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783894517, "uuid": "31abde55-dc6c-475c-98ae-a53ada2c0dcb", "comment": "Malware payload (WannaCry)", "value": "3dbe040d008567910a21da1e2e36fae697fcc5cb3fc384f2304b4bc1306ac564", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783894517, "uuid": "49cce83e-ad90-41ec-a70a-6f5c4c782bde", "comment": "Malware payload (WannaCry)", "value": "3b1244a9ecac0a16764cdfc563d1586bf975647c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783894517, "uuid": "07ab75b1-c3ae-4794-b3cb-fe0a71507c95", "comment": "Malware payload (WannaCry)", "value": "a2d39ed838f9d4ad7e8116474e7bb2417524e413336f04b6ed9c77af1ebbdc46e17b2442aee7e1e0e1473a87dd31d2ac", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783894517, "uuid": "97166763-43a4-4c91-af0b-ad3bf206fe74", "value": "T10036C00A379CC0B8C456927498B75E25E7B7BC4A1334C24F5B64CB6A1F63391BA39B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783894517, "uuid": "f00aac57-69bf-42cb-abbd-dea3ed0e9f5e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783894517, "uuid": "51351a5b-6407-450b-8614-34e73497fc1b", "value": "6144:jIYVTH5DgSgmE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh:jbLgmwbLgPluxQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783894517, "uuid": "5cdf1697-6fd7-4ae7-9936-b58debcfa513", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783894517, "uuid": "1ad71c72-f1d6-4b12-80d4-230379a30a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783894517, "uuid": "f2aab689-08aa-442c-9fe9-820eda547c5b", "value": "3dbe040d008567910a21da1e2e36fae697fcc5cb3fc384f2304b4bc1306ac564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52d54c8-7dbf-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783839775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839775, "uuid": "6c59c8be-0cea-48f3-8f26-54e281356fb1", "comment": "Malware payload", "value": "e2a9cc3de4fceac77a4bd28314e859ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839775, "uuid": "29e82fde-b045-47e3-aa91-f8737c6e74cf", "comment": "Malware payload", "value": "3e3de335bb1e29383e4ac99e84ed171242416dc8cbd58739265e00b418b889cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839775, "uuid": "5492ba8d-bd78-476a-9d1c-9bc5983e6b2e", "comment": "Malware payload", "value": "03f5faa7f8cb988869a99b1f7bb8f6c65c845b87", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839775, "uuid": "30800249-d829-4f6f-a7f0-4f95a3ee75a7", "comment": "Malware payload", "value": "d6b6a6da3c6f1781b057ee1a1df6156918fc8d96af86dbf76883efc68ad98f2a26df9abb6d26632cd9d39ce4a6a59771", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839775, "uuid": "cc7da8fa-3202-40b9-a1e1-ba66a8a78400", "value": "T19F336C5516817C24EA99C8361C7E2F0CB9AD43E6324452EEBFCB3CF28C4AA9DD11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839775, "uuid": "647f71f2-98b0-4afc-88f4-cf19864812db", "value": "768:Q+h9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:Q+KcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839775, "uuid": "c7d39e28-547a-4710-afc2-635e481ab4c3", "value": 50370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839775, "uuid": "2fcc1c96-df06-41cf-ad03-fdcf4e6776c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839775, "uuid": "42c8ead0-fa73-4502-ad31-cd62e6abecf1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177179f2-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820613, "uuid": "54e72f5e-bd1a-44ce-82d3-e63baac81f89", "comment": "Malware payload (Mirai)", "value": "e9edf7fe48853006a5fb90bc10ddb928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820613, "uuid": "033041dc-8afb-42a7-819f-fb91ac45738f", "comment": "Malware payload (Mirai)", "value": "3eb84b562b448b6833cb2636ad8ad32370b4ed45839349d7845ff71f6dd874e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820613, "uuid": "06884bd7-7a87-45ba-9451-bd1d4a1d00d2", "comment": "Malware payload (Mirai)", "value": "b135231d1d7af2295169dd579b1ff819bd87c053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820613, "uuid": "a4386fd8-313e-4c82-8742-02fd1be79b1d", "comment": "Malware payload (Mirai)", "value": "93709bd0677f48fc6702880d7713b110616aaa78c774d9a94ebbc73487d432a71dac26ebe7a28a7e90624c5ecd47fba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820613, "uuid": "7e3bba50-358b-4684-85fc-d9d39a36fe97", "value": "T1ABF2E0DDAB2D50CED28BD47909B013124EB60F52B046CE889DD4EBC7781A7F9264B9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820613, "uuid": "9d3e30c1-b8cd-4f5d-9a46-4dc39ce1d242", "value": "768:zmeHcYYYUEDhtv833lpy0oGBFgk6PsQdmASNQJgGlzDpbuR1JX:ae8YYYUEDhtaDFBF163mNNQVJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820613, "uuid": "bdd9b401-6550-4e8d-a030-aec0a082e034", "value": 37192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820613, "uuid": "5af39b16-60f2-4f4d-b63b-64f742f5283e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820613, "uuid": "43f65e1c-177d-4dad-bde3-2c676fbe636a", "value": "SecuriteInfo.com.Linux.Mirai.10589.13407.32427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13336891-7dcd-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783845516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845516, "uuid": "02cb1d9e-3c23-414b-83a0-4641429b9783", "comment": "Malware payload", "value": "245084f7558c69db4359d2b4052c7187", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845516, "uuid": "119f1567-5b23-4023-b7b0-25451e5dd097", "comment": "Malware payload", "value": "40519e5d8e55aa5bf7ebffd472d059cc909b0f681fa07c270735c2ccc0770d11", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845516, "uuid": "ae907e42-dd75-4687-a0aa-bfbf7ea2aaef", "comment": "Malware payload", "value": "1d722da28d7f50dc77e0b8db0ce6fa17f9cd0658", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845516, "uuid": "822f8e26-8e5f-4d5f-a13e-be360f854a55", "comment": "Malware payload", "value": "2c6b3b2be930ef6d96fa874aa844dec6dc75ad9231228b22c13c5fc02ef6014421974d6cc3ba869ba40e5ad8538f7570", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845516, "uuid": "b6269803-0bc5-45d7-ac12-2563cb96ab52", "value": "T167336D6516857C14AA99C8365D7F2F0CBCAD43E6314492DE7FCA3CF28C4AA9CA21971C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845516, "uuid": "3c85cd71-9eaa-44f1-9c70-ae6be9773f44", "value": "768:3r9NyXsZztCb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:bHusZVcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783845516, "uuid": "35aab74f-d452-4b6a-a128-c02296fff572", "value": 50374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783845516, "uuid": "7772e2e2-211d-406a-a984-6dbeaeab4c4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845516, "uuid": "ff852c32-c7fa-4d5d-859c-68f09cebe85e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db91b5e5-7e16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783877206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783877206, "uuid": "1c06ebc3-9eb3-4e05-9199-a9f326a8c803", "comment": "Malware payload", "value": "ff2157dab4c010cfa49bde50eb56d048", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783877206, "uuid": "2173f028-e310-4f1f-bd2a-60a39932be02", "comment": "Malware payload", "value": "42559b9731ce33efab017c8cfd15b1da14766e673577b3dd73cfefc2df848326", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783877206, "uuid": "6b8e424d-8131-447f-92b4-ddf243e24be5", "comment": "Malware payload", "value": "536a62f522d1a0d04b1f01ff76db352abdd5c48e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783877206, "uuid": "58f0595d-364a-4fda-ba9f-acc57e55c9d2", "comment": "Malware payload", "value": "2b85d82f61e7efc3cdc0e6d4a523ae5dc6c9556d1fa165c82b21400cc559831bd78ebadbd0689a5d807f8fa0c7bb7b8c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783877206, "uuid": "d30ce9af-cae8-47bc-b8c1-13f9d654c6df", "value": "T10D236C6516867C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783877206, "uuid": "dcdbe392-e782-485d-acf4-7b1d3efa1cb3", "value": "768:e+H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:e+wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783877206, "uuid": "38ebff49-d9ac-413c-a575-700f85188420", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783877206, "uuid": "8a7c2691-4739-4822-8e04-77f653f49a5f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783877206, "uuid": "b40aa432-0f33-4742-bc2e-367707135a10", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c172ada-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823815, "uuid": "a4b9dd73-66a4-4d53-ad82-3de6566c9736", "comment": "Malware payload (Mirai)", "value": "846f6f750d925c98614e83b206203cc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823815, "uuid": "60414235-d0f1-41da-b3ac-b9387097ef28", "comment": "Malware payload (Mirai)", "value": "42dbebaa947798c63208f77fc2bf81ba4749dbf8c423cd30663e4fc95d46c32d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823815, "uuid": "9b470e4c-7c84-4832-92b0-4fc2bb2ae1c5", "comment": "Malware payload (Mirai)", "value": "831e176df466c896015aafd42ca4ecf58861d656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823815, "uuid": "6a186e6d-871e-4dbb-88d0-29112b4d38ed", "comment": "Malware payload (Mirai)", "value": "41d83f49e9a1f030da77ff5b6c0bb2a09a28c883cf65b5390953cd9f33b17fecb9012dca95133bf45a89cf3c49c795f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823815, "uuid": "9781d643-4cb6-43e8-94ba-6a3e534ea576", "value": "T1B9B35BD5B50C7EADD5977E7CC20A53176B1C9E409C83860190A2FE072AB36E71E369CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823815, "uuid": "fd8b1324-18d7-403f-89e2-d7d1f485da8c", "value": "1536:Nzic4kKYQMhkItoQ6NR8RaDFTtM3hxBj283GzCGS0m69Qpvuw/qIRalQLLjeH:TEYzhzohzJlGBRfGS07QpvAlQLLjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823815, "uuid": "cce8d974-7e09-48e9-a666-d68166157d90", "value": 108756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823815, "uuid": "4ccbdeb9-1790-4697-bdac-2c4c00c66b73", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823815, "uuid": "2dd26135-2c82-4b1f-bb85-0215d09dc96c", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c86a1f8-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843921, "uuid": "2b987a5b-c528-4540-a070-47fc827214b2", "comment": "Malware payload (Mirai)", "value": "68dfc7998c58af52b01ace399a492f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843921, "uuid": "6c30f5af-27dc-4d6c-8fd5-70b4657b3b00", "comment": "Malware payload (Mirai)", "value": "42ea5f702924625fd24fa7fea22fbed5e6f11c89dad5476ffa1fcb35df8f91e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843921, "uuid": "9cb2368e-878e-4930-932b-83ee7399ee09", "comment": "Malware payload (Mirai)", "value": "4d2f73dcfff8f653804c3d9689e0b379c68a9df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843921, "uuid": "cd3ca3e3-4088-4090-b5e9-6c3baeb43729", "comment": "Malware payload (Mirai)", "value": "32c3e66303429ab75f6e3752ec5adcc8e01ae08ffbd718730da5ea1dc48ae218f14ffc54fd1e6fd0f51efe9215391e65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843921, "uuid": "b68b65fe-a3cb-4011-9659-f507c301d3cf", "value": "T1B3E4D70B6E328F3DF67487354BF70A249BAD23D623E1D581D1ADD1141F6028E691FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843921, "uuid": "d288aed9-457d-4745-aa77-5cdd32faeb18", "value": "6144:jdjoXZmxgfXbuhbCNdjoQmlt4HBa4X05+yG51W4EfC8VYJdaQFEYt265YJJaY+tX:No+QXA6m6ccXtTgnFi1wyqnscm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843921, "uuid": "d6ae677c-6ca9-4e57-9360-7a750e6391ed", "value": 686748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843921, "uuid": "6c3e005b-baf0-48a4-a772-edcc605721de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843921, "uuid": "7e4b3b84-18a6-46be-82cc-1af73e7b2c62", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fffb4e-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843983, "uuid": "09a8ca3d-c8ec-4807-bb43-e4c0aa525f80", "comment": "Malware payload (Mirai)", "value": "ebc0ecc761895db23b468608546c864a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843983, "uuid": "5c8e90c6-8e70-4eb8-947d-c72e9bbf2838", "comment": "Malware payload (Mirai)", "value": "43ef07e39ceb8b84fb97555985342d5bea6bd2b018131274f79126ca3a441a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843983, "uuid": "7a0e02f4-5275-457e-afd9-e1ec86dc16c6", "comment": "Malware payload (Mirai)", "value": "2b2c5a1ff8127ec74fc5cbd9193f5836e410d398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843983, "uuid": "889807e6-1a15-4f8a-b5c5-dda255d319da", "comment": "Malware payload (Mirai)", "value": "ddd43cdcbdd715c07b3e4a6f16ad2e8d90680b7d5a51926ae595603bea60c03bc8e21305df84822f47334a96a7cd6685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843983, "uuid": "628d4fce-4d76-4af1-87e2-02254a43dc71", "value": "T1BB736CC5FA83D4F5EC120A351037BB379A73E53E2169DB87C3A8A526DC125C2DA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843983, "uuid": "a8561008-3372-486d-b0f9-8d50e5914f28", "value": "1536:4s3y6v3JiRd23nRIBlng2N5Xekch3K68cS6Z1:4s333IU3nR0lvN4kM3DZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843983, "uuid": "a4500033-9893-49ea-a8a6-4fb065836c56", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843983, "uuid": "34efb90a-eed0-4bb7-8ec3-7495c70d2499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843983, "uuid": "f1a92f83-3d7c-49a9-86b0-3382d4e49c36", "value": "ar15.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b156241-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843865, "uuid": "1f8b861e-0dc3-44c1-ba0a-2d78e1901816", "comment": "Malware payload (Mirai)", "value": "b18ef8bd83d9f9c866b39cb61a3202d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843865, "uuid": "944e836c-7ba6-4d2e-b22f-bc24feda97a9", "comment": "Malware payload (Mirai)", "value": "43fa0c68d637cc00e5a164c8d8f5a3667bc9279b78466a3bea88ed6f6d726539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843865, "uuid": "3191ed91-6479-42e4-93ba-5c25723aefcd", "comment": "Malware payload (Mirai)", "value": "98d5b2f93689e8b2d1e56e5d4be418c67ecdd9f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843865, "uuid": "9e7d63ed-b591-4cdb-97b9-fb665969f2d4", "comment": "Malware payload (Mirai)", "value": "b6b20ba51dcb49b80acceecae72d169b0923173e99649022a7805481aa7dbb20b36da575784c9f38622481f504a567d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843865, "uuid": "32852840-6ff1-4b19-a524-d3dfa38067df", "value": "T137B31956B8918B11C6D136BBFA2E008E3313576CE3EF71129E285F3827CA46F4A7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843865, "uuid": "24ef2134-cb50-4957-9a6c-f92537b37601", "value": "3072:9xTFH2H7o/d7cEzUw+nKwaMvW7duCan+75n5p1/V:9zWHm+n9aBZg05p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843865, "uuid": "5f1a69ba-2ca2-46d6-b8fc-1f384f7f5805", "value": 116200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843865, "uuid": "18bb80bc-b8bf-4f4d-8c3a-1f38958dc2fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843865, "uuid": "602c5658-c41d-4d8d-bcdb-7b286cdf207d", "value": "Ares.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8349855a-7e2e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783887366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887366, "uuid": "bc66cd0d-4342-4937-8110-f41ede5e0c22", "comment": "Malware payload", "value": "ba284a4b508a7abd8070a427386e93e0", "object_relation": "md5", "Tag": [ { "name": "Cyberav3ngers", "colour": "#EB15A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887366, "uuid": "3fc8a079-de1e-48f0-a5d4-221a1fd3697d", "comment": "Malware payload", "value": "440b5385d3838e3f6bc21220caa83b65cd5f3618daea676f271c3671650ce9a3", "object_relation": "sha256", "Tag": [ { "name": "Cyberav3ngers", "colour": "#EB15A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887366, "uuid": "1fbfce91-84df-4510-b753-20681b1f00b6", "comment": "Malware payload", "value": "66ae21571faee1e258549078144325dc9dd60303", "object_relation": "sha1", "Tag": [ { "name": "Cyberav3ngers", "colour": "#EB15A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887366, "uuid": "135e84d9-6844-46d9-8897-5037aa37b804", "comment": "Malware payload", "value": "7c223661f7dfc932ccce2a0d6460fa2a869fca47f219337794a9ddb0753b5203dbce6a4cbedc24fef6e58e77e9bb3466", "object_relation": "sha3-384", "Tag": [ { "name": "Cyberav3ngers", "colour": "#EB15A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887366, "uuid": "fa949528-b503-4940-9395-b6031e9e5946", "value": "T18C567C03F8A591E8C5EED130C96692527B307C880B3567D33B14BBB92B367D86E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887366, "uuid": "5c3160a7-d74a-447a-ae77-6431a1e891b0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887366, "uuid": "3b3ecb7c-5b4c-4cc3-816d-0cd50c912fda", "value": "98304:qiSsFP9OSEvCX3xJdAJtk+jWa88QbHQj:qM+aHjdAJ2+jWaXQrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783887366, "uuid": "8f4c6f9d-80a0-4ca9-95c4-c79a3e9efa7d", "value": 6428672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783887366, "uuid": "caaa9b39-cf3a-4730-bf45-fb7c9bbde51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887366, "uuid": "bdfd83f9-8f9c-4a0c-bcae-ba32b9e493c1", "value": "p8ng2zc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7473f78f-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840955, "uuid": "23796177-0329-46c1-875e-ce34fca5eefc", "comment": "Malware payload (RemusStealer)", "value": "7b9f2a2e2e46211c9879ac2670ce3630", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840955, "uuid": "fc6e6787-44ca-4970-b929-f6ab2da1e333", "comment": "Malware payload (RemusStealer)", "value": "44814d2124603ec71ad8315b3992359039d0cf5f1f795042393438f6797eb38d", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840955, "uuid": "4463f789-489e-4a40-b6e3-494b88eeff00", "comment": "Malware payload (RemusStealer)", "value": "86e78519505d285724315a04458f72c6594d12d4", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840955, "uuid": "39aaa064-6733-466a-b813-d79e8044c4e8", "comment": "Malware payload (RemusStealer)", "value": "2101801b9e944642aa1dea35494b47053b614dfbbc9924019aac827c6ad07b61188e47e4460cb4428b7605267e1d035e", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840955, "uuid": "0740866e-d14a-4cea-9c82-12e5af1b6e9b", "value": "T13FC53807BDA149E9C09E923199B751A67B75BC080F3223EB2E90B7782F72BD05C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840955, "uuid": "c5c7fbca-9b3a-4ab8-b2ea-6f5b179f418d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840955, "uuid": "8953a804-bde7-471d-a87a-e74337c9cea9", "value": "24576:hp4DAKqPLX/+Yzwb88Cuo6v0mAvLfnC6hGpvhngXG2mRFs2re0vA2Bele5rK2y0T:hp4MKKL2Y3o51A26hGVhgXGRRLd8zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840955, "uuid": "d9fa0dc5-1c47-4ceb-84fb-40e419a3e7cf", "value": 2558320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840955, "uuid": "f77b9669-29cd-41cd-b25b-bfa599ba817e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840955, "uuid": "489c0c4a-79fd-44a1-b8e6-3183bfb25de1", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ee5a37-7de7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783856747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856747, "uuid": "a6c47249-b235-4005-bdb7-d29f3c5df0e3", "comment": "Malware payload", "value": "5d783ec79ae74b73d2f9347a4cc828c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856747, "uuid": "fe75e853-90ad-403f-a328-2b0ef92043f1", "comment": "Malware payload", "value": "45407890088f37af341d09a2076d23e03948b27943852693960bf51d0768edff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856747, "uuid": "ae78824b-204f-472f-979a-fe730aaafd1e", "comment": "Malware payload", "value": "c0152a2852966ad4ab8038b06f5064b7a4f61857", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856747, "uuid": "d488dc61-6365-413b-b57d-62443a4e79d6", "comment": "Malware payload", "value": "5a23915b9be1d94105968e88d4f57f47497d3007cfdb4d4a2a6476110a2c8fac0325230adc7b020a9505f6841459a462", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856747, "uuid": "d8e4c05b-a88e-4190-bf08-840b9c6bfe39", "value": "T17CC2F1F1F8ECA831369D453ABB9DA805A9DF7C2F4DAB7D2014175938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856747, "uuid": "e5371e19-68b7-45aa-b921-4b84e5807333", "value": "384:NV99ipud3s1OiCu7isjsKG6q/A4UAbMdhQuW57:fipQsOiClUMdUA4z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783856747, "uuid": "e5e50fe6-e961-4258-b483-fb0a54933e3f", "value": 26930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783856747, "uuid": "64a72ee9-019e-4760-a1cb-2982f4233e78", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856747, "uuid": "bb2c59a9-5478-4662-9db0-c7bd09d49caf", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582208f2-7db5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783835324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835324, "uuid": "9938a4b5-8b5c-4a37-a02c-acc17fa53a7c", "comment": "Malware payload", "value": "cb54e2a09f8c52253267579184c94ba9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835324, "uuid": "1ebe3560-af76-49d5-a4fb-53abbcbacbb2", "comment": "Malware payload", "value": "46198462d69ded74fa2b0eb5b2ca7401f4e924c6f67707be43f761a937d01397", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835324, "uuid": "5d9bff05-7a97-4760-bd3d-da22e24030b0", "comment": "Malware payload", "value": "561d22595afccfca54086c05ec3b0702a9685099", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835324, "uuid": "8bdbc86f-8480-4157-ac01-d36fbd16f42a", "comment": "Malware payload", "value": "5cdead8ea2db65036eacd23fafc1cd09f6681d5ab1c54df0bbcadbfd94d39bd91cc37392e55d083b22d29ebf8c246f51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835324, "uuid": "c8e827e2-764e-4ad7-acf4-2ccf1b5a995b", "value": "T133C28D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835324, "uuid": "bcb0526d-da0b-4622-9cf2-542784497b63", "value": "768:M8vCB+25j6es8RX9FYpMSUpi+20qUpi+20YQX:M8l25Jxd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783835324, "uuid": "31d480fd-ca9f-4d7e-91f2-7fba6bab7123", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783835324, "uuid": "9e634660-f21b-4518-a598-57d1dddc3ad6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835324, "uuid": "3513b7b6-ee8e-41e1-bc9e-b055def50cd7", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377849b2-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843859, "uuid": "2d743008-d060-4b99-bea3-4dfd0ff6e38c", "comment": "Malware payload (Mirai)", "value": "a74171c9495037bdba0549aed6b8aefd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843859, "uuid": "2d66684a-b775-4167-9725-0c7c0c58a54f", "comment": "Malware payload (Mirai)", "value": "463a496282708bc8f04e052430e60a5ff93688a2dcaf80a5fab5767e15d178f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843859, "uuid": "54b60fe7-74a7-4538-b87b-40b904fc54c7", "comment": "Malware payload (Mirai)", "value": "8d2dfdd2e84855e70646daab68437e0ff1a64e5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843859, "uuid": "8742b564-e950-4079-b801-49d608726974", "comment": "Malware payload (Mirai)", "value": "3eee8c368771429d57d4a69012bf42521d1995fa1c7e6d0030407733c526397e3b69243ede3820938156debf6f146570", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843859, "uuid": "aa9278bb-1fa5-4535-9a67-1e5d35fc29c4", "value": "T1EFA3CFA190A02DE1C1694B3470F1B93D53739D1B78172FB2B642866D184BFC8787B3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843859, "uuid": "84254caa-4263-435a-be9f-4f734e0a6ac8", "value": "1536:YCaNh/aXvRG9DRO9WRG5ttBk8lwssTZae808oUL7DLnBidh4SrC77ppvQ5:HiSX5g9O9WRG5ttdeZaeZ0DLnBgh4Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843859, "uuid": "245f33f7-54f6-441d-b2e8-36e5a1c78096", "value": 99504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843859, "uuid": "890f62ae-c793-47a0-aafe-7c3ff954ecb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843859, "uuid": "898d0aaa-47d9-47b1-995c-a10bafe17580", "value": "Ares.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f39131-7e44-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783896732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783896732, "uuid": "b2563b44-0891-4f07-816e-145c3055a88a", "comment": "Malware payload", "value": "197846dd206377ebdfb1519989a59d82", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783896732, "uuid": "b33c134e-6b3d-4a34-841f-a2451c814a52", "comment": "Malware payload", "value": "46d64d84eb8912ec9248b62150fa80820a40d7bcff676e068327b8acae90d6a0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783896732, "uuid": "1d433082-427f-4006-9c3c-bf502db7c86e", "comment": "Malware payload", "value": "47dab623d1b32009c813b72ce2e46cac8b374834", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783896732, "uuid": "75bfb536-070d-4b46-9db3-ce60c02d0051", "comment": "Malware payload", "value": "ba0885d03a49f29788c1fa9a9bad222fd5eff4719c546191fb56166c22673ac4ad7e2bdcb40b112085dcd7139e9d486f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783896732, "uuid": "2db3701b-0176-42ac-b311-3d6114bb97ef", "value": "T170E633195AE405F9E6F3813CEED263D9E5C4B4794B36CADF0B9843B1AD272D0483D226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783896732, "uuid": "aba856f3-0a21-4570-acdf-5554c15d4c0d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783896732, "uuid": "1d206282-9ab5-40db-8e91-59f5d780df02", "value": "393216:5gAhKu/WpN/x5+FYKV+zxVYXMCHWUjXAcuI3/PGTAI:5gbpNpAJVqYXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783896732, "uuid": "677ba8df-84c0-4746-b1fd-88afa0ab9fb0", "value": 14298628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783896732, "uuid": "8cf7525e-3623-4aff-a951-377223fe1e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783896732, "uuid": "2f506787-ca5f-4ce2-8f58-808a5ef0e1d7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88f25ab-7dbe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783839405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839405, "uuid": "22f848bc-f066-4d16-b7e2-5a1eac9fc3af", "comment": "Malware payload (Mirai)", "value": "139d4ad926eb22146f0bf02a535182a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839405, "uuid": "8e92a23c-d532-4a33-a9b5-ad21508f90fb", "comment": "Malware payload (Mirai)", "value": "475bb3556cb1168275bb79d42656d15644a28f9620de4a22a261b23396990dc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839405, "uuid": "5ccd2922-01c6-46da-93e2-a6cee3e97a43", "comment": "Malware payload (Mirai)", "value": "f7c47ca93f76a8ca04d4412e4ff648f5056473e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839405, "uuid": "a1926911-f9c5-4bb8-92c6-07fcf7f08788", "comment": "Malware payload (Mirai)", "value": "af5ec43c2a0b05460d4dffc2305ff272adbc62f137e148acca363621101470fcc0dedb3928687a6e2834a3d67da006cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839405, "uuid": "3bf03f82-2bac-4132-8451-2bbc438d390b", "value": "T11403F18DF7B87D4ACBBC5A7FE1FB12A054353195366B834D83821CD8E228E2DB04D464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839405, "uuid": "3cd4c2d0-6622-4e2b-a2be-c4c3778fe8aa", "value": "768:xJnqNbxc9TU68DU0Ud8Z1pI6gKkNAWYWX:7qNbxWtq8WZ13kNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839405, "uuid": "0aa6d588-04ee-4381-9fcb-1736bbb0188f", "value": 38248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839405, "uuid": "d141ffd0-a1c4-42ec-830b-6f2e9ad6c895", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839405, "uuid": "e4b9eef2-b2fa-4d98-b218-4a29581c2ad3", "value": "XDmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e055de-7d8d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783818088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818088, "uuid": "80c180fa-4e59-4e40-a50c-b9af7d4ce931", "comment": "Malware payload (Mirai)", "value": "a7595e0c1024f929415cc0aa459c7b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818088, "uuid": "5d7fa881-8ff3-423a-b1f8-9359253ac330", "comment": "Malware payload (Mirai)", "value": "47e557f9048a3cc5adb4e4611a165550aa2d087ca9d02b3cb38e285edc4440d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818088, "uuid": "6110b5f0-f3f1-4afc-80dc-e3fb89e3f3cd", "comment": "Malware payload (Mirai)", "value": "cf109c1ad86369fc1d62c8ca0445a7330a40bd18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818088, "uuid": "f9b22650-24e7-42d2-bd06-00f90636db96", "comment": "Malware payload (Mirai)", "value": "9eee81518135a95264708f912e1763a6bd74a8376f6dffb8dcded8d127cb1c1e29e30d578c57af407205633e678bee6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818088, "uuid": "971963d4-808a-4aeb-bff9-6eb2002534f2", "value": "T120A42959EC409B51DAD16ABFFF1E824A73131F78F2EE72129D155B2063CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818088, "uuid": "867133ad-79d1-4358-8a9d-9bf7c15f58ad", "value": "12288:o0jiv/CGwKMk71h4cQs4789kMnm0Lg4gRsasJ5IjPwr5Ex:oHC6bJmUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783818088, "uuid": "e5c89622-fc68-4fed-bb7f-407d65b2eca4", "value": 485116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783818088, "uuid": "ff79424e-7ef6-4e84-9741-ee3f8b8808be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818088, "uuid": "93f46c94-bc10-46aa-aedb-4b35b8826e17", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667258a3-7e3a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783892471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892471, "uuid": "94735692-2ce0-40b0-a12b-547f945c318d", "comment": "Malware payload", "value": "262031a1644860ef950f4ccae6984846", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892471, "uuid": "98de2335-535d-4947-b842-bf2e39527527", "comment": "Malware payload", "value": "4820ca1776bc4bb9431e8bda45424ceb7dc1c97d52bc3a513605c4889fb3a673", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892471, "uuid": "dd1f0914-0e47-49df-9679-9a1db7eef159", "comment": "Malware payload", "value": "f9ae6100f2dfdb352bcdeb48092745e284e3d853", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892471, "uuid": "e36e42da-e63d-4047-a6e3-fe81834af494", "comment": "Malware payload", "value": "1e1b183fac2a7bed0eee2542746cb28ca4f1cbb91a2272b8ddd5aedeb238070098b45125981f66d523c0bdcdf475c3f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892471, "uuid": "acf9414f-f713-416a-895b-a2cadcfb67d7", "value": "T12411BACF0211C708D897E674B1A7D854A56FE9A022860F4BAAE5B836E54FCA1700AF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892471, "uuid": "47c781a6-30d2-471b-af03-e0f79724b895", "value": "24:IGJNJx+k5JPJB+gJBPMgJBvRJNNvJd5JLJz/Jm3gJow+YJob+BJoe+yJoZ+E:RJNJUk5JPJNJKgJPJLJd5JLJz/JFJXvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892471, "uuid": "fec98848-c9cd-4512-b55a-d453dd5d3ae1", "value": 1063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892471, "uuid": "d69a22c8-899f-4d4f-8e39-7419e9e8944f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892471, "uuid": "592149b7-0913-4b37-a2d7-8c5c757e4c77", "value": "aypapo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb34fbe-7dce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783846338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846338, "uuid": "a59113e2-8e8c-4312-aba0-0b4a6693ebc6", "comment": "Malware payload (Efimer)", "value": "4edd87be0300419dc61831648e2652b1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846338, "uuid": "d4c9355f-99bb-41c8-890b-cb0ffb94f198", "comment": "Malware payload (Efimer)", "value": "4838fb320b77ab6328989f7ead963b76fb3227c0b8769a56486f6b2663fa9774", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846338, "uuid": "e35974f7-a1d4-4bb3-98df-174ad682a5f0", "comment": "Malware payload (Efimer)", "value": "220629335e8d076c4fc5b10c248cc8400b1dccba", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846338, "uuid": "d98cd515-0a38-4bb0-9a4f-ff764fcd62fd", "comment": "Malware payload (Efimer)", "value": "6cb072906d56d2f153d733273660765493da4781cdf2dd301835681d1666097353eb2825e700b49f2d1374177fa9ba98", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846338, "uuid": "4ff1e847-b51e-4c8f-85f7-b21a3246eef5", "value": "T1B3E6332C25F113FED6634238AED161A1E4AD30641B32CEDF4F94C391AEA71E0993D667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846338, "uuid": "6fa26626-bfb1-4e17-9e02-e159b65a8520", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846338, "uuid": "0509258c-ba2f-4e6e-b8ae-efca6307c733", "value": "393216:ByspNvRu6zZqpT1yWNN1KXMCHWUjXxcuI3/PGTAI:BysPvJyThKXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783846338, "uuid": "0fe97f41-cdfb-44bb-8adc-e12bd7b7b1a9", "value": 14319205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783846338, "uuid": "a713da56-e303-4f33-ad78-f4111ca989a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846338, "uuid": "d47ff6a9-d971-4e37-9f67-1d8fe9cb89aa", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a76f64-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892141, "uuid": "0ca63bd2-962b-4fac-9d54-9dfaa885b4f6", "comment": "Malware payload (Mirai)", "value": "3cd1427b73dff5a2d22ea729e645751a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892141, "uuid": "932167ef-532f-4345-8afe-f3b892fbfe1b", "comment": "Malware payload (Mirai)", "value": "49c9517333340e28b52dadfebc89e7b14237af404e57115b8bb376e3a4a663ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892141, "uuid": "4e703e23-e4d0-4c38-ae8f-2f33b3271aff", "comment": "Malware payload (Mirai)", "value": "d17d5475c5c14afbb1d3b4b9d0d47e71d18fbe28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892141, "uuid": "c76d661b-140b-43fe-850b-b06efbb05743", "comment": "Malware payload (Mirai)", "value": "e02c8a802284da6f900189f7ac1662228fc1fc1989889c9e73613b96e02aa6062126ffc2fc6692f6951506b5ca08c885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892141, "uuid": "8397ce78-654e-48fb-a460-bd41dd1598cd", "value": "T139B3AEEFF34B1491D86187F017C39BEE3E6322119E6B95E77C0E263A19761DB090A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892141, "uuid": "584297e1-e019-4b65-bcd4-2ecfbe2c9195", "value": "1536:4BL+VT0QJGaWYT/0nWNp3qZWSY+BP5w+gx/LW0:6ADGaNzYWLqZ9Y+Bi+gxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892141, "uuid": "9a7c454a-c3c3-46d5-8ef5-3467d42e3638", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892141, "uuid": "3c557794-5421-478a-90a4-3dcc79b1dc89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892141, "uuid": "5d369ab3-2738-4263-bd6a-aab824f0eeab", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a13aff-7df0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783860737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860737, "uuid": "8a72b1c6-53d4-4693-accf-1ee0a78f6987", "comment": "Malware payload (Efimer)", "value": "5347aeeb19c629876be0c9c93691ac74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860737, "uuid": "1ba9614a-c864-4996-b644-c560f9919d44", "comment": "Malware payload (Efimer)", "value": "4baf23fdd336fe3f1b17af33f37af21809b56792d0a9433b4c4250a2ce7ff13d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860737, "uuid": "4bd5c0ca-64df-47c7-9ef8-98e23f1a896b", "comment": "Malware payload (Efimer)", "value": "e1b3febd73e4aded17533e134596986a68273c9d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860737, "uuid": "b8882a67-5f36-4603-a176-b65f72d169ea", "comment": "Malware payload (Efimer)", "value": "063811b89f4b6e550ee9b5c768469ad4c0162661141a3ad9d53a96d8c5f2421cf333612c6cdb95d406ef5b64f7e7a8d6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860737, "uuid": "917f5406-8ffd-4d6a-956a-208f8732c563", "value": "T153E6334C36E156EAE6E3003CE8B26661E579B0B94732CA9F072887B17C571F19D3E613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860737, "uuid": "3dabb530-8fe4-4388-8426-70d9ac53eae2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860737, "uuid": "e2fa1309-a483-40ba-bc98-25c299052d04", "value": "393216:uaDEy+nQU7nkHbo2KamsF0DQ+AwXMCHWUjXlcuI3/PGTAI:uEEyZi/saDZXXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783860737, "uuid": "9a1bcd96-93df-41c7-a4e0-bfe6069c4fdd", "value": 14295924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783860737, "uuid": "9d3601da-9cbc-428d-bcca-9bd24cf8f724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860737, "uuid": "386ed857-afef-4be3-b9c8-1ac578a8b50c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373f1aa2-7dbe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783839134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839134, "uuid": "c8ee385a-a0b0-4a21-8f53-41373aa17c47", "comment": "Malware payload (Efimer)", "value": "15a80847ae91234fe33698bc7a406e3f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839134, "uuid": "de4e3e8f-7d51-4f7c-87c9-c7e425c5b095", "comment": "Malware payload (Efimer)", "value": "4bb84a6c841435f1110ecedec3158328647706635d8da1bae24985e8acc7b12d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839134, "uuid": "341fde16-ad3d-4f0a-922f-23659eb3203f", "comment": "Malware payload (Efimer)", "value": "e1db12a77c0c4a4adf7de927d940eab68cdf5fc0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839134, "uuid": "873ccefa-3e97-4c8c-8ce9-612a8c226687", "comment": "Malware payload (Efimer)", "value": "b2f165e00f82a0907b0d7deb014788712c617af7c81b28bda2c4c8a1fdc64007b5f111385fdab31e3b6db60a796c8f66", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839134, "uuid": "6c86bad7-008d-4af2-9ff2-db25fb2860d4", "value": "T112E633886AE802BDE8B3513CDDF5C29AD16974760771C6EF0BDC86A11DD71E28C3A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839134, "uuid": "0a001105-7d03-48ed-9d07-8a8017c24bc1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839134, "uuid": "1c71907f-36b9-4ea0-ad67-3cc0e353a298", "value": "393216:aOF1OluOBbBe1hCWUIF2pjcXMCHWUjXTBcuI3/PGTAI:aOF1XUbBMhCWHwpjcXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839134, "uuid": "58968ec7-d8e5-4853-8436-54c92ce0a188", "value": 14290116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839134, "uuid": "0aaf1181-52b7-4c4a-abd2-eff83640f730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839134, "uuid": "f1f74124-c9c7-4ec2-bca1-5da97a75c187", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208fb9e4-7de8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783857135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857135, "uuid": "36a3144a-cb63-4c4d-b40b-7c44dbef5b75", "comment": "Malware payload (Efimer)", "value": "e100a7cb1cce1b735c8b417085ad0e73", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857135, "uuid": "579423c0-7137-4e23-a6fd-a6dd58db49ca", "comment": "Malware payload (Efimer)", "value": "4c542af8bc52a8333680b8c5a715c0c6c019fc284275410ba066d6af7947d193", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857135, "uuid": "2a1ba137-9c88-4c98-9389-faad0a1765e4", "comment": "Malware payload (Efimer)", "value": "cc4a9064e2f144280fd816795031e32945f3887b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857135, "uuid": "6ab4c3e0-7c88-4ac7-aa27-3e2a39f451d7", "comment": "Malware payload (Efimer)", "value": "52afe1a8743b287263865c9681d5b5a924fc008d35254eeb4ef652e72b0bdc3d4542b786bc6954e462f4a132c0481b30", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857135, "uuid": "ab5f613f-4e13-45ca-901b-8958ebedaba0", "value": "T150E63304A3E044FDD6E3103CE9D18248D6A5B4B70B72C6DF5BE467952E0B1E24D3AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857135, "uuid": "69d8a0a2-8b10-43d1-9a44-155bf208a5fd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857135, "uuid": "621d5739-77bd-40eb-8267-c506f8df2c6e", "value": "393216:ygXMhisCqUNG2v+M9bXMCHWUjXrcuI3/PGTAI:ygGUh+M9bXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783857135, "uuid": "eb1d59bd-2d66-4219-a993-c471f109135a", "value": 14312985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783857135, "uuid": "ab85f5e5-3a0a-4896-ad6b-a306f96cd155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857135, "uuid": "869b8dd2-26df-4ed3-84d9-ec6e762c8384", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cac0852-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783841023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841023, "uuid": "f7c2b2b5-bc93-4e51-9f6b-2ffff0d6f117", "comment": "Malware payload (Vidar)", "value": "55ad3c515562be0c5b5bae109e0bc745", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841023, "uuid": "6a465ad3-9545-41c0-8b0d-e38bc1a75861", "comment": "Malware payload (Vidar)", "value": "4c958205aa4c56b148377b2bd984a7b3b6525bbc914cf8e5aaa34ce91f71d4cc", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841023, "uuid": "a4d605d8-e5ac-432c-a3e0-f68d2d9c39e3", "comment": "Malware payload (Vidar)", "value": "9024d7171e44331efc5cbeb580558deb47b1af4d", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841023, "uuid": "0f96834b-9ace-46e4-8e81-704daf6706f0", "comment": "Malware payload (Vidar)", "value": "e8dc85aa456eb31c050eda2f409379e73f63d6d42c2fe3fef512537d3d12f48993e0cbc48a95ac591cef3c2c3143e455", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841023, "uuid": "47bbdd19-9edc-4ebf-bbb1-c4e5458eff15", "value": "T179C633463B55B9FBCD50D23C4F1DF7F38AB0E6A128218BDB498A4D223E9764612478F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841023, "uuid": "e0f8f2d7-0bce-4ed0-a403-19471145caaa", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841023, "uuid": "cc80fc34-6fa0-4a0d-989e-37cc893d960f", "value": "196608:+pvWnuS9X6aeGBq43Xp4K9spg1GMSstK8S2JEK8XQlsps5eRXg:+piL9KaNBjXpOmUcJEK/lsOei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783841023, "uuid": "c8dca53d-79ef-4713-b44d-6f3bd09d16e4", "value": 12097322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783841023, "uuid": "58b24d65-818d-444b-be9e-1ab3b4296409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841023, "uuid": "cff8d9c4-a603-49f4-a3ad-02446f1b49fb", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f4eec6-7dbf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783839777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839777, "uuid": "15e17487-b986-444a-a9c5-89084e6e3c3f", "comment": "Malware payload (Mirai)", "value": "7aea2a32f2416cc0ac6f912110842873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839777, "uuid": "362220d6-2c73-44c5-93c7-362472682af0", "comment": "Malware payload (Mirai)", "value": "4d352b855142d1a6e3d805ae3f82b16669953b1e8e50e84d96a14265554c508d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839777, "uuid": "59d37ac5-1ca9-4838-bfd4-eac4b9b7ac9f", "comment": "Malware payload (Mirai)", "value": "ffb28ed8fa371fd3cc3b6240b36711f98eecd77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839777, "uuid": "459312f3-f819-4f2b-a928-183798975bb6", "comment": "Malware payload (Mirai)", "value": "5d429c4debbc8c72691bed1f51d37ab2eb199d8e18226460c71348c8fed8c59edbdb20b69687a3831ac6d7ccc8b7c801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839777, "uuid": "8be15158-b7f5-4a50-9c4c-605d4e00206f", "value": "T1A3F2F156D0A54C86EBD48F7FAC55C79637C29ECD767A9AC068C43F402652827720BCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839777, "uuid": "8c6aa041-b968-4a79-9064-7e972d030edf", "value": "768:mDqjUfCQWwjqRm2783JoK4Nvk5w4Vli/dXOBi124uVcqgw095:mGjUfCQLjqRmG8lv5w4VcgB624u+qgwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839777, "uuid": "9eab9d9a-50b5-4493-af68-44ad95103132", "value": 34396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839777, "uuid": "b8477886-2949-40d1-bd30-8602e12c5351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839777, "uuid": "f8208e05-af68-4534-8204-4c242b5b11da", "value": "XDppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b1b011-7dd8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783850616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850616, "uuid": "02b8daf4-482c-4e80-ae9d-c0101b685e91", "comment": "Malware payload", "value": "6fd5af8ae0ec693f69ed0dac78004d33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850616, "uuid": "fbfc1e91-d3b7-48bb-8cf7-b3569e4e2d20", "comment": "Malware payload", "value": "4d4bcd8f5a41658e9248713b9dba906b6397312c4c74debe18759c445b3dc33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850616, "uuid": "c68694f2-ac30-41ed-a402-aa3a463250be", "comment": "Malware payload", "value": "80b841d9ee7d3cd7be236fd4caa34538aac57ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850616, "uuid": "2758ffaf-ee03-493e-bb56-d4fea3b157e8", "comment": "Malware payload", "value": "b6d98744b23f85d90cfeb854780b5f58f1e47d0b22e2f70533875e00fe26bc8c95291f3fe169c71386e218bcd08d3eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850616, "uuid": "33f6472a-e14c-4abf-85db-610be3caffc8", "value": "T16DB317E9B6D15CD9EA14423C02E7D232777CF9D086234B17A670B7321F12E903EDA65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850616, "uuid": "3a54001d-e391-4674-963c-ea4a5c59acf0", "value": "1320e3d8140146b7fa4d833db97d803e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850616, "uuid": "503c7cc6-3c05-4369-8d03-5ad78563a506", "value": "1536:sLAh1PJqafdws7IqMCSMoypJnU6PtEqTIm4gKN2POdapPPQAykGAeA/l:HVUsunqi+JbP3TKN/UPQAMAeAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783850616, "uuid": "3d34e6a4-9871-4f96-98b4-ace5a89a0430", "value": 110860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783850616, "uuid": "0879a225-cccf-42d3-85c2-a0c8e3899248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850616, "uuid": "d49e8ece-fb7a-486a-81d6-3966acc3e449", "value": "4d4bcd8f5a41658e9248713b9dba906b6397312c4c74debe18759c445b3dc33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc8a689-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843868, "uuid": "03f1d3be-ebb7-4bb3-a819-7c059c79ba07", "comment": "Malware payload (Mirai)", "value": "ed1ec5c7f2f1ffed598e4752eb5c2804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843868, "uuid": "97320940-00b2-4a7f-877c-72a2e6729ebf", "comment": "Malware payload (Mirai)", "value": "4d6d0c6408389fdf2831a5b6ab2434cc93d42316ee7430e652962eee4038a7c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843868, "uuid": "1019e8ac-b38c-4cb7-8ba5-7a0d265a7032", "comment": "Malware payload (Mirai)", "value": "b138ae36efdfdb3b803ef5e6eda06d319fba009d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843868, "uuid": "5f489588-72a9-4ae1-9702-8d07c227e4ba", "comment": "Malware payload (Mirai)", "value": "6467d756dc372fb90cc4f9996e1ecbf017114a7fe92aac91b8006cc73abfdd1c6596d19cc6ece182d19c37915affa1e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843868, "uuid": "fabceb0e-88cc-4c00-90e0-def4e2c55e54", "value": "T17F935B22B5391A3BC4E4947712F35326B2F6438A24B88B1F7D710E8EBF156D0264B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843868, "uuid": "38d419c4-12a2-4230-afa9-dc1458ac43fb", "value": "1536:0fOXV9Z7eL9FSVO8+P0QacM3KtHw8Ym5owAtQItt6B:04x2O6R9YOlW6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843868, "uuid": "8b64fdd4-ecc1-4d20-9eba-eba9ad5040ff", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843868, "uuid": "ac970271-e0bf-49cf-995a-999b0ddbe4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843868, "uuid": "ef8f4d27-38e4-442b-a3ff-bcbfee724cae", "value": "ar15.