{ "Event": { "published": true, "date": "2025-11-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-21", "timestamp": 1763769781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9ba2447a-844c-4e44-9cf0-17b512c37e9e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0423cb3-c6fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763744555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744555, "uuid": "5d249cdf-b08e-41e5-8361-1c679415ebc5", "comment": "Malware payload (Mirai)", "value": "2633562abfffc1bb2d8943716f1b65b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744555, "uuid": "d28dc76d-e958-4c23-bef1-fb33c07517aa", "comment": "Malware payload (Mirai)", "value": "002bcdc0de4dd55ee92084bbd631d0e94055972a512668545cee1a2cc369f16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744555, "uuid": "f283d94f-5ec4-4979-8d66-fb791b3e26c7", "comment": "Malware payload (Mirai)", "value": "881f136b56aa339abe7bcf945502b0b11edb19db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744555, "uuid": "fe928c02-2b7c-4de7-9bcb-22d0a06c8d4f", "comment": "Malware payload (Mirai)", "value": "2545cb8294ce3bbae45d4b736b9513065803460f45bea69fa3551a170741bf36ce7280ae1dfd4ca18eb0fa1e8edd2e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744555, "uuid": "3ac7fe8f-8405-4ec3-8317-127d6b90bf93", "value": "T148832B48FE651BEBC07FCE34151E471A199D158F63E2F3369278CC68389A3499AE3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744555, "uuid": "12933fb3-b74e-40bb-b22a-4872bb7a688e", "value": "1536:+A0HV23AoY9bagzKVcDNKKcOjZ76ipcN6z/VIjgKAPH3x9kR0px:oH8HI6ioFjgJXnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744555, "uuid": "9365b2c6-307d-49ff-8598-e6c7ade7eb41", "value": 84348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744555, "uuid": "d89c60fe-e100-44e7-9856-57936308d6c1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744555, "uuid": "77360da0-cea0-4e6a-a5a7-3e40af8f6463", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a80dad-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715918, "uuid": "91ced291-31e2-467f-a44a-7b85138a7258", "comment": "Malware payload", "value": "90df7901452acfeb6dfe20747530dfb3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715918, "uuid": "fafe0f45-5062-487f-ad78-07254948f6f9", "comment": "Malware payload", "value": "005a1c6de4157cc5512a544e4de8c848bf8d45b293983631ba989492b22933f6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715918, "uuid": "18c9a12a-9268-4674-beda-fadc587cbcf4", "comment": "Malware payload", "value": "9be10e49be557f0cab74a25d93c61fbac7cf6dfa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715918, "uuid": "5cb2fdc3-d9f8-4bc1-873b-d1add784a500", "comment": "Malware payload", "value": "aa55172450388549b98795dc0736066e6b1ce0acb3c9384df0e06f1275a1676af26c5b2b119ce3065370e4b0a398aeab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715918, "uuid": "1579e241-580a-4162-ae94-6bf5f457dc4d", "value": "T1C687238AFB84D91FC0F71333C977022371475D0A87839677961AB23809B39D58F9AAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715918, "uuid": "8d702d22-d3d8-4cff-905b-65018c609c4c", "value": "786432:2hu29Y0oufjU3HhZSZHLMUzriNHIWkFn/eTi1BeRwagm:2hBfjUR8V9z2NHGn2Tsab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715918, "uuid": "9028b0a9-8ca1-4d80-807e-7eb371e78ffd", "value": 38282264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715918, "uuid": "6fccacb7-bae2-44f4-87dc-6abebd920451", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715918, "uuid": "fe9d3708-3d1c-4142-9de2-baed4a04651a", "value": "VJONLINETV3.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d981b6-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694278, "uuid": "eee4e95c-cfea-45eb-9109-fbfb812eae74", "comment": "Malware payload (Mirai)", "value": "dbdc0965e03246f03be1c9f7a79b81a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694278, "uuid": "4cda166c-c389-485a-84d5-2cf3b9e94b61", "comment": "Malware payload (Mirai)", "value": "010a6dd06067e9418c9f1dc7c804410645f56c8c03f9222d536139f99c880cd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694278, "uuid": "eec5c696-2d34-498e-be42-65d5ccd61d66", "comment": "Malware payload (Mirai)", "value": "7b402442484aed12be6e5cef6b76a9cc6a385efc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694278, "uuid": "66a64f50-279f-46fe-bc56-823cbdf866b6", "comment": "Malware payload (Mirai)", "value": "e8b0717971808b550a756df410f7c7be1bcfce1f3f3f1d998ab5a27abdd814f76af5916e63241932b8a464e9d60aaa87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694278, "uuid": "f7a2e433-1cc5-4f28-8275-5b495c77377b", "value": "T176530206B52C5744DD8F45760197E0BECC527A0FFA5969E29A283B7C07F608E23F1A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694278, "uuid": "0910fa2d-68d3-4193-8e9d-163202139e4c", "value": "768:1COM8jyx4K1dfYhE9U/jv/YEyWrcjH7CFkuEKWS0hHIAmunmK1G9hoTSNlunHDWa:ZMse11d39sjXZ9aKK2fcLDO7ujlzRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694278, "uuid": "adc1548f-55fd-4cc3-be44-fe5a020913c5", "value": 63188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694278, "uuid": "ed9e63fa-f7f9-4695-bc78-211c0a1aac67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694278, "uuid": "08affc7d-c217-4110-87b2-f7798dacd5cc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458f77d9-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715948, "uuid": "3037a78f-2456-4121-9279-f422ab9593d5", "comment": "Malware payload", "value": "dfc954d895d171a9130a8c6b7872cf54", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715948, "uuid": "53d173ba-f604-4e3b-b6a2-3563948bb29d", "comment": "Malware payload", "value": "019c702cc3f85fa4b9b12d1d3cf03fb7f2dc85a2dccd7abbd916b81b1e7c8cc2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715948, "uuid": "584d5dbb-cd78-4025-951b-3b45ab03a701", "comment": "Malware payload", "value": "1c399f00a29c3d03e22188520ec54b454441193a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715948, "uuid": "f2b5699a-83bd-480a-9e85-1a8ab507a1a5", "comment": "Malware payload", "value": "10e524a274c89bcb271facea3892695198d63409d28011e1c5e9fa4750f3ebd2d6097c2746e0567b438accc7ab9c580b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715948, "uuid": "758e04bb-8c59-421b-9747-4f577e7374ce", "value": "T1E482D090BA26E6A51C00737269B77DC88F82534F3C6508344AFA51352798EB173B545B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715948, "uuid": "d638fa79-e93a-4f92-bbe2-4b58693edefc", "value": "384:esqrnQrBmW3IQ0VQk1hSeVGu/xBhB6MosEhesKDx1fuF+U8MN:ozgBm8nsQkjSEGuzhEYED4fuFd8MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715948, "uuid": "c63cb461-8b11-4a87-ade5-cd476adb0647", "value": 18444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715948, "uuid": "363d0a1a-4b63-4886-8bd0-ff10e07becf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715948, "uuid": "43fbcf3d-65a4-4d63-83a2-3c9c630a9b70", "value": "stage0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700b477f-c72c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763765412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765412, "uuid": "09c25e5c-0ad8-46a5-ab1e-f66b7d827463", "comment": "Malware