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e46d6c3-7def-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783860138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860138, "uuid": "5b5e9ead-11e6-4de4-b945-16ecb8c99bc4", "comment": "Malware payload", "value": "fbde6e59daebb2b0fdc23730ebff114a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860138, "uuid": "e0856f5d-688c-499a-bdb4-52eb617eb8bb", "comment": "Malware payload", "value": "4d74fa29ab5ab01f6f96d9a94a21c365aa3fd21de20164019e838d3d244fa8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860138, "uuid": "00aca63b-4e7a-4d18-9ee7-bf3e58b2644d", "comment": "Malware payload", "value": "bf4267dc17a0f927ff77db7ee5b8269707f1d26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860138, "uuid": "48c89a93-b493-4526-944d-6ea5db77326f", "comment": "Malware payload", "value": "27cd13cb716bfc7e36f194860dd173ccd2fbe149dcfa9fcf4817e99bb729d532739a969fd3d9c83e9e6456df367c2e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860138, "uuid": "824f134b-a719-48e6-9167-a4b3e3078f8b", "value": "T10E166B81B6228E3BFE4BD47CAC21F6B297765A66E3C221B710F081FA48B7941454D73D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860138, "uuid": "131c7e97-ab0f-4527-b659-c52ced2a62e7", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860138, "uuid": "a3278e53-d519-4dad-93bd-0900dbcfa188", "value": "24576:95o3vqRL8Zp09/xlHqzT3VPeBnLCl0lnK:oiC4/xlHqvl+RlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783860138, "uuid": "0cb3f667-5e2e-486b-9edb-4d7644e66dd6", "value": 4342104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783860138, "uuid": "61778ecf-6f4b-4cbf-8bc1-76271580a939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860138, "uuid": "6f2da1c7-97f8-4226-843d-7e3259211eac", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b750ca7-7e4b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783899862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899862, "uuid": "59128b3e-2d7f-4180-8056-a9e79a3b0b17", "comment": "Malware payload (Gh0stRAT)", "value": "8e3cc95612c9f5c531bd6b8eb004dd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899862, "uuid": "9a6f7476-594b-4aef-8a2f-6506d8744885", "comment": "Malware payload (Gh0stRAT)", "value": "4d9a77f6f96f6089a0690281a6b15e1285559c498741d6c1eabba534f3b98ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899862, "uuid": "6bd26f09-167e-4c16-8332-5f7ef5a3dbae", "comment": "Malware payload (Gh0stRAT)", "value": "434240e2a416f73ff8498f8bbc7597ac57599c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899862, "uuid": "332b4e24-a648-44fe-a5ef-523dd2940354", "comment": "Malware payload (Gh0stRAT)", "value": "372fb5f743e1d9a992bb64ecff314af13625870905af5e1a341d09a9ed473f366bf94d926debc702aff830357218a75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899862, "uuid": "d41ab90a-3488-4ff7-b9a0-0ba419b163bb", "value": "T13E573313F6CBA13DE05E4B321972E15144F376A1B633AE528BF8C8A8CF694901D7E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899862, "uuid": "c5a9dae3-6381-46a5-a90b-494d1e07162b", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899862, "uuid": "d322e342-3e19-457b-a6a4-57b7b900bd80", "value": "786432:3Pi66SkmiZmrrMpjrrM1pnUNOJYMYwk5IwFwo/BNO:3PBkmiErM9M/nUNOJYwk5vFw0Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783899862, "uuid": "2537e0c2-34b1-4919-b291-fcace9602a63", "value": 29177748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783899862, "uuid": "7680babd-6405-4527-a660-9087097c809c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899862, "uuid": "af131cd6-19ab-4d41-b7f2-a14d79a36a63", "value": "\u63a5\u7801\u540e\u53f0-3.0.1\uff08\u7535\u8111\u7aef\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab6aec4-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843892, "uuid": "486de963-fdbd-4e0e-a852-4f588f01286a", "comment": "Malware payload (Mirai)", "value": "4189806adafbd3fa0c573c5dc20388fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843892, "uuid": "532cf934-b86b-4f76-ba29-e28e563ddfe1", "comment": "Malware payload (Mirai)", "value": "4e6463d03e428cc263b20372b49a5c5894a09357c9d5b6970dba010e90da7662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843892, "uuid": "0e3c5d3d-3ea3-4ef3-80cc-d9d2345c653c", "comment": "Malware payload (Mirai)", "value": "bec98c844109b89ee8ed68c3581427c5e65fd8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843892, "uuid": "a09de94e-5fa8-4101-8da6-4d71d6d69dfa", "comment": "Malware payload (Mirai)", "value": "60bab6d0bc22d61568d5bb425c150d2a6aa4eae6777d21e546154124832236b75b8fc965c48eec70048bbeb0a08d05ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843892, "uuid": "82cf40e9-f1fd-439e-9305-50ff69cf0323", "value": "T11D13F1669B4FD534C47BA0B3A4540AE0DEBFB25ACC4D16BD08A4BD9ED9360685F01CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843892, "uuid": "7e31c2d3-66de-4056-9df8-c01ab3085a47", "value": "768:+201GjDlPCGZnkrbvw4/eFgS6lvUSfv5yPiZikli6kpXZrEEBx05L:+20wjDlaanG7tW2n5BU6k/EMAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843892, "uuid": "8db38ef5-d2c0-4ead-9fa5-348ed701a8e8", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843892, "uuid": "ef01938e-9b04-48af-bf44-8c4e4dfb132f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843892, "uuid": "e914bc0a-1b39-4aee-9007-53bf19e5fe5e", "value": "ar15.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52f0e51-7df8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783864337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783864337, "uuid": "268d460c-12e4-448e-9d98-d05b2b072832", "comment": "Malware payload (Efimer)", "value": "2d871eafa34e5437eeaa5c61d296a863", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783864337, "uuid": "756fba94-3f06-40af-816d-00219e2f9f4b", "comment": "Malware payload (Efimer)", "value": "4e768cccbab68a463ce0cda76dae71a2a1be0ebadf93f7f7d2ae950d4f944b08", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783864337, "uuid": "47e462e0-8c5a-450b-8663-2f2b3262c5ae", "comment": "Malware payload (Efimer)", "value": "dedcbeb179ac09d179d9b26a7b157cd58c27f34d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783864337, "uuid": "4858f70c-3c18-4c5a-8c9e-7b622bcb2fe5", "comment": "Malware payload (Efimer)", "value": "b7c8e45ba24dc9d4cc2972407adb26735df16d081e4a8d36751faea6db8a2e5f82416cb688a2c32487a496a536b44f04", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783864337, "uuid": "66acd751-af5a-4028-a2ea-f8851cef3120", "value": "T10BE6335C32E082FFDAA3013DDAD06491E835B8B50372C9EF0B9C97D51E631D58A3EA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783864337, "uuid": "7a97fb2d-9435-46df-9b7f-4b5e1338ce01", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783864337, "uuid": "4874fd31-c10a-45b1-9048-b9a6150f81ef", "value": "393216:tRZuQ/cM3lKcNZtpcHqXMCHWUjXZcuI3/PGTAI:tWQUM37tpTXMb8XuH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783864337, "uuid": "0c4a013e-2426-4905-b027-2e7e4d77fa71", "value": 14303926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783864337, "uuid": "0c998091-7cc4-495d-90f2-4a50a4dc60fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783864337, "uuid": "41a9c6bb-e3f9-4cb0-babd-f4fa27338660", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820543f1-7db4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783834965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834965, "uuid": "8be69592-5623-484b-b2f1-48c1ab39b886", "comment": "Malware payload (Mirai)", "value": "d5a73dba6f664b379c41b3ba975793e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834965, "uuid": "b6349da8-ddeb-4099-8de5-a75362eb871d", "comment": "Malware payload (Mirai)", "value": "4e984e6d85e918310954b0607ed63354c2385dcfe736c06bb8b4e80bf5b31a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834965, "uuid": "17d48845-6ac7-488a-aba6-306234bd5474", "comment": "Malware payload (Mirai)", "value": "be738f8ef3a7956a36ba1048e164950f511a7672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834965, "uuid": "fcd4d356-dd50-42b4-bb76-231711d8137a", "comment": "Malware payload (Mirai)", "value": "0e4ceee12f2e9fe133d627cf3cd8b2395a9b68d2a7d91c93bcb8823c48944b2cfc5d81b9578b33e185ad4dfde64926a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834965, "uuid": "78bcaba9-2e49-4ec6-84b1-977b25ce989b", "value": "T103E2E1AA27D25C75E7312439DD3EC486D6E3CBB5D0FAB415201C43A29B84805B677ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834965, "uuid": "b9f90272-c6b2-40bb-b8cf-bf64f6c2a846", "value": "768:5teBMu7r+jPqHnTWPA5TkFOHNAIL7cS6bwLdiJWs3UozA:5FVPSTb5xcSxxilzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783834965, "uuid": "0e3d48fa-c8fc-492a-8606-5425cbced86d", "value": 33892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783834965, "uuid": "085fe419-b113-432d-a987-480c9fe40628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834965, "uuid": "63517191-31a1-4f53-9335-86c62c4d212f", "value": "XDarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d980347-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844004, "uuid": "ce190ae0-b75e-47b7-9d98-7b895d4d6411", "comment": "Malware payload (Mirai)", "value": "b95a6cfdf98e316342b04ccc6e20954c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844004, "uuid": "a44742f5-2207-4226-bae3-0d0d9335d05d", "comment": "Malware payload (Mirai)", "value": "4ea48686b3d985f81b045eb90fbf00a24e527265837b1077ec410d6cd4e076c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844004, "uuid": "6e914d9f-833a-4999-84e5-80071b6088c8", "comment": "Malware payload (Mirai)", "value": "c1a86d0c1ef9a78b08a08d743faec5667215ed2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844004, "uuid": "c5e27896-e91e-490a-8374-eecf1fc4e959", "comment": "Malware payload (Mirai)", "value": "414ed1b055346b7003c54291d1ecf5d4e9d268eaf6b92dd298bef59cb355e4ae08cf0472813a456a4745b196fbc7eca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844004, "uuid": "7853648b-2e53-4607-89e5-31720d13c7ca", "value": "T17AB42A59EC819B91D6D12ABFFF2E824973131B78F3EE71129D155B2063CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844004, "uuid": "328ac06d-3f32-4be9-9923-9546c9613c3a", "value": "12288:kez3RJUQEyp1qghseFa9MvqsxwJEhZg7NoCa065/nUakDs6x:b3RhW1tyeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844004, "uuid": "07cef204-dd4a-4fda-8888-1f50c035b343", "value": 505608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844004, "uuid": "39e99040-b516-4895-9e19-d90af67cae75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844004, "uuid": "9d0fec58-5e97-42bd-a03e-8728e76feed9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba17934-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843893, "uuid": "66f05f50-f9a9-4623-8acc-877fdc1f02ad", "comment": "Malware payload (Mirai)", "value": "5d73fc2fb6341ec89b315de3fda52516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843893, "uuid": "a0ac63c9-6471-4532-ac42-52edd4a93d3e", "comment": "Malware payload (Mirai)", "value": "4f75efaa78238fa1d57714a69221e863f5ebbf6d5d0e28c07d6f9197b670e587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843893, "uuid": "5d212322-2d18-4a91-81d8-f953f1d0a165", "comment": "Malware payload (Mirai)", "value": "e810066b155a88c703b9ccd687107aaa79679557", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843893, "uuid": "d7cea601-c6ec-48dd-80ff-3d87064b3b99", "comment": "Malware payload (Mirai)", "value": "33f4c8616956bf0c9d7f8a8a9f38d682f9d96c98dec56accaac10015673a9f59d4159fc64b85f6cdc66b251a4da6303d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843893, "uuid": "0c183af9-eecd-4595-b6e7-236e9e021e93", "value": "T11643016C464298D2EE6E94B00F9202921D7015A75D139CC3616EF7CEDF8E95858F3ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843893, "uuid": "902d19e2-aec6-409d-8437-e36883071e2e", "value": "1536:52SDVYaBNGdtQobGdNNdXJd3mUcBk+BgE+XkgKvGVJuh:/DOUNGjQJd3dTcBk+d+VKvGVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843893, "uuid": "433deccc-4e60-4c16-876a-315dd04fc0e0", "value": 55328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843893, "uuid": "6ae459a2-010c-4ea9-87d7-1cacf561de23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843893, "uuid": "f5c3b781-eb5c-48f3-b166-bd8fb65c0dcf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc27ced-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823794, "uuid": "ff7b8c72-67f0-46ae-89c4-b5521708b2f5", "comment": "Malware payload (Mirai)", "value": "ebe8a3c3ff031c6f38f1aee6b11f4fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823794, "uuid": "7d147fd7-17e4-457c-b3de-5295e805107a", "comment": "Malware payload (Mirai)", "value": "50302d86e61e5e6cea8e71c74a4a3284334de374e41f6075485be16c7e45bc6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823794, "uuid": "251e78d7-318d-43ef-a906-8b1ff407830a", "comment": "Malware payload (Mirai)", "value": "2e6fc88bcd6777b803769e458f8b037898bcac49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823794, "uuid": "9fba2c0c-16fe-4418-915f-12277ac8d27e", "comment": "Malware payload (Mirai)", "value": "758cc04d5638aa4f905ee543a72bb0a30ec5fd19d56dcb98df6e9395f88e96c231cd106d49ed1f488ecc1b1a6dc987ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823794, "uuid": "0aa6bc37-428e-4752-a459-81ef03f5682c", "value": "T1FE33F153E6E90609D886D17B9DC3B8558488D35DCA4FE236E6683233F2DBB423D6D704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823794, "uuid": "68a672c7-1e87-4183-b3be-b082ec594dbc", "value": "768:iL8siXu4NuLxNDaOHf4mCmt+XKYgDhJpFCZPSXJ/MwnbcuyD7UDMuGP:Vul1NxfNC3XODhQZPUFnouy8DMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823794, "uuid": "a9d8d61a-a137-44a5-af19-aa8702c83f1a", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823794, "uuid": "5fcab992-476e-4275-8aae-f8f4e996b243", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823794, "uuid": "d79280a6-2734-40a7-b493-d9c2b3c17a71", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de3a7e3-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783820704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820704, "uuid": "c9e1ae22-70b7-4068-b462-e3216b836418", "comment": "Malware payload (NanoCore)", "value": "84aadf08ccddfa963b7e9a0ec0a83301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820704, "uuid": "306a5c13-a710-418c-bce3-9ba056df27ab", "comment": "Malware payload (NanoCore)", "value": "50c3831d8653c9d2f31e612a3c68e8f27fbe9e4b18274d5d6338b5ede0896834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820704, "uuid": "2d2a0d34-9140-4613-a167-7f598efdd755", "comment": "Malware payload (NanoCore)", "value": "01e85adef10443ce4e1a5264f8d0817141142de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820704, "uuid": "9fe66efc-59e7-4e0d-8ef9-27ff9c818c56", "comment": "Malware payload (NanoCore)", "value": "918a08c059e305adedad1202968e191972badc2e940c663d022e52be8835a8e390a96aabdf81cbe2f6799e2ad0381458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820704, "uuid": "86c9b214-f859-4ed7-81fb-b496d910b3b4", "value": "T16A14CF2677A84A2FE2DE85B9611211478378C2E3DCC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820704, "uuid": "8cf05809-e144-475b-85b2-c05e516c2ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820704, "uuid": "7838ec0d-949f-42e7-948f-dc6e3f83e7c4", "value": "6144:MLV6Bta6dtJmakIM5muvImfVqflRj0vkL:MLV6BtpmkjkGlt08L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820704, "uuid": "d71c5eaa-9471-40c1-9de2-2ca73529de00", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820704, "uuid": "9d5a88ce-78ee-4843-9272-4adb63ea48cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820704, "uuid": "ce7765be-d762-4f47-8f87-3070c61c6f36", "value": "cakhiatvwc02.info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4001a8a8-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843874, "uuid": "f9bfdbb9-74c0-4d3d-aefd-c15c7e861075", "comment": "Malware payload (Mirai)", "value": "069c3e3a886a51fbb04c7f46f080a5c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843874, "uuid": "d594bb9b-9035-4663-b69b-480bfa273a57", "comment": "Malware payload (Mirai)", "value": "50de9e27eedaac5c4ed887c196899adbd136b63e72a5bcfcf9d3f4ac0460454b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843874, "uuid": "4d774ce6-4ef8-4a64-918b-b1eda33d62f1", "comment": "Malware payload (Mirai)", "value": "1b17886478496e4bbb5877cf0e140b00481a932e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843874, "uuid": "4cb13f30-bdce-4ab4-a3a5-05f99907eff8", "comment": "Malware payload (Mirai)", "value": "32813ffef2563a74906d60c8a3ccefcaa7d532986106463d9e5e733c7a1034a540a14881eca541ae2d0cd525174be4c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843874, "uuid": "b4812847-c050-4848-b0d9-aede3e75d1e3", "value": "T1DB03F142C6D28A01D41FA03B69ECA75F0B0D570F1CA897436AC631E55DA0F5CEEAD29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843874, "uuid": "00eb6e5a-2e1a-48ec-9c31-a102bd984ec5", "value": "768:tliFAVUyruldzKaDNELJSGiImSfGnHuohLTpHkk0Du9ipJoVnbcuyD7UHQRjv:UAVUyrulaQGlmSoHuo5TZP04fnouy8HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843874, "uuid": "f5ae0f4c-3e76-4457-905d-aac08dea7d97", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843874, "uuid": "4aaa14fc-fd7c-472d-92f6-ea825fa583e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843874, "uuid": "16e6ef82-33e1-4046-914c-711e0d646b24", "value": "ar15.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea803b7-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "71a75fcd-90a0-425f-8eec-5dff867272f6", "comment": "Malware payload (RemusStealer)", "value": "21c69a56c0223a76ed12a8816c303bd5", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "f9980853-8731-48c8-bf58-3520a7a467f8", "comment": "Malware payload (RemusStealer)", "value": "523dd77b85d0b0cedc99ca23bc7225d4137b9e562a71a2d6d5e163e703680e2e", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "a7b9f0be-b5b3-4e4b-9571-3b4eca9cbd2a", "comment": "Malware payload (RemusStealer)", "value": "53179f70b061beb209430d34c89c01557bfb0bb2", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "12ecb73e-45a7-4b6f-879b-3dbd7e85b3cb", "comment": "Malware payload (RemusStealer)", "value": "9ff175f8e5acbe4d9a89f2bc662eae380754fe727b17231f9c6e62c844032ecf358cffe1c9b1c025dd8b6928003b961c", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "ba91e89c-3f9d-46ae-bbbc-00df70501681", "value": "T199C54907BDA149E9C09E923198B752A67B75BC080F3223EB2E9077782F72BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "dcee14ab-e8cc-4689-b4f8-605d46bd4843", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "7366ffe6-e7dc-4752-9a23-b20c58a48a50", "value": "49152:dOP+lTMeV21ELlcdhqTpGPtGtpBSbT8bC:dfNehq8IrSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840999, "uuid": "1de04d25-fce1-49fd-8e02-e0734a36cc43", "value": 2559864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840999, "uuid": "4379d302-7ef6-4f1b-a878-2eda015ba2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "6abd8d42-66f1-4d73-9c22-bb163cecce8d", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075908f4-7e12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783875132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875132, "uuid": "befaa59d-87c3-4c9c-9903-af1c5c41e31d", "comment": "Malware payload (Efimer)", "value": "6720084a960be77c3d9dfeb9eca8b7f6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875132, "uuid": "02866bff-c1c4-40fd-ac2c-8b8751f3404b", "comment": "Malware payload (Efimer)", "value": "53c73d310c69defa9564e052b6fa4e8db560499b4a4cc640de5a25672e393756", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875132, "uuid": "5fb61637-fd63-4f7f-91a7-070374641050", "comment": "Malware payload (Efimer)", "value": "49dba38e768905dafe49eeb78c44b498e3fe3457", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875132, "uuid": "407363e7-171e-4387-872b-b50459947e76", "comment": "Malware payload (Efimer)", "value": "7f5a2e368935cd8fbd2ddc73699298774f27c8aa0575ed4ea840a97dcd0160d168ea0cebb165f085ded3da861d45af9c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875132, "uuid": "e9c7ac72-4d45-4f20-b7bb-0c98f40b49c0", "value": "T177E6331DABE116F9DAB3807C9DA062A2E16578391772CDDF87A4C3A4BD131D0583CB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875132, "uuid": "9712afee-344f-4641-af02-802e76aecade", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875132, "uuid": "e5232d15-3248-4981-bcc7-f7b7676b5473", "value": "393216:FnvEcuMW0qCpSzuyXMCHWUjXUcuI3/PGTAI:Fvm0qeryXMb8XBH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783875132, "uuid": "08889e56-a24f-4d1d-a030-65b9f8387cc7", "value": 14312380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783875132, "uuid": "164c4fd7-65b9-4c64-aed0-4a139c044604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875132, "uuid": "8a6960e1-dc8c-458a-9eb9-8a3547027b8d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182ed995-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820614, "uuid": "3cd935cf-6ad4-411a-abc3-95f5a2a3b940", "comment": "Malware payload (Mirai)", "value": "426af863c7fb972b69a3b82b2ac96e92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820614, "uuid": "ed6a39a7-d8c7-4c32-91d0-5935192b19b9", "comment": "Malware payload (Mirai)", "value": "56182524f8086b409cfb3f149690218e5b4c94d3e7fadd95062cd7fd2c125b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820614, "uuid": "f1430765-2837-40f4-9a0e-25f01966bdf4", "comment": "Malware payload (Mirai)", "value": "d500ea02d62cf8282f05b5dd837ef854460d7573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820614, "uuid": "2908fb21-5261-4553-a383-f7cae187f299", "comment": "Malware payload (Mirai)", "value": "2c1f8fab2d1967627a51fc5aa5d108861d425173fbffb36ea41dfdafc39e05fd39d1629f0a405ff90ac91c64558659d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820614, "uuid": "a7d9ba8b-ee90-433b-9b1c-13e45905527d", "value": "T1DE43F2A0E855E929AA331FB818408E8E6D1153F5E156B976B36D0F74B067A810EF92C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820614, "uuid": "f0841fce-4f6a-4a98-988e-ade0d5f0b065", "value": "1536:+cS0NqVfLRNwXetE/WxWTLHei7WG8zjP02i1:+cSsqVfNzE/WiLBx8PPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820614, "uuid": "0269d7ac-4a28-4cfb-b08f-e85aa29fca41", "value": 60480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820614, "uuid": "df68aa99-b431-4748-92b2-52afcf464775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820614, "uuid": "fa03b109-fa08-4b89-9330-157199988847", "value": "SecuriteInfo.com.Linux.Mirai.10589.6778.4375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ad7f2b-7e15-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783876525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783876525, "uuid": "ee4d2280-6984-4518-b425-d8ea3bdc7bce", "comment": "Malware payload (WannaCry)", "value": "3e5a5494bdce4ff61cdff657c036a5d9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783876525, "uuid": "fec5abc9-dc94-4aca-b655-51a968c71f5d", "comment": "Malware payload (WannaCry)", "value": "5692850ff8e528dbbee878372e79906868593f4d67f7cb854f64401b9e140134", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783876525, "uuid": "6688ba51-3180-40e8-9a87-32f909237526", "comment": "Malware payload (WannaCry)", "value": "f9eebae3cfcff9fb23bd0871d006b07d0cb39714", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783876525, "uuid": "557af67f-90c0-44b3-8ef8-b5c8be0803c4", "comment": "Malware payload (WannaCry)", "value": "5abda7fe7beeb5bdcb683109eceb586293101b51b8e951e52a71d6ec95e546c2ea2711e176e2ec0986b8ac7d0e6c1119", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783876525, "uuid": "3fc2f092-4654-448c-8f57-55ad2ccdd1c5", "value": "T16936CF01D9E41B54D6B28BB6A97B8710537A7E848D57970E0358A02A1C33F1CDEE2FED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783876525, "uuid": "b704bdbd-ee44-4481-b49a-90df8b180861", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783876525, "uuid": "018004c5-1c74-42d4-b5c5-84ceb8e3e9c5", "value": "49152:jnBnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAx:DlDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783876525, "uuid": "3bd92d69-8c81-4b7a-ac1a-cb2f70279787", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783876525, "uuid": "1f6a43b5-c755-43d7-9d74-7e8a2717b5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783876525, "uuid": "417bb9d6-f44d-46df-b503-3b716db96299", "value": "5692850ff8e528dbbee878372e79906868593f4d67f7cb854f64401b9e140134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6600ee5f-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843937, "uuid": "b32922c6-c0d1-48b5-865d-f22335975ab0", "comment": "Malware payload (Mirai)", "value": "127a7861098fde8dc02a146db8fc7fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843937, "uuid": "943f1f07-c988-446e-b263-da281407ea58", "comment": "Malware payload (Mirai)", "value": "59758ae00950d4521134b0b64fe4af936d73fb0ab15952c790f64481415d1e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843937, "uuid": "1e33e697-4f0d-4438-93f4-23620799681f", "comment": "Malware payload (Mirai)", "value": "4bf2e7901a5d346a061a7fdc2af7bbb97002396a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843937, "uuid": "8aeb3e37-dd7d-42dc-80dd-66db7bb29623", "comment": "Malware payload (Mirai)", "value": "18605ee9efb7d9eb3c482b08edd501ab05c02f3faee3f8ad878b3693486ef4261b40ab55f068e529fa78851284071af1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843937, "uuid": "6922ceee-4fb3-43f0-852f-f3e34f459311", "value": "T118B3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843937, "uuid": "25058cc3-dd3a-4481-a6d6-c83e784b82eb", "value": "1536:CEkWi8LiZECcpHOWWJDmCn5Pd1Oe4SvbNJnsv3yk7+TeVedVPneQBZN0x+km:w4i50popHvhJnsz7+Te0dVPZ0x+km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843937, "uuid": "2284610a-9245-477d-99d4-bb83dea38cbd", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843937, "uuid": "23bdf8aa-1c66-40f4-aaa8-54c5223177a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843937, "uuid": "34d5fe80-9ce2-41b4-88b8-3033d3bb07d9", "value": "ar15.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394ab902-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843862, "uuid": "344ba252-513b-40df-a64a-cc0ef222d0fe", "comment": "Malware payload (Mirai)", "value": "0e23e1d0d8a101e855e49eea2db451a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843862, "uuid": "012f3667-a1dd-45ac-b8f6-1667c1cdad59", "comment": "Malware payload (Mirai)", "value": "599e66112d62a73a65adf7eac19254639a532131a08489ceb20132c30767ebd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843862, "uuid": "1eebdabd-ae17-46ab-a15d-fa9044f97f78", "comment": "Malware payload (Mirai)", "value": "5666366afcd487e287a70ae0fa849ed6f4254b65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843862, "uuid": "58a81119-5a1f-4022-bf39-3cec0c4bb103", "comment": "Malware payload (Mirai)", "value": "02fab5110f5d14cb6ed87384b597d5204841e978474f8a3226ef8676564339a3f4870aa9e14183f83f51d5d17007cec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843862, "uuid": "d735d45c-f5c1-4f91-9aec-f8101e8eb019", "value": "T194F2F2B5332FE630E8671176412E7AD4BFC7B51B7A46AA5B62DE603FD81418E7132320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843862, "uuid": "7ce40524-fc20-4846-9a8b-777c3dbf05d9", "value": "768:fn545tVQgVoGiNAXDFdvueqeaOvHXRZMD4tsx09i:vO5ZVoGiCJdDqedvHhZNici", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843862, "uuid": "6ef7c156-264f-4e90-a088-5765c5bea499", "value": 36224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843862, "uuid": "15926304-b68c-4521-a392-b4fca9f6b9b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843862, "uuid": "5da6681d-81ea-47cc-904a-91382b6f9f2d", "value": "XDx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef879b9c-7e3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783893131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893131, "uuid": "889331ce-d529-40a7-9472-bb91dc81aef8", "comment": "Malware payload", "value": "89a8f46c8196d1ff1a92c2f675b172df", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893131, "uuid": "0757c3bc-8bc1-4406-b5bc-facb7a28aed9", "comment": "Malware payload", "value": "5aa8a38b28fc275c9a72655b88b512f34a0f77e27e9ba40a105b6855d9fc2da4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893131, "uuid": "1e0a8937-b218-4fd1-8427-444f8ce7ccd5", "comment": "Malware payload", "value": "3b583c7d634ff04968b198dfec44e181bdd09a6f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893131, "uuid": "932b3736-b86e-4749-b8b8-78b79b8a2137", "comment": "Malware payload", "value": "1afb82d9a5dbfd5cb6e7c4c49d3331a4e65a6fffcba6d54fe21d6a187f11f851d6b8e805f9a51b878601bc8c81a9c2e2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893131, "uuid": "a6520ea5-408c-46d9-87cc-abcc73772d09", "value": "T193E6334CB5E106DFFDB3803ECEE16292E294B86A0371CA8B5B5043A65D673E14C3B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893131, "uuid": "9b609d83-3989-42b5-a3e3-a5348e8bdf4a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893131, "uuid": "77c212fc-d7cd-4bb8-8295-9a9a299f8e3e", "value": "393216:qb0fjSG41b/3xXMCHWUjXMcuI3/PGTAI:qUjsvxXMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783893131, "uuid": "b91bdfdf-1b7a-44b3-aa3f-0bd0f6cef757", "value": 14324538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783893131, "uuid": "12bdfba5-efda-448b-9ef8-f15651a8d79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893131, "uuid": "69ec45af-f317-42fb-a158-f3c58cf32f80", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af967bdb-7d9c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783824733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783824733, "uuid": "ded32902-f90d-4d67-b196-aa410c5becc4", "comment": "Malware payload (Efimer)", "value": "da5b9ae440090b076b7cea6b35d6fd5b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783824733, "uuid": "430fabf3-2ee7-4ed5-a02f-e00ea3a8909d", "comment": "Malware payload (Efimer)", "value": "5ac877f1702cfb39fdc4b8c4650fb4cffabfcff00757ea40c7860e6eae6f84d6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783824733, "uuid": "882a18a3-d02c-4ba7-afd5-5395af418732", "comment": "Malware payload (Efimer)", "value": "9a96f88a43bae446faacb26faf28477efcf93fbe", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783824733, "uuid": "d12e1ae2-c192-404d-8e08-6d82e9b702b2", "comment": "Malware payload (Efimer)", "value": "8d801914566d862367d7864e209b611f15da8132e3886668794621895fab80c77f8316295d52815c99cb1ea8c1c6ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783824733, "uuid": "5391125e-2d2c-492e-980c-ea16e943f4dd", "value": "T1CAE6336867D006FAE973803D9DC28590D6E9B81A1733CD9F5FA483A25E172E09D3C747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783824733, "uuid": "643a6104-8da4-4b8d-b1e1-ef859c012ec0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783824733, "uuid": "b4a7425d-5b55-4aa1-85b8-a2a38c53c0cc", "value": "393216:DQIxdwsuKSU/PNbhAXMCHWUjXGcuI3/PGTAI:DHBl/7AXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783824733, "uuid": "645fa780-ecd1-461c-9e63-0155863c08ba", "value": 14330951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783824733, "uuid": "bdc76b0f-e171-4ded-8f65-1f0d248d01f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783824733, "uuid": "6350bbd0-781c-463c-96ee-26379d6bf356", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2bdb90-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892191, "uuid": "98382d7f-b853-463a-a6d8-448513b1f7e2", "comment": "Malware payload (Mirai)", "value": "0d858d18d15b54eec99ed7ad33d664de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892191, "uuid": "a4d95db4-d6fa-4712-b494-8bb401f007a8", "comment": "Malware payload (Mirai)", "value": "5b7f993b896cc48cfba4893a7e8a67fc66e69fbafa341e3c1d3724b2aeb31916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892191, "uuid": "c6c95258-f259-48d8-8e59-87f1db596374", "comment": "Malware payload (Mirai)", "value": "2c625268d90b69dcc2c2d46f54259443354d9035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892191, "uuid": "61836489-3703-484f-8096-16b8cb412c1a", "comment": "Malware payload (Mirai)", "value": "2235e39930f3310bbca59983d38c73997efef93c86078903272ab4038abbae1b41b8ef4d61e55c1c2a29579e6a125ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892191, "uuid": "b20b9ed9-3802-4c46-aaa9-d936df484a37", "value": "T11DD32805730C0847D2673EB43B3F27D1D7AFDA8221A4EA05254FAA8E9172E731589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892191, "uuid": "0f334fd6-b561-4127-952c-918871e89a33", "value": "1536:XVh64FT17h1xpMBbijtnoRFvAPyx+MQOip8qEDppqxdcXVrtT:XpTlh1xSGBoUPn8NvJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892191, "uuid": "0dfc13b0-4dd8-48e6-8369-e09ba6e5e96c", "value": 139668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892191, "uuid": "19ba3ab2-05a4-4ef7-9a03-dcfa78ea1a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892191, "uuid": "3c6742b8-11d0-4e6b-920e-7675db7d2b29", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46fb328-7dc3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783841465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841465, "uuid": "226c2f67-e1ce-4b24-8097-c51c25c3e935", "comment": "Malware payload", "value": "0c95da57ec0d05c98073be1218710db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841465, "uuid": "ba22d25d-4170-49ea-9888-b44af2efda59", "comment": "Malware payload", "value": "5b8671c92e6c66edcb7878d963e34022adb02a45f497484335c214af42930dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841465, "uuid": "7670df33-90f0-4a38-a1b0-bb5ce0a579c4", "comment": "Malware payload", "value": "4678329a3e37f4f86d0c854b41da142c34a52623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783841465, "uuid": "e6cc2800-9fe8-456a-9fcd-be23c1670ede", "comment": "Malware payload", "value": "c7b4b8f139326e2eb1ec62b0f7d436844dcd33309fba4c95ab3b4dce1415749aa941de7c8059ec69ae7f06af06d0bc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841465, "uuid": "7a09db05-4d91-4c19-95e6-a6bcd7cb6575", "value": "T1CD08331C2D79C22ECA2FFBFD59031913B5C8AB6979371C179B58C6B872C1E92A036117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841465, "uuid": "9c5eb559-1241-4dc8-a2e1-990afedfe32c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841465, "uuid": "369a6ad7-f61f-4c2c-ba3a-3bd2f0154eb1", "value": "1572864:4t9IKPIKoIRWYC7n2Gbd+JraYfvHQuA8juyMzUsMF87Vj+0hcVtoBZS+7:4UKBoIRWbxczHQ8SV4e7Vyt/+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783841465, "uuid": "b8d70a8d-0365-460b-b369-236b99a0edd6", "value": 77503326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783841465, "uuid": "8d86eca7-10c5-46d9-ae21-e918911e0d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783841465, "uuid": "7b2b063c-80f6-4199-a2d4-545585c47df3", "value": "LockedGYM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd11b8-7e02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783868602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868602, "uuid": "410f1519-be13-4b31-b284-87e6c4c81b1d", "comment": "Malware payload (Vidar)", "value": "81af526997f7d172e433e765f2840b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868602, "uuid": "632f750f-79cf-4f19-9d3c-3d9e569980dd", "comment": "Malware payload (Vidar)", "value": "5bcc428f37655c7bc16110cc2127c510f66827a382cb1c9fa251b15a7d2c214b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868602, "uuid": "24572e10-f462-4f00-90d6-a116d4659056", "comment": "Malware payload (Vidar)", "value": "38c10e1de147a00dd57110a07d723da7be2cc5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868602, "uuid": "6a887275-0857-434e-8b25-cde2396ec125", "comment": "Malware payload (Vidar)", "value": "05c756bdaad554608893ae92332f3e7fd4d6ec2a46aada0b51552bd80ec9cd95703f706298303711b81c9141eb79ff0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868602, "uuid": "f8e1cd54-f8da-43fd-b8e5-8eb1dc7c96f9", "value": "T1C3F58C07BDA108F9C09EA23198B356967B75BC490B3223EB2E50B7782F7A7D05C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868602, "uuid": "5cc2371a-3762-4cbb-82c8-55434f29a9a1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868602, "uuid": "9a7ce41c-d206-4076-a8fb-6b8e74391635", "value": "49152:dVU+9ss1cJetFuARMQDX7WVnWqqxeg/DSByv1MFK8wemUT3y58aj:dWGRPanWt1DSEv1MFWeB7OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783868602, "uuid": "90366a97-5289-49d1-b444-3f737d633a45", "value": 3409272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783868602, "uuid": "5aba2cf0-104f-4b0a-8687-e53300826e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868602, "uuid": "e81d9b4c-5120-4cc5-a5bf-6e32e8b55274", "value": "69fae640e8174bdfa0056b685ae7e460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425a9752-7e34-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783889834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889834, "uuid": "8308037e-7c8a-45e3-91a9-872b9ccf0245", "comment": "Malware payload", "value": "e37b3d8780094609b9e378508bfb3ed1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889834, "uuid": "faa23d67-0164-43e4-9039-41d0a4c6a449", "comment": "Malware payload", "value": "5e815731f67cb070fb1b31272c45bd7f4ecd4a408cbbc68a9545bafc3292d72c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889834, "uuid": "006ccd4b-a7a7-47d3-8878-cf1d4d0a306f", "comment": "Malware payload", "value": "1916089385eb14eb255842b1cf7b0dd78fa57491", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889834, "uuid": "abf42398-98b9-40c3-83f1-72cb14a90ef5", "comment": "Malware payload", "value": "3ddf3af5f2c55b367bce95076d3d0ad212ddfcfa57394122d68cea555d861ef05d52b1262dda4a17143721b8198918f3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889834, "uuid": "d97efcfe-ac4e-40a3-a420-3b640dc335c7", "value": "T1DF948E0991D1BC3DCD69BEB39E456481A09D5F0F97EC84E9914A3387FBB3EA0C42C51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889834, "uuid": "4e27aeee-83ba-454e-9762-ae91a4fe2e15", "value": "6144:Vbr7L840yOanwmB9UJ22SoXvrDAvBMIhmYPy9MvOt+Nf5BmdMin:VTL84eHc9Q/rDAZMI169MvOqaMin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783889834, "uuid": "45dd2077-7a40-4cb3-a25b-ed62e467db9e", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783889834, "uuid": "d25fcf76-985b-4ca0-ad7b-094b80e21aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889834, "uuid": "f42e0684-c0de-45c4-a156-6623fbb22fa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd8580d-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892133, "uuid": "75a9702f-3c35-4556-a0d8-3e1fb7fb1b2e", "comment": "Malware payload (Mirai)", "value": "6c6f8164ae25f70af0cac5ad2de6b6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892133, "uuid": "31b580da-ece1-4790-a539-45c21ce44580", "comment": "Malware payload (Mirai)", "value": "5e9e0863515b6a21205f11969a6b8b4fb3ee67aa523f8db5665e38e734823206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892133, "uuid": "a2702ba7-f92c-4a39-b178-688109677436", "comment": "Malware payload (Mirai)", "value": "adbbc59013a28c0685160d1f5445d4d7c7aa560c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892133, "uuid": "68fe005f-d30a-4f66-b923-786456845656", "comment": "Malware payload (Mirai)", "value": "5b40794141dd88e4fa59ff8caec9094f629a5feb99ed88bd9cd6166ff417b928920ece1f7a58b3e632863bfaa8190d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892133, "uuid": "9e57452a-4909-4218-8ffe-a4df8f7a8a90", "value": "T1AB43024DEEF9AA88F85B2075C2E961B5394CB2E0307D09991711CD16B368E6F9E0CA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892133, "uuid": "216d1a3e-be5c-41be-bdd6-83fa6c4a1d1c", "value": "768:r0kckMkkTvXsXtUr78A4sK/p4faeyCDMZJfGB0iu6OSMRC477I9hBVrrtrcWc:erVTXsXtUrgEYkyAMZJeVOE48xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892133, "uuid": "df73dc7c-af08-4636-80e3-47332addbdec", "value": 56404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892133, "uuid": "afdaf94d-a0a0-4f15-b480-73a1a30aa5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892133, "uuid": "d317c9bb-a333-4ba4-a9ed-7d4187364fc7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8962b41f-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854734, "uuid": "bbceeb8d-4fbf-4b3d-bb48-e804c37fbdad", "comment": "Malware payload (SilentNet)", "value": "16fce34f04304ef2bc9701b806f94a84", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854734, "uuid": "e0ba59d1-5b65-4be0-bb37-5705d7f0013d", "comment": "Malware payload (SilentNet)", "value": "5eb33ed494f7dfb8c26d3d903dbc83f1e80228a2ad692146f3c7d677523fe527", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854734, "uuid": "deea2e85-c324-4430-ba21-a935451a2e86", "comment": "Malware payload (SilentNet)", "value": "28c3a4d01f3dc0a3e7273554d78d10bc58504332", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854734, "uuid": "b07804fe-ddd1-407d-a173-4cfc0659f405", "comment": "Malware payload (SilentNet)", "value": "cabb4acb245f223ec3ff483b20d5424695909cd5ffc5ba5a1cbda38b91616652a0e3f02f2adcc684c07be178bfd5d073", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854734, "uuid": "b7bd99c0-8458-4ac7-84b6-5f5b7a981605", "value": "T13983128EF1CA1496F512FE7912D417BEB61D6870208ED0F30772A988CBB446F62761D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854734, "uuid": "7703d543-8eb3-4a7c-9dc5-a800ffa9cfca", "value": "1536:wHaNYCN0WbqU8eOEjDRFq1TkGbUwpG+P+uUy/:nNYUbROEjFoumUq1PpUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854734, "uuid": "45ba30b2-0d2a-463c-9910-919a6354067d", "value": 88128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854734, "uuid": "a5c74e8b-6c03-4174-8401-9c8f42e69a6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854734, "uuid": "824114e2-266f-4860-98fd-08c362d7a106", "value": "mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2abde9e-7dd6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783849649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849649, "uuid": "cfa935bd-059a-4ae6-95c6-486d3508cb3d", "comment": "Malware payload (RemusStealer)", "value": "445b56bdc255b067039554e1a058bb31", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849649, "uuid": "535af577-1a50-4387-a56d-db54b540bdb5", "comment": "Malware payload (RemusStealer)", "value": "5eb378956ee84899b8ec8a59d0b9d5e95bef39cfce2acdfe72b032ea4e704227", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849649, "uuid": "46b1d1bd-08f4-4aa4-9ae4-672c882e8306", "comment": "Malware payload (RemusStealer)", "value": "7c309a43172fd0d0a2d6b983366ad432649f9e5d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849649, "uuid": "bde217db-dc8a-482a-a53e-d6f08caba3b7", "comment": "Malware payload (RemusStealer)", "value": "50eb281116a1e104e829094ebf71b8efcb06bf81c49cafc6274bc266dbe6da577c8ec054d2725e36372c608169abbb60", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849649, "uuid": "1e440f33-04cf-4c50-bc9b-3fac35ed73d3", "value": "T141C54907BDA149E9C09E923189B752A67B74BC090F3223DB2E80B7782F76BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849649, "uuid": "f1cb3755-a1e3-4055-947f-53d59a40048f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849649, "uuid": "45fa40ee-8001-44ce-8ceb-6c4569715609", "value": "49152:JpfKlgfYUgpoTBN6fhAqcKmrsIfFvP98PY:J8gN6fhRoFn9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783849649, "uuid": "6943cfd8-e830-45b6-9634-1c69787e8954", "value": 