payload", "value": "32e7dcbd26b6455974d5b2c52c3ca421", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765412, "uuid": "c828dd9a-d22a-4f93-b347-094d1a59f274", "comment": "Malware payload", "value": "0234a33c5424c3c7a3c7c8af9d5c69b116341c59efee6acdbcf6bfa07aff927b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765412, "uuid": "6bee609f-9df6-4bce-a787-8e51104b2ac1", "comment": "Malware payload", "value": "533eb1fd51165654d968bf79b2a430da895e71a7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765412, "uuid": "bcebc084-5398-4c94-8c6e-0802d2cd0666", "comment": "Malware payload", "value": "f26423e6c89691c2878b397c7233c2afe761d415f9b3f79e5246ed969f32d20e746785196ebe4656376e51c10c7ba1c1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765412, "uuid": "8999a9d4-8ceb-45f5-a183-239949685617", "value": "T1589533919E4FBBB2C474E1B0C892960659B18D10D991905A87AC7E360E3C7F83FDF754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765412, "uuid": "a2c36d7f-7fae-4fd6-be15-1cd0b5de63f9", "value": "49152:LU/n+xrnGqorqh76fDFxMnwL/1hgCxJ3k1t9g7:Y/QbMDFGnOgCxpkj9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765412, "uuid": "884b8777-1f21-4458-a0fb-bce12da08e78", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765412, "uuid": "5859d06b-2838-4733-91bc-f6069201b226", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765412, "uuid": "c6cbd0e7-2c43-4430-afff-1c96879df0f7", "value": "gzv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5a5474-c721-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1763760896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760896, "uuid": "efb124ca-dac6-4099-b3e0-5f377eb06f31", "comment": "Malware payload (Kamasers)", "value": "f0d3fd4902271b013c7983f0a6416399", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760896, "uuid": "602c4ec7-c6ce-4c0f-a569-241476231e91", "comment": "Malware payload (Kamasers)", "value": "03934d7466084c03fa0911a53db7c01d33bbbcb059f13d88e3b8443a73052412", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760896, "uuid": "1f691973-1f1e-4224-82b1-7c9189ad163d", "comment": "Malware payload (Kamasers)", "value": "cbc9e9cca14ccf2fe66e104893ac19f99b7e40ad", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760896, "uuid": "b8646878-1a17-4df4-99b2-6ecd6c5e62e7", "comment": "Malware payload (Kamasers)", "value": "23b137a9b27c9d6d15b471adadfc59732360355e26add1c29509149eefe974caf4d6b5f18555cb3b889ba542115334f0", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760896, "uuid": "608e444e-7b17-4548-96e5-7ae9a311b123", "value": "T15675239552E81495E976533554F20357AA31B892DBB482FF16C2D5FE2C73BC0B232F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760896, "uuid": "d7cec174-7691-4947-b8a9-514d42acc079", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760896, "uuid": "2b0a115a-f196-45f1-8bb7-7f1e4c22d6e2", "value": "24576:6jkyXEvz73as9xe+eo1h5zDw7CjWKdG6Hin8L+X24BR38E5qXI4YjKYdHlBQhXbx:6jzXEbRbe+ZhlwkW7Hn8iXfR38dI4Yjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760896, "uuid": "c897369d-12b7-4558-9273-55fc7cce43b8", "value": 1562152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760896, "uuid": "06d2ef45-bc0b-4ab2-b3fc-8b5fa2ee5a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760896, "uuid": "6b4b7fe5-5ecd-448e-996f-14b4ca0d9d74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dcd14b-c6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1763721670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721670, "uuid": "b0b73756-b2cb-44c5-a4d5-abdae3bf3b59", "comment": "Malware payload (HijackLoader)", "value": "d1b3832dc1e6b9dd5a2920aa22c5a7fb", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721670, "uuid": "1a7e0c58-8532-4d19-8950-3bc5e018d905", "comment": "Malware payload (HijackLoader)", "value": "04f8d118b5db015aff6630c334b78ce997fe1b8444a99aa23bfff7c95eb51782", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721670, "uuid": "a6ca739c-2d2f-4a78-8c0f-a834965d96fb", "comment": "Malware payload (HijackLoader)", "value": "f5377e042d5aab444466a6019d26dbac464c5de4", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721670, "uuid": "53937a8c-91bf-4e6f-81b3-e0fbb2f4385a", "comment": "Malware payload (HijackLoader)", "value": "6c9aaa0e723e78cee9872e7ff4611eecf6c42e642cbad8fcb2a02b9a81d956cf466aa50cbce41d2adf067a18ba705c65", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721670, "uuid": "b9e3b0bb-d278-4903-a295-aa6b9d964f16", "value": "T13553F21D7F8AE09CD22DD97030C57F157CB784BAA6A89CC669BC91C647B24B872CF048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721670, "uuid": "e79c9d61-3f55-4fd1-96c8-1fc46ad62156", "value": "1536:ba/gMNVLZGJ9gp/41KvoFNWGrHAr927alDlBCzCWD0ftl:zMNVZGJWy1+oFBrgr88DvCmztl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763721670, "uuid": "69c54af2-3411-41aa-97b4-33dcbd883304", "value": 63027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763721670, "uuid": "1bac4430-e1c7-422a-be32-c28acd2bc78c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721670, "uuid": "97c38e4b-704b-43b4-9d59-46d39d0c8a88", "value": "OasisOpticsV1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0d86d5-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715957, "uuid": "b6362a7b-2b79-414c-9897-525381cea230", "comment": "Malware payload", "value": "5b8a730de21fa3432ed96fb5d63794fe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715957, "uuid": "3046801e-ded6-403f-8d85-e76a8ab071ab", "comment": "Malware payload", "value": "05c47b33e4d04211eb9106971eaf9b782189ee31d3f8fc60a7634e29d4c63cf2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715957, "uuid": "c5974ff6-a4a6-4618-9ba7-940192577691", "comment": "Malware payload", "value": "8e1f8b47742d3a306a045eb87b30e8286349ca6d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715957, "uuid": "89dba0ea-79c3-4541-aed5-a2b440ccb204", "comment": "Malware payload", "value": "c50039185c2c4efa46c879932cf4ae73e4492e00e9b2b940d954e17a47d3348870ee418cdeef429557a7f456d665a125", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715957, "uuid": "729f7e33-fa7d-4b0e-ace9-e64dafaca9d8", "value": "T1E8C71286F345FE1AC0F3A7B3C831116A6246AD209B23926FBD197739A1732E54F116CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715957, "uuid": "a92f84b4-35d1-4bde-8d27-5f1ce69b8f36", "value": "1572864:I6u2IK4LsJvviuJW0SIEd8tYiBzhtQMi5:m2IK4s5Bc0S8ztr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715957, "uuid": "14837a48-b907-4cc7-b6ac-3e5c06fa1a59", "value": 56694598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715957, "uuid": "da39ec93-ac35-409e-9c04-445d137fab03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715957, "uuid": "d5fe0b3a-3c7a-47ee-965b-ceeb69b3128c", "value": "xtreamvj6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2492de43-c6ef-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763739086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739086, "uuid": "c0d9a9e8-cfa3-493a-b944-4a10555c23c3", "comment": "Malware payload (SalatStealer)", "value": "82c26ff814de120d24b80d6c7683eb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739086, "uuid": "3e16564c-fde4-41ed-b894-477d52cd61d9", "comment": "Malware payload (SalatStealer)", "value": "05f219d52f8d3a81def46a9033a247fd14c2ad629282766cfb07bb68d3d244f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739086, "uuid": "f64fadf7-dc52-4eaf-9717-f83b236cb032", "comment": "Malware payload (SalatStealer)", "value": "18187bfae455c11c5e5f2e7ea890726ddca7e88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739086, "uuid": "f4413dce-2618-426c-b422-862db9d75793", "comment": "Malware payload (SalatStealer)", "value": "dbc1098559a178e8b85f0299a221c5f96c6e422ab62ab892d194ef6d3dbc567096f6f227cdc197cd2c5635b316a951c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739086, "uuid": "f1238511-916f-423d-b463-37c69b856c3a", "value": "T13AC65A51FA8B94F6E9071831405BB23F23345E048B28CBDBFB547B6EFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739086, "uuid": "de455101-2334-4712-9923-53101dbf7a63", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739086, "uuid": "fb1509c8-d489-4cb9-8a2c-3e3c21610431", "value": "49152:mZeQXdmBda7toXykHWODKc2yE3qfDqQD/emrAYrNVE8NVGMUpMfQ4QMbMahwTy9x:C5X4nlypG88bO1buTQgdLEXbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739086, "uuid": "62f7209d-7cbc-40ec-b8ab-a615e25d696b", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739086, "uuid": "f5cf13fd-3b26-41e2-908d-c980d99ad91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739086, "uuid": "5ede2f78-5a35-44dc-8b89-a7f575a25dec", "value": "botchat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d23c8b-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765103, "uuid": "c248fd84-19dd-4f05-b778-b07174ae9f4a", "comment": "Malware payload (Mirai)", "value": "5af68d2301b8cd445084ab7aeed9d0a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765103, "uuid": "51f20b4b-dc1e-47b6-a0ce-2028c1c0f03a", "comment": "Malware payload (Mirai)", "value": "06a38c63851a69131a4a745fcf48140d890efa44102f2bb054b5a41da7f1980e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765103, "uuid": "5b16c849-d076-45a0-af34-fc16b8d03d9d", "comment": "Malware payload (Mirai)", "value": "750ae0dca19a7ac6d50e8c240547c9068192ddd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765103, "uuid": "c3486b9a-9368-443f-9e92-b43bf2035d61", "comment": "Malware payload (Mirai)", "value": "df4c291c4735883a982105f5e927814b988e07a0c3535f8ac4ca5d289e4eb74a5e4e036810c7e046488804e9aa2447b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765103, "uuid": "02e36891-6152-4f12-ac38-3bf2893022a8", "value": "T133E329C7F800DEFAF80AE33648570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765103, "uuid": "70c38100-b501-4f41-9fd5-b9ad011e46c2", "value": "3072:GmzTDH86JG78FenJljAX0Gidw+w9EEVvjbiQLZrEyqKYMf:G2TDH86JOHjAX03dC9EMLmyqlMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765103, "uuid": "533b8a28-a02b-486e-9772-e471ea58885c", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765103, "uuid": "51b86a32-1e1f-48e2-860b-4921889ba023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765103, "uuid": "184ef96a-108a-466b-864e-486c9c27672c", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5a136f-c6f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741245, "uuid": "f04aeaac-ab2e-4057-bc76-1f112fc31212", "comment": "Malware payload (Mirai)", "value": "22221ac3b27c7c786e0bb918db6063d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741245, "uuid": "90ea5926-4b89-4f53-8399-bfc428d4419a", "comment": "Malware payload (Mirai)", "value": "0709e2df710aadbefa5c76a6304de855f1ed9339345cd69987860478b79e370e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741245, "uuid": "dd4578b9-0b37-4252-bc3b-26203c0c7cbb", "comment": "Malware payload (Mirai)", "value": "6b5477d686a24988491f42f30b8d80fab797da4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741245, "uuid": "ccd41c45-6527-4de2-b671-2cebd1c69504", "comment": "Malware payload (Mirai)", "value": "25208fce6af31e068a5d00879cced864c10e4d50d7d274ae83f92e401cdfc4fa1540ec06f585d21d13647c14453dd235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741245, "uuid": "ab0e47a0-c56e-4533-ae54-c34431242c25", "value": "T1AAC2E159A2C42D31E370007AAE1CC3077A876636E1DD31E8AEB1434CEEA745796FC21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741245, "uuid": "deddc9da-b7d8-477a-b921-d0c8b621499a", "value": "768:Jc39Lqcb304C/tlJp2ETpiCeLJes3Uoz/Q:JS91QlJwCir1DzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741245, "uuid": "ac4b7580-d7be-4e7f-8b27-1bce00f380ee", "value": 27736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741245, "uuid": "6c691de3-f63b-4d34-b26b-42481b421e02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741245, "uuid": "0216fa82-6657-46d9-9b76-f50bd1ee1f47", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3d3b22-c6ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763738855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738855, "uuid": "8383c004-f0a4-4fee-a076-6b5578cfcfc8", "comment": "Malware payload (Mirai)", "value": "925dbc91be9003abce6f2b70fe65f4f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738855, "uuid": "deb65a10-05f3-4114-b560-aa79b3a8aed1", "comment": "Malware payload (Mirai)", "value": "079a9b3411cd1fc8f24c440a771df02d366a31596d38b2c03d3a346d672849e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738855, "uuid": "82bbee54-2dba-4c09-bf69-2cfddffd992a", "comment": "Malware payload (Mirai)", "value": "a62d789050642f01431aeafcaa90bd80ede9aeae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738855, "uuid": "b11524ef-9419-48e0-a1f2-b01e2e3ef2ef", "comment": "Malware payload (Mirai)", "value": "f2f63ee46759ac527409c9867813de9a92bc1fbb9653e36e733cd17cd8848df1f71ca06a638c3cb8ada16eb8631ffbe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738855, "uuid": "8887d95f-75f0-4e2c-a06e-0468b731107a", "value": "T15DC2E781AC8285668AD813BFF93D45CD3312B3BAD1CE7152CD465F08B7C994F0DA7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738855, "uuid": "6843658d-a09f-40d8-a7e9-44fb339e80ed", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9I:CMn12A//SrRftY97WARbI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738855, "uuid": "edcc1caa-e866-42a7-91fa-f056f06a8698", "value": 26980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738855, "uuid": "d740e349-53b7-4004-9b43-1dee801c6d72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738855, "uuid": "04064f01-992a-4b88-a2ea-24c16aca0737", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a78a77a-c728-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763763684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763684, "uuid": "5cce54fa-efc7-4328-a0e2-1a00f3a5fe2c", "comment": "Malware payload (Mirai)", "value": "6fae01b46b0ac195171b9a2bfe89826c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763684, "uuid": "c9525ebc-55c6-48aa-b024-4ea387909351", "comment": "Malware payload (Mirai)", "value": "087b0dc03790b9c119b6218d457c1bedc3569cba8e40ef345b8fe482eca985eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763684, "uuid": "73c8a83e-0aca-475b-967f-eb2885bc4532", "comment": "Malware payload (Mirai)", "value": "7ad2f5e9d1f98bb368c357f5f7436660e9007d8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763684, "uuid": "3cdd4278-13de-40de-8873-9a2947fcb7a4", "comment": "Malware payload (Mirai)", "value": "1a78a5227ac4aec008c9b349981f38102b428c36e4b775bfb4c5f40ec26ecdcbcd2eccc3dbd879fc63c89d295c3e24f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763684, "uuid": "f517e6a4-3c65-45c3-ab10-aa19e60286b5", "value": "T113B33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763684, "uuid": "766998af-c5e5-4e3c-9f5a-90160d7011d0", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1ga4wWj6Ks/XkmSlx3lJX6s03zxsvAx6vB:eZxMi6xWSa40jSlLJ6iAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763763684, "uuid": "5f231790-88ec-4df8-b088-adf41236fa48", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763763684, "uuid": "40ed7072-2e24-440f-8587-ab7782f657c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763684, "uuid": "d61b3de6-cee1-4283-97c0-fe482cc0736b", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3437a4a2-c6ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763745984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745984, "uuid": "5bf9eef3-d3f2-488e-8d2a-c75028411e09", "comment": "Malware payload (Mirai)", "value": "8ca048888ad2eed5cf191542ac80f272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745984, "uuid": "3d7dfdb8-eb04-4672-9e08-00a6faeed7a0", "comment": "Malware payload (Mirai)", "value": "08a3965acc6577e51ec7a8dd7dd70db64fe23302b1980029b977f571a1254b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745984, "uuid": "58b6b997-09ea-4867-abcf-8f0aa74b3da5", "comment": "Malware payload (Mirai)", "value": "a7301ed762f3754ececd6232d76bb41da422e85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745984, "uuid": "d6a43d4e-2b93-4f96-8da6-d64f426d32b4", "comment": "Malware payload (Mirai)", "value": "777f03f7ed4e195a475ae4a537bde1695d89d9e3da3941d52de4c20f3be64831299888009ab3be06f3a401b7d416c44b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745984, "uuid": "2d711fde-affa-43d5-857b-d8562090edcb", "value": "T104A35B07B9C5ACFDC446C034477E7537D821F1EE0239B25B17C4EF26AE5EEA00A29A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745984, "uuid": "c6738197-46a0-49c2-9e3e-8be1b305eb4f", "value": "3072:JlOKEyxKE9WC9xMIjSiB9M4FSlO3RnNcUAF+0J:JAKRKE9WC9xMIW6Hhnaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763745984, "uuid": "4f2672f0-28c7-4e1d-b9ba-40eaa8c90fad", "value": 101936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763745984, "uuid": "47cb3e45-2e60-48a8-b270-7be08027b536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745984, "uuid": "6ef34025-57b6-44d0-ba4d-dd9614ad2bba", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e74498-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715914, "uuid": "48f77471-4ea2-47b8-ac0e-9b9ad5a03065", "comment": "Malware payload", "value": "20f7f8fe56fe7c6b596091d02b58955c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715914, "uuid": "92667590-a1d0-497b-aefb-708cf831a511", "comment": "Malware payload", "value": "09164a7f82f768d089bc99d35a8a61e92ec17d23880911491b7d84380b69e0f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715914, "uuid": "ceb31b27-c5ea-4f82-bd3d-f45bb39264f8", "comment": "Malware payload", "value": "6af95ea854111e6952d1b67d6c8325ab231ddbee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715914, "uuid": "5ea4da82-5bac-4074-9d2f-7ada879e62b5", "comment": "Malware payload", "value": "b838a55e6de8b8485b4c1b1f6dd97536006781b80b3f95a869b468c11a83a3ac0d26f71174263a156394a5b9afeac2c9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715914, "uuid": "9cf5b4a6-c58f-4511-8390-4799b6c4e1e5", "value": "T13F763343FB19AA9EC4F3D3321AB152392027DD26CB43D347691937B924BBAE40F452D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715914, "uuid": "4b5ab08e-7e0c-40ea-8c90-becb0ae50dd4", "value": "196608:X9+9gtYGL9u/lLTAOzl0giSKyx1WUvfIMM52IN8//rZy5M:N+GtQ/lQqiSKy5j+2IN2ly5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715914, "uuid": "9417052a-84d2-41ce-a313-8db973ec13d4", "value": 7510555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715914, "uuid": "f918370c-2920-40c7-a1b3-fbce992f2155", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715914, "uuid": "8d5bacf6-deb6-4a22-aad0-c7a134d08374", "value": "V6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca176e-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734657, "uuid": "8e20e7a4-67bc-4606-9e5c-4d1cb09d03c5", "comment": "Malware payload (Mirai)", "value": "511f9d2414381982711534d0594c72e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734657, "uuid": "7bcea1a4-af2a-40fc-81b5-54f7751e981e", "comment": "Malware payload (Mirai)", "value": "09aca8f45052c8aaa7923d128cb38bab5b42c72d4ea0edd97f31093e4a77ff21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734657, "uuid": "afcec582-0055-4359-93b2-1443157b598d", "comment": "Malware payload (Mirai)", "value": "c38152687e4585f80c8622df4ddb04d2f9b61283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734657, "uuid": "2d8bf0c8-2e5f-4f97-9fe5-bb5b7ecf10c1", "comment": "Malware payload (Mirai)", "value": "eac256674f0a61900798e95fcb1e63c9f9996b1cff1db471e62b0c0faf18f91d4d5b5d5e3050c701b06dca4e14861632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734657, "uuid": "1efc57dd-3fca-4349-9518-e4f67046da75", "value": "T13D23F132C30CC4D09A746771E96E8ACF13B23B5ED6FE2016B015AAD0AED657633B85C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734657, "uuid": "20fde711-37f1-459a-8cd4-f301af0fd589", "value": "768:dlVAshpNH2Kflo4uzwS7USvib16V1euWXl0RhaNXEl+ODAz7s3UozO:uspVu4awwDicWVaYd+DAzmzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734657, "uuid": "39f5af76-d8d0-411f-985c-b2b9529a4fed", "value": 47348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734657, "uuid": "8de2cc0f-a449-48cd-84fd-c4bded3b2fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734657, "uuid": "25a2abaf-9aaf-4d4f-b9e2-f8cec9f3f427", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa715347-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766073, "uuid": "6fa40fd9-1150-4add-a911-8284a4734783", "comment": "Malware payload (Mirai)", "value": "bf5d6ab7eb96f1993d0d3a6713af45bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766073, "uuid": "31a8cd67-2b51-4c4f-88d7-3b23d7805a42", "comment": "Malware payload (Mirai)", "value": "0a7142fa5cffd96276983a5ea5feb14b4147f194b439fcf2b8eb406f49d12af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766073, "uuid": "bfbcf776-5278-493f-8c6a-d8cfb21154ad", "comment": "Malware payload (Mirai)", "value": "40e9862e1d1b7e98f9d2e28bdbe2840a93c524db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766073, "uuid": "25860303-c6a3-40b1-aeb2-72ebe8f1c93b", "comment": "Malware payload (Mirai)", "value": "c7eaf99954267bba12ecd41fc81665db350954c2038c43d0bff27ff7c45150efc8a3710c3f2becbbba6afec973bd8026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766073, "uuid": "a487e41d-99a9-4a57-a906-adbcd630d963", "value": "T13F042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766073, "uuid": "3271c75a-791e-4afd-aa99-d6acd0b8b809", "value": "3072:OLe6vhWZQIvuCeeuaMuTuRez43IVILCZQy38YhTfYo+M/RgDlplLn:ee6vhtIv1ruaMuTuReErLC738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766073, "uuid": "30a3e26a-fde2-4667-a262-d3f9b6a7f3f7", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766073, "uuid": "c8843daa-a2f7-4a1d-b526-903c82156614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766073, "uuid": "fcfd401a-3f74-437c-bc65-d4fd8efe9760", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e68048b-c6db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763730566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730566, "uuid": "2dd5798f-881e-40d3-9f33-1c9d8a3d7dfc", "comment": "Malware payload (Mirai)", "value": "7c49d844bbaa33f6e7e0d5a48b136581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730566, "uuid": "f29827b4-01db-4c84-bce7-22055ea878b4", "comment": "Malware payload (Mirai)", "value": "0b464225e47b696e1e188f6181e75ce7cba3d4fe794e51eb1055eb9c33d09360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730566, "uuid": "73677d6d-0cf9-4762-bd57-942eb2f1d0cd", "comment": "Malware payload (Mirai)", "value": "e41548005680c2411ba8140ec4b66a3787e20193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730566, "uuid": "c09b62fe-0d2a-498a-8e1b-e18350b6acd9", "comment": "Malware payload (Mirai)", "value": "e58b85c03f36bdbde40b1e04e2b68973a3fa35afa829d9b05ce3f786c010d5d800353d5eb754d8cbc8e7148fe49c683d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730566, "uuid": "ac56700c-9a39-415a-b77f-fd4851fd6547", "value": "T1DC64B5BA77107FAAC368C23805F343E996B3235116A39105E12DCA3D2DA534C5DDFEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730566, "uuid": "91af1e56-bae4-46ac-977c-2e3dfb598889", "value": "6144:YkJw54MqpZHx5j5YtdM7yDF08ga5QREap+r3S+tybN2:YkraMygRBpm3tybN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730566, "uuid": "18e532c4-a6ea-4da9-8cf7-64364f6739cd", "value": 310620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730566, "uuid": "d4386146-4405-4261-be4e-872311bf47ee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730566, "uuid": "36bad727-2c06-4784-a4fe-449c737b0205", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfbbf9b-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763742135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742135, "uuid": "5f99c0c1-bc32-4fb6-bf99-67f2e0497fe2", "comment": "Malware payload", "value": "51b7dc6dd32d6cd5fbfc039301de6dd4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742135, "uuid": "d9d99cf7-1a9c-49bd-bb88-04579a19d26c", "comment": "Malware payload", "value": "0c40078b679f88f2275ddc03311b936f7a7e0ecc1602161ad9a8140c1923a83c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742135, "uuid": "44998c7c-c45a-475c-a979-66b468c9ee91", "comment": "Malware payload", "value": "891f424df5981ebb0308d87420200a3c5159d67e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742135, "uuid": "f4528a69-ee15-47d4-bbdc-c7e200098bac", "comment": "Malware payload", "value": "08475277d21f07ccdcf6598f5b3a929cac57fdd5a3dee874b0c476cc69a28babfad6db851051ecf0b35345897ebced77", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742135, "uuid": "9a8f496e-acd3-481f-8db3-11d4fdbb6637", "value": "T1B58423A60F2409CFC043F0399D6D961BDA65FE092044897BE636BE687B9F4623B46334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742135, "uuid": "2b325022-2fa7-4fd1-9bf0-70ee4164f702", "value": "05d3dce2be32df01ca249872dd2cc117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742135, "uuid": "93b93d3c-29d2-4c8c-aa3e-89494cb2468f", "value": "6144:saVWdyzOxeA1DfdwX3MmIO3J7iMl78LIVg+jKwv/ZTl8WiAw9M6YCDY9gzUR1Ayf:sMROxdDfOnMmX3xFOIVdv/ZxJnwK6K9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742135, "uuid": "3b286c60-061f-4210-9d23-780abb402d43", "value": 373336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742135, "uuid": "e1d0c27c-e18a-4dc5-85e0-271c91587a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742135, "uuid": "acd08845-2d06-4216-ba2c-b165efd4ad27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb46caa-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715937, "uuid": "be5de5fe-d7db-46a2-8e0b-5fd8f4cfbc08", "comment": "Malware payload", "value": "ad61146346aac168b685bdc7502a6db0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715937, "uuid": "7d5f75d8-3329-4359-b2bf-5d959ad5e9c5", "comment": "Malware payload", "value": "0c58f4147604bcd0144da42c630e963d9a7e2d9f7f048501db246c3fbd5da9fc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715937, "uuid": "8b84e9e7-5ea5-4575-9613-efe623fc1a5e", "comment": "Malware payload", "value": "74578a62112262dfeecba30168663678b23033db", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715937, "uuid": "4577999c-7fdc-44b7-861e-3b9c62856326", "comment": "Malware payload", "value": "11fb3d9a49f0d37090bc2cb76a1238c47a79a7d2d9e4167e0bfbc8fdd10892dd88b352f941fa63c3c3c1fe72febde97e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715937, "uuid": "a3c670d8-86ba-4175-923c-6c1c43c57dfd", "value": "T1BF67228AF788E91BC0F75332C9771623315B4D189B4396B7561AB33C19B39E40F86AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715937, "uuid": "f91d3b7a-1b5a-40fd-847f-cc69cc6301c7", "value": "786432:VNifuYItjrqfycOKF5ZBI9N33WbwoJsnXmu+PCljQ:TwIJrqqEVBimwoJs2u+Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715937, "uuid": "b363a1ef-3c7f-4369-85a8-ba1a47a4ba90", "value": 32286530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715937, "uuid": "7bc8f3ab-149e-471f-b605-a5aa90543980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715937, "uuid": "55493b8d-47b1-4ee5-ad04-c0c7510fa880", "value": "ibo26vj_4.1 (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6199543-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714500, "uuid": "810c3bba-6174-4c87-8dd6-7847ce6f1fe7", "comment": "Malware payload (Mirai)", "value": "df28c48be162d206e76ef403754c9b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714500, "uuid": "098234a3-2b30-4031-b1b4-05f35bbc2da9", "comment": "Malware payload (Mirai)", "value": "0caea19ddd33be6099da6f81de7235db63dd146d4aca58dd1dbfe2d94bfa019d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714500, "uuid": "a22b141f-9a07-4b81-b83b-ff444de68cc6", "comment": "Malware payload (Mirai)", "value": "cf4db5417bc2ccd6c83d6fa1457c88cb8fcf2bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714500, "uuid": "98e2db57-8e6b-4c41-b6e3-44087b01ac50", "comment": "Malware payload (Mirai)", "value": "6bb079c9b26f24f93c8641e530c2916e3c2d4949a2a5d390ad42df76baafa9fa5bbd60d1c51e140ae778643d6ff71840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714500, "uuid": "076dd411-4445-4cf4-a520-633b2dbc6356", "value": "T1D3C37C42E5A3E0F0E68701B01157F3E64A34E6305156DDCAEFA83D71EC71A82AD9B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714500, "uuid": "125e5962-2d6f-4e66-b8a5-57033615c2fe", "value": "1536:Zd58ZF1AEOk3aoIYPvFQ2rsXcC21ni87ATvELBFT5NWbEzrOy+LArwS9nnpAQ5+/:n58zBPdQf6tD7u+FTJn+LAr19CQg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714500, "uuid": "a9a3e092-6a7a-42ee-b20b-caec02876158", "value": 