2545504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783849649, "uuid": "873ff559-89db-464a-ba17-88acc51f8f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849649, "uuid": "be8a23ab-66e0-4c95-ba8e-a827697a5a1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93faec35-7dce-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783846162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846162, "uuid": "f27a3b5b-93d7-46ad-84b3-9b50780d55eb", "comment": "Malware payload", "value": "af9b26cb61fa46583a3ae064f2e0a62f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846162, "uuid": "c02c2281-c5da-47f0-8a3d-7db31a87b5b2", "comment": "Malware payload", "value": "60b2f0aef375662d1fe65086687540aa9152178485fd7bbdece0fd9404c56ca1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846162, "uuid": "0fc7e1cf-8ce4-4a8d-879a-e136ec425d3a", "comment": "Malware payload", "value": "24aea564b60f2a6e44fb3625d74f7cde8e34e056", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846162, "uuid": "e35fb537-78c1-4398-a423-c7da0f42da29", "comment": "Malware payload", "value": "2f991207e60c5c3715cc5a813daf3527e9e9af085772fe42930869897d30ee66d49598aa1fb95851e9bbf65074e5a21a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846162, "uuid": "94a6266f-a2cb-44b6-9b8d-9e2a9b77623c", "value": "T11FC28D956A967C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846162, "uuid": "5c7fc778-1ca7-403a-a7c8-feef429d3456", "value": "768:7CXe8vCB+25j6es8R+9FYpMSUpi+20qUpi+20YQX:7Cu8l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783846162, "uuid": "c2dd9056-dd90-4eae-816e-10d8d0f98958", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783846162, "uuid": "0ec3fb1d-7e24-4160-8cd9-0ac5664f8e5e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846162, "uuid": "c89eff92-002f-4bfb-b7fb-d9afe034fd9c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599bcd33-7ddc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783852077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852077, "uuid": "930661c6-fd5a-4660-b6be-6ddd1c6de791", "comment": "Malware payload", "value": "0d93b8fbd3cbc240f2d28f518a4b6b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852077, "uuid": "b5dcd16a-33cc-4d42-82f1-282eac0b2f48", "comment": "Malware payload", "value": "61b0d52f5ee167f2a4ffd48fecc5b180da185ab6baca46d73404c91a89b19a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852077, "uuid": "097e2f09-97c7-40e4-9354-3b797da76a3b", "comment": "Malware payload", "value": "c8f5c3e19c9ce20078f0e324049b86ab6939f0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852077, "uuid": "6ca579a2-487f-4496-8d9a-d11d523b24b3", "comment": "Malware payload", "value": "d104eca535d12b33c7f38a4e00c403bd312f76634e822e409b6edfb2d1d8c4327b34ed4b2838f535d40ac9ff5ee8f750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852077, "uuid": "55d90a31-80d5-4a90-83d8-b43f1429a0d6", "value": "T1F2642351D5886C07F94168B6186B4E609332F6FC661FE736181DCCAD7C6126BFC02A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852077, "uuid": "c157960e-4ecb-41c4-96d3-dc1c720107d4", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852077, "uuid": "b58a7f78-1a5a-48d1-89be-123b2190e98c", "value": "6144:Yav/MCenFROjyKddpkyknuPwL9C2uVVL2AyUtjjd+LV/d+nq3BZ:nNenzInddKuPwLDuRyUxjdCxknq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783852077, "uuid": "b9c8334d-1fd7-4420-b70b-d06e3d8f6fea", "value": 318915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783852077, "uuid": "3eb4c74b-8a30-4add-9c7d-0654072b15b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852077, "uuid": "43e7a4c1-6bde-4c04-973d-170275f9580e", "value": "SecuriteInfo.com.W32.Agent.I.gen.Eldorado.23960.20699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4fa7d8-7dcd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783845751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845751, "uuid": "0bbdb742-7493-4f7a-b130-a450f47059c0", "comment": "Malware payload (Mirai)", "value": "a0bdc3ff5ac7acbd2e042e9ee9692824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845751, "uuid": "71356aa8-a0cf-43e7-b870-cd5ee5357ef3", "comment": "Malware payload (Mirai)", "value": "63bd3cd3f4815243b63271e4fa8eaf8248dcf8bf88d0e56bd7eb61f0ac255ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845751, "uuid": "e11b0608-e08c-41e7-b451-26bece0ae8a5", "comment": "Malware payload (Mirai)", "value": "93d28d7afab71211259e45c9597813495f0dad07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783845751, "uuid": "bb126ce5-2200-4c38-9e55-3b6977afccdc", "comment": "Malware payload (Mirai)", "value": "f60b82d90a4fcbe68ca7fb9afd049618086f1a50fbf159cd2e3de48da8758fe7df70a5c647e714a1dd10cc1cdbd242e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845751, "uuid": "e0230900-7bc3-4def-b147-9da3c88c9ea0", "value": "T10CF3D616EF602EF7D8EBCC3781B9870934CC655A22A82BB57534E424B65B54F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845751, "uuid": "d6b32e59-2494-40a4-8d8e-3fc8a153d74e", "value": "3072:7Q1x+O8Uy8DjStw/6bM2HyODUdXehPfNMqbBnbsx:sx8UHjStLHyODyehPTsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783845751, "uuid": "22aa6cd8-23f2-4995-8531-13a14329b669", "value": 159500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783845751, "uuid": "b1c8f2c3-7681-4aeb-b30b-53009b412c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783845751, "uuid": "eec3ff1a-6520-4362-a48c-26487d68d881", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5ac66c-7dd1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847305, "uuid": "01eaa5dd-c718-4998-83ea-b0aa7d975e0a", "comment": "Malware payload (Mirai)", "value": "335192aed4ab28a4197accf74b4950d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847305, "uuid": "ea29c7cd-e52f-4a9c-85c2-1e22bad51802", "comment": "Malware payload (Mirai)", "value": "65485e2a62e65d7af4b5eef78c98ee540cf4cd6e89591b5dbdad3f3179251b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847305, "uuid": "84fe2d1b-b8f5-46aa-be51-5da3426a55aa", "comment": "Malware payload (Mirai)", "value": "0042c8bf31064f71363cf0ee4bd570343a677633", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847305, "uuid": "dabb8a2a-0674-4152-8996-f86e794f01f0", "comment": "Malware payload (Mirai)", "value": "33e6087c64562a9761f7869d8ddf279917c54028f7a0b6e183f56f687aa3a3f575300b009cf7f9a8ee0e7c98d850563f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847305, "uuid": "ad5b4562-b1ad-49ae-a32e-2b26edccc14a", "value": "T17263F1C26B8E8E1ADD63897A066F0D8422B6799C6306C5C5D5E28C0AFBF7701708177E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847305, "uuid": "285fbdeb-e03c-4679-932f-5c4b7eacb926", "value": "1536:213IKgHWVr2K5N6icMFPT7gATQ0tL0b5nl/n7TSt0YPpEI:214ZH8v5bcI/h56h6NpEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847305, "uuid": "5b742d5c-f09d-4445-8941-9b6e5eb68e35", "value": 72120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847305, "uuid": "5ec3d6ed-7f2e-4ebb-b72c-5a65bc8c63b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847305, "uuid": "c40c6c1c-a137-4576-8fe9-bb45caf09b51", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0648bc-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823874, "uuid": "0613d21e-8df6-4e20-9fa2-a73559197398", "comment": "Malware payload (Mirai)", "value": "a1c5ee42de2466c1db34b90bb0486ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823874, "uuid": "45f73020-a065-4315-bd2e-c7ced7c7f946", "comment": "Malware payload (Mirai)", "value": "66d7509a1d19c4f6a25b5aec9f432e8423b3b123b6359b4d5be2cc52385b3842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823874, "uuid": "38e3ebe2-44b2-4114-a0c7-3237c3a6c57c", "comment": "Malware payload (Mirai)", "value": "8422c0d2720dd3609d4c5f2ce35260d0e74df5f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823874, "uuid": "881341bc-e9ea-41d0-b2bc-21e21f233b76", "comment": "Malware payload (Mirai)", "value": "124007bf465963ba8364e4d62edc23a1f060d58c7b48c8536a3af3702f619bbbd5702137ee6e95c5f68b0b6bb169d238", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823874, "uuid": "337ca76e-bad2-4df7-88a2-6eb5b4479dbd", "value": "T1ACF3294F7721CF21D71DC93149B38B9626F926512AD28889F35CDE083E6034DA86FEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823874, "uuid": "fbfba8d8-4268-4560-85ab-d37936ee8d2f", "value": "1536:76RyyCAgBSyxKhMgX7tREbwfsIWfDIZXIBJD9visEldjutsRGWgTtEf9KR95ElhE:GR6myivtWBqsylRGWK7o414EOm1Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823874, "uuid": "9219c487-774b-4724-a72b-5df32600bb01", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823874, "uuid": "69ca0223-7a42-4a80-af53-649b4fe55b6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823874, "uuid": "58de1698-41c6-4619-a8fb-177e672fa6a5", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df65c75c-7dc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842423, "uuid": "ee197a67-d6ff-4a2d-9fad-836c24be915b", "comment": "Malware payload (Mirai)", "value": "0ef8ed73d10cc2c5f58d35433fbef5cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842423, "uuid": "3e360b50-9da1-4664-95fb-8393b4479b9e", "comment": "Malware payload (Mirai)", "value": "673e31ed5a74715c776797745b627976c91c30af70645effdd82c4849ccd05ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842423, "uuid": "73be9a09-df24-4a76-bad8-4a194f6bfaad", "comment": "Malware payload (Mirai)", "value": "befc545a728b7864bacd495613a1b6b4c8438e5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842423, "uuid": "85bd88a1-7ac1-4b65-9fd1-ea485c200fa0", "comment": "Malware payload (Mirai)", "value": "0bdfe43f952d8ce7396aeceed3f5819a50c1c2d9748b548c27816f2f9e1c1f944c3e5c46564ebd6709a1485a4177f251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842423, "uuid": "a57c83a1-7485-4d6b-be54-56f0e397192e", "value": "T114831229135514EAD62681F1D3FD1B84AD591FA8CEE2EC157C12BC99EE333AD3CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842423, "uuid": "4c7c3566-de1d-4935-bdea-e00a706387cd", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBN6:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842423, "uuid": "69b2086a-b3a5-43fe-b949-0dbf54243338", "value": 84370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842423, "uuid": "29cab109-5428-4380-8f3d-1118992e00d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842423, "uuid": "a622bf98-f987-4be6-bb51-3ab1a3aec01b", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b15c47-7df3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783862021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862021, "uuid": "549380d8-7100-4408-adb3-18bd5e92b41d", "comment": "Malware payload", "value": "0c1080531788317d34e1ce957a5cae75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862021, "uuid": "839f6260-abb8-4d03-84ed-d9cca7da1da3", "comment": "Malware payload", "value": "6da91fe146bdda489c3b0b3abfc01558c9cd53a5dab7bfcf53c9ff0bf1ad3b46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862021, "uuid": "e69edb8c-31cf-4322-8da1-9459fae3a680", "comment": "Malware payload", "value": "08b060dbd390005a83aff98fcb9c56e10c353e92", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862021, "uuid": "356032b0-0134-41b5-9dc6-33cf9cc8b5b4", "comment": "Malware payload", "value": "c2aed3ba2bde85ad454f19664fff88340ff5811e442c45da105c8bfea20b31a25d52e091f32a47586eba7bce1a9ce28c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862021, "uuid": "d88eb88e-0eb6-42e1-9d7e-01de50e0e2af", "value": "T121C27D966A967C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862021, "uuid": "59961eca-955e-46df-9ff0-716e230f9beb", "value": "768:48vCB+25j6es8Rl9FYpMSUpi+20qUpi+20YQX:48l25JDd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783862021, "uuid": "7da73009-c840-40e5-a6a0-08a11f3954e5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783862021, "uuid": "ffca4f97-0bc9-4ab8-8169-739018a4158b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862021, "uuid": "63f97a80-6224-4c50-9f44-55f30518341f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18efef4e-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783820615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820615, "uuid": "4b84939d-ca5f-4141-ac1e-6d17e901a848", "comment": "Malware payload", "value": "f698bcd49baf834dabab461e232bc1ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820615, "uuid": "2763a28e-05e8-4b3d-931f-4039926ece9c", "comment": "Malware payload", "value": "6f90b696fe88bfccce71a3864cf1ca5fb68e92dd8b30e1745d2d7610ca427b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820615, "uuid": "32e23b46-a020-41c3-baee-6325610e7ca6", "comment": "Malware payload", "value": "328c0b61941e07cfafba5793e0fdf80ec1bbca7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820615, "uuid": "c5b14ed3-929e-49d2-a7a9-c0e96739d661", "comment": "Malware payload", "value": "75599dfedbc0c5a662c2af2cb0269e6284a2045959f57a9b0ea88e226215efe0631d460c75a6ed47d0d23f10ff0056fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820615, "uuid": "5b5fab28-e1f9-4a61-a6fc-5b63d89c7d4c", "value": "T1A852D160971CCE0BFF1575781D7E4DF17706C88C60A13E52A8C1A3D9031E8969EE6D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820615, "uuid": "df621dfd-7785-4374-a8b7-da75320eda16", "value": "192:G83RaiOtxjiVYXBZPNju8wR2c9ktPF/2Ru7bjn50k8AMY4jcXMNlnHVSFyAOBO2s:tOtxjiiXBNNjuFktt/PV9cPVRBuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820615, "uuid": "1564455a-d6fc-4d61-a1f5-330057f65f6c", "value": 14269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820615, "uuid": "a3b4d785-d044-4f46-a56d-228d6b81507e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820615, "uuid": "67677b77-37f8-46da-8e05-690c90fb67d0", "value": "SecuriteInfo.com.Linux.Siggen.13385.32702.11656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a82fd99-7e0d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783872990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872990, "uuid": "cd2a64d5-8bdc-42a1-959e-141164e73131", "comment": "Malware payload", "value": "8c9f112d226f70046e65739d85591e1d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872990, "uuid": "43f9f150-0425-49fb-b103-a28ab510b410", "comment": "Malware payload", "value": "7017d5d2fdca2dc8e2174ce18c2ead9746f1c366cdaf3570e0b688876a8994a4", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872990, "uuid": "92c748ed-94f0-4dd0-8f32-44af0b336365", "comment": "Malware payload", "value": "d6833263def67bb08ee612c143ddad4a442bb001", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783872990, "uuid": "fec5d060-81ac-4013-95cb-fae9a4463209", "comment": "Malware payload", "value": "d6ce82f288b8daee5d3b7c463effa88fa27d9aeaf5750a15503bcf10b3c849202efc893a5da0fe762455e4225e0ed6be", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872990, "uuid": "1a7c58d8-04be-4316-abf4-41503ef76a7e", "value": "T133D36B5B73E930F9E137917D84920A42E772B8764761ABEF43A046661F276D08D3FB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872990, "uuid": "ed5f604d-72e2-4ba0-a9bc-54a8ad18e27f", "value": "cf17a5d3cc4e1460b167658a47d42216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872990, "uuid": "e2e39072-c0f8-499c-98c0-2a8ea870ebd2", "value": "3072:yx+vcXTcTQxK0NEJijtQuiYkZJFsOa4GH4:yTeJ0lquiBwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783872990, "uuid": "eedacf7d-bb4e-48a9-b6b9-f1b403685057", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783872990, "uuid": "22f188d7-5814-4bd2-855c-f36b2070258c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783872990, "uuid": "b6d20de4-ae1a-43f5-b2ea-b767b887c2b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c02695-7d87-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783815488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783815488, "uuid": "e90cf8c2-d432-40fb-a6d8-b082346b8306", "comment": "Malware payload (Mirai)", "value": "60367a80f2a2e3112e2df0a85d577b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783815488, "uuid": "32b8a894-f0ab-45a4-b61b-726dbca2f284", "comment": "Malware payload (Mirai)", "value": "70d8a0bd683534586713936af02288e65c0ebb0fae26e357757f241b691c26f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783815488, "uuid": "737a0744-1e9d-4379-a710-4952e27f6dd1", "comment": "Malware payload (Mirai)", "value": "d4e1f67f94a00aabde339604517eda87db120859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783815488, "uuid": "cf0af05d-1ab3-4b1d-9f04-5a9e79900e7e", "comment": "Malware payload (Mirai)", "value": "f86d2809878a889f778c695869fd25fa9da3913b6853a6f5090d08e6c73d976f897e509a4acdf3336977d2420e5e0c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783815488, "uuid": "676d78b9-eb33-489f-9754-29f314bb3479", "value": "T122D38EC1E743E0F5E95206F1103BA7258BB6D43BA43AEB52D7A93D32EC625508B1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783815488, "uuid": "84c9e278-a7db-4185-9228-19f12e9a5a9a", "value": "3072:hRB/BmY4ImwNkDdOEKw8wb7zBvlpMZ8/M:hRB5mYWLDfTLeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783815488, "uuid": "8b54204e-98f9-4c8d-950c-8c0719bac5b5", "value": 130152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783815488, "uuid": "15cad141-fb80-41d8-ae3f-92b8a1e11795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783815488, "uuid": "38877b16-4355-4fb2-baa2-b9567b7c41e7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a913ed-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840952, "uuid": "e7cb3ebb-437f-40d1-a499-dc248a5b62cd", "comment": "Malware payload (RemusStealer)", "value": "06aeb8f255622dfce863917ca2aa1c5c", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840952, "uuid": "40d82520-1f2d-414f-b147-1c5bb8a3061e", "comment": "Malware payload (RemusStealer)", "value": "725700849bc04426ca22bdfcabfebde8612749058816e7cba8ceec442ee8848a", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840952, "uuid": "fc5812c4-eefe-41b5-ac5f-0fabb18de71b", "comment": "Malware payload (RemusStealer)", "value": "b06061c312d4779a885b8d1478e93ad48cfb861f", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840952, "uuid": "1b3f3a6b-f12f-4957-89ac-5a2e4f91b830", "comment": "Malware payload (RemusStealer)", "value": "e8be86d90977a21ff087286d29fa4762e12f16b62577be4e327f35b337200b1feaf1d58288ae839caa843e83801064bc", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840952, "uuid": "eaa31532-6ee7-47d7-ab66-f73111125c57", "value": "T181C54907BDA049E9C0AE923199B751967B75BC080F3223EB2E90B7782F72BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840952, "uuid": "f4ceb3be-ce76-4832-af1b-4a9353c22287", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840952, "uuid": "16c35853-eeb4-44db-bf62-3537ef615948", "value": "24576:45JQrBSLaTbmgduRNcDDqymkbaf4tjPoxKKmrdYvA2Bele5rK2y0HEhWxEe:45J6ByamgmqPqHkBjgQKmro8XU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840952, "uuid": "4b9ed5a0-79dd-4e92-842a-aba14ce1241c", "value": 2554736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840952, "uuid": "a66301e4-8a35-4505-a6f7-aeb7bd37dcd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840952, "uuid": "e7561489-cd7d-4af9-a778-1402489b85ab", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26822d1-7dec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783859205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859205, "uuid": "d0f94ae8-21e0-4d29-bea4-6822c8dd4c1b", "comment": "Malware payload (Mirai)", "value": "5cdeaff71749f656f93e22e623af274e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859205, "uuid": "ed2d31f6-3c28-4a52-a9c6-c048ae6fbed7", "comment": "Malware payload (Mirai)", "value": "7292d7a3ea2ce59bc63b0e52ff058d7b94bc22bdd7b07dc192f74b212e488b02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859205, "uuid": "52f45e53-a504-447e-a8d2-2353779b00e7", "comment": "Malware payload (Mirai)", "value": "6bae67fc11310ec93eb98715fe0e56929edae54e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859205, "uuid": "046bbc3d-bc3c-4f38-94d1-804bc8fd33d2", "comment": "Malware payload (Mirai)", "value": "70b43ebdd49733c667456def386170435d62fedbbf5e6782317e86ac894d31d98d63ed5170e5ef19b5941794c452a341", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859205, "uuid": "e080f4ca-e740-4396-836f-c65f8be09b34", "value": "T1E421D3ACB997A3D66FA8CE80F1A21655F10BE3C632724E6CFC0634746CEC544B631B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859205, "uuid": "e229f97b-cb3f-4d54-b40c-299ee42d7866", "value": "12:QvWXOp3dKU2hCUKAMzhKdqxwJJ6ev/KR0LK7klFaKS+6+AGN2/K+b0LK7+ylqHa1:QvQhBh9M0oyzVviIKYPFB6FipKb8F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783859205, "uuid": "8e0537d8-4e9b-43db-8f9f-7427ee080671", "value": 1237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783859205, "uuid": "f46f1712-bbdc-42c5-b132-b1edb6bc454d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859205, "uuid": "6be2f8cb-aed9-42ee-9282-4cdc9e399824", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0540a29b-7dd1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847211, "uuid": "189e6347-7c3d-4356-8d99-5fc1b41d0ec2", "comment": "Malware payload (Mirai)", "value": "399a906237dc21356c15633f7bca5174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847211, "uuid": "b9d15e24-6cc0-484d-b3ef-abe038376558", "comment": "Malware payload (Mirai)", "value": "729746f293685485ffd1fed6c2ac7d2f69ba8899b8d70f7624e1542cc4a7b04a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847211, "uuid": "d602c000-a1f0-4e43-940e-9ec4fc8ad9e4", "comment": "Malware payload (Mirai)", "value": "e422b22b2c7395e07d3ef21a2f5a1f95d1c6868b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847211, "uuid": "de1ded4e-18ba-473f-85eb-fb3663ed5ff0", "comment": "Malware payload (Mirai)", "value": "469a9796a19c27fa71f9e8d37548a10182863f60a1edcf814d666cf884c7e4575a7907277ba3609aa5e90ed2c8640e0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847211, "uuid": "96c9f389-aae6-4807-a5cf-f67aa560688e", "value": "T198E3D50E2E394F6DF37AC335C7F74E21A75573821AE1C649D26CFA121A2024D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847211, "uuid": "383e0a6b-f060-4f6d-b65a-2adc01588a7b", "value": "3072:+9VgTKmsRLru6kR3ACGZwpJ/+08TvFNM3Nn+JNmOYhDUseDQA/Qaw+qPA2Ob3eaO:+9VgTKmaSMnOj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847211, "uuid": "a0bf33d5-94ca-4337-95d7-618de468b791", "value": 156252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847211, "uuid": "5bfc3225-7d80-4139-b583-91577ffc69eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847211, "uuid": "01556cfb-4f35-45a5-822d-2ee66769fe29", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c249f37e-7e2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783887901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887901, "uuid": "08e565e8-1c03-4039-9b55-ac6e7ac6333b", "comment": "Malware payload", "value": "847ec30a4ff2391f1eb7669c22940e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887901, "uuid": "6fc092a7-d32f-49dc-8777-3763d5be1499", "comment": "Malware payload", "value": "735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887901, "uuid": "4b3f50e1-e313-49c4-9c4a-77ed12b4b335", "comment": "Malware payload", "value": "a86a42b83570dc9dbe993b4b5073cd8cd44ed768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887901, "uuid": "730129e0-bd77-4685-a6b7-ca02d7aeba53", "comment": "Malware payload", "value": "688f2d26f3603eb80fceeeea3b3be991a74dd95d36df78c421bdb6d7e2b591c3faeb2f9d8d44698de3a777639c524f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LightSpy", "colour": "#CFA1D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887901, "uuid": "42ed877a-f946-42db-b0e6-f3464297a45f", "value": "T15A969E5AB2A900E8E57BD078C6679707F771345603309AEB06E087692F37BE05A7F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887901, "uuid": "aacd83ae-3d0a-4624-b76c-567928fd06c2", "value": "ca0be1f0383ce1e68fdbecd6db87c064", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887901, "uuid": "bed249a9-a2b0-4af6-87fd-ca47a2c0a70e", "value": "98304:Oq9D7NJ1yT+K8KCGvffm+ZAKsSeq62QdFllwnRa5q5x:/9DP1yCKfCGvnmvZJvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783887901, "uuid": "dbc1b0fc-5ad4-4991-a0b2-843bd55a908f", "value": 8998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783887901, "uuid": "ea223082-85a5-45d5-a153-fa5f608ad874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887901, "uuid": "8f0ade6d-cdce-415b-b47a-a60f5f7c6312", "value": "v84czzz26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1349493-7dd0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847177, "uuid": "19adfe7e-274e-414d-8bdd-3b29b249b2f8", "comment": "Malware payload (Mirai)", "value": "c9555e3a2643d091f0b8a1d879aec309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847177, "uuid": "979cfd3a-c6e3-4f42-a53c-f53c76c393f0", "comment": "Malware payload (Mirai)", "value": "73a2c09d1ffe6a75554e823efd862849ce1c0a152757f121fe18f06db0e253ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847177, "uuid": "898a09c7-a302-480e-8218-85b0588c5cf1", "comment": "Malware payload (Mirai)", "value": "e971c9968e2f408544058425a1008ca06c8d1a2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847177, "uuid": "f4cbebb5-5b66-49d0-b435-44a480ef8845", "comment": "Malware payload (Mirai)", "value": "19c6ffe460383eda21bfc33e2d7f5affb1f3e35146201cd176124a105371cb38fabe460d3fd96d0784054495c198c725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847177, "uuid": "e451beea-b824-4b2e-83e3-abe5f116e6f6", "value": "T1EF63F1DF8B04D473D552F93A5770DA854622B4B632EC26A5DACCEE2C173A0441E4EA3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847177, "uuid": "c5800870-eabe-44a2-9d7c-694777c716ee", "value": "1536:Gs0rhVkubd4Al7LAqw7EOynJY+N1IEu5QxMfHXL:Gjbd5l/Aqw5ynJY+JuTf3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847177, "uuid": "65f7014b-bbcd-46c6-9152-5d9b46ea5c77", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847177, "uuid": "bb185041-111d-484e-86f8-6ad0f5e7b1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847177, "uuid": "1da08688-6c0d-4944-b865-2d2e32c86851", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4e0102-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892156, "uuid": "e87bf177-917b-4faf-99cd-ab1b465b7009", "comment": "Malware payload (Mirai)", "value": "f0278111f1512a47dad2b0d397c37558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892156, "uuid": "14820bcf-24b2-4f2c-ab17-d8f8e743599f", "comment": "Malware payload (Mirai)", "value": "7456bd8a1a137573b88dceaff30b45d6d3a771fde845f5ee76ef8ff07c8750b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892156, "uuid": "2c32b8ab-a73d-458a-80ab-99e37210041a", "comment": "Malware payload (Mirai)", "value": "efa913e30caa157eaa9b4d58714d6b651328c646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892156, "uuid": "40ccb4ea-dcd4-4705-b843-7ae7ff7554da", "comment": "Malware payload (Mirai)", "value": "33a613ef87f4c7e3c6ded96463be9b2c6a69779b9b1e49984ae1775830d95340887eb90fc434ca9c30e5e7b8964ff5b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892156, "uuid": "f6f9dc26-83b4-4152-aac6-c08ca30274e9", "value": "T10AA339C5FA83D1F5D81708346162BB3FCB31C9AA8066DA4ADF9A6F31CA37541C716368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892156, "uuid": "75d690be-b9e8-4d8d-bca8-58af8efb65e1", "value": "1536:jhQDIyL3UWM9Gzu4ZHr2v+1j9UxrB4lWDSmi8:jh2TAWM0zTr2v+1I4w2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892156, "uuid": "2dc12148-48ee-40c4-adf6-82b6fbb515a7", "value": 105992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892156, "uuid": "2006c7d5-4c05-4e75-a11a-277b90af59aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892156, "uuid": "021dc419-4125-498c-9852-7d6e890863c8", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6e0f35-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "6397e86e-b4ba-4ed4-841e-c55a31c7b231", "comment": "Malware payload (RemusStealer)", "value": "c9ffefe6123ad0c91544b2784e02f89d", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "1ffccd5a-7918-4c43-ad0a-145830a05a1f", "comment": "Malware payload (RemusStealer)", "value": "746a58853d9fe375f106cc126291b01b5c6dbd486c805ae8ede0c77066c9f830", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "a1f85d33-4201-4294-97f3-b55c942ef356", "comment": "Malware payload (RemusStealer)", "value": "89d7a8908764f029f79c16f824d931a96830f90e", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840999, "uuid": "41aeb063-2590-462f-b4d5-4927fa2f0905", "comment": "Malware payload (RemusStealer)", "value": "410d961b8b771986c300c402dc6fbea1bcd82e5ea8c136e70ceee6261efaa749c113f51aca83d483ece191d6e6e6168b", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "5797437d-99cd-4a23-9486-52b1b54d5c2f", "value": "T1E3C54907BDA149E9C09E923198B752A67B75BC080F3223EB2E90B7782F767C05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "28b8d77b-143e-487e-a578-05f4d6942e0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "3a8d96b7-1894-4669-bf58-647a835606a0", "value": "24576:Ly2dc2l0XKGw1LiEQTuACWz3SmmfaZ9JS+xSSgohhw0bG18w22vA2Bele5rK2y0O:Ly2C2CKpLm4czL9JSBohg8AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840999, "uuid": "69630ba7-174c-4000-b184-fdd32ad024c8", "value": 2557312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840999, "uuid": "4f916695-0818-47a9-bfb7-5069a1d2177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840999, "uuid": "4a6afc2a-f3d1-400b-a034-4a5e2a51ae26", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38658f59-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843861, "uuid": "d5eef0cf-f9ae-4c6b-bafa-148489f40e4b", "comment": "Malware payload (Mirai)", "value": "c3b574fd09be6565e56de28dee092383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843861, "uuid": "a3e813be-a4d8-4723-a81b-37e14f4a2460", "comment": "Malware payload (Mirai)", "value": "7479b14f9fe222c0e9917b50a9951a773330195bdc2da392e97eae3eb2e4ae12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843861, "uuid": "275e9e67-3fdf-41cb-9000-2dd03bf36070", "comment": "Malware payload (Mirai)", "value": "647d5cca72cd6b760b96366e1a8407af42977518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843861, "uuid": "aac4005f-298a-4a20-9905-869c88e1d15b", "comment": "Malware payload (Mirai)", "value": "26cc1e0ca9c17db04ebf5ad382323b46f646fc4f42bf7db4053f2d389a4ab9180751c601ade3476595b3b2e5273f2cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843861, "uuid": "e57389fe-1cbe-43ed-a919-d7715b7b9e6b", "value": "T15C13E1AE6F4461E8F77088FB06B44FF12C750BE5A853194B31E4D6C26D8B074B45664F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843861, "uuid": "d8cb3b8f-573e-4d0f-9827-9b438425e0d7", "value": "768:OqKYPJlO0J+8JoLm4eyNXidvduMTjw9RwC2M2Iihs9+xHcQaIl8IJgGlzDpbuR18:rjlDILm45NXidvdV/wzwC2NJ5HuKPVJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843861, "uuid": "b30eb3e8-1288-46b5-9283-eb5a25d3ef81", "value": 43320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843861, "uuid": "31110a31-9308-4272-a36a-e170fecdfc64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843861, "uuid": "6d8ef3d8-703f-4b71-9ebe-dbc42d5e62d2", "value": "ar15.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee61822-7dd2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847845, "uuid": "419c6e2f-ac9e-4574-af3d-8578c3003a64", "comment": "Malware payload (Mirai)", "value": "c69826fa00cb6761615838970d2d0bf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847845, "uuid": "d924dfe8-9bb5-4432-94a5-8e60ecd4539e", "comment": "Malware payload (Mirai)", "value": "74be485cd3ff6412f02a1cab0af46c2106e335d7dcf46679719bb6e6e966d20f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847845, "uuid": "dd286733-adf7-44e4-a19a-28325aa078e8", "comment": "Malware payload (Mirai)", "value": "b0a9ec7961b3378efe99ee7c85ca3ddb04ac06a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847845, "uuid": "c97fd650-afa1-4001-9462-40644359c5a0", "comment": "Malware payload (Mirai)", "value": "a58ea518ff5c8903d099a9071a3edd2e961b6d3b135a518f2b5c06bbb61c7c9a3c315d69dbdc7ffb0dce526739708257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847845, "uuid": "09ae917c-3b1f-47f7-b872-aca11e9705d0", "value": "T152D3078AF8819F21C5D612BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847845, "uuid": "076f2251-a6e5-45a7-9009-dad1c881880b", "value": "3072:g/SZ1M4OKa/14UAR4ube6LtimqMxaC6vAaOyGLAD4VkKJjjqZnbWK:g/SZKVR/KUAOuhLFxxaC6vAaOygArK9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847845, "uuid": "028d78bf-8c6e-4516-8cc0-c6f44033392b", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847845, "uuid": "9b97e687-1ebf-4de2-848c-018af4af6218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847845, "uuid": "7a4c7a4b-c895-47a6-9d61-916700b27bfb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5583b345-7db0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783833172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783833172, "uuid": "3e8d6af5-787f-47fd-865d-b95494e7dd46", "comment": "Malware payload", "value": "303295977a07e6d5cd7bcc4230690b86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783833172, "uuid": "16e73cb8-a096-4743-8265-7c5428307c08", "comment": "Malware payload", "value": "758f13bc264b65c8364a6d2f5cbac724ead2468f7756925bf1b296b39a2fbaba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783833172, "uuid": "eeadf812-1b8d-4d23-bf14-b1d121fbfd28", "comment": "Malware payload", "value": "cca43728faa3b9591c6d2f3bb4f24d76a9350d39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783833172, "uuid": "75514db9-9f71-4c4f-9f48-61dce7736829", "comment": "Malware payload", "value": "e28622400ebea156e6acbd64ae6b737e66ca19c68b4af0e3618ef5c013a4fed9124055026ad1e9f4143049e8ae7dc822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783833172, "uuid": "1b5f6e81-8521-4228-8591-9f2bd0c4b2ab", "value": "T1C0A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783833172, "uuid": "7bf9095b-a242-4cbe-944f-387dd2a5e4c1", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kpMEyId:fma7JLqHxcncWZViTH6xVRFORMEyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783833172, "uuid": "58448232-4cac-4679-8691-105d020dc087", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783833172, "uuid": "884f3791-9642-4739-b8a1-5075bc1c5af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783833172, "uuid": "99a08961-a8d9-467f-b4c9-a7fe0777964e", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eef8377-7e33-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783889533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889533, "uuid": "8fc28852-0a6b-4231-98df-2ff00c961c3c", "comment": "Malware payload", "value": "a29342094e578be147db37a920dfc3f1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889533, "uuid": "aea97ee2-8cec-4657-835e-5117c99fab52", "comment": "Malware payload", "value": "760e6e859327f3e3609445db2e0efae25f9aef7b2b8252de3961f135aa5014a4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889533, "uuid": "c779c775-33fb-4ca0-a5ec-62b4d2ca3d85", "comment": "Malware payload", "value": "0f6407cb957fd1b54dd3f0df585d059b8d2d892b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783889533, "uuid": "106165ec-2a07-4aa1-a6ad-b6002c3b04e7", "comment": "Malware payload", "value": "21d095f075ce6ab42053cfbd59abeaf61704a3651f2c2da80934640baf88d76b97b08f506e171fa1c21e82384c1212c6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889533, "uuid": "e0851e37-0608-42e6-b054-72862d11e9d5", "value": "T162E63328A5E201FEFAB31038DBA206D5F5A4B8B75731C94F079993A17E271E04D79363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889533, "uuid": "ebb553b3-f7fc-4e8f-ad2f-d413be3ce012", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889533, "uuid": "b1133126-a0d9-4a02-b9f7-3573b48f725d", "value": "393216:EQ+03e99RDKsx7CshIgZIjPPXMCHWUjXfcuI3/PGTAI:EVUSXDKsx28arPXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783889533, "uuid": "3a99ffa0-dbde-48e0-9ea1-59f2b400f52d", "value": 14309244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783889533, "uuid": "9d293c45-4a47-4f83-898e-cca9c05f9bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783889533, "uuid": "1a6868a6-96fa-4a65-8379-72f49e7133a2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c0239d-7d98-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783823053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823053, "uuid": "821eb7e6-cf0b-4601-8a5a-b52de77c478f", "comment": "Malware payload", "value": "4e34490ccfb4ee2b193eb197b273b202", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823053, "uuid": "4cdf10f7-de85-4adb-bb00-9815813c3c93", "comment": "Malware payload", "value": "766d88722c18c4722e1b3a28281133b0c88082a5f3b58d4c58391879ed20a643", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823053, "uuid": "af17f3b4-e581-4172-bd9a-38100bbc84a6", "comment": "Malware payload", "value": "de31fee2c26ecadfbf65cf5200b7b272089e220f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823053, "uuid": "ecb91c02-00e5-472e-9d9d-493f270a0e9a", "comment": "Malware payload", "value": "2fb26fb4255708babdeadcf5145704e1f4cb7119e8cbb6da2c1262260f820b363062c699f20ff21f36822381b69b9068", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823053, "uuid": "baba11a9-d73e-4d5c-8cc8-c4845c6cfcde", "value": "T10DC623EA26E481B4D0925630B68BC3A97481B90C45FC4E1E3DD76D02AB18CDF6549FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823053, "uuid": "c76bd3be-9f6e-4b05-8556-2313b1851f7a", "value": "35cdf706d9aa8edbc924bfbdab2dc355", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823053, "uuid": "64b1370e-9fa9-4625-9722-c467f5f949a6", "value": "196608:pk9Dof/oFOV40SUu9tkcmuPkoBHYyiEhRm4l8clhp1i2q50dSfxaEi3h:Sl2/oFObpugSHtiEK4lZhp1ixlgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823053, "uuid": "68b010ea-40d2-4c89-9fba-6a445fa63447", "value": 12022496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823053, "uuid": "274c1931-0d93-42fd-8f12-c3d4a1c681cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823053, "uuid": "d3c793c2-28fd-446d-a161-4713509b2e95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57774846-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843913, "uuid": "672796a7-ff14-4464-bbba-919aa228cbf6", "comment": "Malware payload (Mirai)", "value": "058b53e88be881c85fe319b81c530ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843913, "uuid": "bddaa7d8-8dc3-4894-80c7-9fed3f360dfd", "comment": "Malware payload (Mirai)", "value": "76b70bcb493883810becee24bee6d261fdd912e93d1acfddbd63c60f597d0183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843913, "uuid": "4cc690a3-038c-47dd-b815-f1e53906bba9", "comment": "Malware payload (Mirai)", "value": "2bb26c4a9d4cb077a640dd949f903e805b6f41da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843913, "uuid": "ef802853-1670-48d0-bdfa-227747a21d62", "comment": "Malware payload (Mirai)", "value": "c10594c3bbe1d6091568ce1c0f437b83fb279bf1b569b76ee3cebfaf250d503fb0b5f5227811521b2ce1f9010187a8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843913, "uuid": "71f58a9c-04b6-49e6-92d4-4f3882af0d4d", "value": "T1D16328C0BA8B80F5E91709714073F33FCB32E6294175DAAEDF59EF26DA27501A216249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843913, "uuid": "0cf4347a-da0f-4dbd-8806-8887c097886f", "value": "1536:DnuhiIMU+I1MS+TfrJa0tOIJSWfKWrSdushsPSaozKsB5XP:ruhBMUl1sfrJaEOsySSdusmqag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843913, "uuid": "9463e1a5-e9a8-421c-a9dc-80a5069067ea", "value": 67088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843913, "uuid": "63a02bcb-da80-4516-86ea-c359cb5b2ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843913, "uuid": "2b1425ee-c25b-4d8b-af5d-56eb3214a605", "value": "XDi686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a143ab5-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843917, "uuid": "6e8018ab-c447-4ff9-965f-25c56d9a01fb", "comment": "Malware payload (Mirai)", "value": "4b903f78557c05f57b18107134a3df9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843917, "uuid": "1aa15a5e-0a5e-4ed0-8525-3c198122c94d", "comment": "Malware payload (Mirai)", "value": "76ec56423a4b94269a392c8df085dabfa9e2bcedc10bd5afc188051bb8c13d07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843917, "uuid": "0998baea-27f0-4533-9c44-f0c2c5b4a22f", "comment": "Malware payload (Mirai)", "value": "f6f874de76956716deb1584bb26be9059f0507af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843917, "uuid": "4252dc64-d891-42db-b9d9-0a8151430efe", "comment": "Malware payload (Mirai)", "value": "74f75d3859bf9c3684f288d47e10338bf9141ebec248b024dd5b2e38872c3dbf90d3185cd7d39db133ca6ec853c0a300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843917, "uuid": "9cc6d808-8e69-401b-bb47-19290f2ac534", "value": "T1768329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E35DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843917, "uuid": "39bf5681-b16e-415e-96e4-306f412b26d4", "value": "1536:jInlZzkj+0cO4xoPEw6HMA+yneAoWFS6KjfTsv4gz9F7E9:jIlySh9is7HMAjnDc6KjfTc4D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843917, "uuid": "bf731983-5538-4cf4-bf65-db561f193ea4", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843917, "uuid": "aed1aceb-6e57-4d76-a790-735990b97cb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843917, "uuid": "cdef7121-ad4f-42a1-bc79-ec109685c6f3", "value": "ar15.