127996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714500, "uuid": "eb508b55-3614-4290-a1b2-05b79e2113f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714500, "uuid": "d270fcfc-455c-40d9-8671-85405e49808b", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71ae919-c69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703334, "uuid": "31a64518-ac98-4a2d-809c-a573d741272c", "comment": "Malware payload (Mirai)", "value": "ceb5da7f369c020750a6f5711b73429b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703334, "uuid": "9016dce5-001c-47b3-9147-89795280a14d", "comment": "Malware payload (Mirai)", "value": "0ce63145c4511bb5da3f1482029371028e2f15cd13b790a335f0f677eb3bbec8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703334, "uuid": "a8474d70-b9cd-4a57-a2e5-ebbe1a3fc774", "comment": "Malware payload (Mirai)", "value": "4fda3e5403120ebab11286a7b0ff2cf20bf72d25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703334, "uuid": "95d3b5f3-49a3-40d0-98bb-736d7c6787d9", "comment": "Malware payload (Mirai)", "value": "c4fbdb504c69645c0d8656ca247bd180fb3dba60968f962f115c5477f58bbcdfa89ec9a8f62e09ba8d8a199daa0a1ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703334, "uuid": "68fe0553-91c8-4831-89e2-792b73f2cb9a", "value": "T1B624C60AAF610EFBDCABCD3705E9170528CC551A12A93F367674C928F90B65F4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703334, "uuid": "40af8222-87d5-4a67-8de7-f5d3ec20807c", "value": "3072:hdsktqJENhPKsho8UZw/51XVKNqMgFOGdgs:tqaVKNFwMdgFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703334, "uuid": "24cde7f8-f194-4d57-a6e9-a571b31a3065", "value": 226480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703334, "uuid": "f735b016-0062-4acf-a041-a963696284a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703334, "uuid": "cb2ca3d1-dd19-4af0-bcab-10dd552e5a58", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c7a91-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694333, "uuid": "56875461-4613-491e-b3e9-e2e042f07ab2", "comment": "Malware payload (Mirai)", "value": "7e2859bbff233233053a3a3467467547", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694333, "uuid": "9de210ed-956e-45bd-a88c-31f7c3f036c3", "comment": "Malware payload (Mirai)", "value": "0ced25bf93173f63d1479a6a93ad37671a90a8d29b322be48e45cd76d548a120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694333, "uuid": "fcae3d8d-d9e9-4b52-8b2b-15cfcfa7f496", "comment": "Malware payload (Mirai)", "value": "6ae958dbafa13e1b3201954869d0d7e3a89c3741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694333, "uuid": "358f8415-aa3b-4b83-98f9-851973128a27", "comment": "Malware payload (Mirai)", "value": "023acf447243800de8f932dd107f465a0af8eb40489da5497ddde219b8786c7e130ba58c60b2a53d69a5e62e5069a8e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694333, "uuid": "2f66e60c-33a5-499b-bfdc-4db4aee05d5b", "value": "T119043B81FD455B17C6C622BBFBBE42CD37261778D3EE32029D155B21378A86B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694333, "uuid": "7fd68b4b-829c-4abf-b0af-6d2c510e6a81", "value": "3072:Kfnf+gEM1myzfxE9yFHN3YL9eNo49RBK4BWNgxGStnS:zknfxE2IpIo497K4MgYStS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694333, "uuid": "88d0b0e6-c0e4-495f-b8c5-e4b127d1dfc7", "value": 178816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694333, "uuid": "f5d9f3b5-74d8-42ee-9c67-de572a043cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694333, "uuid": "ad5ad763-d0b3-4fb9-ad1c-2e9fef2bf525", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5e3e3e-c70f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763753190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753190, "uuid": "50dc9ffa-42de-42d7-ab07-a47e824ce002", "comment": "Malware payload", "value": "928ec4ca606f5d541a90b02035a1a874", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753190, "uuid": "285ed602-53b8-416b-9950-a993de9890a9", "comment": "Malware payload", "value": "0dd9571197f6fa4002018889fc536ec414d7e331dc284ac870cdda3c832c4615", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753190, "uuid": "4bfad592-3f99-4699-98c4-e532123a2e44", "comment": "Malware payload", "value": "0505e1241f92161f63b6f3f543f43b51f619b165", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753190, "uuid": "6a3b0662-09ff-4619-813a-979ef7b8a49c", "comment": "Malware payload", "value": "7c4fbdd5d7d890f02305fbc240e92478e65ad34175ca91b495e49fc04504d630c11aebb706e08cd18dd0af06eb918734", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.DLLhijack", "colour": "#DF6B83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753190, "uuid": "da3623ec-080f-4354-bbfd-533f457828d6", "value": "T1A6741A112BF0D8B7D27E0532DEA8AB98F5E2BD734D70951713603A6C8D34F419989B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753190, "uuid": "12c8138b-c09d-4ffa-8dc8-f64eaa163d7c", "value": "a4f061b923e25805b6d6788911a740c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753190, "uuid": "78b4649b-bb95-4fd7-b0d9-a8b524d919c6", "value": "6144:7a4efNhfavBgK+g4isMkM11tzgIzeiddHwksI:7a4MsgK+GsMx11RgIBddHzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763753190, "uuid": "e5cbe730-ee3a-4e67-85e6-afa2a022b93c", "value": 339984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763753190, "uuid": "3f5b2ec9-100c-4f89-ab79-13ad4f668fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753190, "uuid": "4a92cbda-edb5-45c0-b838-5329ac053e63", "value": "adsiedit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545960e0-c6fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763745608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745608, "uuid": "a6866b8c-891e-4de3-b259-61e6e1416cc1", "comment": "Malware payload", "value": "e743cc543bbc635c0b8a3b92cb102639", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745608, "uuid": "7a3ba697-5834-40a0-baae-b2973fdf5a09", "comment": "Malware payload", "value": "0eabc1757a9dfea73fdaf68bc4405f0ed0db2136c9073721458349655b8e0ac4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745608, "uuid": "e83adb81-b578-4e6f-be7d-099b66f4232f", "comment": "Malware payload", "value": "23502f685095f782676187d58f82508c0d55f70b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745608, "uuid": "2d8df5f2-d6f5-4559-a4c9-e32e2662491c", "comment": "Malware payload", "value": "f681748f5836a924941877b3b943c1602db5221f31d54d89fcfb34ea75300c2738770116b621509da346a883923d7c94", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745608, "uuid": "b0704654-9cfd-42cb-b4b6-0ccb0351ed97", "value": "T11953AE1A76108332C4850B72552FD3D01BB6BC489FB3162671EAF79C1EB29C6627BDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745608, "uuid": "97c57d9d-3b6b-4618-91b7-4bd436168ba7", "value": "768:/f5lqf9VvcCWmiGV4DVBCVNZ2EQrh3Kt2wNDQezQQ9c+s3o6qIo6qmC:5sf9VvcCWiV4DV+NZirw5DQo1LHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763745608, "uuid": "a62baf99-c973-43fa-9e54-bacc042a7690", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763745608, "uuid": "443f58fe-8268-4dfd-8bc9-21d3a2250004", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745608, "uuid": "9e19b0d9-5800-4ad5-bff9-3e16eafe3dd0", "value": "x1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cae86d-c69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763702849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702849, "uuid": "3b12beb0-3336-4b76-9d62-adfb2cb6b293", "comment": "Malware