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173aa9b5-7dec-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783858838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858838, "uuid": "4e5b7230-0e18-4659-a536-cb7e1e82e1dc", "comment": "Malware payload", "value": "d36cab6e0adf4e4e85263b43d997f6f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858838, "uuid": "4bfadd40-25ed-4cc7-9970-f2e99fc8742a", "comment": "Malware payload", "value": "77918051a743b1fc4eda4d92cfaae814a1a452c2d6797cd610cc28ac8503ad48", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858838, "uuid": "ab2f016f-f540-46f5-bc18-2f9ab97e9085", "comment": "Malware payload", "value": "f86e6d44ed70f6686705ca21cf3971955365c661", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858838, "uuid": "76d86044-3df2-40dd-90ba-4a457742f9c0", "comment": "Malware payload", "value": "e4b737fd587a278c2418b88145a47c4fd8cb9100b38939cc4a061676631c5ca3ab25c33dec954aeea6ef7c6453df7e78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858838, "uuid": "44fe56e8-4644-4c9a-9ae3-1002357da112", "value": "T152336C5516817C24EA99C9371D7F2F0CB8AD42E6320492DE7FCE3CF28C4AADDA119719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858838, "uuid": "c0e2e2d0-ba59-4587-a74e-22b833bd3bb2", "value": "768:lJFWzZx5b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:PkzGcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783858838, "uuid": "192264bc-dc3a-47dc-92a9-eb1016a2b243", "value": 50378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783858838, "uuid": "04cd00f0-fa61-4933-85e1-a9802cbedfad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858838, "uuid": "5091f27d-590c-4408-91c5-489672401412", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3061c8d-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823880, "uuid": "9a38a256-41c3-4753-989b-93197c97e8b3", "comment": "Malware payload (Mirai)", "value": "0603f6162bc0970c925752f9c7d338a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823880, "uuid": "5b831705-96e9-4aa4-8415-28c0b1aaeda1", "comment": "Malware payload (Mirai)", "value": "78d584e29cf2af465baa137c03d6644a8d8c269716349b03eddde76f3b9c88a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823880, "uuid": "bee39dac-2c07-43b4-8a99-7662b7875b10", "comment": "Malware payload (Mirai)", "value": "1e7f5d2ccc76208f117a834213c118bd05efdb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823880, "uuid": "5e693b5c-26b9-4b04-bf5b-870c85c95c61", "comment": "Malware payload (Mirai)", "value": "e665d26ef1c2c726aa490a2abe10dc6bd99079635b900f82801abaaa4b94dbb6109cb44e903946ae40bdb8e008555c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823880, "uuid": "2c40dc2d-4ff9-401c-93cc-dbd7ebf2181b", "value": "T13ED37D00BB184917D1921D745B3F0762D3BDD44368B8E109190BBB561732EFBAACBB9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823880, "uuid": "0f755574-f548-45ad-9544-5aab66fed618", "value": "3072:cBsu7X+0TZihY0U4YK46yhyo73hoI/eVA7CMA1D6cC:VKu0T+Y0dY56m3doI/eVA7BmWcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823880, "uuid": "bf68802c-200f-4df8-8802-01fb73a2507c", "value": 132408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823880, "uuid": "47c0ad52-d323-4a23-84a9-c0477a6f2188", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823880, "uuid": "9e4fea35-eed3-487e-9dfa-642f9a36aa7b", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1124ce-7dec-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783858958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858958, "uuid": "a1c1df7c-fce6-4a98-b603-5b1f0137ce3a", "comment": "Malware payload", "value": "2f93215309b2776296533373f7c6a23d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858958, "uuid": "a57b6172-c99b-4e6d-9610-bd4b6297d007", "comment": "Malware payload", "value": "791cdbdf8e0053d6aa3dbcf4f714b17f284ee81e95c88def8ae45ececd271596", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858958, "uuid": "088f5726-a85f-4a8c-8b82-216bad49cd01", "comment": "Malware payload", "value": "d0b09a568fc7f01e52c117664018e60eb464355b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858958, "uuid": "0929e490-c402-4945-97c8-2bc158595bb8", "comment": "Malware payload", "value": "6c467a259609b2b01563356531fd5034d21e0fcf7610f582e519b77d1f0a1375e257aa28eaeb0fdf5ddf1175bbbbe337", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858958, "uuid": "9d82c4b3-b98a-4f4e-aa3f-4cccdbfe1a52", "value": "T11DC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858958, "uuid": "f7644281-bfe1-414e-b7a2-50a7d9c87f3b", "value": "768:98vCB+25j6es8Ry9FYpMSUpi+20qUpi+20YQX:98l25JUd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783858958, "uuid": "f3d3a62e-872c-4766-9c97-295a80d7ee04", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783858958, "uuid": "3d2c6bd9-31e0-4b5b-b26c-b83e4d04278d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858958, "uuid": "0a52012a-ec96-48d0-a474-f8ccf3c07607", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fced23-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823810, "uuid": "3044b6f7-ba31-4432-895e-7a44bd1aff7d", "comment": "Malware payload (Mirai)", "value": "adb7997d0a288c3ae6454ee7223c7c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823810, "uuid": "2bfa50d7-2ead-45f9-b384-75a580a663c5", "comment": "Malware payload (Mirai)", "value": "795896a03556795d8c69818b26b5779f2e949c29b0f67d037e78be3da7765326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823810, "uuid": "c6c6c133-9ec2-45f5-aac7-f3db9416116e", "comment": "Malware payload (Mirai)", "value": "f4dde76732f54cfd162975f70da4b1b376ea107d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823810, "uuid": "f365d4ce-577d-4c99-9cb0-86afdf610b42", "comment": "Malware payload (Mirai)", "value": "26e4e00d80700fd0538d5d309f791db3d6491aa76bf48c97ec6277856744b5df750f113c6cb81d00b3fb7f2fefa67db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823810, "uuid": "76a19b01-c045-45df-b1e1-566b8423a642", "value": "T13033F162D67AB7FCCE7CD3F64DA186C8CF1A99B6E54E1236106440FACE9658D2304783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823810, "uuid": "df7b12e1-af3e-4804-b7f1-beb17143d8c5", "value": "768:HH0F54T2OcsCsZu12+ZLuWBthfw28xKV8+wr2lGLpqPYGXfT6wVIZTcxTfh8pLmV:HH0F54THZc9lPLfl8xPV4YG7Lycx7hjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823810, "uuid": "7ce6e733-a401-4597-99b5-99a23bda7803", "value": 50132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823810, "uuid": "6dbf319f-5344-46f6-b6e5-9b605709594c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823810, "uuid": "bc10c824-9c84-48e9-b497-04591352039e", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606d4f95-7dd7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783849941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849941, "uuid": "3a57c715-6a7c-4dcc-a049-3e0adec43a7d", "comment": "Malware payload (RemusStealer)", "value": "8f2d0500697d1fe2728d38452bed504c", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849941, "uuid": "2867c3aa-ae77-4ee0-924a-81a14a9700b4", "comment": "Malware payload (RemusStealer)", "value": "7ae44ecd94c5e10f560e78539d4dba8b10d2ddcaf551d1321d81f7d97b771d5d", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849941, "uuid": "5e619ed4-7a25-4bcd-a9c1-24d5d11c80e6", "comment": "Malware payload (RemusStealer)", "value": "d98d5f83037c07458b59af7d445b025a3ea6bfa8", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849941, "uuid": "ca08286e-7dbd-4ab5-a0db-611efa7226d3", "comment": "Malware payload (RemusStealer)", "value": "6968dd145fad7c156a54f1dbab8e2c5482046c2cfe3bbd097d7722a8709c02a66b25215f3b8a26e3926a419fbb3aee30", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849941, "uuid": "c451362e-f785-4720-811f-03fe36d74cf1", "value": "T16B65232256D8D532D5F99F740CF991F20A35BCD30F3D66C736046E9B2BAAAC4A230316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849941, "uuid": "409ced9d-aed3-4c80-98af-a5061fcf3c94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849941, "uuid": "9695f2d1-5419-440c-a899-8ac4bc803877", "value": "24576:ILbZxRPVkOtnjqTY2okeY7j7H/E8cO9sHYsgz5h5VjDf1V5J1alXcfyqL1h:kRtnND+L/E8Z/hff1V74Myq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783849941, "uuid": "bf025792-c53a-4eb3-8a95-6af1f4af4bef", "value": 1538560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783849941, "uuid": "bfeb35ff-daa7-4da6-9294-de0571ffa317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849941, "uuid": "05927c33-0fc1-484f-8052-5f72f40a17c5", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c6490f-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854750, "uuid": "a5432351-cc67-4961-a13e-c80e3c02ea27", "comment": "Malware payload (SilentNet)", "value": "f5778dd7daa8688ece29f825aae114e8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854750, "uuid": "b6039643-c77a-487b-ba05-7d8bc291e7f1", "comment": "Malware payload (SilentNet)", "value": "7bd0102479cd6f94b19ed348e0051bfacca12012da057ea920efc6c72daf1b82", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854750, "uuid": "40d95e42-4047-4567-a515-8bd036ab9a41", "comment": "Malware payload (SilentNet)", "value": "6ba80e822df343b687e408ebf38d2e2a3b5a2c07", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854750, "uuid": "355baea2-f491-43f0-bad3-d18c7439b464", "comment": "Malware payload (SilentNet)", "value": "b6f0bf9a4044984101d49f49f81f3be2581fbd95297356312ab4cec1bfa85469ed13da23602e827e2039895f2f27a6d8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854750, "uuid": "0015cb77-d8a4-413c-8104-2de887916af1", "value": "T19D46F134C61C1035D8AFFB32845772D0A3FBAE965207B59A3E6A120CF909B53DB35E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854750, "uuid": "98a6af02-0258-4032-a309-0362c42cbdac", "value": "98304:o/LerlaXVVma3eHXv9So616z0swm4T1P8ItccmkOEPnLP1WS:qLerAFO3vf2swpTB8HDEfES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854750, "uuid": "3026827d-5777-4d25-b7f4-bfbca11a9d6f", "value": 5461660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854750, "uuid": "d5df4adb-3392-49e3-a83f-21477cfae702", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854750, "uuid": "f12b4026-1179-4bf5-a527-8f902884a001", "value": "StarClient_1_21_11101.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46a7451-7e3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783893139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893139, "uuid": "d218f8bf-d588-4852-bf49-d7ec09a35ded", "comment": "Malware payload (Stealc)", "value": "852d9a34235fc2c168be654268ff28c3", "object_relation": "md5", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893139, "uuid": "2d5db93e-600b-4217-b33e-c1603c48cc32", "comment": "Malware payload (Stealc)", "value": "7d09e2f4a9ee25024a1498f833448d095787e6faf8908ed9ed3fe536032c0de6", "object_relation": "sha256", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893139, "uuid": "51a3fc75-c677-4573-9e09-ff834d49ef0d", "comment": "Malware payload (Stealc)", "value": "de89589ca983276dc41a74c7e8ba919c6a6ecf62", "object_relation": "sha1", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893139, "uuid": "d57fe3b5-c28b-49ad-bdde-176508c004a2", "comment": "Malware payload (Stealc)", "value": "6d51fc3da0350f6dd5e1f223c69b8b433c12f7f9de905aadfd252e2d0e54d06dfaaad1e0751965c535234063135bea8e", "object_relation": "sha3-384", "Tag": [ { "name": "87-120-104-81", "colour": "#4FD431", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893139, "uuid": "d3c2e85b-94a5-4df6-9ea5-cd44d2166190", "value": "T1F0A5330A96F88852D9D40B7104ED77161A32B9639B3443CB4A88CC5FBE2B8D5D6317BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893139, "uuid": "ee10c858-dd99-4657-8bde-d7ea9be72c54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893139, "uuid": "d420ff25-cba1-4df1-871b-554760e5dac3", "value": "49152:AIyWYyaWqk37e+vHdDoupcwK0Kmb8w8tjEnQzPeq:AIWpAv+nwxid7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783893139, "uuid": "d51f170d-218c-4cfb-80f0-98ad3d5a56a2", "value": 2210816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783893139, "uuid": "97a42859-4463-4593-8595-a7eb0b5097e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893139, "uuid": "ec1ea764-b71a-43c2-8cdb-2cc43eeaf028", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68a3c91-7df4-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783862621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862621, "uuid": "c1430a4e-50c2-4c0c-949c-04dca80d9259", "comment": "Malware payload", "value": "6052705b2e268ccd4e8e309626e85f1f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862621, "uuid": "aa24a5de-20d9-4307-8b8e-d90ed796f627", "comment": "Malware payload", "value": "7e73dbd7cf6d6529466f20c12c1f31cbf4533eacc7146c809618b7547e1a46fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862621, "uuid": "f6cd822d-2961-404c-a324-63d972df250f", "comment": "Malware payload", "value": "950bb2fbe7f732a7d65bbb5e4f5aa3fdbec89108", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783862621, "uuid": "deea8747-dd52-4de0-a67c-c11b8caeb9e4", "comment": "Malware payload", "value": "e457b70659ecf1b699a5d6381e4c80c341a0bf21fb408c4e084f8e8d62c8e2a6d54faa9aaa0844ce05c7d713d21d6028", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862621, "uuid": "2491fb31-b409-4baf-8d77-205f59efe3e2", "value": "T13CE012E4B5A212B24F84CDCBD85385F5B463A1E12A225FE4395971E492752C1FC7062D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862621, "uuid": "80b31570-7b52-4f44-af5c-674893bed69d", "value": "6:SXRJSXA+sL0yMiFSAKxyM8wA+LKie0yMflAI5yMeAuF:ShJSIL0fiFCxflLKV0ffJ5fqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783862621, "uuid": "a0b8ce84-2e66-42a9-9f02-a9841669eabb", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783862621, "uuid": "8ee130be-29ca-45ec-a635-8eadba544525", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783862621, "uuid": "46601428-6477-485f-af7a-ff48a5c986ea", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dc2b8e-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823877, "uuid": "02ba9416-2a53-41c2-aa83-ba2abd2165cf", "comment": "Malware payload (Mirai)", "value": "38f7048e3c632fd7dc38bfee214eca7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823877, "uuid": "78b9cff7-af6b-4ad6-bf8a-761f1b1846d7", "comment": "Malware payload (Mirai)", "value": "80f66f2a896623bf068089121aba8be0104f1ad71f0c3b503f6775b57705c858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823877, "uuid": "a2de1c55-ce59-48b5-9a6f-f5bac4bb7856", "comment": "Malware payload (Mirai)", "value": "9e9601e41b8259f2b823d715c0705310d781190d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823877, "uuid": "d1e875e4-7526-4eb8-84f2-cd5d8fc343bd", "comment": "Malware payload (Mirai)", "value": "342b237ac8290416aa4a790152208a0ff04443709501a47924bb4476be0462065cd74fe86a324155dc729f836ee48433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823877, "uuid": "07665c54-b89b-4991-a39d-be46a725cf04", "value": "T1D2B31906356198FCC167C034D73FE937EA31785D12243A6E6BC4BA711E22E365F0AB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823877, "uuid": "a0abae85-3867-46bc-a0cb-2c0373604f1c", "value": "1536:VSFqSKVn5GuXQ9v/qGPdqMG7WSh1VolZhhdei7POSUvElRg79VRCG44k6H:VSvUcuXQZ/qGlqTma2OtEI9bCG4sH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823877, "uuid": "a5472faf-f9db-4ac5-932a-ecf439f72afb", "value": 108408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823877, "uuid": "3c9a0c3b-6b6d-4159-8d34-983280bfe265", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823877, "uuid": "911c9da1-981a-4c99-b688-0cb1b87a5f4a", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bd7b8f-7dca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureCrypter)", "timestamp": 1783844368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844368, "uuid": "20193b40-53f9-474e-b91a-d376dd56236b", "comment": "Malware payload (PureCrypter)", "value": "503eaa167b3c6888e99f28a94c04dcd3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844368, "uuid": "be904bf2-0fda-45dd-8d21-adf7a0d92c7c", "comment": "Malware payload (PureCrypter)", "value": "81e6bc9a79e4234febec3a7aeea430d57c9edf46c670d26997e61bb3ef5aa32c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844368, "uuid": "0e81ed29-003a-4b65-ba5b-8f0b2e5d14f0", "comment": "Malware payload (PureCrypter)", "value": "df2d9f832bf6759e9dbc1f77e613e32f968ba223", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844368, "uuid": "e87be2f5-0f17-4a84-9d10-1b5edd0c5e1b", "comment": "Malware payload (PureCrypter)", "value": "b3d147794ac38895cd29adefec0df8129bd6da9b07d177c9d96cdf59fcfb2c58adc4ca57e89f42309becd337efd34588", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844368, "uuid": "6b6a8abc-11f1-4e6f-8350-cd2ca984ffd2", "value": "T1AB55BF932441A7E5B3BE4A6E322BCD8D257435BDBCC374C8C2B0DC4B6678A453617DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844368, "uuid": "c5d9154b-eed1-48e3-ac0b-805c491083b1", "value": "24576:rgQE+hHihtzAKt1dmGbGhGTUfwY7XwwRRl6yXX8kYcQw1D2E9EEpEtR:UtG7hXy48GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844368, "uuid": "b40f5eb6-77e6-4743-a34d-0f5b16c180e6", "value": 1314627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844368, "uuid": "823295f7-09ce-4eb0-a453-3de14e4feb34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844368, "uuid": "b48a79a1-f0a8-40ec-b566-b2a97704bf03", "value": "ZA2A_DONE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e27f3a-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844019, "uuid": "903e9f17-2c36-4142-a601-317465ab4ef7", "comment": "Malware payload (Mirai)", "value": "27181b065c9c6bbb84b3ca6f1d097ee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844019, "uuid": "0ec2ad60-1688-4fd0-988b-dca5b70959e7", "comment": "Malware payload (Mirai)", "value": "822030a56d574157f128e46897b9e75ddcd8aad028cd64d7442b8b636fc432c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844019, "uuid": "8150a2d4-42d4-4b2a-aef1-5399d1c766e4", "comment": "Malware payload (Mirai)", "value": "df083abb82b1da0dc8ad2373187a2487a70245e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844019, "uuid": "a3ae8c8d-f3f8-416f-b60b-dc524e538599", "comment": "Malware payload (Mirai)", "value": "0d9216c7d630fccab0cd9e434d90bc11c1aed7c5be1e3edf0e7b86a4c5ee2807376b8c1fa061d7ad00333bde7eedb518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844019, "uuid": "912f89c0-917f-4a0c-b417-e1f69da2a84a", "value": "T11C933A45FD819612C6D113BBFB2E328E372663A4E2DE3203DD25AF22338659B0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844019, "uuid": "4fb19258-9fc3-4805-9054-b954f1d6aaf2", "value": "1536:WXte8DGCx34p8qOCgnb84PlLs/cuOXffdPDamvxS:Wde8vxIK6p4PJs/OPrxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844019, "uuid": "dc71a8ea-e35c-403f-8c95-49b9e803f61a", "value": 92244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844019, "uuid": "09891672-0295-4609-97c7-7daa60214b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844019, "uuid": "a34a6721-ff7f-4a68-91af-5597ce6102b5", "value": "ar15.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e098ad58-7e3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783893535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893535, "uuid": "9cf502af-e7da-4a7b-8bab-dc0e395e9dfa", "comment": "Malware payload", "value": "d32c108fee5841a0cb1b2a475350bb39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893535, "uuid": "75b7e33e-1580-4981-af94-5b20b0da170c", "comment": "Malware payload", "value": "82dcb68bc62aca8055c5c3d22a4bc328b534ac315206da143d94576882a7cb53", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893535, "uuid": "23fb5ef0-8aed-4075-ba8e-d05576c50437", "comment": "Malware payload", "value": "baf9287b832db89ac776ab0ba707e9fa85be9df4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783893535, "uuid": "5d543bca-24ec-4caa-9787-47887d2b691b", "comment": "Malware payload", "value": "f28ebb9c41d1e85e6ccfc4903dba899eef95e7c99a809ad7682e9fa9fcd7ff7d53554464a990e7c6ad1a0fcec84829b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893535, "uuid": "a7217577-5b59-4101-81b0-c9bc4275a1f2", "value": "T1F05125E4EC28C8303B79802EF1CF61A45AC3482F04593959325FBA990F5C45CB6AF77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893535, "uuid": "7e3f7def-f4b2-4877-bc77-393df2617b22", "value": "96:cOOniRH6cAD11LqjIZtwtJDxe7JdRqU4YGF:006bHnwtJD07JdUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783893535, "uuid": "10db318a-b4f4-4390-821a-2e7ef7dc6d71", "value": 3139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783893535, "uuid": "f2d31925-b5f2-4878-bfa9-44812a002aa1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783893535, "uuid": "b6049758-6611-48bf-90b9-d7d3f0c125fb", "value": "82dcb68bc62aca8055c5c3d22a4bc328b534ac315206da143d94576882a7cb53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ee12fb-7db7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783836050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836050, "uuid": "88671f1a-14c2-484c-b10b-6e047200169e", "comment": "Malware payload (Mirai)", "value": "c71d7b41deabe16565466b1395460aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836050, "uuid": "2ff3fe96-e485-4d5a-864e-c3a937997f6f", "comment": "Malware payload (Mirai)", "value": "832011524c7c5ee7eed800a1d375fe63abad997d83d146a12d77fc837674a475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836050, "uuid": "4d4692df-2027-4885-95df-04f0dbf5f409", "comment": "Malware payload (Mirai)", "value": "a92288c11ad379a25431be5d798c0afbb6fdfb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836050, "uuid": "66b1558d-3dc0-4834-b183-4a76c2b4bec3", "comment": "Malware payload (Mirai)", "value": "170cf8f633ede27828bb2f98566850189c4cc1441cc3308694c677ecaf57e59b280e802c312e00e95dc48c7868450326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836050, "uuid": "4e97a5b0-9475-451c-a733-a9061659d730", "value": "T15B735C32B9750D2BC5D5A8BA61F30325F2F2478A24ACCA1A7DB10D4EBF2564032577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836050, "uuid": "a45d3971-ab10-462f-b9dd-de78a7971be0", "value": "1536:X4YS2EBCq/5DA0jlVu1Q9tnZTgN95BU9bFU51jt2rF1/A+:o9HbR7FuNPWxbM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783836050, "uuid": "ec1ad0ca-8a5a-47cc-98a1-4530e108672e", "value": 78792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783836050, "uuid": "e912813b-e7b6-4aa3-a1cd-21accf386c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836050, "uuid": "c4b084ec-3a08-4250-a61d-f8737c001d8d", "value": "XDspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5effed-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820678, "uuid": "b46d4246-7f1e-4c02-8ae2-689516d7194c", "comment": "Malware payload (Mirai)", "value": "10d83ee16c520993977e65a4b339eece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820678, "uuid": "08758213-93a8-4d77-a8fb-9bf5cbf972a3", "comment": "Malware payload (Mirai)", "value": "83a6436320441c985d8c9aff65d35e5925f8298629be3bda1df5877e1113b72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820678, "uuid": "6d4cbd50-a651-4e89-b856-200ee2dd5be6", "comment": "Malware payload (Mirai)", "value": "6a4b34b1d286e49be07d3718f5e60ab0ed3aef6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820678, "uuid": "2991862a-8723-4440-9f10-1aa19f21e740", "comment": "Malware payload (Mirai)", "value": "9677b82af0578ccefb251345550ce149eba3688c070346453aa6963712d9d20a35555452b28f0a1439a340fca8eb33ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820678, "uuid": "2e6db57d-960e-4130-8778-c5e21c879a31", "value": "T1B7F33C46E6414A13C0D6177ABBEF42453323AB6493DB73059928BFF43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820678, "uuid": "ecc0ebec-5421-4478-aefd-ec937c9024c3", "value": "3072:8hG77R4X2HaUJbXUc1df4RVaEFkINdLfhLNM/9tMiOZH7v5w2F:8hGPKGHaUJbXUcrf4aEqIzLfhZM/9Wnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820678, "uuid": "60f9f2e9-afd2-46ae-836c-7b6465d2a781", "value": 160069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820678, "uuid": "18a15c1a-f9d8-41a4-8328-549182d16c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820678, "uuid": "2fc4f5b9-b9c1-4836-9cbd-24b88c0f5a3c", "value": "SecuriteInfo.com.Linux.Mirai.10589.6778.4375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aec2bb-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820616, "uuid": "584c6353-1c65-4e14-bd49-b36af4ec9dee", "comment": "Malware payload (Mirai)", "value": "cea20e90b6c32dd62790d6959c07c7f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820616, "uuid": "1a7fdb75-b870-40dc-8f7f-bd2e527fec25", "comment": "Malware payload (Mirai)", "value": "83d866a2c3640eb8edebd26b2258c52c0fc55eb583235c5756dbb75413d9155b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820616, "uuid": "dd5c5d9e-8a83-444b-94f3-5917edd9aeda", "comment": "Malware payload (Mirai)", "value": "d2cc75ee8b39a41f61dc9e4d4c50449203dd6c61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820616, "uuid": "29c1a443-58c9-4e83-8be4-bedd43cc7fe5", "comment": "Malware payload (Mirai)", "value": "4409786e4768bf9a35681095d8efb98e3afc474b1a699644d4f24e5711629714f5be7ee91d2462eee261baad98ea5497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820616, "uuid": "846eae15-0302-476a-bdb1-4559a4bb8e93", "value": "T18803F1953E9E4564CF105433FBBD988767FD8FAC8255D836290DC19C2C9FA80AEFA045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820616, "uuid": "0739cde8-c153-45ad-8102-c1a1cd604c28", "value": "768:Zdz8twyz76Bq7TY8bUAZz6BmUZme4DIZTvOgRHBiD0KIfTFIJXHjy9q3UELSp:ZR8twyzGM8fAZn+meSmTvvruOf2JXbLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820616, "uuid": "bce40fcb-36d2-4beb-91e7-248015da3800", "value": 38088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820616, "uuid": "71e064a5-5200-4384-bb3e-a8c5be636900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820616, "uuid": "24b49c46-712c-49ee-ae0c-24dc12b8db91", "value": "SecuriteInfo.com.Linux.Mirai.10589.15085.17293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfa3d0c-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843867, "uuid": "7dc35686-3171-415e-9ce1-c228d8c2fa89", "comment": "Malware payload (Mirai)", "value": "92064ceeead3ebac4fbf192be589b79e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843867, "uuid": "d24fff57-f233-48a6-ac1c-e9f05142e50c", "comment": "Malware payload (Mirai)", "value": "8539e2c0cdb559ff5a051dcd07a85196a25bc3ffea197c2a05a849f471ea3b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843867, "uuid": "46f62df7-e141-4372-b32f-8212d9cd9183", "comment": "Malware payload (Mirai)", "value": "587a4cfd46f2cbc82afc56ec8db3a9abfc1ab76b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843867, "uuid": "657c61e4-dc2b-498c-a103-ae8a655616f4", "comment": "Malware payload (Mirai)", "value": "d5ce19429798b3f78b96d849620db2a3fb3bb6e6068ec73c327d988eda3d3e6e03e34489f918f5512695462faf8ea45b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843867, "uuid": "9ca1882f-d6b0-4027-809a-ad72a0a89ce7", "value": "T13C93021FBE660B77F7852A3050232BE066CA68989539757AEDD2D1AC8814ACF10D1C3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843867, "uuid": "2856fbca-df0d-4147-897f-fa3c40f6214c", "value": "1536:g/Oadb0CoVIRkXeqiqb/DctKzf5lgTcEicT3EeD009S1RkD9t9A5DIG3E4TpLv:bM0ClRkuqicDc4UCeDF9SDkD3m5DJlTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843867, "uuid": "7b83cf8b-fc09-4acb-9dd8-af85182139b9", "value": 96724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843867, "uuid": "fbf3b2d2-3f54-4d89-8156-128eed6339f0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843867, "uuid": "bb9346bf-dfed-4ced-b93f-274858aa6409", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22666b39-7db8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783836522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836522, "uuid": "7f0f8d1d-b2ba-4e9d-b45a-84d7928fea60", "comment": "Malware payload", "value": "ce1e595366242a1f9667c29c91a2ae54", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836522, "uuid": "329b0995-89e3-42ba-adae-17ddebc29b9f", "comment": "Malware payload", "value": "85a4926e97f501b7066e5e5c95d73f26b046210dee8af5bb83196a29db71a4ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836522, "uuid": "f86826a8-f2d0-46b0-bae6-3ab88f761731", "comment": "Malware payload", "value": "e3ce5eb8e3519c74180039b048060d04c5caf825", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836522, "uuid": "f09816e0-53c3-4d59-a401-8c509e6dd8c1", "comment": "Malware payload", "value": "d26d8e5ab73f9c634b09b70661e9661d96f620f712a14b02d42b403ae2147a144e73fd53e0c229e61013fe6180f23a9a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836522, "uuid": "650103e3-5342-4303-953f-f77855b2cbe8", "value": "T11EE0C2A5579AD8DE047E49C4B4730500D6206333FE04862C3BCEF990BA78224B85F499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836522, "uuid": "08b45269-dcdd-4b96-b38e-1ebed5c850a8", "value": "6:hoFmAi3rHIdOjXu7i2ovH6UFxcFs7smI9//P6Q//D7B/+bZJbKXFs7Yjs:KmAi3rHIGXYzovH6KGTsJbKKEjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783836522, "uuid": "d9d31133-d370-4ea4-af80-385e49b71afb", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783836522, "uuid": "bc77f1b5-d7ce-47a2-bf4b-a5bded64cce2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836522, "uuid": "02a6d66a-2856-43d6-a53c-1ecef418740b", "value": "wwg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91284336-7d9f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783825971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783825971, "uuid": "efd2c176-c6f1-4fd6-909b-cf960a99a8e0", "comment": "Malware payload", "value": "de030e52f66dd69b3d931a3d2a5e8675", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783825971, "uuid": "19674f8c-dd39-4d40-919c-6c737ceed7d3", "comment": "Malware payload", "value": "85c71cb954f79b09d239900289b10d40290caf5501302103587c43fb96c65dec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783825971, "uuid": "5dc270ff-5b8d-4eac-9074-f613a932d79d", "comment": "Malware payload", "value": "6e9b3a86155641d8b26a5274df705a3959b805f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783825971, "uuid": "3c1bde6a-b534-4c77-b948-6bf7996eb3e1", "comment": "Malware payload", "value": "a34bf22ea7503a8c6709b782a3da4295968478512a942d87375cb9baae782c1d0dc6a4cd78245553c0d7eae815f9fa07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783825971, "uuid": "74d1e7e4-21e2-42ae-85ae-c045861e390f", "value": "T16D512DCD30BF26366E033DDAB119D884F506F2D618DA5E05FC84EEA2DC979653838698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783825971, "uuid": "dcc56f2f-632f-482b-a8ff-f902081c2c10", "value": "24:fvp8wWPNIo8KQ8pt78z/ASRpKdQ8tvp8fVPNI38K/8OLLeiPSRpKwq8Wp8GNITKw:R1RpKQQqRpKEIsRpK3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783825971, "uuid": "d53e2c38-5fd5-4ee1-b88e-dc7b8b40855b", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783825971, "uuid": "322eeca0-2b9e-4921-a398-853f4ba8e6e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783825971, "uuid": "3d0a37fa-4080-47f4-9adf-b087c0de030b", "value": "womp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d330169-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843976, "uuid": "6d414114-0e67-4815-b2a4-b4504d5d4e27", "comment": "Malware payload (Mirai)", "value": "a9d1bf4578ff7efd1b67c37912ff910c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843976, "uuid": "4e2b136d-dab8-440a-aedc-87c11a06a504", "comment": "Malware payload (Mirai)", "value": "87205d7c2a7af5a33bf1bdfe0b81edb09e382033c0a3ab81124de9e7d6dbddad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843976, "uuid": "fe4c9ee6-e7f8-4ee5-b7bf-18a19ca54a3f", "comment": "Malware payload (Mirai)", "value": "8e8d0ff2948c5b3d9b9109d7059cfaa3ed03b2e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843976, "uuid": "99d8e821-55f0-4100-bf8e-affc2a8071cc", "comment": "Malware payload (Mirai)", "value": "50d751d6cdd1c06adec60beb1b1dd0cf73a640b376044ce3969e9eddad30e54e1de966c43696a7b745509992d88a5a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843976, "uuid": "ec5372cb-c417-4566-8c76-c35ce900c54c", "value": "T1F2432885FDD2996AC6D013BAA72F358E33A1B3E0D1CA3603CC945B2173896CF5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843976, "uuid": "b47c2f5a-f789-42ce-9fce-e8acb2ee5d58", "value": "768:DcyddN+3ZDmZoEJdCuN0ObjwQoyaEFM+2Bn5IH+e4kT8Mwcj16IoNBitKMfg3BNd:DapDbwVNTbjT6EFMrI5AMjj16qtK79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843976, "uuid": "c1f967e1-d6be-43e5-9b25-066578feb82a", "value": 55880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843976, "uuid": "be9f0830-396f-495f-9689-f9cf85e03232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843976, "uuid": "aadcae5e-f900-4684-9e01-812d02fe683c", "value": "ar15.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a61d420-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854736, "uuid": "3f2a9fb3-9688-4d81-9fb0-0ea0b82feb20", "comment": "Malware payload (SilentNet)", "value": "bf4406b83f0390a46e5fa1984211fa33", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854736, "uuid": "0421c7b1-2bb8-49d5-bf51-5c6da9d1a7a8", "comment": "Malware payload (SilentNet)", "value": "872ee6387647110afa6d6385b854cf00107405c091ddaf4571830289debdc6dc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854736, "uuid": "3c112f45-501f-4b7d-a699-42f0dd137eef", "comment": "Malware payload (SilentNet)", "value": "2a2011befff7104cc47fda68dde0f6dcb4bfaac1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854736, "uuid": "5db227ac-1a55-4640-8d8a-ee9657976b9f", "comment": "Malware payload (SilentNet)", "value": "65583e1f4bfd28521aac620f129b3b68f856997c5b2e74a626563db1429f2eb17efbf4f7c99512b71d09f1389f2d4f42", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854736, "uuid": "769af931-e9bb-4111-8f39-769efbb04c03", "value": "T184930256BB0BF000DD0ADB7666048F27C1623B269F5210CF3D29ABFB5E82DB24B75564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854736, "uuid": "a5e1d52d-52d2-4fd5-9c57-aeb936a0968c", "value": "1536:ViXMuJ7QU/p3P8847qeJJbZZkNKp9HKTkAfKMjpgVAOezH+KJ9:SMkJB3P87qidzp9HEKOpg3mJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854736, "uuid": "3cddba00-5da5-4955-87b3-967f07117ca0", "value": 92715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854736, "uuid": "72796b53-b443-463c-94d1-1ba9a022f999", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854736, "uuid": "fd269d3f-6f14-4c96-a14c-5f7fe4dac061", "value": "money-mindset-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f614ab-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854752, "uuid": "463e7d98-7b58-4f05-b895-665cf6fe94a5", "comment": "Malware payload (SilentNet)", "value": "edff6cce1482ea126f64b1d10b38213b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854752, "uuid": "26b14462-7df1-4dff-bbee-bc35f7d3810a", "comment": "Malware payload (SilentNet)", "value": "87859d2545f47c0c61eb3b415e745877978306382f6167e423e6667cec58bcc1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854752, "uuid": "8683a5a2-f424-4a50-8100-51449bd892ff", "comment": "Malware payload (SilentNet)", "value": "6149d8b7b2f43cc5caa10db52f0060f2b2b96707", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854752, "uuid": "7e169219-d1f5-45de-90a6-cb0b683c382b", "comment": "Malware payload (SilentNet)", "value": "d6663bc1cc7dd70539ee82ebd3221a4efd13e9880a234dddf449b02d21ccd7facfbbed73988b2c1109b9fd20c133c5d3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854752, "uuid": "32ff2629-248c-4004-9555-62083ac68cc0", "value": "T19D651227D11C5726E61F9577F1018922FC5E03D1B00AA43702B9599BCAF788D8F4ABEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854752, "uuid": "e0ea42bd-e32d-461b-96b0-c5d26307ec95", "value": "24576:XtNi1QTYdN+qJjOCD4gaoWILKfi3ij3FJuybju4+vsfZefWV4bUTSH08cC/u6:0Qjgj9DuCLn3ij3FJuFZvmQf9YTmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854752, "uuid": "895d15d4-341b-4b0c-be12-9ba1beb62dfe", "value": 1487907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854752, "uuid": "8e399da1-82f9-4921-866c-7aeb4de93004", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854752, "uuid": "e3c13236-f474-4aa1-8beb-16aca0ef974d", "value": "TotemCounterConfig.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0057a5-7d94-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783821134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821134, "uuid": "63ea2495-4ab0-4d48-89a5-fa5d7995660c", "comment": "Malware payload (Efimer)", "value": "d8156051e4f18c42cc2c459e1ad0172f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821134, "uuid": "4a28c3bd-7925-45ba-8570-3b4776daba69", "comment": "Malware payload (Efimer)", "value": "886eb34b664e06f2d543b0dc5f41c2bc56b2da02f0ecce54413af8128e050b54", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821134, "uuid": "a578fc05-ce9a-4c6e-bea9-b8766c87a446", "comment": "Malware payload (Efimer)", "value": "8e385c455f796264c8ffad0c35e32b244fa1556c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821134, "uuid": "18843f03-2d19-4f6b-a677-baf20c56e034", "comment": "Malware payload (Efimer)", "value": "57cfd034c29e6f1a7b4ae0746ab85aac9d16c772bdc829a7d9f77a438cbf0e710027f3cdb753c8945e8480acb8465d8c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821134, "uuid": "cf7b1a0a-a6d6-4a82-b06c-c54dfe267dff", "value": "T1C3E63358F6E023EDE6A38138DEF285A4E56174B50732C8DB177C8A55AE272D00E3E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821134, "uuid": "2b64991c-93f3-4ce1-a1f6-4a160f1d482f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821134, "uuid": "c5260068-4d7a-4eda-a050-aafb1b25733f", "value": "393216:Oe04wr8F+CN9kdZsobN1XMCHWUjXHcuI3/PGTAI:OhYFhNmTXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783821134, "uuid": "d08fb2f4-8b10-4760-82c0-8ba399404204", "value": 14309513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783821134, "uuid": "8d54e3fa-8749-4f47-bef9-e0dcf05c088a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821134, "uuid": "0c25f924-f706-4f37-a514-6aac3ef96a52", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439231d5-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843880, "uuid": "976336b1-792f-4834-94b0-6321c8073bd0", "comment": "Malware payload (Mirai)", "value": "c22d21c8ad17abeee8c2cc7ba0de641d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843880, "uuid": "1c8cacaa-0dce-4129-8b09-28983934e6b6", "comment": "Malware payload (Mirai)", "value": "8998e3f3369f7017f60ac0f15e417985bc51137d929f721ee72dc0496150b936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843880, "uuid": "133b5384-5b74-4965-ad49-3724e634c5ad", "comment": "Malware payload (Mirai)", "value": "2f007b98705508fdb76fffba43c5b6f6f5e2fe7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843880, "uuid": "a8030842-f10a-4071-b262-c0f00483cee0", "comment": "Malware payload (Mirai)", "value": "6f3d2e29aad0c660a8f13ff83ea20df8b7c166e38642a8f03eaf434d7ceae8901f4bb7cffd4fc195ca1e2ddc10bc9829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843880, "uuid": "62711c4d-5276-4c83-ae70-107843e43988", "value": "T13903F16AD466A182F9E6CB708F42D1E07FA00BCF67924F8E82A7C56126B4F42075E4C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843880, "uuid": "6284e1b0-3af1-40ab-ae32-8ec075c43b3d", "value": "768:J2oiqxi6WdJd+rqpt6RKjitRO8j5FXVXw+exws88nsQf44uVcqgw095:JjicWdJ+qpUR5fOQXFQ88tg4u+qgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843880, "uuid": "5102b23b-4b10-438b-96c4-69cca80c10b0", "value": 40180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843880, "uuid": "91b3adc4-c9e6-4188-bb09-3260be846129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843880, "uuid": "f9b56fe8-64fd-4424-9c10-eb60f665dfbc", "value": "ar15.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d988f5a-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843870, "uuid": "ccd9f5ed-7456-456e-8af9-59750742ade9", "comment": "Malware payload (Mirai)", "value": "730ccfad891dc098da9ea493369a0829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843870, "uuid": "d34a067c-8337-4000-8397-29170271c532", "comment": "Malware payload (Mirai)", "value": "89ade154d5fc53bccfbecc86ebe5f50fde1ff6b7b4a17545f41994634a32e853", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843870, "uuid": "b65b1806-3aca-4cd9-bab3-225b75589fef", "comment": "Malware payload (Mirai)", "value": "5d3b307500a090f9ed475fd0b9fa8d2fcc43be13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843870, "uuid": "f27e3040-0934-4cd3-b0a1-b147a5be353d", "comment": "Malware payload (Mirai)", "value": "481ea129c712283132e27659ec54e1a71f3b0474e48b7565bf747b1e616b867e7f7c3ebe990bb777bc823718fd8aed42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843870, "uuid": "7f4af1ff-563a-4143-a37b-2db753886668", "value": "T16713F1395B07EFECD1622D71F8A808887B0976FEF56B00263290125A997595733F6BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843870, "uuid": "d42f7ae1-759e-476c-a05b-d73278bc5e1b", "value": "768:f/dNuaLROE0tDx6923Sdwbkbw19nvn277hVABmtpqBQMQEqfxzJ+nwADyRkVIydR:f18eAE69623SdwIbw15n6hKBm/qqMQhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843870, "uuid": "7c925e3a-6e03-4cfc-8f0e-1eb6c6eb623d", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843870, "uuid": "2b5a5465-5fa9-4f2e-8428-ec8e952be9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843870, "uuid": "8487fb6e-7156-4b54-ba5f-5f8be692355f", "value": "ar15.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd93ec2-7e21-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783881589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881589, "uuid": "14fa909f-23a0-40ef-9478-1baa67905a8d", "comment": "Malware payload", "value": "e17da3ae5a6de8dae5feae7387af1010", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881589, "uuid": "7042e626-212c-455c-bb9e-c827c3be624a", "comment": "Malware payload", "value": "8a49a7a85261be6333936338752674a901ce4aa144f889c7099a2c43df5c9e5d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881589, "uuid": "904743ed-0a5e-4b42-8b22-3b4b050583ae", "comment": "Malware payload", "value": "918b9cd0a3bf37ac8b5f1a29e46b4121fc0ce1f1", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881589, "uuid": "1de714ac-1f19-4669-ab00-863c904e2647", "comment": "Malware payload", "value": "3998742fbfa0f0530cd2e8239e2d11f10170b8257b2974067d98b2853ad99d7beb2855161ae84165a8532bf1e3269574", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881589, "uuid": "03c1c777-8a93-4167-aad2-39c4a2c57973", "value": "T1C416B630F224CE36C0EA173A448796615775801A8F9BE70711E485BDFC8E3552FBAA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881589, "uuid": "0b10c40c-3dfe-41d5-92e3-1f2698ecdf7d", "value": "beff4eef203dc94c1dfe99ddb10a8d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881589, "uuid": "e909b046-4ce8-4298-82f8-5086c08958a4", "value": "24576:RR8Qa9cjoFVaxmwcPp5UhzNVRNKf00VV6yD8R6Ys1AaychqgpDCGNXCs5RmYS:pM/V/wzxNIIlR7nchqgpDCG1CEVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783881589, "uuid": "00e488e7-4660-48fa-b8ee-6c7ace2c4506", "value": 4408930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783881589, "uuid": "f6ce19a7-a179-46f4-ae7e-b80345c52e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881589, "uuid": "9dd167da-0a1f-47fe-baef-80683afaeea6", "value": "8a49a7a85261be6333936338752674a901ce4aa144f889c7099a2c43df5c9e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d8030-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783854906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854906, "uuid": "4c0f8729-0e3a-441c-b320-d241a005feae", "comment": "Malware payload (ValleyRAT)", "value": "a09dd729b252ba50f3f526e5b42454ca", "object_relation": "md5", "Tag": [ { "name": "134-122-128-154", "colour": "#FD6B34", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854906, "uuid": "dedbf835-4933-419c-91e4-889d19ecc1bc", "comment": "Malware payload (ValleyRAT)", "value": "8bf54a76924ad62e3b5562826f0e491c4c498f166276b071c177b694762199f6", "object_relation": "sha256", "Tag": [ { "name": "134-122-128-154", "colour": "#FD6B34", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854906, "uuid": "9117a5e8-2d23-4e56-87bd-15ace8a7125e", "comment": "Malware payload (ValleyRAT)", "value": "3a213ac3efbe3bea693f497e4d97e4616201ff73", "object_relation": "sha1", "Tag": [ { "name": "134-122-128-154", "colour": "#FD6B34", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854906, "uuid": "8f4f5338-3569-4ad2-8b5f-9b7f3a80f9a4", "comment": "Malware payload (ValleyRAT)", "value": "552d68cf4770ee8307b1b44ff73c459a79242d868c14d18108ad99e12b367c5cd506aad6659774ab4f6d612e26e20d2e", "object_relation": "sha3-384", "Tag": [ { "name": "134-122-128-154", "colour": "#FD6B34", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854906, "uuid": "678c3e8a-f2dc-44b4-8bf7-7a4d076a72ea", "value": "T17F063338ABB1224C3F87A6FE50DAC509B2B6D94BDD5D05E3AFC65153B5432A7300538B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854906, "uuid": "0c38c481-91f8-4479-96d2-f4be69e95523", "value": "98304:XCY96F3qAzqxCPES88IiLAnF1B/GuPwiR3r9jMbBxwd:X96FaAGIPT8PF1B/G4Rbq2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854906, "uuid": "c4d4edc1-e74f-49c6-a490-c9675607eda2", "value": 3822100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854906, "uuid": "b8272d79-ab52-44e9-ac45-eabf21241353", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854906, "uuid": "c27dc4fb-9996-4d5a-b09e-30a8b6498b3a", "value": "yun7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7928bf5-7e11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783874971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874971, "uuid": "42268021-53e4-4cd8-aa97-c0e269d91ac0", "comment": "Malware payload (Vidar)", "value": "1a28a76881ed49198001278d4b75e6f7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874971, "uuid": "0e9f0d03-172b-4666-8097-12f8ad007a29", "comment": "Malware payload (Vidar)", "value": "8d90853120d18cea4a8a1fa72116fb93db3887f98c330cee9519bc78f87eebf6", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874971, "uuid": "980729f5-9e03-4bd2-b7e1-1266989c2d54", "comment": "Malware payload (Vidar)", "value": "47b23e60eb6787db795c1cb21d4c0a27e23646de", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874971, "uuid": "29bd0f30-af52-4311-969b-becc438fba75", "comment": "Malware payload (Vidar)", "value": "99365b5d067aa114666f282bf0b0718f54565fb1e8716ab02c95cfde9aaf9eb5aa724846928e37769afde0a1c73567e5", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874971, "uuid": "692b81f1-5696-4113-80a2-701e22131f59", "value": "T16AF57B06BCE548F9C0AAA23289B7A152BB35BC490B3627D32E50B7782F73BD05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874971, "uuid": "a5087d79-905e-4681-ba10-058c974759c3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874971, "uuid": "82daf75e-9fca-45d6-b06f-54ffe5b0de3f", "value": "49152:KcuAOe1rKO29sVbkNIdmteoH6rGv6FbR5PjOomrJiSodS:K/sVouqJXyer11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783874971, "uuid": "88acadbd-acfb-44b7-92ae-4389c1b73571", "value": 3327344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783874971, "uuid": "216f3a7b-e8d1-461a-87e4-cd49eab78c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874971, "uuid": "7aeedb9c-62c0-4d9b-b0cf-291d537b010e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912405ba-7de7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783856895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856895, "uuid": "cb2ce14a-634b-47bf-a503-7f77a1e165fc", "comment": "Malware payload (Mirai)", "value": "4d61056be1ff894fb3c972f320b74a1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856895, "uuid": "86540c19-1a91-4cd1-a56b-1215977487a2", "comment": "Malware payload (Mirai)", "value": "8e2a423ec6fa3af3e68ab10866de5e0fcae9deaf0e980eb1973b0a0736b5ed93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856895, "uuid": "c145a5f2-66d1-41fa-8154-8067aafe07ec", "comment": "Malware payload (Mirai)", "value": "970ce9a9ecd3ab2f1cddd19eb8095cf2ff57c107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856895, "uuid": "fe39a60b-a672-4b7d-a808-cef7c48a99d3", "comment": "Malware payload (Mirai)", "value": "7179d2e356a37c794f2cd9b42be550ca81b4a237698793cffe39be9d6f67496a964297191d145ec4a8a8b7eb1a5261a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856895, "uuid": "b2b4d7c5-fdb6-4651-ad4f-9692592def70", "value": "T181C32989F8929A22C6C716BFFA5F42CD773663E4E3DB7107DD195B21328642B0D6B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856895, "uuid": "0dd45445-4265-406c-9c8e-e2a33e31b8f6", "value": "3072:frb8cmEMPFWg8FciU5ImubGUJhyAByBnbt:frb81mFcioI3rJh1Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783856895, "uuid": "551fce64-db29-4130-a0f2-ca834ba5632f", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783856895, "uuid": "b32520da-14e3-43bb-8219-40fb5f47ec82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856895, "uuid": "eb5ddf63-663e-4ea5-badd-4a58de8fc588", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5b6819-7dec-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783858957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858957, "uuid": "aed836a3-6216-4088-bd51-c8728e61d1bd", "comment": "Malware payload", "value": "0071f274ac936cd4a51245d6a7b41eda", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858957, "uuid": "36c4d0d8-42d1-45c5-915f-84aee19a8920", "comment": "Malware