payload (Mirai)", "value": "76ba0a47a458ab6127d3d4aa53119681", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702849, "uuid": "9d7bc8f8-4294-44d7-b24b-9bebaf31bff1", "comment": "Malware payload (Mirai)", "value": "0f745f704dd1ffee2f17dc22b97dde19ef9c294e46c0892183d582aa7bde44dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702849, "uuid": "b4e3a4b1-1717-4603-8599-372d808f8332", "comment": "Malware payload (Mirai)", "value": "bb0dac22cabcc3d5f52598f4accff86402374295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702849, "uuid": "1d2e4cb4-af36-4650-898d-17a32d2c0003", "comment": "Malware payload (Mirai)", "value": "cbf3df4d885a50c3763af506c9457fb91f6c77a6ee07caa3508b7bb18e7416ac27a82a6665b2f210c9e948e6cac1ca3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702849, "uuid": "42b3fd5e-e0f3-4cee-906a-dc2664cc11f5", "value": "T16933F707F84285FDC556C13417BABA3AE83671EE133CB6A777E4BB222842E615D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702849, "uuid": "16f286cd-d8bc-443b-b354-43463aeb46b8", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHcw/0QkiuVn4P:yHlPZMEcTFZ2A1HHcE0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763702849, "uuid": "179f683f-5bf6-452b-a3d2-e85a5beb78b6", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763702849, "uuid": "cdc3d32f-6a27-4265-8ef8-f4a657a28d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702849, "uuid": "8f48b626-b587-44b3-b1b7-1a69fe22f642", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1f6b0a-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734372, "uuid": "3b5bef4d-1203-43c7-a645-cbeddf653445", "comment": "Malware payload (Mirai)", "value": "68f70b79318a24832d027cb1065e2094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734372, "uuid": "f01b4e38-2f2c-4a44-85a9-290d76832622", "comment": "Malware payload (Mirai)", "value": "100026bdd1cafe371428ef4323d833876caafbbe1320c65fd3e1463999c83d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734372, "uuid": "79f6e888-7ebc-4cea-b977-440d23658abf", "comment": "Malware payload (Mirai)", "value": "583551d43630b480e0cce7a8ca8f423bba0bf31a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734372, "uuid": "b6145e49-a7cf-4c61-822d-e176650c9839", "comment": "Malware payload (Mirai)", "value": "dc64fe6fb16d659f439327c66492bf81939bf08daebcafb8f5db1e44f39bc44e5cba08a8a0f3c420ae6095e7f46129d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734372, "uuid": "e1e68d46-c272-457e-96d2-85a4950711ad", "value": "T1C223F26A7640D6B2DCE00B31D81C2E53F40E0BB6E12BA28716159A2CECBD415ADF6F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734372, "uuid": "7e13406c-5abe-4964-a35a-07a609cf293d", "value": "1536:o5FypnpCGRa1+LLEXdWpRNL/C35NvXeKzrkhXLx:oCpCaa1+LLEX0pTL63XeWeLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734372, "uuid": "bb3e2145-5b18-44b6-9eeb-b6076fdda54f", "value": 50088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734372, "uuid": "a74cd514-0895-4e6c-9cc3-467588b93fa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734372, "uuid": "5934755f-54d5-43cb-a1e2-376e9720f562", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90083900-c718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763756875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763756875, "uuid": "4eec80a3-c00f-498f-a24e-979e9e41d1c7", "comment": "Malware payload", "value": "115c539fac981e07f2f9e2575f9286b0", "object_relation": "md5", "Tag": [ { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763756875, "uuid": "2878d5e8-7195-4576-8373-b31b4bec9cdf", "comment": "Malware payload", "value": "1156bc90807971ab1f51e13a197ed635157bacafbc35ec8a461427871f316688", "object_relation": "sha256", "Tag": [ { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763756875, "uuid": "db877960-1f37-4fbe-af7a-e58b076e99aa", "comment": "Malware payload", "value": "99ac94218ab3f07fc537727be22678ff30fd910a", "object_relation": "sha1", "Tag": [ { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763756875, "uuid": "e08ee5ba-04c5-47f7-9eb6-4099c48334f4", "comment": "Malware payload", "value": "34469525f72a789ae5c12e086639bb3e576ab1985abb9faf51e31dd89c9d56cdc25fa422a6d8d43dad665f50ede7b9ca", "object_relation": "sha3-384", "Tag": [ { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763756875, "uuid": "7e451194-fe32-4c51-9e2e-d92584b36845", "value": "T1BFF533E916F1023614C6AC22197DCB8A518853F830F879B0BA67D16A47B7F07B1A37F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763756875, "uuid": "7a6c395b-3cce-474b-b256-4bd3f430d114", "value": "98304:jBvAE0jyxjf3hj8tdZCVVqiis+qweugTexYNHb3yz:jNAE0OxDhjgIbgsNweveog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763756875, "uuid": "163d4e61-a166-4f8b-9fac-8f86e7dc201b", "value": 3406477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763756875, "uuid": "6c0885f8-6d5e-4e19-860e-be871c2aceed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763756875, "uuid": "81b967a6-3fdc-4bca-a107-c1ef02607cc3", "value": "OFICIO No. 22028 CITACI\u00d3N AUDIENCIA PRESENCIAL 2025-2781_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14922ff-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714491, "uuid": "0dd3f420-d801-4ea0-8a93-7a5c058d7516", "comment": "Malware payload (Mirai)", "value": "f3163b0850dac4efa7b7079d2955802b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714491, "uuid": "06b200c2-a8ef-4522-b916-4aa843b67a25", "comment": "Malware payload (Mirai)", "value": "11b1b08e46d004bcd7d15ee07f0ec27e1c0712be5fa9e2c22a9148257b755740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714491, "uuid": "a12fcc34-1cc2-4b18-92f3-6ca6d3ac50c5", "comment": "Malware payload (Mirai)", "value": "90c8957498412022e13786a101f2ba09e8bfcd18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714491, "uuid": "f233d987-5b3a-4040-8198-10f8852a82dc", "comment": "Malware payload (Mirai)", "value": "736686083b5efba8bba37237142d141442ba753e9a0edbb12ec6a2a21b82a5cc14019d042a3cdafb828b602d6b7ea2d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714491, "uuid": "8901fdfc-9cae-47b0-9686-be7d7d5729b4", "value": "T133B3E1557A10FD4AC02663FCF2C50DC0B3B15EB64B96950B8553BDB82DB98E83E0ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714491, "uuid": "8262e869-f2a9-471c-afc2-d10fef3fff02", "value": "3072:07LQz8FiuEAqy/Z5z4givst375mk2idSrH15wuw:Dufqaz4Nstr53uV5wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714491, "uuid": "15affc29-8670-47ea-ad44-04b027f8f6a0", "value": 116488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714491, "uuid": "636628a7-4613-48e4-bbce-ee14438745be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714491, "uuid": "c488437f-bc90-4fb0-95cc-197b4365e251", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a251781-c70b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763751282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763751282, "uuid": "efb3328f-f876-419a-ab23-85862d74f19d", "comment": "Malware payload", "value": "2264337dcc9eae27d76ad54cdc75a3d1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7711", "colour": "#5C5DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763751282, "uuid": "e634a8a3-25eb-4d5c-903f-6ee1488eaacf", "comment": "Malware payload", "value": "11bbb88c47564da062cb574329e2bdcaa9a23c37ae500ea22e363fff34a4ac03", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7711", "colour": "#5C5DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763751282, "uuid": "06d613cc-3543-451b-b444-26dd7d411757", "comment": "Malware payload", "value": "6dcd20a7d9d2e163dea57e82907708d5427e3267", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7711", "colour": "#5C5DC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763751282, "uuid": "ff313e28-093c-4e91-a97f-de3b2f328ea6", "comment": "Malware payload", "value": "e48cba99e3ed053715c8ab485f52b24be83b7865fe8c5f87ef846ef0a8665ac0421a99d11d8bfa30d42cabbd3afcda41", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7711", "colour": "#5C5DC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763751282, "uuid": "c1a89dd0-c4e0-4823-8755-bb64ec84ef27", "value": "T1C9F63361D4B28870021BE463A08E187D69A75BE2CDFD09D921E63F7DB317EC90F64B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763751282, "uuid": "3fc63b23-8712-4fb7-b0b5-e32e258f30eb", "value": "393216:tLsxHJpdYdsgZmhutgCJiaIa6HZdeg4OyNTWgeb/:tYbpdY+gvniaT6X4Ooej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763751282, "uuid": "62cb8927-b9a6-4e88-9abb-0094d0a1c4df", "value": 15286932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763751282, "uuid": "86971571-4312-4663-836f-a9d263a471fc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763751282, "uuid": "28eb2e60-bdd9-496f-991f-790c546a075d", "value": "\ud83d\udee1\ufe0f \u27e6\ud835\ude3f\ud835\ude64\ud835\ude6c\ud835\ude63\ud835\ude61\ud835\ude64\ud835\ude56\ud835\ude59\u27e7 \u27a4 \ud835\ude3e\ud835\ude64\ud835\ude62\ud835\ude65\ud835\ude61\ud835\ude5a\ud835\ude69\ud835\ude5a \u27a4 7711\u27a4 \ud835\ude41\ud835\ude5e\ud835\ude63\ud835\ude56\ud835\ude61.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d2ab9e-c69e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763704653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704653, "uuid": "1d494d57-d2cb-4938-9c24-f34b2a670d7f", "comment": "Malware payload (Mirai)", "value": "8d6d09635bade8d4972073321d6fd82c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704653, "uuid": "b0e4b324-79fe-49fc-876f-2f0f93b3a954", "comment": "Malware payload (Mirai)", "value": "11c1dce8e587299ff82deee0b28d7f6f942f3cef3f6bb085d0db7609e7a0e826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704653, "uuid": "1e05502e-690d-4ddb-8d5d-276a211d40e2", "comment": "Malware payload (Mirai)", "value": "5a238d3195c8892d44dab5b050832851d8787336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704653, "uuid": "b2f8ccab-8581-4b1f-b7b2-cace39e7f677", "comment": "Malware payload (Mirai)", "value": "73827a9138997859353b3bbec5cde5bb6eb3a1b9151a2244b236ebaac6fdc3276ffb5fee09b8f95554651b47942c08d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704653, "uuid": "3fadf4eb-daa6-4b67-98db-98189a333912", "value": "T1D5D319C0F643D2B9E50907715136AB378632FD36602EE697CFA4EF36B871A80D61925C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704653, "uuid": "c6aba346-ffb7-4f77-aaa1-056279bb1ed9", "value": "3072:monz5NWKR7xYWpW92HUn9t5MaPKmuc9ToeoSN5rnZShs1KmejNljoBQ9C1W/7BPx:zlNWKR7xYWpW92HU9t5MYKtc9ToeoSNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763704653, "uuid": "33350ae1-31ec-41cf-9d6b-29d91d399c78", "value": 133068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763704653, "uuid": "70cff15f-6bb4-423f-98ed-d8187594afc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704653, "uuid": "cab6487c-e63e-4c89-8174-99f172acc9bc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba00437-c6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763726186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726186, "uuid": "0e2da3aa-7e20-4462-a12f-42e3661ccaca", "comment": "Malware payload (Mirai)", "value": "adb83b92bb6cc72427290dee19398407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726186, "uuid": "661daa96-1808-4ac1-ac3c-ec234218b964", "comment": "Malware payload (Mirai)", "value": "11c3d12167ef18859b3320ed6bedde0581d0a15f5dd1a995cfbc339060006638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726186, "uuid": "d9eb7f1a-6346-491e-ad32-1a92900590e9", "comment": "Malware payload (Mirai)", "value": "0b335e3e3dca5bb573f2cf309f3613b7c5f5ef20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726186, "uuid": "09f9d8d6-f2f7-4da7-9107-e961dd6a3bfe", "comment": "Malware payload (Mirai)", "value": "a43b5febf3b29f34a555ebdf11a5c418979bf063c13f0549e77968e221723f968e7366377b5d6c129bda1bb72b0663bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726186, "uuid": "668cedab-5cc6-4afe-8109-4a4ce37132a8", "value": "T127C33CCAB801CE7DF94FD6B644630D0EB935A3A156931F26225BFD93AC331A4BC12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726186, "uuid": "3e0f36ce-1a6b-4f43-a509-15be6299763b", "value": "3072:/t3PO/02E0qPkc14UDAGX/lXJNo9AjEBNacG:9O/02E0qPBlvlZNjEBNacG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763726186, "uuid": "abfad0e7-0846-45ed-95bd-ff5e55e13c5a", "value": 118748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763726186, "uuid": "f650cd24-59c4-49c1-9303-49bf44a05b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726186, "uuid": "fff8af3c-13be-468b-bf30-f38e18762b87", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d2a4f6-c6b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763712885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712885, "uuid": "bb7752b3-fe7e-442c-a217-f6858a18eb41", "comment": "Malware payload (Mirai)", "value": "38020e274025b24dbf9390ef0de568e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712885, "uuid": "44fac40f-05c0-4081-8616-6af5d682796a", "comment": "Malware payload (Mirai)", "value": "12492fef08ca0341cc5f984c009d5ffc4a1a2c525ebbe8c36b096fb7a9ee9142", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712885, "uuid": "e29012da-639d-45ef-a3fb-637ff378727f", "comment": "Malware payload (Mirai)", "value": "2892e42b3ecaba2566e7285f81a1219ef7e565ae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712885, "uuid": "7bafcf4d-26cd-44b7-a127-552d69c1c9df", "comment": "Malware payload (Mirai)", "value": "8eea2d2699a379ce46836f8d0a100f14447967a3a36f543b7d513aca3e9146e3d434d20dff2a49c8c758f7bb0ab6b370", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712885, "uuid": "625bc53f-f57b-40e8-b921-d9853dfdde7e", "value": "T1E7E0C28E0B135