payload", "value": "8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858957, "uuid": "b70132de-9443-42b5-ada4-ae1ac2f2dcf2", "comment": "Malware payload", "value": "5c945b65218d8508aff01d4972f7827ce0c8796f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858957, "uuid": "2dbd894d-6655-4caa-adf1-139e15466d4f", "comment": "Malware payload", "value": "7cefebedde88e95ed03f9c2c8a95eea1d1c428558f430d26522fb3a5c018975f4cb237f55cf9dc50fd6d3b763b4e90cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858957, "uuid": "8e9cef8c-354e-4553-b791-2f615e8a5877", "value": "T1CF01A6CA85C0EE00506A8A5E72E76290F821D3CE054A0B687F9C5D7EFBC8905F066EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858957, "uuid": "36b6b41c-910d-44f8-b38b-14eab78fcbd8", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkavCfpzj7CUk/1aFCs7jxCtZNSClauD:kXCKysE2hi0ziQvZohavAz315bN4Sk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783858957, "uuid": "3a07c8e5-9024-4385-84bf-36bdf9b7041c", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783858957, "uuid": "3532b413-9e0d-4cd1-840d-73e77226ee76", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858957, "uuid": "191ecd9c-8dd7-4f1d-b6cf-d261903e8693", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92006a0d-7de7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783856896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856896, "uuid": "a5aedbd2-c0a3-438d-b735-68caea9d1324", "comment": "Malware payload (Mirai)", "value": "9849e8bcb915fa8ec09e46d79ea5f5a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856896, "uuid": "13857bb3-e883-4565-a4ab-f25b0a220b46", "comment": "Malware payload (Mirai)", "value": "8fec3546d04243274ac807fceaaec3ad8de6ef7f951aada9112e9abd464a6e2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856896, "uuid": "3e24ae5d-31c5-404a-bc4c-ae28ee976b23", "comment": "Malware payload (Mirai)", "value": "06644c991d4a4820d7114e6b0abfc3d7118a52d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783856896, "uuid": "7204ee78-f4ca-4fd3-a514-b6c55f670a8a", "comment": "Malware payload (Mirai)", "value": "bd07945a5f57fc57d912204086d05dfc8d770eafa95400adf72e525a0f06f699271b478cc8b36e574f6ae2e9a6e2ad77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856896, "uuid": "ed07290c-3016-49e2-bb6e-8bd1f8a976fb", "value": "T1CBD3078AF8819F21D4D612BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856896, "uuid": "448ea5bd-a8bd-4940-91f4-098abd105bdb", "value": "3072:HbOOuaD6zYPK3K424GN4ueuUpOJ3slEaAaPAaOcfgpNJhKZAQqwnbWy:HbOOu1zYi3KWGKu8pQOEaAaPAaOegXKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783856896, "uuid": "abe149d7-15a4-4991-89e8-40b43b033e7e", "value": 140860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783856896, "uuid": "561ffb36-e0ea-462d-b509-2a87f316530d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783856896, "uuid": "84810e55-a2b7-4dcb-ba91-7c62ebc144f5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b7d114-7dd1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847326, "uuid": "d465cb85-79fd-41b5-8191-ed3d761e2d0d", "comment": "Malware payload (Mirai)", "value": "a777078f1c147cc5708ae62072cd3cbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847326, "uuid": "114b3fef-38ff-4ef5-9ac1-e62ff17bbb53", "comment": "Malware payload (Mirai)", "value": "9097e9eefcf5c3282542c9ec678f1171e6556ccf7c39a42ec8efcc61e0d7a262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847326, "uuid": "bfaa6b9f-f44e-4692-9f98-8a61d0f122e6", "comment": "Malware payload (Mirai)", "value": "165df554177a1692bc2bd37a2f6a731783285c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847326, "uuid": "71ea57d1-f0d3-4478-a923-32052a210681", "comment": "Malware payload (Mirai)", "value": "972c2f2215814caace378ad5870221b66ce9ac2cfc462b3065ea2709ca379538800005015e7a85969f1317e949e31281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847326, "uuid": "0a9f16f8-b021-443a-9eb1-659ff1111527", "value": "T1E8F3D717EF602EF7D8ABCC3791B9870A24CC659A22942BB57534E428B64B54F46D3CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847326, "uuid": "0791240b-129e-47f8-976e-2e3ec8645fd3", "value": "3072:2RlVdxZU68xuhER7F7f4tUAuxUQtBf2Bnbe:iJZUtueRxf4tuxULe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847326, "uuid": "d6eb0eb7-833d-475b-92d8-84afac6c9fa5", "value": 159324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847326, "uuid": "2353e06c-0d02-4311-b293-e93dbb3eb267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847326, "uuid": "9f8adb37-a785-4bf0-a654-153c3342d95e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0767d85c-7dca-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844208, "uuid": "f4242759-b061-472b-9a88-c2e89155ae1a", "comment": "Malware payload (Mirai)", "value": "cc044eb8c0479ebdb57a4be765c7fbd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844208, "uuid": "ba831c9d-ffed-4d20-8351-6b9ef4331b0d", "comment": "Malware payload (Mirai)", "value": "912094073402dd8253a9729135849ef3d4257a6f328633f1506e0ace10305316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844208, "uuid": "e6cf816d-e017-4be4-a5fa-eca33c076722", "comment": "Malware payload (Mirai)", "value": "b4e48b221390cc104d6aa461e68b3afd7de08430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844208, "uuid": "4aa1d4ef-80b5-4087-a2c1-b5fb2c00c58c", "comment": "Malware payload (Mirai)", "value": "9dcea0ae96859d3de86df930fc22883a8a187d1a232f45826260201d3cea21bc52dfdc08ceb3b59e677c5b8cff74979a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844208, "uuid": "e8e0f719-a3fe-4af6-baaa-4e9b7dbf62a1", "value": "T123D38F9C9D1E7DC2C2C3F2FEAD450F66312675744A64C3F61900A2CEEB9EDD698B1422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844208, "uuid": "5fd73063-1ed6-442a-8563-2d1d873eac2b", "value": "3072:fS+TUuULCtij7v1XduM5KmoO6Szuc4nEizempiGCKhR2Jj:f7fU6g7z6mvjic4Lz9iZK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844208, "uuid": "46f8c7be-174a-463d-a0b2-bc8d40b343e3", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844208, "uuid": "42c627a9-b6cd-4f30-8e40-5ef6b0c4c2d5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844208, "uuid": "c58df774-dcf1-453d-b496-97e080de699f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402bdbe0-7deb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783858477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858477, "uuid": "9f514e42-fc0f-4a3f-a462-72df0616ddea", "comment": "Malware payload (Mirai)", "value": "5dcdfa6e1a64f2f35bcff3e396c79c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858477, "uuid": "e9385a10-b4be-47c5-8a53-5cf972a49524", "comment": "Malware payload (Mirai)", "value": "91ee376197f689fe49e7ab6927482f6884a6ad37f19ad38b7850620cc11a3a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858477, "uuid": "d3c4cda8-08b2-4b23-abf5-d5b3b2643a82", "comment": "Malware payload (Mirai)", "value": "ae07680f4accf69ce3d2f7d5eb5abeb559770cd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858477, "uuid": "57dce810-2212-479d-90c4-20063dfaafd6", "comment": "Malware payload (Mirai)", "value": "81827037ddac38fe0cd92e30929685632b130e90efe3c081533d3ae58c5bf3182fe81b4293d95b4cd91e5f908c544a7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858477, "uuid": "4df1b8d1-1c49-463c-af32-8c640a67cbe0", "value": "T14BE3C50E2E394F2DF77AC73587F74D219B59738226D0C649D27CF9121E2028E641BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858477, "uuid": "2170bc0c-07a6-4f1f-a1d8-dd0130db08b0", "value": "3072:SLq0qZeexbPWK0TYIwzcfxE3wAlrhRgXfT2mNF9TOuAsCbYM34Oc2unP5jQgy9rK:SLq0qZeLjQtu0nkzGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783858477, "uuid": "133e8809-3a25-4454-aae1-2eb4c32ff173", "value": 155804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783858477, "uuid": "0c621324-98fa-493c-97a7-c57e662d4774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858477, "uuid": "ceb7623c-53cc-4584-abe5-75f417acb255", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e402682-7d8d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783818047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818047, "uuid": "6839779b-1a3c-414b-ad64-f3815bb13d97", "comment": "Malware payload (Mirai)", "value": "c485cba1a7ccadb6e9580f54e097668e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818047, "uuid": "be24d865-b439-493c-bf90-9dbd12692cd9", "comment": "Malware payload (Mirai)", "value": "92afb5b482be852d9e83533fb74558fd92b6513c7fdd4a18273ad1a674148c25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818047, "uuid": "bfe47702-892a-4b03-85ad-e83d703c3bcd", "comment": "Malware payload (Mirai)", "value": "3c491684147385c48b676efe88cbfd442c029d54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783818047, "uuid": "ae163844-2c1e-4272-b7e4-5b72040d5782", "comment": "Malware payload (Mirai)", "value": "8dd587d34d215255254c462f624291cea039a2a7dadff2d78904d22b98a5ef54aa41b7fa9eb034c8fb9d59241c6ab592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818047, "uuid": "bc2d872e-7c2e-4c08-8968-bc3971132148", "value": "T1483423BB7E308F55B9E8846EAA5B33D2E70B93D50255208206CE47EF039E55DFC25887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818047, "uuid": "fe3d3817-cdfe-4b01-adf4-1e45936dd6e6", "value": "6144:9B+t7BEc72WBR9+fEXfCyZ9+Jxx2KbRk63xZ7lSLAR:9Y1LR9+HyZ9+Zzk6rlS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783818047, "uuid": "c4bbceb7-5f83-4508-bc96-159f35b613e0", "value": 246052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783818047, "uuid": "d8acbfe1-8137-4e4e-89cc-8f40f9bcac6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783818047, "uuid": "24cb312f-342b-4457-b57d-4649125b2f95", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad81666-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843945, "uuid": "22f94614-7d0d-46a4-81c0-aa39fcb07f1b", "comment": "Malware payload (Mirai)", "value": "5708c7638ce198eae5646139dca23684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843945, "uuid": "0bd92d46-c0ee-46b9-ac64-4cdb1481ab7c", "comment": "Malware payload (Mirai)", "value": "9302bb14ecc2b8659e3189452a9e1a66c21e1d60e2ddfde26d15e804a01f526a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843945, "uuid": "02e41a07-d66d-4272-bf31-3ac4b9d2974a", "comment": "Malware payload (Mirai)", "value": "48b73f64dcc248b50f5f10780a4d3003ee75fe7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843945, "uuid": "7be546b2-0ca5-422f-a11d-1447f3eface0", "comment": "Malware payload (Mirai)", "value": "269f2af35dc13e1c49531b15c9186624fc2533572cb2acb80c63d7ed20c479c0a24f4bd5891b78263855693b6f32eadf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843945, "uuid": "64d41230-ddb7-43ee-a8f3-240177c52669", "value": "T14A636D07B581C0FDC699C2B4076AB63BE533B67D1239F2BA27D4FA236D49E205E5D900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843945, "uuid": "43ae7209-b601-4912-ae81-17ff474eb65b", "value": "1536:UoXJuUtarb3Engon3miFg72oNXpM5eyaOLu0hYBSrST5OI4J7HOXIM:UAHtwjEnF2T2w4ad0hYBSrKOI4dFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843945, "uuid": "22ad1607-b9df-410b-b135-574083c6c0b5", "value": 69600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843945, "uuid": "6262a31c-ffe4-4191-89a2-78888b0b1193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843945, "uuid": "08471c12-934b-4b10-b402-e757ea1b7a1e", "value": "XDx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba33c8d-7e06-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783870280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783870280, "uuid": "2abeeb6f-9fbe-4c1a-9391-30f25edb5fb2", "comment": "Malware payload", "value": "e459ce1ed82fe9161b4d8816c5da1a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783870280, "uuid": "eae6002c-6dea-4cb8-b8e2-0d9be1705006", "comment": "Malware payload", "value": "941def3b5eb0054ae91feb7a6d01a3d4708ad4be9fe04b939af1a47c961108be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783870280, "uuid": "48b3c90e-4f1a-46ec-8dc1-51d6466cddda", "comment": "Malware payload", "value": "770677d711f3f568f209966a0305925bbab054b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783870280, "uuid": "a67550b0-c292-40b4-bdeb-977322635099", "comment": "Malware payload", "value": "750597d344a162b7602fdc3abd04c2d8758108736baabab7a296b7978754982a98cd0cafe16f7904dbbe0c3d09f2412a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783870280, "uuid": "58923e5d-de3b-4b94-ad93-c926c93ec6e2", "value": "T1C908333C4DF5A19FDD7E9CFC0570D632EA2954551E2C788BAAE82432713340A067EADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783870280, "uuid": "abe0a2ed-0c83-4e2e-9092-3aba05c47b6a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783870280, "uuid": "6a848b8c-4be6-46a1-82c8-77764766ee81", "value": "1572864:mt9IKPPlMiYdeTqowzKYypCPRfYLgRLlPBnU6InslAnRSAI7:mUKlZYHoyKYyuB/5PU6InsoRSAI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783870280, "uuid": "52b0d684-f4f6-4389-87a1-32d1152e32eb", "value": 77169564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783870280, "uuid": "4447e2b9-2d49-4b05-9d31-71d63e6bc491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783870280, "uuid": "3f65fe03-a2d7-4331-b1f7-7853221c35d0", "value": "Game_X64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee076097-7e0f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783874230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874230, "uuid": "7deaf418-88bd-4c1e-94dd-913336cda62a", "comment": "Malware payload (ValleyRAT)", "value": "c32aa7a605881e7389eef939e2f0e7a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874230, "uuid": "dc8dc60c-7d94-43cd-8e51-a5c53146c741", "comment": "Malware payload (ValleyRAT)", "value": "942be7e0bd06baa6436f3d441f2fed1344093a5a4cf895f88f8a37cc2b05cfb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874230, "uuid": "c6d4d1c6-ee6a-4fc4-bbc7-4971bc4bac1a", "comment": "Malware payload (ValleyRAT)", "value": "f39cd84fb08f0210bcf2e6d288173a651ae44b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874230, "uuid": "24361396-4684-4d75-b012-9af8c8b8081e", "comment": "Malware payload (ValleyRAT)", "value": "84dc095781a8b09c429def81d83a860611942488b718ec4582488578f923a97ed43f1bdc68b77444c28b40331cb5acd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874230, "uuid": "1315694d-7c55-4c98-8c37-504ac923180b", "value": "T19847333B714A7539F02A0935E9F295F04A3B7DD066124CD2A7E4F89FCB354F41A2E682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874230, "uuid": "262bee5a-f70a-42e4-ad73-dbee4fa8829b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874230, "uuid": "5ad067da-5628-4799-9165-5024e8c4565b", "value": "393216:vmHqXppdRVd5DBcmxl/u9SNrxXQ0fQnwnbSdF1Wk0+kRE6f5IJmn0mKl4G4:fnZZlYMdiwnbSdjWkGf5j0mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783874230, "uuid": "12f3d155-babd-4040-8a4b-8a700ab7483d", "value": 26274982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783874230, "uuid": "05a05cca-f4c4-4a0e-89cd-9dd1422e01cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874230, "uuid": "09daf947-dd62-40a3-ab5b-64c80ca14228", "value": "pfd26312000003381626281setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bed980c-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892131, "uuid": "52e63318-923d-4691-b2ec-ace1ffd398a6", "comment": "Malware payload (Mirai)", "value": "99b1f60ef1d9eacbd69cd62d0d7d1520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892131, "uuid": "2f1639b7-30dd-4345-8444-fa6e96ef3fda", "comment": "Malware payload (Mirai)", "value": "9453e63799fdac8cc20d17d3d6cae8aaae73a6ad69cd1732efd3352d68de62c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892131, "uuid": "aba423ca-c68f-42c6-a2e5-439ce22abf03", "comment": "Malware payload (Mirai)", "value": "808d16f4bba10c33f7fc1211a1611370b84eaf4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892131, "uuid": "4ab9848b-fd47-43d8-952e-5455c7b8c707", "comment": "Malware payload (Mirai)", "value": "f2ba016261eb5a2b67f8915295781edd3054f04517585e2db4a239dc13544e6c347311a5e31ab2a7322ecb589400b2de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892131, "uuid": "82ebc548-a495-4c0d-a6cd-c0d743e021b3", "value": "T1DC13F1C1C5676102EB35A433385FF5D5AF1B32D8BF865B6AD2A27426046EF143F38A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892131, "uuid": "f7c15852-63e8-488c-81b1-9d889bef86d6", "value": "768:u7wpHaIvhh3iwkg1HTfdzoUaitD5k0dWj0c456OMbAD8DnqQkrb/MnbcuyD7UHQj:awHJh3i5g1HzdwitNhdnDam8jlkr7MnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892131, "uuid": "72e92988-dcf3-48f9-9e52-66e6ef31a71b", "value": 41780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892131, "uuid": "f55932ac-ae07-4baa-9e5d-eca2dff71149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892131, "uuid": "08d1943f-1e8e-4a23-964f-5f0a8f95d1ac", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae39e1c7-7e0f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SliverFox)", "timestamp": 1783874123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874123, "uuid": "719ea2a0-e295-4d18-8ae9-0fe3d9aebf9e", "comment": "Malware payload (SliverFox)", "value": "c6675a6348ce6bf6893c8ac4914ba9bb", "object_relation": "md5", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874123, "uuid": "a9ddaf25-925b-4c79-8ff4-4b614cdd884f", "comment": "Malware payload (SliverFox)", "value": "9569536b0039412115aab58dfa315a1f71af1b7294326ccbf7411fc3d26fa292", "object_relation": "sha256", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874123, "uuid": "2dbe3274-57bd-4d00-b26a-140bc32a3ce2", "comment": "Malware payload (SliverFox)", "value": "ea919098f869ef2fb4d352ec8d7f5c36f7eb2638", "object_relation": "sha1", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874123, "uuid": "9a2caf0e-7a05-4aa7-b8dc-5b9453ef7fcf", "comment": "Malware payload (SliverFox)", "value": "60a56f7562eeb06f0d486b37149922497cca1567131ea95f3103da17c6e583a45ca2a6c0a0faf8f44c5c7c33786d57d5", "object_relation": "sha3-384", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874123, "uuid": "2c65795f-dead-466b-950f-55a9a10039ca", "value": "T138A63381A4C639B0C04FCB78649664FEF0253FD2BA2E4D1A77D4B61C5E73A2934B9349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874123, "uuid": "347feca3-ebe5-4dcb-8509-4162c5abc50a", "value": "196608:hP/h3UZiMppzYvOQVqqNjazBtflL4ciUj1jdWW+mRr+geo:hPpUsvO33zbflcJkF+m2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783874123, "uuid": "9af4d440-ff46-452e-8a0d-5611574226d2", "value": 9752576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783874123, "uuid": "4dce1aba-e065-4d73-9270-0d61b13988cd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874123, "uuid": "06c6d069-96c0-484d-af2f-578d6f43cbd1", "value": "app_setup.6653001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73213465-7dad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783831933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783831933, "uuid": "86b47249-b44b-409c-8a5e-62f5517decd4", "comment": "Malware payload (Efimer)", "value": "419b410a2449adff6b6fa61504fd23e7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783831933, "uuid": "2c16bd25-6490-408c-a38f-85cd01681efa", "comment": "Malware payload (Efimer)", "value": "966f8030e53f9f7874adba182b4d91c87defcc0a99466d30ca2c4dc4ca070d95", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783831933, "uuid": "ea7eb600-077e-4e9e-af58-a8f5b64fcba6", "comment": "Malware payload (Efimer)", "value": "1c48d98f523747441f75f854ad68f70dd3b9d673", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783831933, "uuid": "925991fe-2de3-4003-b0f3-c42b051a2e4c", "comment": "Malware payload (Efimer)", "value": "042f4ad70346f25f6f9dc2e0505ca88c87a740f2f2890a63b5afd5747552b028725eef28d5d72f66111ebca6bac3c2a9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783831933, "uuid": "81cbb62a-8258-4969-900c-ea3a205e40c8", "value": "T14CE63368AAD003EFE6F2013CEDB05574D87874B15B72C6CF22A456699E170E09D3DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783831933, "uuid": "35dbf3a0-9369-4e66-aeb2-788cadbf3742", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783831933, "uuid": "d61f928f-82f8-4928-a118-9fafa31fbfc3", "value": "393216:SXGkV9dpfNTA+FXnCbKOXMCHWUjXQcuI3/PGTAI:SVPpu+FX0KOXMb8XFH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783831933, "uuid": "718b6aa6-896a-4370-b617-782296961cbd", "value": 14272859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783831933, "uuid": "3b04368f-643d-4d5b-aac2-8db287985f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783831933, "uuid": "ddfdf217-92c6-4c85-9995-e621d0ae87e7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c2b103-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823803, "uuid": "4dd5d3d8-a79d-413f-a5d1-2a5af010423c", "comment": "Malware payload (Mirai)", "value": "4cae732539ab3103bbdf3bdcb3638e70", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823803, "uuid": "219c2cde-2c3b-41b5-83db-e4526474564e", "comment": "Malware payload (Mirai)", "value": "9679b99144febbed9aae1222361e08578897e83d9b5d12024850a8aa57a011a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823803, "uuid": "565abd96-9bb6-413e-a2c1-182a54337a62", "comment": "Malware payload (Mirai)", "value": "b1936c1cfbffb262e761f71edf4a4244720637ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823803, "uuid": "eb7da7dd-68d2-4094-a82c-bfd39f408fc7", "comment": "Malware payload (Mirai)", "value": "d3f95e348bdf234568514db106068f787d7dfa4743780e5d255ab5f1fb463a237d0bd4a45c6131d30c8072b1155ff05f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823803, "uuid": "6b3c94e2-4460-4516-8bcb-4f3d5a9eea3e", "value": "T1B2111786052489CDDD128E44F7A744C0DA4D429BFDA3BB0EE9D5456BE4ACE38F4DCAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823803, "uuid": "0aa757f2-4741-4fa1-8184-e58dd9559f7f", "value": "6:hCQzhSpSe3Ko3g3vS5Se1Jotr8cSeODJoO3r+Se/Fo/q+tSeBob3NF5Sef0oCADR:MCEUx2XDBKhU4vDjkUPDfKYUeNIyyAAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823803, "uuid": "f915886b-d1b6-43d7-a8a9-cc6fa1a0964b", "value": 900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823803, "uuid": "69874ea5-8e72-48ec-a33b-53330bdb36e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823803, "uuid": "1d1e1789-e1d8-457b-885e-eb78ef198b19", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d9016b-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843857, "uuid": "35b259ba-da5a-48fe-a99f-73af0a068b02", "comment": "Malware payload (Mirai)", "value": "545f8eb277b12fa68abec6312977724b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843857, "uuid": "bdf9c5a9-0590-4f24-aede-dd710e2481c5", "comment": "Malware payload (Mirai)", "value": "97566e3372ee3d461296866f0567cf353381f2be766a6bee31f037ebb28bcb9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843857, "uuid": "b11c0d77-057e-4fb1-bf9d-aec8b9231f60", "comment": "Malware payload (Mirai)", "value": "729ab27a47f6eaa5f7891b45ed727afd68ea2165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843857, "uuid": "72a29cd6-42fd-4ae1-b721-9f6a7b8dc5f5", "comment": "Malware payload (Mirai)", "value": "b140f043936f296c19265512ff99171cb11560dce10b6c9e2249e468ac9806e9b0749334fe1172192e700385246b8920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843857, "uuid": "db77e954-b771-494a-85dc-f370cbd7e27d", "value": "T18703F148E1FDFA98D5C5583F0AFEB73A9C819529F4A0CB6A93E46317F02271A2C47084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843857, "uuid": "31671e70-ca4f-44b4-b5ed-85af44f86bcb", "value": "768:yI6G2kqD3GsY942+sOVgPJQLd1QU/K/vrITBynbcuyD7UHQRjl:BV2pD3GsY/+Uv7vrITBynouy8HyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843857, "uuid": "71dd0fe2-75e8-4237-9c5b-635ab57e43a8", "value": 41312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843857, "uuid": "c3446640-299c-40e4-a0f0-38c33b0bbeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843857, "uuid": "1d76b8e1-525d-4f03-bb7e-f1a61981bf4a", "value": "ar15.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9370a43-7dc7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843298, "uuid": "d643b4cb-ed81-4d1d-88c4-993e2ca6513b", "comment": "Malware payload (Mirai)", "value": "2c1ef9fddba7210e8fd9d0273b98fd43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843298, "uuid": "0bbc5160-2a2f-4266-9a03-571665f74eaf", "comment": "Malware payload (Mirai)", "value": "979b8d7e530ae28c2b86d39ad15218d13072b4008fcd02e4750635f41968e857", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843298, "uuid": "8d8656d1-e184-41c5-ac07-e0aa92e07d96", "comment": "Malware payload (Mirai)", "value": "975becfe48c125186ec5fe2dbfe621aa3411d6bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843298, "uuid": "6452683f-11d6-4af4-810f-c1a57df63b27", "comment": "Malware payload (Mirai)", "value": "7a0905d466fcd6112ed76f12b4148f2aa87977ba948ec29f1c29cd6cd291228f0c778c72f884734e2d6e79bbfaca086f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843298, "uuid": "7db15eb4-a624-402b-9205-63aaef11e6f6", "value": "T11D948E52EBA3D4B2F45200F1210B6792A676D934203BD9A7E7D61D74E930BD0872A37F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843298, "uuid": "f788bead-8421-4f79-9fca-f9628e1ab0a3", "value": "6144:hOVSxeaQ6uu9wW2kDg6/lP+VoONo/hhwpJvJDN3ux6ktnHxgY:hOEzQL4DgK+lEhyvJDsHaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843298, "uuid": "fd67017f-ade8-47ef-b451-a885d9de4587", "value": 444676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843298, "uuid": "81ab0ceb-8c8f-486e-b407-bc3955932d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843298, "uuid": "d73f45af-8a94-4ebf-b842-fec849425dab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8ba48e-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844031, "uuid": "755955b3-f768-463d-85bc-778c59225564", "comment": "Malware payload (Mirai)", "value": "4acd58f4655a2f36e27d0df7cff066f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844031, "uuid": "49594038-0571-4787-b65f-87b235aeed34", "comment": "Malware payload (Mirai)", "value": "97edbbe31be3c913352b6a8177cc653be71c6b4cd7705f3f00fe145aa6bbf6a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844031, "uuid": "acc58ff4-c69d-492e-8318-cfb2246f430f", "comment": "Malware payload (Mirai)", "value": "20cb7bc9074e8a52b83e13aab225ffa8df21a590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844031, "uuid": "6d794842-90ea-4745-b50a-866f00052cf2", "comment": "Malware payload (Mirai)", "value": "12d23e93df3161681f5c96c0206dd28edf96ffa1847e6566d8c930f0e5f929426f6cf3d5ec44f10763a72ed24defe06a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844031, "uuid": "b4e24891-17d0-41a2-8334-4394ba0f23cd", "value": "T153833947B981D0FEC459D03887BF7637C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844031, "uuid": "34ef44bf-9ad6-439c-8a3a-dc1b1349032e", "value": "1536:0THF5amJjfczdAyI+uN80EVkCkj6Rv3U8GbdGrAyvTZol:0THJFczdAyMNKVkCdRvAbdGrXTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844031, "uuid": "1c92b0d8-9904-4b02-aab7-0e0872a14d0d", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844031, "uuid": "ba07869c-33f6-4b4c-a2a6-f1f45cf9cc18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844031, "uuid": "20179849-ef1e-4333-aa30-ca877de32363", "value": "ar15.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdb2b39-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854745, "uuid": "2a92eb98-7388-4321-aadc-10faa1ab504f", "comment": "Malware payload (SilentNet)", "value": "811dd3f7ffc02f4221668a676d18f01d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854745, "uuid": "bf669ae4-8a38-4eec-8a36-ae34473ba8a4", "comment": "Malware payload (SilentNet)", "value": "98106340b98a635dc433a672ab2c1fccf2b714928c43ab9cc96e390a8d6dbe99", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854745, "uuid": "b3beaa50-15d3-48e7-be03-c0e9e33396f4", "comment": "Malware payload (SilentNet)", "value": "a666f44ea7deb3d14f99b0bfd64d5a41bc836d8d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854745, "uuid": "4ead9228-46dd-4d4f-a35a-7d8d6dfdba23", "comment": "Malware payload (SilentNet)", "value": "35800e04f8db080e3aa0ce3a448b3a3d14302929373b34b3c3202a6599a1fa925aae2080d4140369ad935978d65c7394", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854745, "uuid": "06cef382-72f9-4a79-a09a-b30122f6cf6b", "value": "T1F6A6333EE889DE38E9E6B09942E0BC12F17067C9E01258F9675C373DD41670AE79C61B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854745, "uuid": "a2a67de0-6647-47d9-9a1a-f0edf2f7a87c", "value": "196608:6Aq+n9sHuJCd57gPl0F2FSRwj7TZSl71BkNnvf0aLBG3B4ZifMzF2y1PPtu:C+n9sOJc57g7F17E5gZvckma9F2KP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854745, "uuid": "2c7db8b1-5cc4-4795-ae70-57e95b19250c", "value": 10312760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854745, "uuid": "83b21aaf-bd87-466b-bca5-48287a87bd5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854745, "uuid": "99e85c52-0916-447d-b275-09a9c3615a99", "value": "QearanQlient_1.21.11sn.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a59a38f-7dcb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844804, "uuid": "bfe6be87-aa18-4e1d-9754-cf701b6e35a3", "comment": "Malware payload (Mirai)", "value": "f3f3cf94bc8076388fb662444085f3e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844804, "uuid": "2beadb80-3123-4340-a23d-018940eae8b1", "comment": "Malware payload (Mirai)", "value": "98314dc2da8bf9ce92add44e6c60da384495045427c291dd15f10909b36c461c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844804, "uuid": "02e4b171-fe56-4fc7-a1fe-782bdfc152cd", "comment": "Malware payload (Mirai)", "value": "3f9ce7662bbe304b9c711084bc422c220c41a140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844804, "uuid": "afaaec39-40de-473c-ad90-b977a49f75c1", "comment": "Malware payload (Mirai)", "value": "5578dd967ecef316a4c3823569fc031aa107369b22afdc9e9df009359e4262ea6b6a4d10a7caed45e2390c8b8e3353e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844804, "uuid": "222cfcd9-9531-496b-8e5e-11213c5232dc", "value": "T132538E77C92C2E54C25542B0F871CA791793B08482971FFA5A99C6BA9483DECFB093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844804, "uuid": "04637c76-9485-483e-b357-96339485c93d", "value": "1536:hIatwtTyu6UlGF8te90OZQgzHcLitKUJnl6/4nCCM1iVuQfV/nm:hIOXu6UlG6te90OZDzHcHUA4nCpikj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844804, "uuid": "c435c572-9e37-4e38-bd4a-555f55b6280e", "value": 64744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844804, "uuid": "3bdf587b-b3e2-4bfa-9f35-d02f9da2dbf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844804, "uuid": "4035be51-f695-46ba-bc64-ff3559828271", "value": "XDsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef0bcdb-7dbe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783839282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839282, "uuid": "e4b2f52a-eea3-4851-9aa9-f01fc3b9fae5", "comment": "Malware payload (Mirai)", "value": "862f6c480dd4c9b37803c7fc3a79ffd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839282, "uuid": "429ae70a-213e-4c39-9e19-877fdcc9522f", "comment": "Malware payload (Mirai)", "value": "99863fca0df6156e734ca682fc7d4b7e518013908210247d5f8530049854aa6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839282, "uuid": "8aaa7db5-71c3-41eb-b827-8edbddc18cc2", "comment": "Malware payload (Mirai)", "value": "bda92b798b6e7eb657558d2d50ca63a8de4b0e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839282, "uuid": "fc587705-627b-4ac9-8a14-73680c2b8893", "comment": "Malware payload (Mirai)", "value": "69de75efcb8714156acc6c957f4032299abdb12f30365bbfb439c0f528dd34125187563d3dc9c5c4c660e35c5dde6569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839282, "uuid": "87bffaaa-f636-42ba-b7e2-602da2267b2a", "value": "T198832A97F401DDBDF80ED77B4463490AB631A3A106830F3A675BBA67ED321945826FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839282, "uuid": "d479114c-d1a9-4767-b76f-1f0dda64761f", "value": "1536:4jKI91vPGP54FwSAakqE8Pc/CbmjhFaipTO1f7/aNisFp+/qXvm8:4eI9FPrOSbkqrUGiZOxmFp+/2m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839282, "uuid": "681f68e7-6970-4f60-8f11-ed0745e3a9ca", "value": 81860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839282, "uuid": "b191942c-7ddf-4a4d-a0ec-671d58573833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839282, "uuid": "2a2ff73a-8fca-45a3-9208-8dd6f9ef009c", "value": "XDm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0293149c-7e2e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783887150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887150, "uuid": "20694d3c-e618-44e4-9e7f-d6c7b49c7234", "comment": "Malware payload", "value": "117fec7c4271a4e50d4cc60ad32bfd15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TONResolver", "colour": "#0AA367", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887150, "uuid": "c220a79a-6a5f-4153-8e66-68581d074efc", "comment": "Malware payload", "value": "9a75e798a71c2541f17102128f7c546288bbd3eb30b6b2b4948b17e73873a510", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TONResolver", "colour": "#0AA367", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887150, "uuid": "bda7b40c-b065-4c98-99fe-8984b3244a0d", "comment": "Malware payload", "value": "87764506383868490b0005dff9d05d0a3f1d0354", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TONResolver", "colour": "#0AA367", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887150, "uuid": "f17bc282-0914-4a14-9da0-8e992cc58477", "comment": "Malware payload", "value": "46bef0ce6f91cef05e67f8dd1fe595985ebab00f9969a681a70b8267d24fbd76280434ca401e28fc51da3cd3e93a0d26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TONResolver", "colour": "#0AA367", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887150, "uuid": "8586a979-254d-4551-97d5-2f41bcbeb032", "value": "T1EF64E9A8279EB0829D796C776D23E154F8194C9D52C8502CFBE078EFFC6431A85AD6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887150, "uuid": "8010b672-abda-43e1-917b-9d1008a4a3fe", "value": "6144:EF0acaOsFKi1Z0hT3769fBELA6uRUCF6HY0mMT1GmBQSx:OXpOPmhxHRUCF6H1m+GbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783887150, "uuid": "f493f909-849f-4cd2-9364-50293e6d0fb0", "value": 311038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783887150, "uuid": "a55c03da-ec4d-4ec5-a777-780de54a99ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887150, "uuid": "0022eed4-fde4-4074-b94f-f800eb5ee73b", "value": "a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6b17a5-7dc7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843227, "uuid": "0bdddb34-2a79-448a-8ca5-f4a7f43eb6ba", "comment": "Malware payload (Mirai)", "value": "2d39e673ff63f1bd0458ad5050b76813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843227, "uuid": "4ea84e7e-3a6b-4dfa-aa34-a6f83fb43492", "comment": "Malware payload (Mirai)", "value": "9c07f6a2cf47dcb2c3994f303d0005154ee4d121e89ef5bd4dee439b2bec1d31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843227, "uuid": "e511b3b1-b5d4-483b-b96d-f492afd3653b", "comment": "Malware payload (Mirai)", "value": "b6de5ac549e490b214bb63a9ddbbb8a0884815ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843227, "uuid": "dcbb61f4-7b55-4346-bb5c-98cfd966ce81", "comment": "Malware payload (Mirai)", "value": "e11ea53c59703128d8f28e2797436fc9ec8bdfc80a290ba0d3ec889dc464a5889c5b000c3ee4c631ceeccb8dc731e169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843227, "uuid": "580d48d5-70fe-4a4c-8ef9-1d64fed96c9c", "value": "T11C24133FFF466FB6CD4D406A9B491E8F6D72B85C0D02284B85B40ED252B587B274EA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843227, "uuid": "a4a68e19-e116-421d-ba85-de692496e648", "value": "6144:Pif+5ALxvOVpG2r5HvgR766XM1jkb7FWQDJpsn1UOz91:6fuALo3G2tYA6X4+7cys51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843227, "uuid": "c3a04ecc-1ac0-4e0b-9ab6-738136d0caff", "value": 221400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843227, "uuid": "a06e9b27-76d5-4bd5-9dda-aa4da98b9637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843227, "uuid": "c751de35-1035-445e-b20a-c28df563e3ae", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4097307-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892145, "uuid": "62c644c0-32b8-44e9-a759-c798e9f9b6d6", "comment": "Malware payload (Mirai)", "value": "551bd323c2e19a92964a6c66d892ffb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892145, "uuid": "8a4d5c03-b82d-4652-9056-f0a57a21750c", "comment": "Malware payload (Mirai)", "value": "9d140cfba3ee024ebbd61bed8781126c0b9abf796bcee9e7061e43e27fa1160f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892145, "uuid": "47a77650-5deb-4202-b09e-f71806e6b407", "comment": "Malware payload (Mirai)", "value": "0c922f6b727d51686c40393d87832da7f70d24df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892145, "uuid": "1d4dce24-01a6-4a57-9afc-b9abd4f217d2", "comment": "Malware payload (Mirai)", "value": "7c049d10da57e6dc4276ab30037af13af568b82ea154132011c701a412afbf5579825de2ee9f98ddf407f8bd788460b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892145, "uuid": "5a6236db-81c8-4be4-93e9-26463384a387", "value": "T1F0A349C5D6C3D8FAFC5204362026BF36DE33D67E212ADE87C3AD9A21A831511C61A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892145, "uuid": "001a1afe-cf2e-46d6-abf6-98b36eae9c50", "value": "1536:NFyiVawbC+RJ8dA4MP2Et/U9WViSu5jrckeSH:NQ7ARJaJAt8oruZrcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892145, "uuid": "c1cd6580-9e8f-4886-91e3-fda775bbcddd", "value": 100968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892145, "uuid": "3de00d9b-9760-4427-98a8-5f39ec6f93ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892145, "uuid": "ecc350d6-4191-465d-b087-fb1a83a01a4a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9c5535-7ddf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783853537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783853537, "uuid": "14bbf1e4-fb3f-45e8-909f-bc17abc23378", "comment": "Malware payload (Efimer)", "value": "e46ec6ae24369ea0ad3d4c0a15fa465d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783853537, "uuid": "7bedb39c-8d7f-4d06-a714-6f33267d472d", "comment": "Malware payload (Efimer)", "value": "9ec85a59cff749c68d63d7903000c16862f8325b68b66d2111b0564955b8d614", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783853537, "uuid": "ed292cf3-aa18-4c6f-85ea-5db12339bb00", "comment": "Malware payload (Efimer)", "value": "4456607c550004c7b11debca35534a4505d30d79", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783853537, "uuid": "1ed1df08-47f2-4e2d-87b6-53c936a9f16a", "comment": "Malware payload (Efimer)", "value": "fd201c710e9598e9a956b06fe53184ff07121df3d4a4f19628be510202a115a6f18b4043f9cccaadf28305cde5babd22", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783853537, "uuid": "f74cbac0-966b-4941-9446-be4b178e9c71", "value": "T1FDE6334869D106EED972403CF8A183A6F9AAB4B35B72C4CB17BC83677D272D04A3D517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783853537, "uuid": "b65edb6e-dc9d-4bd6-963a-11d4def9d356", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783853537, "uuid": "3de1f9a8-0de8-4d8a-9598-9e407367c1d2", "value": "393216:gsAFiiD8EVdcIUXMCHWUjXWcuI3/PGTAI:ghb8E7UXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783853537, "uuid": "d5bac828-bf13-4893-b336-ccff48a637ed", "value": 14315656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783853537, "uuid": "9bd297a5-a92a-4f35-b080-aebd65cebc56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783853537, "uuid": "fceed1ca-d7a2-4c99-8d7d-c1d11596e0d3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d782446-7dbb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783838017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838017, "uuid": "900655f9-1393-46a3-92a4-5bd7393777ca", "comment": "Malware payload (Mirai)", "value": "a1301e40d42a25afef6ce65b984cfc6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838017, "uuid": "ce22b1f4-8ea9-480e-8ea9-f0a5b2500689", "comment": "Malware payload (Mirai)", "value": "9fb33d5e98da420db03efcde6e1dfe9604e0dbd6fd638f556b8696770bcf0096", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838017, "uuid": "c34d0a2c-5cf6-4523-ba5f-225f9cca87d0", "comment": "Malware payload (Mirai)", "value": "e7df00f789648596bed5088d65502a26689317c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838017, "uuid": "a3152bc0-e4fa-4f9c-b3e6-a56f6a898cc4", "comment": "Malware payload (Mirai)", "value": "52a25ffedcd7b126271110363de1d3cddba063cd3288a84f66315c539598e261b94b06ed8e8aa8c977458cb4cd3fe52f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838017, "uuid": "b7c86a33-ea94-4a93-b417-99fcd3f7ac24", "value": "T170F34B46E7818A13C0D61B79BADF424533339B64A3EB33069918AFF43F867AD0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838017, "uuid": "94cd11a2-6b39-4421-96d0-6f861f0b45e2", "value": "3072:WPNLTE1RQvS5b7QpkzbAaBOjt66vFuLM/9X/1GJLMm1w80WiSh:WPNLonQvS5bspmbAa6t66vF6M/9X9GFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783838017, "uuid": "c8245963-5b17-4da4-8116-c372504b7a55", "value": 168052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783838017, "uuid": "bc208a4c-551f-4591-b5db-1c145ddb660b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838017, "uuid": "656c6edf-6b61-44cf-b8c6-ecbb6c6872b7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7055c0b3-7d94-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783821191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821191, "uuid": "7e53cf83-e413-4449-a70d-37ca9d622e34", "comment": "Malware payload", "value": "a833313dac6a135f1adcb4e829c229bf", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821191, "uuid": "1a4d455a-7f7a-4272-941b-15ced5e3a948", "comment": "Malware payload", "value": "a236eaa0c659201680739c3dcbb028a5d58de8b11471d3110a03e82d029f7aca", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821191, "uuid": "5f01f48a-36d2-446b-a9da-4f40f1310cc4", "comment": "Malware payload", "value": "bbcdf4563d2f9222f17f2a362167d552ebb8b83b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783821191, "uuid": "4dbc7f63-ed6a-46af-84b7-4f1db36b0c89", "comment": "Malware payload", "value": "e9f291f9965ee36df19165224f9a67d1b6d823bd9a9725366c0d46f20b63ea5ae2d855ebdc20673987fb0b1114692f0b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821191, "uuid": "480371c8-2645-4d31-be6c-b4f2575adb0c", "value": "T16147224BE70DA81FDDE6F5798D7A0232A02758A85306D7D72902F12CEEA7AC54F04BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821191, "uuid": "b199a84d-b863-4790-af1c-e8ee7f9841f1", "value": "393216:CZIQwWFMa0o95KGI8hoPG4q9IjxKfINktlx3owpIq+ZloCO1QxG+Wx3eZHLGTkxM:CdHN5Rx0G47jgfISx3bpIbGaGb3eu6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783821191, "uuid": "255d1ee4-5404-45a8-abae-d8f76c82d4e4", "value": 24741313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783821191, "uuid": "f3d05be0-df7b-4faa-b3c7-4359632125f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783821191, "uuid": "91fc776b-f135-40f1-af78-f3236f62b162", "value": "Phone+Clean+Fix_1.0.1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a651ccec-7e09-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783871533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783871533, "uuid": "66b2b1fb-b3da-4d31-97eb-b333431eb126", "comment": "Malware payload (Efimer)", "value": "fb543254ed01bd259241edde0000157b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783871533, "uuid": "fc254502-b0f1-4930-86be-e566a163b397", "comment": "Malware payload (Efimer)", "value": "a4c79a72a8aa38058a43b502d2a7faf04b8367f18875468f37d009c235a9249e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783871533, "uuid": "59fb961d-a94b-4d54-95c1-b3920bac16f5", "comment": "Malware payload (Efimer)", "value": "c567472add370e797468c22b8b943bf61855853a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783871533, "uuid": "2e540f9f-3577-49d5-85d0-0624294c418f", "comment": "Malware payload (Efimer)", "value": "e980d4fe612b55b000eac22bd23dfb2e655244f97c32438914673dca5510154cacc86f8ad9ad2e7980ee8b7ba5728080", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783871533, "uuid": "1cadee71-7895-4ac9-85c3-c3a979355e3f", "value": "T1DCE63309A5E042FEE6A3913CEDE296B8E570F4531B31CEDF07A48252AC972E1493D717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783871533, "uuid": "0a91e170-5933-4a2a-8785-7d943600f652", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783871533, "uuid": "d77232b8-f650-4dee-ab97-0eacb361ea1a", "value": "393216:mvYg9FBFlBSkydKJ8qCXMCHWUjXycuI3/PGTAI:mvZ7zSkydKJ8qCXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783871533, "uuid": "007245a7-e5f7-4600-844c-1509c579d5e8", "value": 14303692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783871533, "uuid": "9321c2e7-8321-4144-88fa-32fae8df85aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783871533, "uuid": "c6f37da3-78ec-428f-9fb9-740ee9c5856b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8080482-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823862, "uuid": "3a398f2f-cdab-4f26-9eee-ff91e2fc4877", "comment": "Malware payload (Mirai)", "value": "6d90bb5cc519bf7937952b40c45f2306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823862, "uuid": "7475bcd0-4891-456c-9068-c521ebc042b4", "comment": "Malware payload (Mirai)", "value": "a77c058ead923018c2aaf9266e7d2ee57a40f97de14a52282930dcac96f9cec0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823862, "uuid": "63ab6536-a66d-4725-9c35-b333094eef56", "comment": "Malware payload (Mirai)", "value": "2c37bd39a6a7a05299810824b815c5896291a578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823862, "uuid": "30051a15-4599-4a07-9650-ad97fb70fa0a", "comment": "Malware payload (Mirai)", "value": "8272fc88910b01cb55700c58ead7274a11812b083f5b0f7e9179fae50c4b02c98f3670ce6ea76850fd4a509289971373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823862, "uuid": "71f42cc4-e0dd-408e-9904-e7752ad951c5", "value": "T1F4C33A5CFA17C0F0E5C345F1067BA7AA963B99126237F1E2FF562762F871302598922C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823862, "uuid": "bf88c3ad-086c-40b7-8824-8b75989b6cf3", "value": "1536:tjpIk5FphkrM2kSXrakAf3/3ABhjodBZb2ZDKjwcMZp+U0Y1xWIpyiH7:os0w3f/3AkBZaZD3cMiqxWIpyiH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823862, "uuid": "1e1251d4-77ce-48ae-8819-67eae0f3e21f", "value": 128380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823862, "uuid": "8d516689-1b2c-4e5b-8caf-c47dfc1093de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823862, "uuid": "908ffc42-651e-4d76-9984-2ae6f2425490", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6244972-7dbe-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783839455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839455, "uuid": "4530e1a7-1f74-47bb-b1dd-ee04eedf23ac", "comment": "Malware payload (Mirai)", "value": "89a333e1aa18bde1239eab8e7f0d0fff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839455, "uuid": "f9d03489-2ea0-4a3c-a6e3-b8ffe8ba743d", "comment": "Malware payload (Mirai)", "value": "a7bd675a3169bb27d847529fa48b014cdfd976d2b7181ada63c7ef0d29ed64d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839455, "uuid": "c6d2ce3f-5070-4a12-a4bd-e1fba04cf24d", "comment": "Malware payload (Mirai)", "value": "dd53f897de2a22cc94a4f4cd192987132a8a108a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839455, "uuid": "5477a334-3559-4de2-9467-c707584aa549", "comment": "Malware payload (Mirai)", "value": "d9587428ef140bc9ab6788cd965c6a68831b9108eb48ef63694b29a519a9ec23b111cb8817515b736a0d34721f1b3575", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839455, "uuid": "c86f1ede-fbac-4c56-a32a-991ee782b239", "value": "T110930806BB550EFBDCAFCD3746E91B0535CC650B22A92B363574D918F54B28B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839455, "uuid": "c497120c-dd3c-426a-b863-e75c0e455bf9", "value": "1536:cpikwRXiybTnHenWe7Q9ojjWszWlEyWtZ/gKe0E9a+0jBkmV/RAd:cYkwRX7y3bzqENtJ+Hjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839455, "uuid": "6c377f9d-3a38-4dd6-bf09-8d465e412182", "value": 96744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839455, "uuid": "d0f0b3e3-812f-49cc-9774-8061529dd14d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839455, "uuid": "d15cdb8f-59cb-4a15-a4a7-bfaafcabb9fe", "value": "XDmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be634a4-7dbb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783838015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838015, "uuid": "ae19505f-a2ee-4893-b780-373123fb231c", "comment": "Malware payload (Mirai)", "value": "385939b9618fa1ecf2e9cfb726ba0a21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838015, "uuid": "9b64fc43-acd1-40c6-828e-89a48fc2be53", "comment": "Malware payload (Mirai)", "value": "a81acebfd23404a4505816130e27185e2a8d59f1418f4ce0b3f1186600a144c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838015, "uuid": "66e87e1f-ed74-4172-8a18-523eb85b6ab3", "comment": "Malware payload (Mirai)", "value": "6f5dbf56ba5cb16d3c2e025252ef2e74bfd30552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783838015, "uuid": "40cff324-da18-4c52-b4c0-2842389142cd", "comment": "Malware payload (Mirai)", "value": "3f4da4cfe35d1d48d5b6839df1abbdb6e2d3b983793c3ec7aac2c6b73b0fb4539fc39859c91f773d0af4da469347d591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838015, "uuid": "d5d31524-fcbb-476a-8bb9-4bb3126044c3", "value": "T186E32B07B98080FDC4E5C1784BBEB036D932B45E1238B25B27C4BE266E4EE615F6D725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838015, "uuid": "32bc5068-a3a7-44b3-b5bd-152cf0b38c12", "value": "3072:BofVxS38YYejOg2b2U5Q9dC/Agf0TOZjfm6kH:KzsGV5LYgpmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783838015, "uuid": "5e738d36-a844-4991-8e8c-7f6ea4c561e0", "value": 147640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783838015, "uuid": "9e65a7a4-6f6b-4a3e-b2e6-d876b6d4d335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783838015, "uuid": "78db2e62-bd77-4455-a5ef-cacce3bd639a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406031d9-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820681, "uuid": "caa9ec9f-c564-4afc-98d5-8ad94d7de504", "comment": "Malware payload (Mirai)", "value": "08984c6587a270ee930f40c314429f40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820681, "uuid": "b74b65bc-4509-4588-bc7b-4a00e7efa835", "comment": "Malware payload (Mirai)", "value": "a8a60a1ca586d6b3b8a2cdb7058ca20665318bc1743c75b7b56101e9ff06f814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820681, "uuid": "7a387ae5-2012-49a8-acf8-b5cc8212e9ad", "comment": "Malware payload (Mirai)", "value": "432fc2b05bfdf6b5658818c2c2f0f6e765032b09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820681, "uuid": "2922dca8-f105-46ce-a32e-31cb1f8795c2", "comment": "Malware payload (Mirai)", "value": "14dc45149d4cd9c268a7e626b5848c0074f81a92cd3ade1b6d2676b60850f8ffbb4e6ea62206e33b34a13927a5e6640e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820681, "uuid": "63142993-dcd4-4cba-aa12-7337616b14a6", "value": "T174831995B9814B12C5D512BAFE1E118E3323177CE3DE73129D206F24778B96B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820681, "uuid": "849df283-5aa7-45ee-aa00-03b176b3dcb0", "value": "1536:ZTnJWOzhCrfmhD0CS4UIYaZaUDDYX/QTMCiob5c5eCqfZ737pY8V/hX:2AhFjS4NYaZaUj5cYCqfZXpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820681, "uuid": "e37866d7-4f7e-4afa-bb09-cef720f7ff61", "value": 83652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820681, "uuid": "73c9bea8-e224-45cf-85dc-c30fa1ac5627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820681, "uuid": "5fda229b-c69e-4a39-81a9-ed5440dd1f82", "value": "SecuriteInfo.com.Linux.Mirai.10589.15085.17293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8182cfea-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823797, "uuid": "6e9811b2-1728-449b-abae-618b39e0b2c5", "comment": "Malware payload (Mirai)", "value": "313d2bbe173988f47fc4ec6477323dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823797, "uuid": "95671525-1578-441f-bd9f-23cc7ad431f6", "comment": "Malware payload (Mirai)", "value": "a92ba723f321aa6a37d07ed61538f259c859e63cf4768a07e253361800e48758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823797, "uuid": "b2b9b964-d0b9-4460-a740-a0a3333e5460", "comment": "Malware payload (Mirai)", "value": "80577cd959e65f39893155b657df24a9eb8b06bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823797, "uuid": "fd382f2d-3296-4887-b07b-62a593c8a6af", "comment": "Malware payload (Mirai)", "value": "44ae05d34bcc249c4593b416dd0d150c91892a704d12b5fdddc7f77c7bbce51149209cf6430fada69ca5fa891cdb6181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823797, "uuid": "a85f5705-ac72-45a5-a042-3d0aa58b3b2e", "value": "T11323E1178522EF30E47441F3B4A64001AE59BE21EDFE3AFF12044D65ABE65CD3BB8198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823797, "uuid": "f8ba34f3-61f2-4366-87b1-64eda0bebd4d", "value": "768:eyc9gYwGswWAFVQ38oVMJRYCVtUHcqhj75ZcQ31CscTxsFJQHLWuN1JO3U03wf0:Xyr9YCI8qVrcQgnOFO6SJnf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823797, "uuid": "75541b0b-adc3-45de-be3c-210a8e9e55c7", "value": 46348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823797, "uuid": "ddf34b53-c4e9-4803-9135-11fa6ea8f8b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823797, "uuid": "11883236-632d-4bab-a8f2-72e25f2ddd55", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc34afa-7d93-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783820675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820675, "uuid": "e06c2e74-869a-4950-a9d2-af58291c237d", "comment": "Malware payload (Mirai)", "value": "52a9d5df1280233c0aacb79471526c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820675, "uuid": "d18b0b64-62c1-4252-8a1c-957c3b279522", "comment": "Malware payload (Mirai)", "value": "a973b2e00f8250789c5d78d286156fea7482d3082cada7fd1771412986c54050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820675, "uuid": "e72b067a-b700-4326-8eb6-461c2ed972ce", "comment": "Malware payload (Mirai)", "value": "090384b316486fe06fb81f098cc9ee522d338948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783820675, "uuid": "d3200d4c-64ce-4628-a9c9-17a59ab942dc", "comment": "Malware payload (Mirai)", "value": "4a1166e113b6f5ab95d34b30888abb27199e6fec03effa4aadf889884bc3c505541d9d36d311529028475489be015435", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820675, "uuid": "6e5caf1c-31cb-4007-89b2-1a1ecaf248de", "value": "T17C93C71E6E228FBDF769C33447B78E21A35C37D616E1C685E16CD2105E6028D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820675, "uuid": "6dfbb75a-bf83-4000-b835-c5d77ac23a6c", "value": "1536:Cw4h0fLnw2U8POwzHXH3Lrxowl0EqH0ueMOuBwINV/Bdo:Yh0fLw2UrJw2EqUVIfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783820675, "uuid": "17e55536-f5ac-4e29-8fe2-c8555e4cae9f", "value": 95096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783820675, "uuid": "1320d46d-0330-4552-bd5d-d2f74e5fb59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783820675, "uuid": "d192fec3-422a-49fe-bad9-34570758e0d7", "value": "SecuriteInfo.com.Linux.Mirai.10589.13407.32427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33786563-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843853, "uuid": "af351942-5859-4d1a-85c5-b3f6b3fb6023", "comment": "Malware payload (Mirai)", "value": "588b6b8e85c1b8a5b73b2a3d1cd6dce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843853, "uuid": "f9d7767a-ea70-4e41-b8dc-c3d190557158", "comment": "Malware payload (Mirai)", "value": "a9f9a2861509be291daa012af57021d53946f838c77926685c0843274fab1058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843853, "uuid": "f430e4b8-1168-4786-bcd7-a88b6caccf62", "comment": "Malware payload (Mirai)", "value": "b60e5eefe1c4d0b80c559b1264035f563121d484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843853, "uuid": "fb844cb3-6328-4bea-a5f2-6d0f8a9ee78d", "comment": "Malware payload (Mirai)", "value": "eeb770726345aacd09df08722439ba9665c5b1808ffe926243f866f0cf46a87a58019a1be4e5ad953b5f3d7ff06fb543", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843853, "uuid": "45819202-d30e-47a1-8e2b-e3f481d5cd4d", "value": "T1BDD3C54A6F314FFBE8AFCD3745E91746095C581A23A87F717630C868F68A24F25D3928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843853, "uuid": "0703b2f7-8626-4808-8efa-aecb1f86be52", "value": "1536:Boycq0RA7LZbg7pH9238TbEi+jVye77gL1NRmS3y6p9nvHxQxedgfZ72jDEnp/Q6:bcXRA7L1g7pdE8TbEi+sbxNZvv9gfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843853, "uuid": "66665b72-38bc-43f9-868a-1d4e5cedd281", "value": 138148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843853, "uuid": "dad9f526-d055-4c20-9ac6-01af35da6a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843853, "uuid": "f5c49dfb-9127-45da-b566-37eb36764ced", "value": "Ares.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64dfd46-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892149, "uuid": "77c577d0-d9a0-46b1-a839-c0c0c555c7b0", "comment": "Malware payload (Mirai)", "value": "341c7ff48769487720d2a9ca449c1b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892149, "uuid": "fae1753a-37c5-4c72-a4c9-ae8ae94e98c0", "comment": "Malware payload (Mirai)", "value": "ab12736b7adf8b430d9a7320d68bdbaed1c09383dd1d597e514bb44e0a27b141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892149, "uuid": "6e4c7c18-4126-4600-8e8d-881fa292fbd8", "comment": "Malware payload (Mirai)", "value": "13237fc1b6611172e49c895d847c4300a4a57040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892149, "uuid": "31469f86-1f50-451f-b12a-6664f451ee1a", "comment": "Malware payload (Mirai)", "value": "fd4c5c4fb6f5cef61cfd63e4197404c8d1bee59f866785fcda12d4773fa812c91bce1c9dd384de70d301fc3fca6a9614", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892149, "uuid": "207c2875-98f0-46c2-b6d1-a927623e45e6", "value": "T16704C70AAFA10EBBD8AFDD3706E90A0229CCA41725A43F757574D528F64E60F1AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892149, "uuid": "2b9b108c-16bc-44bc-9fd0-ac0560364cf6", "value": "3072:1IYNJvs8Wt8En7+RgCNelBg/R5DLcVk+:1ICU8E8EdC0lBs53P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892149, "uuid": "d0074769-a3fe-4ab9-91f4-c6243b441563", "value": 186292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892149, "uuid": "0d0ac28e-34f8-4f2c-82ed-4c6f451382b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892149, "uuid": "0c071a43-79c2-4787-9519-705921e78b8e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91eec47c-7de8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1783857325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857325, "uuid": "5138d811-7d18-4c2e-b3f5-21a65dfd4c01", "comment": "Malware payload (ArkeiStealer)", "value": "3c106df669073faea28214b18b314e6d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857325, "uuid": "7b85cffc-b47d-4043-a08b-428060b8f370", "comment": "Malware payload (ArkeiStealer)", "value": "aeb862624e0b3839fdfe861d3cb6e6104ab0efc820b12e75cf88f8bc034005c3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857325, "uuid": "aa561143-1a25-49a7-b29d-ce21155b98ce", "comment": "Malware payload (ArkeiStealer)", "value": "1efb153b44172a2d9459d91db1af6208d1acd585", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857325, "uuid": "05739746-7d69-437b-a21c-0617a9046c0e", "comment": "Malware payload (ArkeiStealer)", "value": "dfd04f2cdf438166fdf482ac08cdfad10524cc0baee9b9d57e57c0e9efcb0a6ec274b241cd2b82331a4c97feff96265a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857325, "uuid": "2d69857a-992e-45e5-885d-8b0baac9ae21", "value": "T1C8E58C07BCA119EBC4A9A27589B252927B31BC482F7637E72E8073782F727D04D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857325, "uuid": "63c837dc-f5b0-4346-87e1-633db81c9e1a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857325, "uuid": "4f1a85e0-2cad-4243-b6d9-84ad7dc110dd", "value": "49152:BVrwiIIilgKKyYTwKUqzAY2zBbk3LUbXdE7jUq:BVHWywAzAYOB43Ard0jUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783857325, "uuid": "e196d2db-36f7-4a6f-b5b4-6ac7edb7b52b", "value": 3137384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783857325, "uuid": "b5e273b8-a6d1-4000-8515-036ce91cbc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857325, "uuid": "b2caebdc-35d7-4227-b672-4435e2902b8b", "value": "Capcut pro activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca63315-7dbb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783837962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837962, "uuid": "8aa60878-f17b-4f93-9734-1bb92eaee872", "comment": "Malware payload (Mirai)", "value": "12859dee9d5a547a3ed6c822775f4c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837962, "uuid": "38b392ab-18df-44c3-8289-ffeabd2f30c4", "comment": "Malware payload (Mirai)", "value": "aed152d72f07953e2ccc38e7a7cfdcce6fef6220ad26b555c818b538b6f0853a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837962, "uuid": "87e09a97-6d32-4044-8e53-fb6d6b0c067c", "comment": "Malware payload (Mirai)", "value": "67371a67cba0e06b1d07e5ec0bdae99d36f59476", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783837962, "uuid": "01220afb-ac7f-4222-a126-925d23c425aa", "comment": "Malware payload (Mirai)", "value": "eeb4ace3d6f7e6e98a897ca379768b502a07e2cb0dee694c2654071a08abe13fde2c0dd0330b8c5b5fcce6043c3dfe75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837962, "uuid": "10d39c92-55db-47e9-a2bd-2ad8275ed3af", "value": "T1F33301FF85A6DA38E02482F4539C8AC47BF95297752F9B5A853672FC8C36DA03410E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837962, "uuid": "42d27cf3-e65a-4918-8226-067f7c677f36", "value": "1536:L/Hul1ZIqCPmOdMrWx3p9a1W+zuuodS9/z57y4K:TOln5KPGCxva1VodM/zZbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783837962, "uuid": "96764508-ff19-4d53-92a2-8eef9e99e1c5", "value": 54020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783837962, "uuid": "710b5dad-e490-48ac-a5dd-b65e46ed2841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783837962, "uuid": "9b4a53df-efa2-4dec-95f8-8068f79761c4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed34f77d-7d8b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783817535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783817535, "uuid": "a3c26394-1a4f-462a-863b-a12ed57ba3e2", "comment": "Malware payload (Efimer)", "value": "1716b064b674843322936e5e5450f7fb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783817535, "uuid": "c2709e07-691b-49d4-8c0a-65ecd76e928a", "comment": "Malware payload (Efimer)", "value": "afac2f3414146f23409b3025b08a8b396ae457e8f0ca7fb6e6fd32c2942afec7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783817535, "uuid": "9aac4619-2bee-4685-b022-7b3b0733d402", "comment": "Malware payload (Efimer)", "value": "1a7bc9eecd62a0160ba78c7936f9a585d1f43b1e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783817535, "uuid": "3b275c07-30f4-4ce8-a104-1c5b3c750238", "comment": "Malware payload (Efimer)", "value": "105eae36ef473f7867abc743f27bd5947623e5ff32a6f158161a157b8e9a582d442edf407cc815af6441cfdd862463a0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783817535, "uuid": "16dd3ea0-21b5-43d3-8eec-baf55c5d0d3b", "value": "T1F9E6335C53F815FFEDF6113DAFC15991B028B8716376CADB07D843A2AE5B2A04D3A602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783817535, "uuid": "41de24c8-c4d4-42aa-85b3-575b37d82bea", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783817535, "uuid": "64af2b68-13ca-4af1-9069-9c76cf37be3c", "value": "393216:Y0JZ9CZBaXzQEpt4aOcd1Q7TTXMCHWUjXkcuI3/PGTAI:Y+CZBaDNPO3TXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783817535, "uuid": "e75b8f3a-c95f-4321-9877-2484d56b78b8", "value": 14299939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783817535, "uuid": "7030abd9-2787-4c3e-a89d-7e251272baa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783817535, "uuid": "b3b978a7-89fe-4ef5-99be-c41ce7eb40f6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d500b787-7dc6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842835, "uuid": "97019491-2736-421c-a70f-d50743c8a674", "comment": "Malware payload (Mirai)", "value": "52194eb707aa7183e0b8c9240875b867", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842835, "uuid": "d3d5a0fb-e9c4-44f6-8d8a-6e395e7bf731", "comment": "Malware payload (Mirai)", "value": "afd2986cde9864880e45dde1e21a8a13318476036bfbb97e729437449fc2a304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842835, "uuid": "576fa8c0-8436-496e-9d00-815100747474", "comment": "Malware payload (Mirai)", "value": "afa85c0b2dc41dcaec42129cfa8ba2fc631feda1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842835, "uuid": "901657ba-5c10-4b3a-a1d5-cea59e7b464d", "comment": "Malware payload (Mirai)", "value": "b7dfe41af41ce8b9827bec1e3a39767a4c693880961ffa6b6d07784faf0e43aa32b7729e8ec887c8489973ff3355dd32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842835, "uuid": "3db8e67c-7c72-4f0d-964c-f9282b6b185a", "value": "T12682D09190E379B2CB30483FEEA5C28FE6574AB894A530E22650535973C4A035DFE7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842835, "uuid": "60ceb37f-7c91-49a4-8d09-93b293c1508a", "value": "384:4pDj2BdT2cYB0KKey/rQPO/SsC/hymdGUop5hRZ:GH2BN2ZKZ/rQdb/s3UoznZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842835, "uuid": "4d38af81-531d-4a72-9db9-061902960997", "value": 19072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842835, "uuid": "e5ffadb2-f1dd-40b1-9ad0-f12e0a05f415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842835, "uuid": "992b373a-5e55-4e32-9232-c73bb91753c8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77e6ba0-7dd8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783850597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850597, "uuid": "28d47d41-ed22-4378-a401-3d1cdeb8613a", "comment": "Malware payload", "value": "13878ba9d2a09fe3891942e0ac57e7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850597, "uuid": "40a10536-a5aa-4e18-8cda-1dccfcb1ca9f", "comment": "Malware payload", "value": "afe55ee0d0c72c8fba189f76aa94bb7eb4516b540d609a64077dd72bdc00c97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850597, "uuid": "4072fcab-d740-4925-bafc-5dd01ab607e5", "comment": "Malware payload", "value": "94e2a92edf24ff8d665aefc914ab3a71d3cdc0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783850597, "uuid": "cf2da0b1-6181-4b63-9426-a76f7d95a31a", "comment": "Malware payload", "value": "bbd8510238c38c69d8ea99bb6a6f2efecae299f5d34251b1f1f6224cbfe9ff9d2e665d7b2a587eca3568c5e106e5feaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850597, "uuid": "5c94a5d7-e4b5-44c1-91fd-3ebdab53e111", "value": "T15CF37D57B3E522F5E177823889B18A06E772787207309BEF53A442B56F236D08D3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850597, "uuid": "0aa9ca75-4df7-4c0a-8ffd-022013687bef", "value": "b3ac3d0964f8c70ece992584bc945941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850597, "uuid": "ccb60337-a6a5-40d4-83bd-a77233175c24", "value": "3072:dHtxGu4QkfERT5fR36ICDM/bE9SapJ0C414z5vCt3:Eu8M55hkCE9lpJZz5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783850597, "uuid": "58a18f6e-8d9a-4782-a277-d137341bd61f", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783850597, "uuid": "94108efd-bee1-4b9c-8921-c08770765fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783850597, "uuid": "f8734e3a-2b50-4ff5-9a66-3e01d84a3fc3", "value": "afe55ee0d0c72c8fba189f76aa94bb7eb4516b540d609a64077dd72bdc00c97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995a3ff0-7dc6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783842735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842735, "uuid": "5b33d58a-ba7c-4d9f-8a8b-1e494ca5e2b2", "comment": "Malware payload (Efimer)", "value": "6e39b63340c5e76f2019ee1271eea160", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842735, "uuid": "750f89d3-432a-4793-adb2-75df87083120", "comment": "Malware payload (Efimer)", "value": "b0974d61f413e6864c1db64d3b249f4632b4fda1f098fa5469964ebef5785a96", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842735, "uuid": "e87af880-d8cc-4965-8a47-9a922d85b937", "comment": "Malware payload (Efimer)", "value": "8cdafa38342dc6dfda52ca3f09d2e7bf292cf712", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842735, "uuid": "9d1d89fd-3bf6-49ad-ac43-4d2414b1fb3a", "comment": "Malware payload (Efimer)", "value": "1e865c81fc2c058767d164bea87f84d2a8e1528f527e8e0c9ea99eb690ec579c286fa813da129f6fdc820f3a660a0404", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842735, "uuid": "e15b728b-c2c5-402a-b6e5-7a20e92d6235", "value": "T197E63309AAE401FEFAB3013CEDE3265AD55978B28771C4CF47F88AE66D132D10938657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842735, "uuid": "184959f2-22bf-4eb7-84c7-02c59b1da114", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842735, "uuid": "93dae72e-dad8-48ce-9903-4dcec8def629", "value": "393216:p0TTZ1yIvEC0EIW/WRbm7XMCHWUjXkcuI3/PGTAI:p6Z1yIv9fYS7XMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842735, "uuid": "59dc096e-e2b7-4697-8235-90401c63ab94", "value": 14289218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842735, "uuid": "648e2c58-8516-4e22-99c5-b35e7e2d6768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842735, "uuid": "1fcf7abc-caa8-404f-9f70-d84fb90adf31", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814e5c16-7db4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783834964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834964, "uuid": "3b709d4d-a94c-4575-a3f4-8b9e0d2833a3", "comment": "Malware payload (Mirai)", "value": "b3aa83e42a4b4976a734bfb3a00f9649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834964, "uuid": "3a8df8e2-7c51-4902-a252-2dacaa764c4d", "comment": "Malware payload (Mirai)", "value": "b17eafa26e49131f35a803e31884d20990edd70f57e198434988627b7360267d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834964, "uuid": "0453fe5b-da89-4e15-aa8e-1a41230ec1e4", "comment": "Malware payload (Mirai)", "value": "560143edb43e4a84f78bcb39796cbadee54d921c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783834964, "uuid": "36573725-9de9-45d4-8689-eba7147efaf1", "comment": "Malware payload (Mirai)", "value": "bcec25fab165be749504f40bfe93c39a3b366ca26d7cf9bb51792d04f6312af9ca023e6d99d0c50aab5ac2d094554e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834964, "uuid": "1c027ab4-47f4-451c-b49a-62a2e616ec17", "value": "T153F2F1338A657987EC6444F0DAC582C17F9339F281A0382D6125809FD3E634B75FD8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834964, "uuid": "fe44ae91-75c3-4c32-890e-63c3a6f13018", "value": "768:3AZnxsISc8tJZ+aBgX8vKx1DKzxFfQA0NU8q/us3UozD:3SxXSJLBOXeQA0O/TzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783834964, "uuid": "fe9becf7-0d59-4558-83fe-2fc8edf0dc02", "value": 35592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783834964, "uuid": "a8e9a1f9-6798-4f9d-ad3d-cd5b503cf397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783834964, "uuid": "d3ba1cb6-aa24-4b2b-8168-5ca35a06a76d", "value": "XDarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87582996-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823807, "uuid": "99fa41dc-e250-4a16-8594-afb65c4dd6ef", "comment": "Malware payload (Mirai)", "value": "170e626f9c595f98c42d3ea81f78a587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823807, "uuid": "158cf065-4b08-4f44-9400-4ccb76045291", "comment": "Malware payload (Mirai)", "value": "b2c0cae650ddf10b0d3be03931adb4f7ade22e061b71e6728205f8a11b02f5a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823807, "uuid": "6c98bce4-f851-466b-abf2-73764a331779", "comment": "Malware payload (Mirai)", "value": "a1e2a3641cc5dcdbd443f02c879bada1057c1541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823807, "uuid": "bf0e01aa-711b-4657-809e-1a0765b58a7a", "comment": "Malware payload (Mirai)", "value": "374bb84a2bdd4e1e12f3a1feb075ac300ca736633da38009f61d079b04b5802e05684d0cacd19ee6d8534c19aee22e91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823807, "uuid": "fd6a3553-3a8c-4ba2-bc11-8cd4d6ad3e17", "value": "T1A06302C4EB9E0589C84D33B50C555B8B3454F651ADE01554F9CB8A1A2FBF83C28B4FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823807, "uuid": "e121adf7-8e97-4988-bd0f-f03fb35b1563", "value": "1536:gvhhzFBU8f1b7mE3cAMUi8l8AXb4GqtAzUtrBM3NyFOeQw:gZhzFBl171c1UiarCtaUt634D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823807, "uuid": "8912f0bf-49e1-4f12-b62f-0346be412ccf", "value": 70088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823807, "uuid": "36dbb0d1-07d3-435e-a230-de58088f0ebc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823807, "uuid": "536ec511-0fbb-4443-b588-075e7cdacbf4", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baab262-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840994, "uuid": "8fed9d4b-7524-4548-91ee-6568e4fd7da8", "comment": "Malware payload (RemusStealer)", "value": "33793adf34bd6458e99bcff481451bde", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840994, "uuid": "29af76ed-3998-4a7c-a2a9-331748ceb88d", "comment": "Malware payload (RemusStealer)", "value": "b3a79fbfcdd287765708970ae1ed1e6da86b7544ba3dc807e5254e009a46acf1", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840994, "uuid": "4b0f59ef-fe83-400a-99a3-ad3cecc657d0", "comment": "Malware payload (RemusStealer)", "value": "1be21e84579f3c8215df67d4f7ce4b4516599ccd", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840994, "uuid": "41d8b6d4-e183-4855-b163-1b636c2a52a8", "comment": "Malware payload (RemusStealer)", "value": "14db97ecdda5d67e28e358c3e599b29ed8386292b882751841777e73bcdc60af0362c34d38fb96577b961fa0fcfb2e8b", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840994, "uuid": "64652034-f59c-4581-88ed-d27c319ed1ef", "value": "T10AC54907BDA149E9C09E923199B751A67B74BC080F3223EB2E90B7782F72BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840994, "uuid": "3a0ccb54-219f-4e7b-ab3e-be3f395f49d8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840994, "uuid": "9ccc7fda-2c97-430f-91db-aa5db8b68bad", "value": "24576:zywcHQAOTbyVqd7vxVM5I17bavrrPUPGRyaXcd4Y7Fy8vA2Bele5rK2y0HEeW2mz:zywWQLuQvnMwfaDYuRyaXyz7FT8kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840994, "uuid": "df3aac82-fc46-483a-848f-f83bc6f697df", "value": 2559336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840994, "uuid": "c472dcfa-6926-454a-82a5-aa2076afd7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840994, "uuid": "acc9e4ef-41f5-4d95-afe9-ddae0389ed1f", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d3cc3c-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843890, "uuid": "8c2a45e1-25de-4dc5-83aa-dce4d5aea117", "comment": "Malware payload (Mirai)", "value": "d5e6b73c62da41194159416daa891c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843890, "uuid": "7ea9c24a-33f8-4b18-a30c-70914c562ac6", "comment": "Malware payload (Mirai)", "value": "b44e601962161986eacecd5ab5a0f274f6bd6d4fb0737c83ef28b829eb250ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843890, "uuid": "888520fe-97d3-4dfa-981d-ed711ad396d5", "comment": "Malware payload (Mirai)", "value": "63d829da030e51d6c409ad6754d78e18abcadeac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843890, "uuid": "025dead5-9f3f-4461-9409-7c8e3048b7a4", "comment": "Malware payload (Mirai)", "value": "1d3809f6902f6fa30eef894e4e3a290e3676fb4422c21ad9be03c812ee2a2db41c0da57b066220a358788f60a43b99db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843890, "uuid": "f49f274d-fffb-4c0b-a9eb-79bf58325aae", "value": "T1D4B36C369D792F67C1D5A1BB01B70371A0E3178E35B8C62E7EA40D4CEF9CA64312652A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843890, "uuid": "d1db622b-6d23-4bb6-93e1-e69e2e27e9aa", "value": "1536:iX8XxAVK9jqpUb0seTIHfMPsPZngfuetb7WpRMWFJPwPXp:28Xx8OjoQH5ngfuRRMZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843890, "uuid": "e514e64b-74ef-4ff3-904f-8e49fd671782", "value": 108296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843890, "uuid": "b906699b-65b3-482a-b4ce-0a60d02a3d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843890, "uuid": "3277a560-4703-4d2f-9c91-2eaf83ec1d7c", "value": "Ares.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329fe210-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843851, "uuid": "76bd1dc7-193e-4aae-bfa7-b292c3e33f45", "comment": "Malware payload (Mirai)", "value": "56846d843867769ac571520a6f280e6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843851, "uuid": "2614bf1c-8cf8-4df1-83d8-90c654fff91c", "comment": "Malware payload (Mirai)", "value": "b5297aba5cfb714ff4115caaf238ded30e7a9e26ff38e95859fdc23c9e68b029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843851, "uuid": "01e1943a-8275-461e-8030-a62457f31db3", "comment": "Malware payload (Mirai)", "value": "2f1b0a93746291e568301f0967d01b21a705ec1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843851, "uuid": "18a01b09-1672-4488-8d71-3f656a8dae94", "comment": "Malware payload (Mirai)", "value": "3641636bb8fd7157617f95c273f03a38c2ce5544d05557b7bab240d5083bfe9226a568fc16aadc16fdeb5e8aa11633e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843851, "uuid": "be9f1025-4873-48be-8116-59f34cd3cc69", "value": "T1DB13F1AFB5A120C6EBAC2C72E5B905E02952399552CBEB1C930C8D88B934FD97F1D474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843851, "uuid": "e6813574-bfa7-4b64-8531-dcc233941eab", "value": "768:wjp+7ktVF3ZGSCJaihvIOqCxCO+w7KvrN4OjRw6JvX32wBw7KrqNiTpo3+QOOHom:wjOYVF3Z9CJDwkxCtaKDekBH2wtreiWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843851, "uuid": "58f764a1-d515-4480-b2a5-436c78a9086e", "value": 44580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843851, "uuid": "27380b37-9ec8-457f-ab0a-2c6d03115653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843851, "uuid": "3792b653-3d56-4439-b712-e8cfe0d25669", "value": "ar15.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a57a475-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843971, "uuid": "8dfbfae2-1e24-45a7-9160-1405b5e021e9", "comment": "Malware payload (Mirai)", "value": "ad349a01b163079a9aad97fde375621b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843971, "uuid": "f7b9e121-1119-4068-9b27-6f8e5a5e1a9c", "comment": "Malware payload (Mirai)", "value": "b5662a510152519a293ece02e04dc6fff11add96f42861b13986f903ab9bd3ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843971, "uuid": "e4edd419-c9a0-4a4d-b3e2-d9f8966ead9c", "comment": "Malware payload (Mirai)", "value": "244ae6b9ec24f1778afa3c5b655ee0329b9e4d31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843971, "uuid": "8b6c7f5f-c066-455f-9c7f-ebf293b5b402", "comment": "Malware payload (Mirai)", "value": "f8a63efd46af2e7db3d0e7b4dfc7d8201b4a095a18abceabf7fc4f7aed9ba535292eda84a06ee6c80c504eb3257b9be0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843971, "uuid": "7b2ce061-a902-45dd-86a8-34ed95a275ae", "value": "T162A32946FC814A21C5D512BEFA1E318E331357B8E2DE73229E149F3173866AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843971, "uuid": "fe19a8b5-d162-4f0e-81bd-c4975525b241", "value": "1536:wAnky0uGMdiA/5JHa9yiqpp0GBE7QxKSI3k7iaRr1OXDDdRiNpqx/FYv7Xh5GYWX:Qxz+pp0agS2k7iaRxpqx/FYThULIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843971, "uuid": "a8979c77-278b-4729-85f6-a51a4512831e", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843971, "uuid": "64de8d90-6ff7-4041-a496-c0c710100992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843971, "uuid": "fba44f7a-6c72-4b20-bf07-9624520ea3a2", "value": "ar15.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eabeba9-7de9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783857669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857669, "uuid": "f8301178-f86f-4fd5-a153-bfd028278dbe", "comment": "Malware payload", "value": "574e92b45163b6a0f4b5a54d4fec45b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857669, "uuid": "81ed1ff8-5fc4-418f-ae52-40b1438f75c7", "comment": "Malware payload", "value": "b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857669, "uuid": "b954950d-53df-494a-aae8-b90c33b3e48c", "comment": "Malware payload", "value": "41b0c1c5a997a1304d0fe9d2bb275198be4fbf30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783857669, "uuid": "9275cbd6-2347-4fd7-b414-5dc025bc403b", "comment": "Malware payload", "value": "76f45ddd17cfd972a0c9841ee661af2e6160051358f4d3e59c3d97ae79f4501d5236448f66d2524a76f393a21c0538ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857669, "uuid": "a9fe6341-4055-4af4-8de5-22cd65719567", "value": "T1A401ABCA8404E802409A9A2C32972055F421C3CF154B4FA9BFAC6E3EEB84C19B066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857669, "uuid": "cce89941-86f7-4c85-b64a-db1dcdb30ef2", "value": "24:kXCKysE2hi0ziQvZohaFIzrWXbikjnp2IX:e9Qp+MsFIzKXbikjp2IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783857669, "uuid": "ededb0bd-f846-4925-ac26-a4ae6203d68a", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783857669, "uuid": "5655e9f5-b55f-4723-ae14-200210c2705c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783857669, "uuid": "d4fb2457-29a9-45af-8bb5-00edcb397f31", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46401083-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843884, "uuid": "54e0d964-b040-4d20-95df-e3c747e7e6e9", "comment": "Malware payload (Mirai)", "value": "9e9c55bbd02bfc6a67c5fd246678e5d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843884, "uuid": "c5a85d1c-0498-48e8-a279-8a2bcf4a5b1f", "comment": "Malware payload (Mirai)", "value": "b65f670bb95830ad04bd6b22e7f47cd2410670d82f75eeef3388cbb81f02285f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843884, "uuid": "dbb74e5d-b79c-47b4-8265-10e18e04d4c3", "comment": "Malware payload (Mirai)", "value": "0924766cbe116ef76f13112dc71b07231d5c4600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843884, "uuid": "817fdd13-85af-485c-a5e5-ebbc1e4666ca", "comment": "Malware payload (Mirai)", "value": "a67b64f2d1e2ad37ca7e01536cf7397d4c5b38f87431e55e3aae3808c395259c1024cb459d8987a17ce2ceb47c75fddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843884, "uuid": "5e728729-5cb6-4f85-bae5-2ade6aa77519", "value": "T140A33C02BB594A87F9930EB5253F2BD153AFEE8060B0F2C4798BDA0E4171A772556DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843884, "uuid": "d3202759-3fc0-4ee2-8938-b8038b760631", "value": "768:43pClI/O/jlBQH1SwyGOH5ODtQYtXiNHX2kYxGsDk6BYndrx490JbeLSH7SnK7gR:kYc+AA2kY4ZhEL2ShvQkXvbApxQ80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843884, "uuid": "d72f90b8-ec07-4e68-884a-2549600a779c", "value": 103704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843884, "uuid": "d0179e90-04a8-42d4-849e-2396d968cf2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843884, "uuid": "05bd03e8-69aa-41d3-8b24-c98b484615cd", "value": "Ares.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a81edb7-7dea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783858118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858118, "uuid": "9021421d-ab2f-49a8-ac7b-eed0d11b1e34", "comment": "Malware payload (Mirai)", "value": "54790c8b4087cb31b0f5b0a757bdf3d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858118, "uuid": "44a69678-a888-4e35-8dbf-a42f1f0bb657", "comment": "Malware payload (Mirai)", "value": "b7648399204fbb9beaa228be5f4c3882f320dc790534843d6a9762ddfc9413aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858118, "uuid": "9968b414-b5a3-4cdc-bd83-8142420d90f2", "comment": "Malware payload (Mirai)", "value": "456e38f72e69b50340b36ade3ff282e84c406664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783858118, "uuid": "0f5c1127-3ab2-4401-9102-6760c188e6d1", "comment": "Malware payload (Mirai)", "value": "918eec9ab7cf55c659df81cd7d19806c7f1dd74a8752b65393329285d43f4c029919fa42c2b72025baf491bc48f83c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858118, "uuid": "fd4db93d-80cc-4155-a0c3-30002eb2ae01", "value": "T1B4B31999B8D29A22C6C316BFFA4F428D773663E8E3DF7107DD155B21328651A0E7B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858118, "uuid": "566ecb3a-1bb8-4f7a-9378-7194a6d88428", "value": "3072:t5vswOEVaMWdLMciU5Imuz1oLC0jbBssBnbup:t5vsLTMcioIf+LCmsAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783858118, "uuid": "01ad46b7-d829-4ab7-89dd-112148bc5123", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783858118, "uuid": "8c29afe1-28b6-42f0-8a86-cd0e21175247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783858118, "uuid": "7ba9b752-abd0-4ce6-848f-35aafb931059", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f4ebf8-7db5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783835534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835534, "uuid": "3a6ccb86-0318-4dc3-adc6-9831ea35bb56", "comment": "Malware payload (Efimer)", "value": "5fa10ea66e86576a410e05a0dae50764", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835534, "uuid": "31520412-1005-47fe-9306-6cef66cca403", "comment": "Malware payload (Efimer)", "value": "b78af846465da9ee352461836d584e8b4913293b691a429e0a90005135eea8e5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835534, "uuid": "4c3b9582-6eda-46b8-b5e2-7712432cb5a0", "comment": "Malware payload (Efimer)", "value": "2d1cd541435d3cb15358bfdfb05f3c18b3697338", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835534, "uuid": "c2728d9a-c408-4c48-8cdb-cf40f0751bd7", "comment": "Malware payload (Efimer)", "value": "1697496c957f5f7e65d64d0fd93b9d12c91d6a9ab112088387c906ca646ff8e38e867502bedca6f79480e80455c67726", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835534, "uuid": "065829e6-00bc-4586-a70e-4e184d6aa324", "value": "T146E633186AE011FFE673953CE9A2A986E6A5F4652731CA9F07D043B25F032D00D3DB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835534, "uuid": "01837980-0c34-4d78-be7c-e442f41908a2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835534, "uuid": "4cdf154b-7652-4552-ac11-8cdd392ac763", "value": "393216:ugCDFogfq1bq4jjXMCHWUjX5cuI3/PGTAI:ufi1b33XMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783835534, "uuid": "b8446dec-1947-4a45-aa09-3d397fc01159", "value": 14325774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783835534, "uuid": "f3d47322-b946-4e73-89dc-72a6e4bb8e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835534, "uuid": "ca914363-4aa2-4577-b717-7b0a5dab4aa9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46f9dd2-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823856, "uuid": "db3ec18e-efca-4b0c-925d-e19d578e78f9", "comment": "Malware payload (Mirai)", "value": "06c8a05632b2ede63ce321d123069d71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823856, "uuid": "0940d967-05b1-44e7-acf4-21cf6bd95d9a", "comment": "Malware payload (Mirai)", "value": "b8445de08b5f8dc796f0e20a3df7ef4ff1e3c17c8241367e067a93b44541f469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823856, "uuid": "993a98e5-18c3-473e-8d2d-a7be8b2b61d8", "comment": "Malware payload (Mirai)", "value": "b6e8e672f072710fc29c92355a694e40ce66a83b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823856, "uuid": "0b401eeb-103b-46e0-87df-60bd2c58a0c2", "comment": "Malware payload (Mirai)", "value": "65df50c20d905937b6df001429931f5a535bc3d705c856f5d6723282b507f2ada53c5e0f8458aecbe2dabaa567a01ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823856, "uuid": "faf03e5d-5dc8-4dd2-b551-a962c4ea37e6", "value": "T14CB31B99F890DE52C6D52675FA5E418C332353B8C3DA72068D249E3477EBC9A0E3ED42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823856, "uuid": "6effae7b-fdad-433a-a379-8a7633a81193", "value": "3072:IUPZjTuolizTrrgUQ4g8O2CRb0gsT1vO1OEtzf1D:IUxjTW3gUQ4g8OjRbn0O1Omz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823856, "uuid": "c458cfd8-3767-49fe-9e44-9fa38f3fafea", "value": 107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823856, "uuid": "ac1d43c8-35b3-4892-a0bd-16575d3e22c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823856, "uuid": "677e3630-ee99-471b-b606-ed36af18cc6f", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e68dec-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892140, "uuid": "bd1e2bbe-2039-4745-9ffc-47573ce3ebb7", "comment": "Malware payload (Mirai)", "value": "3d66a3731b2f17fb97d2caafc93853c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892140, "uuid": "f187b341-ff52-4725-9efc-734e36168518", "comment": "Malware payload (Mirai)", "value": "bf572a2541586cd390c1fbcc554e06b9bf1264507893b1b25084d839debced52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892140, "uuid": "7285d8b0-b0ce-4d9f-8c2a-68ba7bac0b73", "comment": "Malware payload (Mirai)", "value": "4fe6c8ee0b4188ab913c108dff0b9ce32f10b230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892140, "uuid": "99bbfe73-af69-4dc0-8d74-e717b2fa4e3f", "comment": "Malware payload (Mirai)", "value": "73dfb0dbd4f6b2bd08ec225e33000930f919577e0182ec1b4264ea21b63cb3c6d99cc2ee029a1e24607171a137436ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892140, "uuid": "c00b284f-5549-4b07-a560-28737d71116b", "value": "T16B3302A8E801AE75D3EB1DF019DAD1D2B72DCE043AD6CCD10294DF17342766E9D8DA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892140, "uuid": "dda87b41-2d22-429b-a535-68c4d9e60edf", "value": "1536:Fxb4DADTXQom9YFRxkVrxorGNtjb4u+qgw09q:F14UTXdR6VmrGNtjb4u+qgwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892140, "uuid": "915e8704-c78e-4737-9a12-84e8ce10ed19", "value": 50804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892140, "uuid": "0cf65729-89c6-4380-ae69-fefd483f85b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892140, "uuid": "7fef4067-b337-44d8-b88d-93c9f0cc0514", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17b1475-7db8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783836763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836763, "uuid": "799ce5c0-6b07-4fbe-ac4c-e900e317bb7c", "comment": "Malware payload", "value": "64a4126a7c58d861ee2052b4b20a8bc3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836763, "uuid": "3454a03e-d251-4f5f-9525-78dff0c03c0f", "comment": "Malware payload", "value": "c08ffbdcea80f5567d6b81978a8ddc0effa7bfb630675ad6d6b110d0cfcfcf9e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836763, "uuid": "a9e89c71-a289-4c63-839f-3879dedc2b26", "comment": "Malware payload", "value": "bab0ec0067ffdbc78625fadd606d28b066b1b4e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783836763, "uuid": "10b1bdcd-ad61-48dc-acc7-d04c6fa55b25", "comment": "Malware payload", "value": "222fa76f5cb3d4af241a44507c3d22dd808409bc2a627a8dc74b1b4e4973c0233c94a35e482fb6ab630b0effa420c96d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836763, "uuid": "e3984d0b-90f6-46eb-a2a7-52d76b30f4da", "value": "T1B7D0C251579AC8CE087E49C4B4730100D6206333FE04852C37CAF990BA78228B95F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836763, "uuid": "8c5c02de-0285-44ec-b6a0-2fe8cafda9e8", "value": "6:hoFmAi3rHIdOjXu7i2ovH6UFxcFs7smI9//P5Td/D7B/+bZJbKXFs7YjV:KmAi3rHIGXYzovH6KCdsJbKKEjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783836763, "uuid": "07d91bc0-c71e-4bbc-9beb-da993a054e66", "value": 289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783836763, "uuid": "602314b4-5f2f-4d1d-82e0-ac98f6ee9314", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783836763, "uuid": "7dd10c79-9f3c-4c96-98f8-fcea1904a0e7", "value": "ccl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00df05f-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892138, "uuid": "4ab9dad5-716f-409c-b8b7-908eb40977d4", "comment": "Malware payload (Mirai)", "value": "7de6a1ecba3ee5fdbc01d86eedb08b2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892138, "uuid": "e35b3d42-c975-4628-9952-073f25e58add", "comment": "Malware payload (Mirai)", "value": "c32bc2da712e383271c1db938df8d660b4ba0cc80ead33d7a33954fe3e3d1817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892138, "uuid": "9ac91a5a-f66a-4976-ab8e-8f9655f41b12", "comment": "Malware payload (Mirai)", "value": "16a003b30582e1563d3b37ed416c2a0b2773a42e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892138, "uuid": "eb74799f-4217-447d-8ee9-ea41d67f465c", "comment": "Malware payload (Mirai)", "value": "d876fa5ec38a0db3ccb89dc4bf9fc18f4ad9e4b3c0068a7ecf4b1ac9951de055a0632a729947512c1be0b9e919f093c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892138, "uuid": "9a8cf78a-8679-4b4b-8786-70257cd136cd", "value": "T10AC36AA3CC766F59C658D0B4B074CF7A6B53992091872FBA156BC3B98043D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892138, "uuid": "98174304-b42f-4ea5-9aa2-a2fba82e7623", "value": "1536:saIG69k86J1OCgmp2YtgLoNChdEmZsxkAWDnMGk+KRz4UIRbbW:sE9nOVatgLMKymZseAWL8xRQbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892138, "uuid": "9a6c33fb-a611-4c14-9a82-f2cd8ddf3896", "value": 122532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892138, "uuid": "3730ff76-6b37-4e04-86bb-72c0c92559d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892138, "uuid": "c690621e-746d-48d9-b5ed-9bb4bb137475", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af293448-7de3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783855227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855227, "uuid": "6a332f06-1596-47ff-9b5a-062ff293ffa2", "comment": "Malware payload", "value": "27f0fb1c153957bae1ebb83d5bbaf4fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855227, "uuid": "ef7aadff-e265-4624-9d5c-bf604c7d20cd", "comment": "Malware payload", "value": "c41efac9ff751941dcb6997a73a45ca7cde3ac4f3e5bfb6da0add62d81167a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855227, "uuid": "da3f3500-efcf-4324-874a-135f5beaa75c", "comment": "Malware payload", "value": "ba24e5198143826c382e60c4c87cc5ec838e346b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783855227, "uuid": "aba39a86-1ccd-42eb-9bc4-e13e1213a816", "comment": "Malware payload", "value": "d6a9dfc7ea956d20269f3ad6fcba781e3e8e0e67b6d6a8141d5c41ef3a48b132ce0bdfb85dc6b6c66b86d02925eaa1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malspam", "colour": "#7CE1A2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855227, "uuid": "0b364e6a-da2b-4758-9106-4d3855b2b42d", "value": "T1B5936D07F2988078C04DC2BDC78AA533B276B8865923B79F2BD41A513EB6F586F0D745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855227, "uuid": "4fe73dc5-00a9-437f-b86d-ac1b03745c7a", "value": "c49c984c1a82dcf3cab82402d603845f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855227, "uuid": "6da766f3-791f-4366-8e64-596fe150f1b5", "value": "1536:TkInxNbbNaBvYntBMNtUXoNdR0BercFt5q4JGzf2WWOORQNU2acuVaG0H:IInxNbbovYnteYodR0Qrcj5N2GFQNUlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783855227, "uuid": "b45529a4-b04c-4109-ab6d-f21f095dd436", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783855227, "uuid": "30694e07-bac9-431e-8f70-c73aa16ead71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783855227, "uuid": "98a38d3b-95be-4030-9a6e-fe4a7a3c2a17", "value": "Vidpovid_MO_DepZvern_Zg-109432_vikh-220-4512_vid_12_07_2026_Kvalifikovanyi_Elektronnyi_Pidpys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa3baf0-7e03-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783868918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868918, "uuid": "67d3ca6c-cc01-4f16-9767-cbeabada0279", "comment": "Malware payload", "value": "6af6db652ace081cd28dd97395782f11", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868918, "uuid": "7f22970d-8145-4d80-93dd-33beecac3829", "comment": "Malware payload", "value": "c625817e704ada13cb0a2d9f0ba2af055461c051df96c31152950c68c5b6afa8", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868918, "uuid": "92280236-1e3b-4258-89ac-7a0c242eee9a", "comment": "Malware payload", "value": "9f26664c86055b40f07b9da993940736f2d4ae3e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783868918, "uuid": "f6220bc3-e741-4259-b631-d6b2a8f58bcf", "comment": "Malware payload", "value": "45e29084b0da4b0c06f5f9b7fa57531a210e7aebcf0464a5201ad59b9c3b9809783d23d36ad6c3cb15f0256a5752c733", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868918, "uuid": "9dd0296f-e8eb-48ee-ad53-674dffdbb5f8", "value": "T191767C0FFEB548EED0CAA13C8053E616BD623C004A24AB5755E4F3785F33B275A5AB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868918, "uuid": "462a9cbf-be3e-49e0-851c-7a879bfd2671", "value": "24f6f1d6e4b89cdd88f085c7a069194d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868918, "uuid": "17d06b22-7af5-4d2b-8cbf-c27f69a13e7d", "value": "49152:jusSddwD8zQyNFCuvOrvL3YpyH+W4y2xLMKnSHFXIZ2SR9LO24JPP46W+3y+oPJ2:+2FNgMKnSHEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783868918, "uuid": "6f6052ac-d80d-43fe-81c6-8f9f114f8eeb", "value": 7567368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783868918, "uuid": "8f80d944-ae0b-4d85-8619-626692e16131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783868918, "uuid": "c4e67d1a-6c3e-43eb-90ec-946a3dfdac7a", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7fb83d-7e19-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783878412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878412, "uuid": "f1b1c3e8-21b6-4533-9acc-e2ae6cbda14e", "comment": "Malware payload (njrat)", "value": "aaef009f16ec183313143cd3fdc07a69", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878412, "uuid": "15ead1f7-cc22-4964-a1d1-e47643428005", "comment": "Malware payload (njrat)", "value": "c854317fdfc61855002f0cca0cba147c979a56878b8b211c5d512218877d680c", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878412, "uuid": "bd4b3f44-fbd6-42d2-bbdd-49ea74c38890", "comment": "Malware payload (njrat)", "value": "cb2f8818339a9b671ae42548da707b23e2c93591", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783878412, "uuid": "11e87c5a-3716-4395-9fc9-a9c52aea12a0", "comment": "Malware payload (njrat)", "value": "6defe405f3e1f4afa5cf122f78cf338ecbb2c8d096ac07e1344f88f633275c58a3ffdfb4c5acb6dfa1c0f601a6a2deaa", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878412, "uuid": "c043c47c-4935-4549-ab7b-92de595ac578", "value": "T1A6C51230959505E7FF4A65F86AE95F8D0C10CAE43A9759D6D0F3BA0CC2A2598F0E123F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878412, "uuid": "0c20ef94-a877-4ca9-8541-e2cc93ba41d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878412, "uuid": "84725460-9005-4ae5-b267-322cea8e83f1", "value": "49152:5A6mLg7duv9AQatEjaVHmPwnmKKUSQh/sk0AZOE95ixqcHhExp+qNB:5X4lv9AQaWj6mPwnoUSQmky45iPOxpdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783878412, "uuid": "d28b4345-c959-4a10-bd97-2ad9c4dfa204", "value": 2589816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783878412, "uuid": "086b2b02-ad9d-4257-b575-c66ddd4b2b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783878412, "uuid": "3844c5b8-8ee0-46fe-9960-75a370886c26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0af95b8-7ddb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783851767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783851767, "uuid": "61e561e2-651d-40fb-af91-f03546f39340", "comment": "Malware payload (Gh0stRAT)", "value": "3a57f4a52442ca8deba24da9e199eb75", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783851767, "uuid": "2f6a8197-119d-448f-bb97-3efc0bc017de", "comment": "Malware payload (Gh0stRAT)", "value": "cc16e880d67af10df85f43a178b824548e20ddb40cda6e23a73a75e4c456c8d9", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783851767, "uuid": "6c136078-31b1-44e8-bfe9-ffd0c1a42978", "comment": "Malware payload (Gh0stRAT)", "value": "397750ec9658c8b76ab78e1802406531570f25cd", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783851767, "uuid": "82827e2a-42a1-4153-9e1a-be0799402651", "comment": "Malware payload (Gh0stRAT)", "value": "2b1dfb130a3fb91995fcc91217fdd9bf95040fb2ca5fb3629fff293d382f348b10800154aee9c69cf6f53902e85ec21b", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783851767, "uuid": "e409a0cb-b42e-4829-8709-7e80b3a0a7f4", "value": "T1E131FA957185F55D4BC8B8A134A92ED6E4B4D458B66CF7831C9EDD101D6292920F0A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783851767, "uuid": "0b54b8d8-4787-4d29-a243-e1ab6467cbdc", "value": "48:d6xsU5NH9l9wx/U6z1hLWHqQj88gUbOoBlC:d6xs+Tl9h6ReqQCUbOofC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783851767, "uuid": "78a8f77b-ef1b-4af4-899d-3ba471e12816", "value": 1642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783851767, "uuid": "33cb1306-c5fc-4bf0-80a3-5223cf5cf8b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783851767, "uuid": "7e438250-11c4-4386-a57a-9dfa194905e8", "value": "\u65b0\u5efa\u6587\u4ef6\u5939n.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876bab32-7e1c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783879642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879642, "uuid": "5e197231-ea79-4a53-b659-89f6a751d9db", "comment": "Malware payload", "value": "caf9ae8be4b52e708a31da0a88f96c58", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879642, "uuid": "216d1779-89e8-4d61-9613-546b72456d56", "comment": "Malware payload", "value": "cf18061441faa3ed7bd56d609406c37ef66928f79864cde00af7cac178092b5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879642, "uuid": "aebc1e73-73ed-4ed6-ba04-40cd5e3bb661", "comment": "Malware payload", "value": "52cee89d5efc6326961412d38f6c73852db5cf00", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783879642, "uuid": "f799d737-7fd0-4ac4-b398-845c5699342e", "comment": "Malware payload", "value": "2d3dec7e6eb7060d56a0f5841e6bc03ff198bb3b79da3509035327581d7f0a50347bc1068fc0ba374a14d3486692a1f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879642, "uuid": "b965c7f0-a238-4a2b-8809-6420b5000d3b", "value": "T143C26C966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879642, "uuid": "10982cd9-5424-4514-adbe-c8c4ebde96dd", "value": "768:A8vCB+25j6es8R89FYpMSUpi+20qUpi+20YQX:A8l25JKd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783879642, "uuid": "7d854ab1-f72d-4244-bb36-66518c22fd2e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783879642, "uuid": "758ae833-294b-41c2-afcc-2e006bb465b0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783879642, "uuid": "1e8b13e9-407d-4905-9e52-35b66822d970", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343e477f-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843854, "uuid": "5317b5b5-2d30-43df-a955-75773db4b892", "comment": "Malware payload (Mirai)", "value": "834e5698ce70c83939d83e3b474c7ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843854, "uuid": "d7bef29d-f403-42e6-987e-737b214200bb", "comment": "Malware payload (Mirai)", "value": "cf8e07fc5dc89f86e39373e9b5c593f91b8ec737c635390b65a8182d1b883a85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843854, "uuid": "2b274482-b911-41d4-83f6-348f4d4190f8", "comment": "Malware payload (Mirai)", "value": "98baceec3d658c5e1975fde6efe911568336d85d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843854, "uuid": "c2a7fa66-2edb-430a-b44b-c2d3022fe5c6", "comment": "Malware payload (Mirai)", "value": "914fe22109534810c42db7c2aa5ebfa831071219569fd4ff0f772781ac29398a9ccb8a80e935ff6198f56d31fd919b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843854, "uuid": "944909b3-d86b-4a4e-88af-1ec68919d397", "value": "T192F2F1D59196109ECD18B1318EFF87C94878ED445A65FA819BF07F93A45B3132838FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843854, "uuid": "027f3bac-7b67-4013-a74e-7674d72e08e9", "value": "768:Yf8Hbcod+R9LHE5EcR/X5/2EWoXSiyP84FCEKc5ZT3b+A:L7dS9DE5pJ5OWi8zcj3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843854, "uuid": "be8b8a05-6d98-4538-b707-8fce95cee210", "value": 35276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843854, "uuid": "f9d99bf7-acd7-4357-8c32-2efde2bf8017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843854, "uuid": "ff69baf0-c9d1-4fe4-9f00-4392300bf98d", "value": "XDi686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48153397-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843887, "uuid": "52a0814a-62b9-4aef-afeb-c11b48d701cc", "comment": "Malware payload (Mirai)", "value": "d3ab617fcdd40ee2d7b6a50f3f031f96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843887, "uuid": "8e6ae88d-dfa5-4132-87de-b9716040a019", "comment": "Malware payload (Mirai)", "value": "d0035f7818ba3114a9950f1f4ef133c8c89a607836813bbedeb5b53e85f9c166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843887, "uuid": "0e1275bf-10d6-47dc-80d1-2d26f490d8a0", "comment": "Malware payload (Mirai)", "value": "9c5ee3c34350952270708cd2180ccf1a05d4c077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843887, "uuid": "bed09dee-0203-4158-ad18-52ea41f8d5f9", "comment": "Malware payload (Mirai)", "value": "5cd2f518978a8658edd2ab050db7ea6d31592f4ac38959ff2d9a278a93153544f4d6d53f2737ac042bdd2305be7bc2cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843887, "uuid": "fb443942-787e-49bf-9431-66e3b8ccc242", "value": "T1ECC3AE97F78B24A1CC6146F407C77B8D2E6362119E6BA9E76C0E763B097A0DF18163C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843887, "uuid": "01b149e6-2feb-44c0-a7bb-de5dcac59489", "value": "1536:xCfNRkaAYxcvAbWm17FHQEyh5mLaDWqo024sSoBZ86VC4xZJCNgYw/LW4:xkN2kxiAD+5mL+tUSoY6VC1NgYwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843887, "uuid": "b853f696-bffe-45c4-b3b8-00842946bc73", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843887, "uuid": "e07aa88d-75e7-40ea-a80f-f55034f5d38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843887, "uuid": "8decfd1e-a738-4848-8816-ed297d13119e", "value": "ar15.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8e269e-7dbf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783839818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839818, "uuid": "ba4d8556-fbde-4955-b9d0-6c3a173a6928", "comment": "Malware payload (Mirai)", "value": "9ed64ed754be54af968875a20e412676", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839818, "uuid": "3e3ecc5e-0b66-4f38-a3dc-1dc8d7736571", "comment": "Malware payload (Mirai)", "value": "d105bb8c6af157835ee9cbe80eda7dc0797c3f9f933e1c599ae257e2f30f0c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839818, "uuid": "8ccd9452-d22a-433c-939b-a444bd9f4931", "comment": "Malware payload (Mirai)", "value": "7a5586748bc59452ae3174804300b2c398806f02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783839818, "uuid": "0ec4821e-a9af-4f36-9541-1ebe49e9fcf1", "comment": "Malware payload (Mirai)", "value": "26ae64335b7d44c3aebe8f20d540168e0db2e49edab1ae8ff347a253ebd1112bd46fc4eb24937ae1dcdfba28483aa02a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839818, "uuid": "17396efe-1b28-41cb-931a-7b885c32d87d", "value": "T149633C02B31C0E47C1635DB42A3F17E193AFA99121F4F789651E9B8A9276E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839818, "uuid": "cfec3f47-e231-41e1-bb26-694696529408", "value": "1536:H83cgtEbm75ycWY8H84j2cBJlWFm9/8NIK/5DxwyRXLV/nu/:KvDow8H8U2nNI+87/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783839818, "uuid": "d4ea2ce6-a0b4-4ac9-863d-2ad3dbf65067", "value": 72924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783839818, "uuid": "36cc1532-a7c7-4760-8be0-d6bdd1c55a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783839818, "uuid": "0eaf3ecf-927e-4574-ae80-7a56ce72c8b5", "value": "XDppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8742bad1-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854731, "uuid": "d3fe26f3-8cf3-4439-86d9-6109eb78f468", "comment": "Malware payload (SilentNet)", "value": "29512f0d64011c210dd1be6aa243d446", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854731, "uuid": "02abc6dc-5ea6-4fd2-bd21-c0a536b9c17d", "comment": "Malware payload (SilentNet)", "value": "d146ede3dcaf9d1e3ceae7b24269c417a25c823bfdfc3143061d179973594b44", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854731, "uuid": "103552f0-8629-4eac-9589-80daaf10a5f4", "comment": "Malware payload (SilentNet)", "value": "0c53095d1c38405531aa6c1bb0fa5753248b16d9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854731, "uuid": "47fa7c14-c253-45a1-a06d-bb0435905075", "comment": "Malware payload (SilentNet)", "value": "696cc0030ac2e4cd11f7b6ad6da0d864c043ae2803369edc4ef505ff401f2241442c382237c42968e413cbce11c581c3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854731, "uuid": "7c02eb55-9614-4ce8-a6ca-1a22fa8d98d2", "value": "T13A473354AFDB4670CB73B778C45ACA62FB79C18CC0272543685FD72A8EE1AA1C709784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854731, "uuid": "6575a336-8d90-441d-a169-eea47a3037c4", "value": "786432:lGkoRctry61lbb75dJacWzPulBaQWp4knB24AHpxqf7ojb:lGkVyslbb7MzPIBaQWp4UBb6p0f7on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854731, "uuid": "2ee769d3-291a-41d5-9a11-d2a4d44d2041", "value": 26508788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854731, "uuid": "c614cf41-00a0-4daa-967d-33571777b834", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854731, "uuid": "93f07e83-5326-4352-b4ce-e9d99ef98eef", "value": "AUTISMClient-2.9-26.2-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e59336-7e13-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783875832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875832, "uuid": "c7c73c55-5e21-48b5-bfb2-88763e6e3f2c", "comment": "Malware payload", "value": "0dee85c725db3e60ee68120738651cdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875832, "uuid": "9fa635df-bc5e-4e7d-ab74-3e60d4d46241", "comment": "Malware payload", "value": "d16bffbd3ba31504aea1fc01e66e29ad5927830ea5e2cc49369e82a7c68ec5c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875832, "uuid": "20bda524-3ab8-4849-80de-533fdf9c047a", "comment": "Malware payload", "value": "aa4591559138e75cd8d4db47d1948a3064288208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875832, "uuid": "b76978c5-a0ed-46c8-a3aa-7f9fd45e5f8a", "comment": "Malware payload", "value": "03de4a5f1eb7bec691375be4f9e9bb192099b13635796e6ba88f9c6a670993973eb4474ccc9fac30cd7d526d123ec71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875832, "uuid": "f9e797b5-1760-4b3e-91ea-351acae45c8d", "value": "T15FB4D69BA89550F4C1FEE134C66AA212BDA13495073827D72FA147F10F26FF85A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875832, "uuid": "009b9d9c-1a57-47fe-9c4a-e75945ba70d4", "value": "6144:c94NsgaeLCfHqHc6c5EBr777mMsIRbS5OwziAJxTDo7BTbWI:ciZLBtBn77RD3w2AJK7gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783875832, "uuid": "f50f1e1d-ebbe-4af8-a014-41b76ce83f56", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783875832, "uuid": "382a1824-d6e7-4894-81cc-2ecc3c83bea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875832, "uuid": "19b6ea75-5c4f-492b-89ef-0cb4caf3a3f8", "value": "20260711-215002_sftp__root__8857952871563194709_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df7f9e-7e1e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783880624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880624, "uuid": "50942e20-9101-4afc-aec7-26379ce12ec3", "comment": "Malware payload (Prometei)", "value": "0a352c6d7a147f34906808304e755f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880624, "uuid": "7a9a2071-a983-4448-8868-520a607be1f5", "comment": "Malware payload (Prometei)", "value": "d2bf8e50fd79d43040d4bb94491cf2a2155b5824d8f17c4d2e89760d9a5272c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880624, "uuid": "e7f2e0e4-d6f1-4c87-ab0d-6fe490967618", "comment": "Malware payload (Prometei)", "value": "bdc3868216ea81056d2589b383ab42076fe1a687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783880624, "uuid": "30960dea-9801-4d9a-8171-ce112dd3fae5", "comment": "Malware payload (Prometei)", "value": "0911417ddacc86261b34f8658575f2f24da8d9d630392199670f19ba4170ae4bcb97910805d0a57d6ffaaae20ad435db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880624, "uuid": "b7375d9b-79d3-4aa3-895d-4fc2cbf93f29", "value": "T121A423B4F9229E9F6DD769B91B24831DE181C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880624, "uuid": "aa977616-b3d2-4f2d-bbce-c59bdbe9776e", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdn:Fs6pyCC/Ya2hpi6T6N4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783880624, "uuid": "bd64c893-d90a-4950-bfcf-bc141b24de44", "value": 449058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783880624, "uuid": "1bfe75c6-a57d-47ed-8fa0-67af15fa7ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783880624, "uuid": "fa06f782-d1f7-4281-ae8c-e675d1d64ce0", "value": "d2bf8e50fd79d43040d4bb94491cf2a2155b5824d8f17c4d2e89760d9a5272c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9a78d6-7e39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783892134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892134, "uuid": "7a0366b1-373c-4439-946f-2957c61c1e51", "comment": "Malware payload (Mirai)", "value": "1184540cf579b8144460681a0d9ad857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892134, "uuid": "069422fa-928b-4cb4-ba56-c25b6c9f22fc", "comment": "Malware payload (Mirai)", "value": "d417a527536373273357ef66652b8ad534d83041ffb9b9b2e41df1f40ee444cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892134, "uuid": "3e550c93-7bf2-4d25-8249-fb4746847a22", "comment": "Malware payload (Mirai)", "value": "4828088c4cc283025ac0e3917cdcffbfb1bbcdd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783892134, "uuid": "aa644666-a34e-40cd-8774-abeebca22bb5", "comment": "Malware payload (Mirai)", "value": "b97f5f93cf5877c16ccf77ca41fc48fddebaa88c22f0f18bda0cfba6f29bf2e805670f04af49ebda0bb5c561b9abaae5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892134, "uuid": "43d11558-0b28-4c8b-ae5b-b72150a14700", "value": "T1D5F32AC7F900EEBDF81AE37648530809B130B79254925A377357797BEC3A0E8456BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892134, "uuid": "f0a7ba3c-17a8-46f8-90d0-6adcd954aff4", "value": "3072:OFsZf1vj7dlJSx0mCdSaVgjbi6LVGFJzLOyZeXkPwr+:ffZJSxmdS5LM7KyZZPg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783892134, "uuid": "05e20f04-6e86-46da-9146-2eb0b59f90d7", "value": 157792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783892134, "uuid": "b7faedca-726d-4bc1-9934-b9c5ac6da580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783892134, "uuid": "1dbf556f-3c4a-4f7d-9bf8-5f3caa224874", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99480794-7ddc-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783852184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852184, "uuid": "1ddb03e7-df09-4197-bded-f05c8d844455", "comment": "Malware payload", "value": "d7dd5ca239dd204fe8a51215028b9bd1", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852184, "uuid": "89fe6433-e38b-417a-a5d0-468ba4c004fc", "comment": "Malware payload", "value": "d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852184, "uuid": "63246d90-e038-4014-b6f9-dcb3ae5af666", "comment": "Malware payload", "value": "ef762657a3de5ab8632d13691592f5b86cda9c77", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783852184, "uuid": "2f2a5faf-c825-47b0-9297-0adda7eef71c", "comment": "Malware payload", "value": "dba806599d6d7088b3d1776821b8e25c8d936fee39007849b036f6e936d6f4cb5986e046b56bd0bbf4c8563ee384b0c4", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852184, "uuid": "7b3a1877-1eaa-4c71-be25-9eaa357db860", "value": "T1A1A3103475D81019E1F3EF72ACF477C5AEABF677B9B2125D1850160A4912E80EE12B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852184, "uuid": "d133ba9d-cb52-4942-a7c1-2492d37bb1c8", "value": "192:3cc5C3gfZJr5Gc5wjD9IurjD9IMcIAzPucB/CRc7dTXB2JD:3cc4QfZJr5GcuP9cIGuc5yc5TXB2JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783852184, "uuid": "b878414e-5218-4990-9b9d-d42fa65f14b2", "value": 107212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783852184, "uuid": "34be1bcf-ee26-41c0-95ef-517eb5bd0165", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783852184, "uuid": "f3edd1d7-85bd-4b73-865a-f836fbf50e67", "value": "ProtokolZatrimannya.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103158d-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843848, "uuid": "85719930-1408-4a4e-8ce2-5f3e13c8a7be", "comment": "Malware payload (Mirai)", "value": "4bfa1419210081c9cba593d578bb390d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843848, "uuid": "76bffe41-8368-4fb7-a007-207dd17268f6", "comment": "Malware payload (Mirai)", "value": "d743e027f3a1d4414c5113d3afa9a49e9b623fcc2b2b5e797473ce25a5027a86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843848, "uuid": "74de13f8-37b0-4952-a83d-1fde18b30957", "comment": "Malware payload (Mirai)", "value": "ecb64bec52a8e44d1d2f865cf0f2d3ffa9a3aae7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843848, "uuid": "07059e20-718a-4645-aaac-bf4921e23e0b", "comment": "Malware payload (Mirai)", "value": "2f3436b8b7b6fda3fa85dbb8d44edd39c062a39529c1f76713e08a9205d4af20bca98d217da6b4ad3bdacaa134cdf5f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843848, "uuid": "c477d9cc-fdea-44d7-a911-990eabc9bb97", "value": "T1AEB43A51FC419BA6C6D12ABBFF5E828C772317B8E2DE7112DD155B2073CB85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843848, "uuid": "04b07c2b-ceaf-45cd-a5c2-22dd5834cf10", "value": "12288:CbvmvhmYvYksQeDGHjxkGlhpf6Evg0gQEU4yMJaTW+Je:CSv8D8HukPvBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843848, "uuid": "9166de2e-c355-4f76-8580-6170add577cf", "value": 518848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843848, "uuid": "89ce131e-6be9-4be6-a9d6-90ce9b953d6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843848, "uuid": "2b2e2382-479d-4024-a249-47e5015d2af7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b938ef-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1783844148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844148, "uuid": "15391ffa-434a-4be7-bc71-b36c811abc28", "comment": "Malware payload (HijackLoader)", "value": "9c8250a200c30661fcf304025546500a", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844148, "uuid": "36d388e8-911a-4a55-a060-3edac5873e84", "comment": "Malware payload (HijackLoader)", "value": "d88aa7f544145d8feda83c37b2c771b493bdbc6a3f84ce7ab9842823ea9f295f", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844148, "uuid": "fa0dabb4-9958-4146-8204-707c1350db80", "comment": "Malware payload (HijackLoader)", "value": "64ac5a38f7b4933b22f5ed15ec216613ad43de41", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844148, "uuid": "428d2362-af1b-4f3c-9920-c89c3c4a0df1", "comment": "Malware payload (HijackLoader)", "value": "2641184c6f6388b434c0e412ffa14536065af5329aa38d35f7bda82447c503de83315edf3934232c985f9686db004458", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844148, "uuid": "66b5a495-5aef-4038-8917-0a1211ed8f9b", "value": "T1F8F5334B18716763F233C0F564FCA942B6A1FCEAA3B19364B0E2B2296DFDDC45036516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844148, "uuid": "492d6fc4-e411-4779-b4bf-8e126e4a2694", "value": "98304:BK9WQbWUuT+TbGab3nHvdHCIaHLrSDlm58u:kL2TgbGKUIwOm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844148, "uuid": "ba44fd39-6f22-479d-b4da-9152ad916ff5", "value": 3600384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844148, "uuid": "2d83a068-cd1b-45f7-9612-082770a4a219", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844148, "uuid": "aba0b12d-1635-4e7d-9799-6dee8e345018", "value": "PorProfiler4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0dbf56-7dc2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783840991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840991, "uuid": "10826cb5-eb55-4841-9fa9-671b2231646d", "comment": "Malware payload (RemusStealer)", "value": "5dd60bfc3351e273a520564f0688a45e", "object_relation": "md5", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840991, "uuid": "48618a30-3ac9-4845-b785-8478b61a51d0", "comment": "Malware payload (RemusStealer)", "value": "d8f202a15c6d0ecb27229a8df34860d9c39cc16e3cd98054bda32a3bac8b898d", "object_relation": "sha256", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840991, "uuid": "4e1acf44-5cf7-4e6e-85ef-44e0cb7f3481", "comment": "Malware payload (RemusStealer)", "value": "646f1c1713ab2707ca946d64e1557daa629159df", "object_relation": "sha1", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783840991, "uuid": "ec7313bb-f501-4874-87f5-f70e807559fd", "comment": "Malware payload (RemusStealer)", "value": "0bbc124854dad4f6addd70c98925cb2bacd2158b8912699b701d71a28c43c7966c5d110464d4ddfb2db0cb07b0dc9e8c", "object_relation": "sha3-384", "Tag": [ { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840991, "uuid": "da402e31-2fd8-4edc-b334-7c2549120b38", "value": "T153C54807BDA149E9C09E923189B751A67B75BC080F3223EB2E90B7782F72BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840991, "uuid": "b75d39cc-8221-4e06-a924-711df2c04e60", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840991, "uuid": "44aa294a-6a80-4d12-80ef-b6728d3ce9a8", "value": "24576:eUOmTxoDkcIbJPJzaiPBZ4ySStboPJzQwABTRuG9NSaYK1ogvA2Bele5rK2y0HE6:eUOkxtc6PQ0QeRiQwARRpSa/1oW8bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783840991, "uuid": "09d3958d-cff6-4e70-816a-7dbc795a9075", "value": 2558320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783840991, "uuid": "2e8ad812-e8b0-4d4c-a0ee-0278b054b767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783840991, "uuid": "8312bfff-46a8-472d-b1b4-bb923511ad2d", "value": "jhgkuyyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f84f24-7dd0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847179, "uuid": "6371e7c3-9579-4143-ab01-00e0b1ba0b87", "comment": "Malware payload (Mirai)", "value": "15372176d6331ee6cd179987ee4f0e2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847179, "uuid": "b251420d-8b13-4b16-9b24-b35e58ca1f6d", "comment": "Malware payload (Mirai)", "value": "d94f32c60d0f1372133abe7e627a5b09373546d96828a45a9025a6c3b18022e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847179, "uuid": "3c795e3a-e5bd-4097-b984-96a650a09174", "comment": "Malware payload (Mirai)", "value": "c10b0811a729655de24379b957e381f46e3fb8b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847179, "uuid": "c9776385-e9a5-4fcd-8a7e-3701e5e27c5c", "comment": "Malware payload (Mirai)", "value": "049aa2e92fae68089a761be64902556b15b110e77baf282f020c4157e9a394eba19c37a53ecbdeb988859092733d73f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847179, "uuid": "bcdf735e-c484-471c-8d2b-e210da7cb41d", "value": "T1C051D0CA125626713DEAFE7E75BA8424B380F1CE68C1ED24E9D938E4424CD1C3345663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847179, "uuid": "2cf4d688-a1b2-47d3-9d9c-96c54b917292", "value": "48:v2UBUQUpUSuUaaU398UuUbU8UdUxUYU6AMnU4an:v2UBUQUpUXUaaUt8UuUbU8UdUxUYUiU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847179, "uuid": "db17ce33-da05-46f5-9661-01eaca425e2d", "value": 2640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847179, "uuid": "283715a1-5fea-4dfa-a7d5-e541de326080", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847179, "uuid": "0596b562-85ec-4d5b-8adb-e018d6e2a6cd", "value": "HMugenXrevamped.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd1e492-7db4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783835012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835012, "uuid": "98c33fe3-856d-4532-8abc-df27a8a5bca0", "comment": "Malware payload (Mirai)", "value": "716954b760aa6c8de2edb7b641b957cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835012, "uuid": "1f062667-7bc9-4d77-bc21-d4b1fed76b8f", "comment": "Malware payload (Mirai)", "value": "d9f33d100deff9e00bd88d195dcfdd26684654efa1d20ad27449d61efd7d7780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835012, "uuid": "a119c74a-8c94-4472-8e84-c5923f99523e", "comment": "Malware payload (Mirai)", "value": "5b108e3030be43611dcaeb52a9ebd469c436bff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835012, "uuid": "201e4946-9dca-4ba8-8ea2-c116819d17ce", "comment": "Malware payload (Mirai)", "value": "31a169caa9779f7ccd32853f7a5ff05143dbddd5dee1d20a5e294cb5ccaa17359cb3eacb04eaa2dec5a3e6bc820ef144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835012, "uuid": "f4602ee5-b91e-43bb-be29-1658d41de54a", "value": "T106733991BC819713C6D112BBFB6E028E372613A8D3EF32139D226F21778795B0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835012, "uuid": "9a14264d-b9f9-4cb7-8e57-79767354cb92", "value": "1536:CnBtsMBC0J/L+HyCx1Ol1QS0XCSkdOLcpvDV/hVd:CnB9JpaOl1QjSDlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783835012, "uuid": "dea137ef-bab7-49eb-a84c-5eabd6f04710", "value": 75472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783835012, "uuid": "0b08e174-92bd-43b7-8ce1-d73791fdf315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835012, "uuid": "c858432e-2011-4f7a-ad84-46b2868ce4f8", "value": "XDarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2992d5-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843864, "uuid": "e7fd4ed2-65d4-4fbe-83c8-f59819398c9b", "comment": "Malware payload (Mirai)", "value": "d40f636533ed9f990c798814e676a774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843864, "uuid": "03789e56-5fb6-4422-bd51-442cae03aec6", "comment": "Malware payload (Mirai)", "value": "dbffb6c37db2d069f5a3920f4c2eac4d2bf04321ec5920d7fa9adcf037f95fb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843864, "uuid": "33d914ea-c48d-4e56-b6f8-6b0859736dc7", "comment": "Malware payload (Mirai)", "value": "9da7ccb37d3b17bfa793272bffba88f5a56d837e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843864, "uuid": "2d8b561f-f34d-485c-86ae-57843ab0ed84", "comment": "Malware payload (Mirai)", "value": "64e55dfaf1a2e8d12f706d4e2a1eb2fa051b193ceefa8647d1cf8746cc09d9afeeb3064d037b690699dc9e5e86dc2d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843864, "uuid": "6f04014f-4d20-4134-b33d-7cec845c647d", "value": "T163B39CABF74B04A1C82247F14BC74BEE2E137201AF57C9E36D0E257959792DF4A06392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843864, "uuid": "7fe694fd-82de-4aa4-b44d-1b3f9b9f6cfc", "value": "1536:ZNi+neICsCfV+Ki5zQO/1UluYs5RcOHxWTSKgiV/KJ/LWc:2YegyV+K6UO9Uzs5RcTgNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843864, "uuid": "e499f46f-20df-46c1-aa5a-a25e19ecb356", "value": 108200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843864, "uuid": "55cdaaf6-0425-4696-ba9f-0ae14f738dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843864, "uuid": "b56e37fe-90fb-41ea-b4aa-89c7b982ceca", "value": "XDarc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b32f44-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843878, "uuid": "45a6adca-5847-4dac-b376-bfd8337adfd3", "comment": "Malware payload (Mirai)", "value": "2f777d1647c308a00c992138220f6b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843878, "uuid": "74d21d25-bf4d-4de1-b469-c2a79da0952d", "comment": "Malware payload (Mirai)", "value": "dc1956b99db7fce70fc4edc88cedad3d42a546ee7d0ec55f0bb0340c5af4a85d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843878, "uuid": "b6295050-ee0f-4fb9-b1ae-a3a185b69772", "comment": "Malware payload (Mirai)", "value": "01d5c1897abb4691b8a3e4daf55f9c9bceb1c9ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843878, "uuid": "33c33546-5e5d-4df9-9c69-8a17f1963065", "comment": "Malware payload (Mirai)", "value": "34883cf8164fab43de38e593ccf592a1050f5cd0df85220127dc7ad385cf1557a97c3f3fdd628c0d19dafe81e5ab0b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843878, "uuid": "15dad8bb-c7ce-4fb1-b4a3-fab494d27ff4", "value": "T1804423F914F4026B5CB6D5EF7A55048AFE2CCEA69124DA73FDB094D34ABF206600C932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843878, "uuid": "016c243e-0f0f-49f6-b044-6a8d81df72c2", "value": "3072:QuyjobS3Y2dR4EFxOMgR68WvRKntfRdtrB99Jm77XP7MUOwWCLWw3DAoyksAsfyx:KjTFRxcWZKt5drK7XP7Mqa8QkIEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843878, "uuid": "fdb74a54-daec-4e44-b082-fa62280397d5", "value": 256208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843878, "uuid": "f0787e2f-decb-4718-9dd8-ab0cad0402d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843878, "uuid": "a225e63b-a561-440a-a153-2eaee3df1876", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eebc37-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843889, "uuid": "e668ea0d-44ea-4052-96f0-07dfa1b663cb", "comment": "Malware payload (Mirai)", "value": "c9b9d1a315248e103215a0103dce923d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843889, "uuid": "9e9fe8c1-854b-482d-add4-a73aabefaf5d", "comment": "Malware payload (Mirai)", "value": "dc1b0eb67684bfb7ac6b6c4e1dd540e64057af505555868729500dabe8a55541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843889, "uuid": "93779f52-a37a-4497-810f-69d2c2c2284f", "comment": "Malware payload (Mirai)", "value": "ea85863cad8d7de9e856e0bd307aba37a32dbbc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843889, "uuid": "03a43612-8d03-4dc7-a42c-143c2fe75ce3", "comment": "Malware payload (Mirai)", "value": "d54ef7515094d5ea1f8ec32b5b09a86032e3165f810dec69269beef9ae9194405be1f8428751f84393a587c4eda67de2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843889, "uuid": "c56a4499-91d8-4f37-b519-aa11fc6f95ca", "value": "T1FE9318C6B401DC7DF80FDABB4463690EB631E2615A831B26675BFD93AC321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843889, "uuid": "dcc629e9-4af6-41dc-aa0a-221777e06cb5", "value": "1536:wQ1JsIO7ywe3iyF1rP8RcUSh+Ti+9gFFWqPrdPj8bMb2vwv57LBo0z3LrV0rK+tz:wo1L8jSh+TswqPrFXCQ7doqsK+t788V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843889, "uuid": "fc0d13a4-643c-4860-bc07-e4de03e43f75", "value": 96728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843889, "uuid": "7b9798a7-01d2-499f-9070-9f8b3dba124b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843889, "uuid": "11ffd42f-8456-4f30-862c-dadd02ee9ee3", "value": "ar15.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba833ae3-7dcf-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783846656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846656, "uuid": "28aa3690-e970-44ed-9fa2-1cda5e54547f", "comment": "Malware payload (Mirai)", "value": "42d39d345177d0656d6e1d6d587d9191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846656, "uuid": "33a57197-4bcb-44ae-b62d-e2c0f01f6c7f", "comment": "Malware payload (Mirai)", "value": "dd91d7197e10fae7b273e4624e7f7d1660dff8d53feb3ac60285bcddac73c5f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846656, "uuid": "6f8d17d1-db1c-4003-bd02-c470806ae0f3", "comment": "Malware payload (Mirai)", "value": "77c9121227b4f734a9d5bb143f790e8feef16b2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783846656, "uuid": "6b16a739-ffb2-49c8-bab5-56d0c83e99a2", "comment": "Malware payload (Mirai)", "value": "115231835ab6b2df289e1f8fa5de01ed9bc7181f84089d4e228fa8194e1b22aa92848f68d0967e7090a81349d4f014a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846656, "uuid": "21f9bd1d-475c-4647-b5aa-0e02169c8d2b", "value": "T1CAE30846F8819F12D5D552BAFE0D124E37231B78E2DE73029D24AF21778A9BB0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846656, "uuid": "4503b1ea-e666-41ef-9b69-cb08b78731bf", "value": "3072:gS7wX0zHgH+i/XvtoK1h3WriymM7aArR8kB:lcX0zHgHVXt1hIiymM7aY5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783846656, "uuid": "7ae4aac6-65b2-4a1c-9d90-03a5fd566678", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783846656, "uuid": "7c56e191-234f-4411-9158-467fb7c64621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783846656, "uuid": "51b2f547-bf46-4121-8fa9-07dfbce83cf9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869dfe8a-7e4b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783899827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899827, "uuid": "966757c2-c846-4119-bb42-cbac2207748b", "comment": "Malware payload", "value": "26d7035a2330793f6d67f2b3c5429f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899827, "uuid": "26c7b184-d151-46f3-9969-b177c165f78a", "comment": "Malware payload", "value": "dfacebad09d75d41ee5f477754815ae7e4afd926638d7b72a6a25338cd2479da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899827, "uuid": "f972abb4-c0c8-43b1-b2c2-baa9a4698710", "comment": "Malware payload", "value": "e6c21df0a8142465a410de7e6da31ece2c2fab4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783899827, "uuid": "a80496fa-69e1-4f07-8fb5-e689070a6bbe", "comment": "Malware payload", "value": "c4c853d16c73d0986cc635b6a4c1ca4c0f4932055286fff338d3c83a0da44d8f76c3a2c898e6f7bd0f0a3ae17a6c79bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899827, "uuid": "9880cc61-5731-450d-ad64-df1ed73f5d1f", "value": "T1AC36BE96AEAD40D8D895D075C557491BE7B6BC242331838B317DFA5B6F333920E2E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899827, "uuid": "c62b5bff-0c45-4cca-9fac-a948bcd41082", "value": "48fe88e0492732b61e81e006305b27a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899827, "uuid": "d40596b8-e199-4a71-bcce-8aea16e50620", "value": "98304:qTQUX2D2LH8oRO+TJOTs5BqrSZ5DgOc+pV6UHsiXMoj9ghi1RebMIg9Cbk/V+thx:qF2UH/rTJOTs5BqrSZ5DgOc+pVNsiXMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783899827, "uuid": "3b7654bf-e729-46c4-bd3b-82642b9fb4a7", "value": 4896457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783899827, "uuid": "125df966-0542-47d7-8512-d5407cf6dc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783899827, "uuid": "fec0e148-69de-47c7-b7da-b57bcd69347d", "value": "Feishu_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299357d2-7dd4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783848560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848560, "uuid": "a7df2f47-ee2b-4267-8404-db1e8bcd58cd", "comment": "Malware payload (Mirai)", "value": "7b00d91580390f3a1d464dee4e44bde9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848560, "uuid": "e088d9a3-1374-48cf-8b6e-d99f855169c9", "comment": "Malware payload (Mirai)", "value": "e19866e1a91bdec9041afb1be289fb4a057c758e8e5d38b89f21a5c1032337c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848560, "uuid": "abbcb441-9de8-4886-a5eb-cc41cbf234af", "comment": "Malware payload (Mirai)", "value": "4d931bce49f8888386c84fb6ba40a09726fd73a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848560, "uuid": "37740ae4-23ce-4904-83a3-11efe45ccfc9", "comment": "Malware payload (Mirai)", "value": "07e580d0a67e40b08335cf9829998199040f38e80286764eb234c4d69b5f3b815755e02fdb447387238eef87f0c52dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848560, "uuid": "fe974f9d-750c-4f8d-a7a5-6f68480d7322", "value": "T1967302BEEA47A8A9E80C6DB051222DF56430F01EC52E7C74BD8E5FF755990B067063CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848560, "uuid": "d6c4963e-6f7b-4b67-8ca9-16cde10271fc", "value": "1536:J8LBXbEoCSxeZzVU1fsfkkq0WHN+bxeduKlCt8AXUnvfa0TpLk:8UzisfkOx4lmX8a0TpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783848560, "uuid": "c60cbd26-1e76-47f4-ba1f-d8ab147f1920", "value": 79396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783848560, "uuid": "f610c9c6-d80c-4109-aeb6-15216834137e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848560, "uuid": "b3fd1a8d-ef79-4b63-ad00-a8631e80637d", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74229845-7dd2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783847827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847827, "uuid": "815e16ac-0a7a-4cf4-9cb5-a4f963e4e008", "comment": "Malware payload (Mirai)", "value": "a6cb1180309a3cab0d854d2ea7dfd0f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847827, "uuid": "aaca0629-6e8a-4bc5-9d2a-655d6e0ef7d2", "comment": "Malware payload (Mirai)", "value": "e2f717161e357470d19469b417f1c803d73d392debbd8792fe27946288ef0e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847827, "uuid": "96c8dbc0-52fa-4187-8a43-2f3e8c6a2d87", "comment": "Malware payload (Mirai)", "value": "c6cdb8297d6109c99caef7ffdca6d2a642605620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783847827, "uuid": "d366e80a-5d90-4e8d-a778-26a17321c09d", "comment": "Malware payload (Mirai)", "value": "fd39c50cdbcaee91d8b231d48d4c21fa519a7fc425b801396fc68412b7e7d521eac4f19a84f4202418bcf428315ed8ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847827, "uuid": "a558d81c-4325-4b8f-af7f-109a4dbcf70d", "value": "T1F2730268EC1395BEF120F9B922DCC50524C63D3B6CA774919B102965FAAFB0B7C432B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847827, "uuid": "5c5cb23d-abdb-4485-8dd9-67b71e6d180a", "value": "1536:M5FwaRXca+CqWxYLppTrTBBLWv+5mV5k+EkfnFQ0licfSM4Az5Wvt6f3K:laRbP2/nBBaUmV5kHKFQ0kcfSps5+8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783847827, "uuid": "32141797-264a-4ce5-aba0-5c8b1a77bc1d", "value": 76012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783847827, "uuid": "0b8f5bd0-05da-4930-b5a8-ceaf42ed6245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783847827, "uuid": "e7ed6dcf-e39b-4d9d-af7e-0fa02bfe177f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8a7b74-7ded-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783859571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859571, "uuid": "5856629b-b60b-432f-806f-9acf5179d03b", "comment": "Malware payload", "value": "8d1fcaf142285c3ff5be435dde68a4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859571, "uuid": "c44422c0-205a-48b8-94a7-afa85e6e0168", "comment": "Malware payload", "value": "e712d2be2d4554c756b6a2b9aaf22dfa2100e31679c6e9eec8d4501c9730a856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859571, "uuid": "db0ca047-ee60-4ea5-b10c-dc8d9cd7c05d", "comment": "Malware payload", "value": "595bba6878094794f5421bc45dde512d9724d201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783859571, "uuid": "787a6b3c-c1d3-4fac-abcf-1322da77a18c", "comment": "Malware payload", "value": "9843bde83229324ea79aca1b9b33d2a713aaf91ac4aa48b07aa1b2008ede3d56c77ec04b3c3ab0ddeace1fb249be9c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859571, "uuid": "9f3befce-2bc5-4983-8abe-acf09b8d4b1d", "value": "T16786C36B2EA1C328C179CDFEC0A2BF30D8F3B575073782E7519103655A069DA5E3A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859571, "uuid": "5c46dbdc-1131-41ac-a77e-586df0b15697", "value": "fc8f02921a06b9af961f79067d418147", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859571, "uuid": "151e40fe-f728-4a19-9534-338715e75ce6", "value": "49152:UvlqNe/jFjueZYTXeHbmA+6SSagoz0pJjp/TGVUim13Le4L++FUQRR/gfFd:IDnz6g13b7RRGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783859571, "uuid": "fd1dd59a-3b8b-4aa1-9aee-de46ca08a338", "value": 8329768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783859571, "uuid": "094e4da9-dac2-449d-b60a-cf0d20ab0194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783859571, "uuid": "c5d826e4-a275-402b-a99e-c5098aab69a1", "value": "Volti\u0445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f44f99-7def-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783860127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860127, "uuid": "87f98374-7b46-4a36-933b-14a71af1d992", "comment": "Malware payload", "value": "2ca43236dc070530c348c24b4f61fbd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860127, "uuid": "f41fd926-2b6c-43f5-aff1-d42e64b582fd", "comment": "Malware payload", "value": "e79766b8a3cffa940cecc8a983fd7a0c0fc853b1aeb60af106ffeff48e3dfa5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860127, "uuid": "6fdb4ca8-245a-4bef-ad97-adee9b984dbf", "comment": "Malware payload", "value": "5e4bd0b10975aca09366ff8d3b83cbc3a74df725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860127, "uuid": "7659dc75-a1d0-40a1-a827-409fdf842804", "comment": "Malware payload", "value": "44f88f8e78f07b9d2c8e6d2857c7cc7e21741785234cb26e7f865e6e9896f75b0cc02990e326fc18e3804eb4c0ce4496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860127, "uuid": "a4b90294-b204-444b-99b6-ec7acb03ce80", "value": "T1D4C54A03BD91C8B6D05B9231897292927B31FD492F2123DF3A90BB392FB27D05975768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860127, "uuid": "49880b5b-3527-4d2e-92c2-162905a2c581", "value": "4d791c7ff8a04656c4df23bdb9ebb892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860127, "uuid": "88b61201-b99e-4621-86c1-9044cbdd8b23", "value": "24576:OMKhPd9h4WV6xKMFTX2Nwb1V40QMC5Fvg6lfEXBelesaKDQepr4sTG3l:OMKRDh96QMZGa40m5k5P3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783860127, "uuid": "94f074de-5b30-490f-8e4d-8760fb71160b", "value": 2519840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783860127, "uuid": "eeddcb2d-33b5-42ef-8fd8-b7c344327d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860127, "uuid": "661efb39-3b22-4ea1-b0ee-0598c2840227", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b265cc-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843905, "uuid": "86653bc3-4a5c-456a-a597-21ae4f0838f2", "comment": "Malware payload (Mirai)", "value": "d814d90bd4bca307f7d262800eb503f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843905, "uuid": "5dd6fd89-409c-4048-a9c6-8d2ddd945cca", "comment": "Malware payload (Mirai)", "value": "e8967c0c8e2a6b5ef35188c86839354a8ddecf06a42a6f8349fad0e082cb7a63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843905, "uuid": "8a5787fa-b36d-4e9e-accc-534010c2853b", "comment": "Malware payload (Mirai)", "value": "937f8ce84392a7b25b87b6d347251510a8c3f73c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843905, "uuid": "1e7bcd36-4b24-4412-9be9-a0065c1f1bfb", "comment": "Malware payload (Mirai)", "value": "fe4e46110c3dff78602c45af5bc878858daf81c319a5945b8818734e9cc3f853b4941acfbea4a530f2abeab822ff994c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843905, "uuid": "370b7c3d-b3ee-4640-a4ce-309cf1581069", "value": "T10F045C46EB818A13C0D21779B69F524633239BA4D3DB33069D18AFB43F867DE0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843905, "uuid": "c94a2a28-0828-4e4b-8dd1-b63e17f0e6db", "value": "3072:mUwNeg3DYaX5dPRdzFFoJSUYCOK/Uljmy3d0fM/9PGCvmM:mUkzYaX5dPRdZFAGCP/cjmy3dEM/98M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843905, "uuid": "e7aa66ca-828a-4bf0-8122-f9ae5c229e9b", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843905, "uuid": "e585ef7b-9af8-481f-b19c-32f6e9cbe70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843905, "uuid": "9e235b3f-436c-4f01-907f-ab3c290872a1", "value": "ar15.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f31fbe-7e01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783867929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783867929, "uuid": "f0ab50b6-fab2-4f6d-aee9-7a811bf61652", "comment": "Malware payload (Efimer)", "value": "563cc0cdcda7fbfb52cfcfe0a159a5d8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783867929, "uuid": "2d7d0181-ab4b-4d82-8bd5-4f1c73f15003", "comment": "Malware payload (Efimer)", "value": "e99541c2d33cbe83ed4d3e4802a3091e02c7050f6ceafed21f26e7d22a1d89b6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783867929, "uuid": "f75bb3d5-c4a4-4849-9ad8-f4d53a328903", "comment": "Malware payload (Efimer)", "value": "c2b345d2d5ca206dd5e3a562d3201f6f1bfc9080", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783867929, "uuid": "d90cc9ee-8b04-426e-b055-0507f6b9f804", "comment": "Malware payload (Efimer)", "value": "5f6a5f2f4e7b94614092cfb62a8e8c7af14c8ccde53d8a2cf1cd570e59304c75aaa3c25dd493b05a9b2e199bc9a66560", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783867929, "uuid": "299a5ddf-ba3c-46b3-88b1-504ae418537d", "value": "T1C3E6331866E002FEFAB3023EB9E3D358F8A570190B318AAB47F48BD55D9B1D05D3D616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783867929, "uuid": "c872e217-b5cf-4003-8575-8b203b7fd491", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783867929, "uuid": "6f3dab01-494b-441d-b204-6a4b06d035cf", "value": "393216:XGE9DAyvOiF0275HiAXMCHWUjX4cuI3/PGTAI:XD98yW4h75RXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783867929, "uuid": "ebbda759-a173-400b-a1b9-5d82859f5ece", "value": 14270460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783867929, "uuid": "865a468a-0172-44ce-9edb-c1669ad47c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783867929, "uuid": "4155b150-9fd6-4587-a510-cc9fbf3d3d99", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0247f1a1-7e49-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783898746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783898746, "uuid": "f03c477b-a238-4b8d-a37d-37ea5abfd3b5", "comment": "Malware payload", "value": "6b3f65093a05923a72038586ff77ba55", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783898746, "uuid": "7602bc35-d5a8-47d2-8659-05e951ef3100", "comment": "Malware payload", "value": "e9b3f3a8f1a509b66b234bfa920325f8a0da99a2d41732490571e0de1aa141cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783898746, "uuid": "76e469a1-a1b0-496b-8ed0-dfbcd2af8372", "comment": "Malware payload", "value": "6fa41d32b9ed1ed28e5552ea31c751f17d9352ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783898746, "uuid": "cd0a0665-d0da-4fcf-807b-176aa7e93f3b", "comment": "Malware payload", "value": "04d90a7113519a0c739b60cc9f1740ec654832f79084f53390e0e25266eaf683fe19f2ccf9f2528aaa2f81834bdabd48", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783898746, "uuid": "6953acee-431f-4908-bd15-8e12af12c688", "value": "T185235B512A857C14AA98C8371D7F2F0CB9A942E6324452DE7FCF3CF68C4AADD920961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783898746, "uuid": "e3cecc1e-cb44-4428-8240-040be9efa5d0", "value": "768:xQFWzZx5i9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:qkzZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783898746, "uuid": "9bf4a97e-7145-4e5a-bbc9-2fb91554238c", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783898746, "uuid": "6757e47b-7d5b-4c2e-a760-3e5c94f76dbc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783898746, "uuid": "f9b294e0-c338-41b5-a02c-456408bb3136", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4722c5a6-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843886, "uuid": "919b832a-9b55-4030-84bc-2980dc3efe8e", "comment": "Malware payload (Mirai)", "value": "f740f02f7d7e24848456f7987ee0f848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843886, "uuid": "96dd81e2-9c30-433c-8d5f-f8c18f30da2a", "comment": "Malware payload (Mirai)", "value": "ea52afab6dee2b0a2ba0ea4a4c33b7329627d9568d050010468ff9c03c0aec50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843886, "uuid": "8d98b308-7551-432d-b5fb-b5b67a188e57", "comment": "Malware payload (Mirai)", "value": "b1a97a78e5f4d733445f44852359ca2afc95a64b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843886, "uuid": "b0ec3082-577a-4cb1-af87-8922bd543007", "comment": "Malware payload (Mirai)", "value": "eeb70bc94379592d9e9abae7a5820f387110359268932df6bf25d8131a37926c10e7db01c4da4875c01beef9f991d097", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843886, "uuid": "86e6f829-6835-4cc4-9132-a6aaf6f439a1", "value": "T122739E23C87618ACD25806B9B0B4FE3A53B3E51056571FF6069BCA76A047EDCF5493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843886, "uuid": "30e9dab1-6814-4bf4-befc-ebc5fca1da87", "value": "1536:O/Ad1XEcrdPaXS+hKbprnU7YUpF6CYGM8+VYo2:Ood108PvZbNUlpF6eMZOo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843886, "uuid": "9f3a0b13-51c3-43fe-89d1-f88f6fbe3039", "value": 80404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843886, "uuid": "d6f901db-607e-4648-8cdd-f9c51690bc29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843886, "uuid": "76580fea-8b62-4f66-8c6b-f80fb68e4953", "value": "ar15.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab40e8-7e0f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783874168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874168, "uuid": "41c1deff-3469-46b6-985b-b977bf1590b7", "comment": "Malware payload (ValleyRAT)", "value": "374530f9b06d5942f0b4d2cce67d4f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874168, "uuid": "8e49ddce-649b-4b40-be26-292ea486a65b", "comment": "Malware payload (ValleyRAT)", "value": "eab4918ea7581aececacc1ddf3d86812ea1d203dfae8ab635c66136348e3d534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874168, "uuid": "7b01788c-515c-4991-a8bf-22c6821eee2b", "comment": "Malware payload (ValleyRAT)", "value": "83fcb94ab2b1effc1d601d472afaa8215800285a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783874168, "uuid": "8820cefe-aed6-49aa-adea-baa2000c0490", "comment": "Malware payload (ValleyRAT)", "value": "78c797b1ecb05cb5d962c02f96178a85cf09a98da5b34c8f97a766d43c381718649e7879d8f450aa91edd080807f1aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874168, "uuid": "7ae2f730-1662-4726-bdad-7e9f9e175c2b", "value": "T193935B0379D1C8B1E9761D3054A0DAB19E7FB9111E608DA73368467E0F306D29E39EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874168, "uuid": "3f03dc6e-9252-4ee9-ad8b-0e25ab7a7032", "value": "eda3c04f4ddf95c5e3607d886ff699c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874168, "uuid": "b4eba71e-c75d-404b-aed6-d377fc1084eb", "value": "1536:EfVxDfUeKXM2opqggulqXSpj+iTLoE0ST6AZvvCZcsWccdZ34bCIQD8trgy:EbUe1vpqVSpj+iTLoE063vCeZ3mCIQQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783874168, "uuid": "8ad543d2-fa85-482d-8940-ed98a4674f0b", "value": 89040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783874168, "uuid": "e8383641-0de0-4a2c-9513-015c55acc205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783874168, "uuid": "d30ec474-4948-4746-a917-f62ae2ed47e5", "value": "Open the latest report on the computer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea98120-7db6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783835684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835684, "uuid": "d1810e96-dfc4-428c-8c7c-ea38b12aa580", "comment": "Malware payload", "value": "07448193e857308be2da8b052abe39ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835684, "uuid": "5318c052-0acf-43a3-a808-fbfe4cfbcc9a", "comment": "Malware payload", "value": "ec788ee50c7c7abcc5f3b17d29a8a2eb20bbbfd15068730c428f17cf635c6076", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835684, "uuid": "45d1d40b-5249-488c-8c16-1cdd367b9f1e", "comment": "Malware payload", "value": "23ba12c5c6d349ef67fc77537626898ce49cbfbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783835684, "uuid": "2c590b04-cd05-4d22-a330-011bdd3a5109", "comment": "Malware payload", "value": "296f24998bf467b319a4a054ef020b32f3392c1d174ba150cda6c5fb00b1b963ea1b5c2d573175eb01044118e04cbd96", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835684, "uuid": "1c466e0b-ff62-4698-b278-247278b5f423", "value": "T168E0C2A1579AC8DF08BE49C4B4730500D7206373FE04852C37CEF990BA78224B85F0AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835684, "uuid": "dd9fe956-1121-4740-8967-cb430e8c44c6", "value": "6:hoFmAi3rHIdOjXu7i2ovH6UFxcFs7smI9//Pw81d/D7B/+bZJbKXFs7Yjs:KmAi3rHIGXYzovH6KPUsJbKKEjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783835684, "uuid": "7e4e8070-902d-418d-a0e7-b521f83e171f", "value": 299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783835684, "uuid": "b270783e-555a-4693-8e95-cd7242086af3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783835684, "uuid": "311449d0-0776-4f8d-ab7b-68655b674f7e", "value": "bbcl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452d5c93-7df0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783860633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860633, "uuid": "21e03c5b-f43a-4334-84b2-6898f1a2f262", "comment": "Malware payload (Vidar)", "value": "90293a1f4e28feaa96a249f68586f120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860633, "uuid": "7bf0f177-97e1-4ef2-86ec-6d04226fc903", "comment": "Malware payload (Vidar)", "value": "ee1bddda91c3a8a3ca8b3fcc077c373dc80da17b94ae6dc7f4219116a49fd7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860633, "uuid": "a2f16e80-826b-42b9-9dcf-3b9745a5cdea", "comment": "Malware payload (Vidar)", "value": "ea6f8db99166b3e00156335e005ac71997897d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783860633, "uuid": "7bfe8d54-f208-4587-a9e2-b5bf044ea306", "comment": "Malware payload (Vidar)", "value": "c8d9605559ad063816eef8031f3aefcfc9a9543006d4b8d26733fcc1cc6d31f9ae4669886ed19939d14282a6ee9a4882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860633, "uuid": "ff87a3ea-1942-4d03-a9b0-50967cb76cd8", "value": "T1B2F7338093458655D1CB6FFC617F1EF3AE1A4DF0A219609F06A28932F6AE47BC58C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860633, "uuid": "153f8b21-b68f-4460-a5a5-b83183404ca0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860633, "uuid": "b7e1a61b-0a50-41cc-a2fd-3f43eb966ade", "value": "1572864:oLdkhYYBlTge0SFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7U7:o2+YBZBLaABZVPArg/bXeB7U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783860633, "uuid": "08322361-157e-4b9a-930a-6e744bf06813", "value": 73651480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783860633, "uuid": "db869833-3d45-4c1f-bfde-5acdcd7d3e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783860633, "uuid": "db967556-9709-4bc7-9782-5aa896bd5bb1", "value": "Arcane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a53a200-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823812, "uuid": "f9d4bd8e-649e-43a4-b1a9-d77a20857b47", "comment": "Malware payload (Mirai)", "value": "17c0ccbb94b1a3fba9048def3efa927f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823812, "uuid": "2c52db01-4141-4847-8ee6-afc8a826d7fe", "comment": "Malware payload (Mirai)", "value": "f203c98a908119c7bbd8f4be45a8ca429e1cedce7c971d59b1d432bbdb4595b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823812, "uuid": "de340964-c4e5-4d52-95eb-61d3448b549c", "comment": "Malware payload (Mirai)", "value": "d8f7dc0dbccbd2af4d281df423fdc2f8275e50f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823812, "uuid": "440e2604-8556-41e4-b25c-c979ecf52088", "comment": "Malware payload (Mirai)", "value": "d82f3b1cb50ca60395b3f73167a4bb72b635bb1614c4afe121589ebe8233406fe7503e8750303642c9969d41a44edef5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823812, "uuid": "b55df8f4-b462-45a9-929c-23d7a111e93e", "value": "T1281166C5046449DDDC028E40F76784C8CA4D4AD7FD82BB4EA99D04AAE69CE34F1DEAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823812, "uuid": "84f3bf4f-c3e5-4975-b5f3-57c0fd8cee38", "value": "6:hCQzhw/Se3Ko3g3vwbjSe1JotrlSeODJoO3rw/Se/Fo/q+nSeBobzSef0oC+Seee:MC2qgq2pDLU44GOxDfKJeNIysAAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823812, "uuid": "4122e650-cccf-4bd7-a6dc-97c96edebdba", "value": 988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823812, "uuid": "fb432cd3-9222-4cb7-856e-29c4f3124516", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823812, "uuid": "27c08da4-cb25-4033-892e-a90c8154d11f", "value": "busywget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e2a185-7e2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783887684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887684, "uuid": "d6f53fcc-9e46-43cb-b62c-0062926e812c", "comment": "Malware payload", "value": "f89daf8aa0c5b563f5810e963c70a02e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887684, "uuid": "080bd48d-5236-4a1d-a4b9-68f40dfb3fb8", "comment": "Malware payload", "value": "f333bc5238e39790fb7560de067a852e9a99df2bb783cf08738d8a0d424b9658", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887684, "uuid": "8e781e31-1f81-4896-baf7-683b7581373a", "comment": "Malware payload", "value": "64133291e23c46845b6ce724c9f1ad857b21a10c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783887684, "uuid": "dc302d67-2a46-48f8-98d2-7048c4b0f836", "comment": "Malware payload", "value": "d49f9e97ce03879afb73a033b179eb3df519ad90548b6a3d3650382572aa04e008ba609b9584cf57772ec962eed9c980", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TA416", "colour": "#501B1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887684, "uuid": "cb2ef760-5db0-4e44-8c62-26b90af6031c", "value": "T184221C03B5405A8EC01012B5092BAEA0BDAB5EA45BF145D36B79FF0F6DB92C078F7562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887684, "uuid": "2f0beeeb-7c39-44b2-b3a4-ec33e00af577", "value": "96:BlQmBxIuvxh5VsNUIGsMNYbdWP7P1dAq8EnWnfHn35cVN:0al5hkNHbdQdADEWfpuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783887684, "uuid": "80f6ba57-2155-4206-a6b0-0530a03678af", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783887684, "uuid": "9e168179-6c03-46b4-a420-9d7ff5ed3c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783887684, "uuid": "dde40fbc-145a-4f8b-8500-a86b1c203b11", "value": "Avk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884e001c-7de2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783854732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854732, "uuid": "ad362be9-3105-42ea-b7ab-76bc544b54cb", "comment": "Malware payload (SilentNet)", "value": "33452e2365f5ceba4a62808522f061d2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854732, "uuid": "e1e221ad-7549-4e3d-a8ea-23f6e24c7966", "comment": "Malware payload (SilentNet)", "value": "f4d26d50fbcd9ce634bdf2ec2fab288cf16008898af2c5a9da2c5fea049a172a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854732, "uuid": "fe6d3211-4a12-43b8-8db6-143df7866007", "comment": "Malware payload (SilentNet)", "value": "fc86f18afd9e5805beb1426aaf9adc72ce11c443", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783854732, "uuid": "768894ea-6469-43bb-9759-5ef2e3c69c73", "comment": "Malware payload (SilentNet)", "value": "5641461928c172a7eee7d02e97ec6766c8d59269db7d6d25c3ddbf04daa4ea5e2a4b07138c5fc1dc37b0b8984ffee010", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854732, "uuid": "6f6b1f35-d63e-4245-9615-d3a0d70a1d72", "value": "T10BC42362469890FFEC2B67B345F512E27F7704A9FC9749CAD8B76572CB64682040238F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854732, "uuid": "23301d67-5c48-4d05-99bc-a44c8c2bc469", "value": "12288:9Jny8kpgRQJrZOTRnGcamPexKlSO4fa/adhUg9dx:bnyrpB84Q7Q8aEg9dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783854732, "uuid": "b1fa4567-fbe8-4c82-aaa4-8a873485855b", "value": 584916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783854732, "uuid": "7bc42852-5cca-4eeb-913d-e3f16c99a44d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783854732, "uuid": "90d2c94e-8aba-4c29-9196-6dde9bf77cfc", "value": "Kind-s_Crystal_Optimizer-1.5.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83227815-7d9a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783823800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823800, "uuid": "f1f7f29f-ed81-4da3-9397-fdddbf2974ef", "comment": "Malware payload (Mirai)", "value": "79190736e65e2cd1a001359854fbf04c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823800, "uuid": "3d25d5ff-f54b-461c-a79f-8112c71a52ee", "comment": "Malware payload (Mirai)", "value": "f4f3d6cfb309115d5ac33dbdd5a850e97cf542be479f2bdfe87bbc68af86df27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823800, "uuid": "91e4e13a-adeb-42ea-a8c8-6586d2f9092d", "comment": "Malware payload (Mirai)", "value": "5049abcc9f1efbad498ef4cc656fda764e149a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783823800, "uuid": "0faf40ac-6e8a-4a3c-9e73-90934a99afbf", "comment": "Malware payload (Mirai)", "value": "093174d01445cf40845abb9065b4bd0b9227142c0b59572d269f68fdece38e8ee6b6a8abd2889d354533bf1cd6f8bd1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823800, "uuid": "cad1533b-d322-41b2-87cc-88205718205c", "value": "T1465312B69F449C01CE79D2F81ABA4DBB8FA9203F405547EF8EA0499467FE878D510827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823800, "uuid": "eae71e37-5498-43b0-bfff-fff2b1f593f8", "value": "1536:ipcA4IMaChjt8H0biyah7WS8xV3TInY6Tc+6p40pQE:lGGhY0bi6xlInY6QFp40pQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783823800, "uuid": "292b6c19-8545-49a6-9a8f-94833c83ab79", "value": 64928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783823800, "uuid": "b09bec39-24a8-4aec-b0e7-c71e12351972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783823800, "uuid": "841a3eaa-73da-45ed-9f5c-891641700038", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fca2b0-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843909, "uuid": "3aa9dd53-a6aa-4641-a023-f72746318fe9", "comment": "Malware payload (Mirai)", "value": "5e9dd8039d07d7e40235836c0d1bc81a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843909, "uuid": "cdbf45b4-5ecb-43dc-a620-81a4ada5d7e4", "comment": "Malware payload (Mirai)", "value": "f5415a98caaca5382334318efb805d6c2b3492f3c79db1a9c821a302ac5a30cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843909, "uuid": "0efd4d21-690b-49a3-ba04-81a823dbeae4", "comment": "Malware payload (Mirai)", "value": "ac08fa54eda9b933bfa0d1d2a5d2ebc202b44462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843909, "uuid": "ba5694a3-66f4-4015-9e71-c9696fb4dca8", "comment": "Malware payload (Mirai)", "value": "da6708d93b1940bf87cee337a16bbf3c05aa7ad1ef20430d26bf4f610bf8db8190b68ba6b48adbc238fce02a8e11c3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843909, "uuid": "18f79851-96a9-4193-95a4-a89560936a43", "value": "T185B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843909, "uuid": "6e70bba5-0731-45df-abf0-e23f4431de98", "value": "3072:ed5b7djS5HECrc0vl6hRhFczcmVRh865U5:edh7djS5ECl6ozcmVRO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843909, "uuid": "67596789-decf-409d-8b1d-14675391beed", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843909, "uuid": "a9419cc8-b227-4306-b7fe-2001fd8e45ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843909, "uuid": "ac56d795-4cc0-4d7c-996e-b19f5a3196de", "value": "ar15.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02f11d6-7d88-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783816118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783816118, "uuid": "567eb53d-d109-4888-9fc9-d701a240f373", "comment": "Malware payload", "value": "433013aa0f51be0edbb011f07940c97c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783816118, "uuid": "c26d94a8-2cd6-48c7-b296-f79cdb48151e", "comment": "Malware payload", "value": "f8ba9f2170d4304a292942b3d4a635266bbf3177bbb35f3cde1dfbb96d01f9bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783816118, "uuid": "489ffb25-33d4-49ba-9afe-44066b2faf89", "comment": "Malware payload", "value": "26c168dd67318a91450ac98c8d1b484fb9f3a2bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783816118, "uuid": "15de465d-c024-4459-bf15-d0b50fee4ab0", "comment": "Malware payload", "value": "1ed6f985c2a62adcb16aa270f54d979e0b4eb9156cea6f43bd5b436ee9cab5ef3b42d6d135dc2d0418f5773e2ff76c27", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783816118, "uuid": "e79abc92-cc5a-482a-b1ac-e49aea4bedd4", "value": "T1F9336D651A857C24DA98C5361C7F2F0CB9AD43E6310492EE7FCF3CF28C5AAADA105719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783816118, "uuid": "258e90e3-4f1a-4789-856f-1eb0df022614", "value": "768:q6Utd8/s9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:9cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783816118, "uuid": "d569b486-0083-4859-84b0-698bffcb1baa", "value": 50386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783816118, "uuid": "c9dcb112-2199-495c-8070-0fec79dbd30a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783816118, "uuid": "9fdb5315-6fb8-4bfa-89ec-956a4265550e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a54b66-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843858, "uuid": "72d5a64e-a056-43e0-b0b0-027002c01f6c", "comment": "Malware payload (Mirai)", "value": "99978d4d5f96e6c5940911c26c2e187a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843858, "uuid": "b31f9cdc-d83c-451b-b535-62784fc8b491", "comment": "Malware payload (Mirai)", "value": "f8bbf31702721fdd1b53ecce8577c9a8f1e2b29f23da77d53f5aad0714f6458d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843858, "uuid": "3fda9dfa-9953-4a32-8f6f-eb988a7e840a", "comment": "Malware payload (Mirai)", "value": "c2347557c56f7ec5c24a48a33e6c5d50811a3e9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843858, "uuid": "b83b9e31-0382-4381-a427-89a0a2c33b97", "comment": "Malware payload (Mirai)", "value": "2699d4b69deb5f73789529826d68980bcb43098b3419790c5e198c50f3281707876e9067a1b19a891e794bf2bf83b6a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843858, "uuid": "e9354228-78d6-4b9c-be7e-731045fcb3c5", "value": "T1D454232AAB495A62FA3F59F1405E5253BA5321E0C3A465714ECECFC44C77296332B3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843858, "uuid": "1be920a9-b029-4cdf-acb4-e9372d77bb2e", "value": "6144:VZS+1N8ZEx85OLq+LOQPn2PBlVMCfNPJEUN+X8Z/H:7NpORPCAREUN+m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843858, "uuid": "ee3d8dda-aa47-4c29-b60f-84e167505468", "value": 291376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843858, "uuid": "46d82f65-6391-4af9-b898-646ba57d69f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843858, "uuid": "64494e03-a97d-46e9-bdab-60fd19f5c804", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447f85bb-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783843881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843881, "uuid": "425daf9a-bd5d-49db-9a03-101da352e2fe", "comment": "Malware payload (Mirai)", "value": "80f5a6883cd0ef97ac07d6509b1a769a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843881, "uuid": "873ff7c4-f2f5-45d8-94df-be6647e04bb1", "comment": "Malware payload (Mirai)", "value": "f96e554b98d7fcda2a7d21c7fedecd2b44dd8b3468c1e91e0c7bb5f0d9cac78b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843881, "uuid": "11a6e361-507c-4700-9a56-d3ef15960471", "comment": "Malware payload (Mirai)", "value": "2e731493319c12315b914717d9a4b6036cda5003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783843881, "uuid": "2cefa285-6cc3-4a99-b7cb-1138768ec572", "comment": "Malware payload (Mirai)", "value": "729746d209bd34f19e0d3b7a961e06f31f1f108c3bab53ec7bcc30bc701ff0528a2418c17a07196c562cb2e860ed3a44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843881, "uuid": "fa40dd95-3e02-4ad0-9cff-3dc104bb2c9e", "value": "T1D2B43951FC419BA6C6D16ABFFF5E828C732317B8E2DE7112DD155B2072CB85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843881, "uuid": "d39610f1-3945-4ae4-8ab6-be29f3bb1bb8", "value": "12288:FNLEHJj6LqHKozeDVi9wDs0cXFN3K2yPjN7hKL45p+XWe:FCH0ymiCUzKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783843881, "uuid": "652497b0-516d-4c7b-bf1e-e70f7519d609", "value": 524960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783843881, "uuid": "017254aa-c483-4e43-a0f1-48a12877b0bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783843881, "uuid": "26d51c0a-c8ca-4374-82f5-8a20b4e31ffe", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb106d32-7e13-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783875863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875863, "uuid": "c1421926-21be-4e59-ab14-9c8506b09e7a", "comment": "Malware payload (Mirai)", "value": "1151213e11d2b2670f83d50d7db5a6f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875863, "uuid": "3934df9b-fddd-4f42-94d7-d4eab764b96f", "comment": "Malware payload (Mirai)", "value": "f98daf35bd61fc2ecaab19bd15a009ac21807a6ad216a85a0caf820edd453015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875863, "uuid": "50cacca5-bd01-4d69-8efe-e401dcb30c5a", "comment": "Malware payload (Mirai)", "value": "28752481837d878f9f98b6add2d43adeaacab144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783875863, "uuid": "30253afd-0d49-4f1f-9fb7-64b0ebe093ea", "comment": "Malware payload (Mirai)", "value": "98e61f714a38a62beca21ea48d7b4054ccde9d741cb54e9f219b9fafb1f6f45e3e522702fa32a6e9d60ed0e1d1f1ca7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875863, "uuid": "56b6a219-f2cd-40f8-b700-3dc015303c00", "value": "T143D38E9C9D0E7DD2C2C2E2FEAD450F56312675744A64C3F61900A2CEEB9EED69CB1432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875863, "uuid": "cdb0c0e0-310a-4aea-b740-c3cde61e776f", "value": "3072:+BlGGK083+41GwdQOWn7MT9PIkBEWt5Mlj5tYqdfCKhR2MzH:YYu8uzKR9wVWLE51dqKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783875863, "uuid": "2c8a756c-9f38-4f07-a242-b1765c190979", "value": 141216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783875863, "uuid": "513a156a-44c5-414a-b168-19e22008066b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783875863, "uuid": "86b6887f-2df5-4740-9069-f470d5ab4f5e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55102770-7e21-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783881705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881705, "uuid": "67431b24-1a48-4da1-8774-78709ec27f7c", "comment": "Malware payload (Mirai)", "value": "c6a57044a7b38300773d663e5249fe50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881705, "uuid": "5280c8e0-1b09-47c3-83ec-e6089b11643a", "comment": "Malware payload (Mirai)", "value": "fc7bd58cb79f8e00d92ee58dd6f421e494f5076c97a84cd556e916d9b55777be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881705, "uuid": "10a26d89-288e-49eb-9ebb-4d5c75670acf", "comment": "Malware payload (Mirai)", "value": "4fc6890aa22e0961f7288b193de9173fc63dd18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783881705, "uuid": "bc6a2780-e078-4eea-b0c4-86b9dc8e6a4b", "comment": "Malware payload (Mirai)", "value": "f4c01831cbe6501e26dc053ae6ed928ed48748867675c0145fdb5ec8619729fcf7556e04293a63ed8aaec212743df727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881705, "uuid": "f9e4a409-cd10-40de-9da1-30cf55fde938", "value": "T13B457C57B2B364FDC053C43087DBDAA2A931B42546222E7F66C4CB302F67E641B5DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881705, "uuid": "6a1007dd-6b19-47c6-8be9-54360ab56fc4", "value": "24576:nYY1kSL4kfUYwpWudkjkg9+VkcvYBeoKpWQ9qvB/eH:YYCSL4kfUhdS+rQBedB9qkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783881705, "uuid": "34ab9e6a-a1e8-48b3-8379-5a3c4b7e02ce", "value": 1241872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783881705, "uuid": "8594210e-3f86-4a06-a97f-1576c65f7fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783881705, "uuid": "91011122-17d2-4252-964e-483b901a9621", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcaa465-7dc5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783842477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842477, "uuid": "bfefcf9b-d1b5-4d75-9f7c-3b19b093a70b", "comment": "Malware payload (Mirai)", "value": "6b18df325f2846d5b9df29de0ef9039a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842477, "uuid": "895652fd-fb1e-4bee-87aa-96edc2f1caba", "comment": "Malware payload (Mirai)", "value": "fcd32946256a8325aef4e805b69c00d9d8ca9e9d80ded595b947ffefafb777e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842477, "uuid": "87ef88c7-3fee-4f81-ae0b-be13c5cdeff9", "comment": "Malware payload (Mirai)", "value": "251b6ea458711db36241cfc6481684ac54fe83cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783842477, "uuid": "137bde3d-ff05-4b2c-b770-cb5271996efe", "comment": "Malware payload (Mirai)", "value": "e2303ea6657b58f31b523f89200df700575fd33bf76ec1230327165cb2a8feb032964af67f8fd4c01fa427695e55ea1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842477, "uuid": "4cdad37a-1d79-4fad-b7ea-2c0f8432c451", "value": "T1EFD32B86F9519E23CAC653BBFF5D428D37262768D2EE32038D256F64378B85A0D3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842477, "uuid": "90b9fb05-2d4a-4a79-a41c-581814522d1d", "value": "1536:xPlSFSUEjoD0d48wuwIpSjCV2eIf4VwKh+TQ7FjokiIlEEwywiez+R2H3lro50gA:xPwpDJ8wuwuECV84z0e7ATH3lkMSuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783842477, "uuid": "24765dcd-4866-4a48-bbf3-18679d283352", "value": 137920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783842477, "uuid": "da5b05c4-a6ad-4fe9-920a-6660eaf5e5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783842477, "uuid": "72c278bc-18ea-46f2-aa6d-91c3a01277c7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb0d280-7e30-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783888078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888078, "uuid": "11080bf7-b857-402e-8495-db9275f8e91b", "comment": "Malware payload", "value": "aaffef0dec08f7ef6370f691e2086edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888078, "uuid": "2f0e7cf0-c081-47d8-81be-6daa418bed4a", "comment": "Malware payload", "value": "fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888078, "uuid": "1cfd78db-10d7-45e9-9683-431f7c333c63", "comment": "Malware payload", "value": "6dc7cf37242d56c99000da5b6e1fb79b2b597804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783888078, "uuid": "e38b1fb1-a47a-42a0-856a-12dff39b130c", "comment": "Malware payload", "value": "675902580c527460ea6c7f9bd5d64821c57d94b2c90c578b2123f21f87014707bed74e2ec06c3f112d506d7d466940c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fog", "colour": "#09A276", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888078, "uuid": "743e0bb4-8c1f-4a67-8f84-74f756598a9a", "value": "T1EF521A4BBBB649FDE92841B580731A00E2FBB734476253CF57A891211DB23E17C76AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888078, "uuid": "6a7b486a-d275-427d-a1ec-5155b838fb6c", "value": "fb0caaad6f50733b11514c7913cea514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888078, "uuid": "6ab4757c-a84d-435f-b3d0-a450da28cdb2", "value": "192:6Pf4jlBkQI4Yarey5GHocGs/rU6toG0cO5tfTclt:6IjP9ISQfIMoG0cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783888078, "uuid": "28773f69-efff-46b5-86b0-8637eb679098", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783888078, "uuid": "f6e0ae9b-2ef0-4bea-b2a0-f70e5a26c73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783888078, "uuid": "0fd51a69-0d0f-47d6-9c64-160fd8e5de1e", "value": "WindowsDeviceSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91884057-7dc9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783844010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844010, "uuid": "5cdd0eda-017c-422f-a56b-f9dcb5089ed5", "comment": "Malware payload (Mirai)", "value": "b3a024cadcce34d51972454ca4ad8cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844010, "uuid": "3e29e418-712f-4b83-9637-84295f3fa350", "comment": "Malware payload (Mirai)", "value": "fd51d24ac680b22b82c9b0db108f499c0f75badc392c49b874583f47d0573aaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844010, "uuid": "add25f1a-544c-44d4-ac3e-68c4b1e63d05", "comment": "Malware payload (Mirai)", "value": "74d9cdb89a6e19ed758c3c851129cb8c16b6d77c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783844010, "uuid": "ce6a7859-91cb-4228-b42f-90e9825ef89e", "comment": "Malware payload (Mirai)", "value": "2afd5b3305f6e1e17f4fbc8c55766745a379cacf78c1e24cd54b9e8db79a695794331e7029f7dbfc1ed5142d7412191f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844010, "uuid": "d26c6856-bc6b-43bb-9354-88f932355ba5", "value": "T17C834B0273580D43D1671EF02A3F37E5C3EBD59121E4FA89660E9B4681B6EF2158AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844010, "uuid": "1606e616-db28-416a-b9c9-37dc17673d2e", "value": "1536:iUkRQYIJAimN14dMKloFH+wmCWoyntMvqZ:1kzIoEZoFLmvkqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783844010, "uuid": "4730088c-a676-4e31-9f28-2e8ac01ac56d", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783844010, "uuid": "d14eae76-0623-486b-b21a-e5e41da6db16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783844010, "uuid": "35767443-542d-41c9-b052-0ba5634202e9", "value": "ar15.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c411715-7e2b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783885931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885931, "uuid": "b6d6dc4e-48de-4361-9a10-274001c67f3d", "comment": "Malware payload", "value": "caf7d5d928b90f08384795d8552f0df3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885931, "uuid": "02e11b76-61ac-4a85-bd1c-e48ed8db8d80", "comment": "Malware payload", "value": "fdb636d63b316929768ebe2c2ebf6b0a9eae33a18fef4426efdc62d13712f28f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885931, "uuid": "101bc408-85eb-4ee4-986f-607ae049e0ca", "comment": "Malware payload", "value": "69c404e697583f45a47e8a1b098e80e047e090b3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783885931, "uuid": "ea1f7ce0-f5bf-4c7e-83a2-a8a8e6d20f1d", "comment": "Malware payload", "value": "94c0991e0e8177901c3daa22047632051d56d5fcd1b10980f661bb33ae5497d678edc64a3f26da8b155d573fe09864d8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885931, "uuid": "e36603ea-8522-468c-9197-b3ca9a38231f", "value": "T163E6330DA6C112FDE1A7843CEB535219E2B2B4B70772CE9796E8C3895D5B2A1CC3C613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885931, "uuid": "9e040c28-41d7-4116-a73f-73cef97bfb48", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885931, "uuid": "b593f132-96ce-4167-8e32-a1177011fafe", "value": "393216:zh/cCwAq1KPr2LzAT2GdgVXMCHWUjXxcuI3/PGTAI:zh/cXoyLs2AgVXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783885931, "uuid": "1c4fce73-ad65-4741-86c7-2155e200ee97", "value": 14322145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783885931, "uuid": "d919143f-5b31-4964-9e87-6a58f7f002fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783885931, "uuid": "8fbfd92a-18c1-40e5-ba92-5b538cf887d6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0739b5-7dd7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783849934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849934, "uuid": "9c230919-d320-47a9-91d5-9ea681b24896", "comment": "Malware payload (Efimer)", "value": "8f623d285b5bb3c23cf3bfbe1b995fd0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849934, "uuid": "7e51eb63-4dab-4abe-916a-6a54b49040ad", "comment": "Malware payload (Efimer)", "value": "fdbe4bffe6371ba752e5faf4497292aeecea3e4fefb5eda5492934490b1f5c11", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849934, "uuid": "e34ac8a9-4fff-4340-9d43-1a51604eb655", "comment": "Malware payload (Efimer)", "value": "abc5b5ceb1978f1929f7bf3e2d17c289b0161904", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783849934, "uuid": "3629fb84-4931-45ae-be38-0f6a7bdf636e", "comment": "Malware payload (Efimer)", "value": "e1ad7fea36b1f0a44b47cff86aa5832666873895a8597db47f63e34828e938a8ca6ffaf8122cfd9b6121a7597a05509b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849934, "uuid": "365022ca-b189-4b8a-bba1-af34acc3c349", "value": "T1F3E63328A2D021EEEDA3813E9CF552DAE564B4774B32C99F8B6C47727E231E00D3C146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849934, "uuid": "54f29614-500a-41b8-8c6f-b61f5a43b6ed", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849934, "uuid": "b005959e-8112-4340-92f4-f1760a363f28", "value": "393216:GYwuInfSV3DySV0hqmAl/EXMCHWUjXpcuI3/PGTAI:GoCaZn0mOXMb8XeH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783849934, "uuid": "b82556e9-0cea-485c-b075-a6978d3f0059", "value": 14281236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783849934, "uuid": "f5f37f37-dc89-4173-8f7b-3bc006c451f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783849934, "uuid": "d3209b27-e019-483d-ab8f-d4a2623b9461", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693ad05a-7dd3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783848238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848238, "uuid": "bf1afb3c-85a2-4776-ab18-ab2a6c131bc9", "comment": "Malware payload (Mirai)", "value": "133751691aeb934c1b8b1d5b403120e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848238, "uuid": "dc94df3c-3bae-4b52-88c7-081c22652030", "comment": "Malware payload (Mirai)", "value": "ff5e5686ab36e4b2518145932a070b02f370badfc21326158c094f2706949bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848238, "uuid": "25521032-42d4-44c5-8a88-5dc9c33321e6", "comment": "Malware payload (Mirai)", "value": "a65c730032e3660ff2dc333cd7bc74db24708b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783848238, "uuid": "0d02787e-3fd3-4770-ad1b-0517f1c25dd5", "comment": "Malware payload (Mirai)", "value": "b622cf284b9330fafbdf9bb688e03b2613cab41599b700e51a09a80c87f62b18dca012f88ac8e480013485f99fd865b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848238, "uuid": "7deea1b6-b4fd-4037-8128-d8803d2cbed2", "value": "T17B535BC1AA87E8F7F91602752177E7378636F4361129DAC7C7A4EC32AC52901EA2735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848238, "uuid": "ece291a9-d0dd-4720-9c3a-38014f68254d", "value": "1536:5xCTpF8kbRKPrW96GsAifPn++L4LOWDRhGlegZLh+GvvtUmLXjWK:5xAv8kbRKSxfi34SyhSe+9tRWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783848238, "uuid": "08a4eba6-2366-4a63-963c-d4c92ce22578", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783848238, "uuid": "36225309-2a99-44f5-a5b1-9a3572e7cad2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783848238, "uuid": "7e457ed0-a434-435f-a698-49066349d984", "value": "XDx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }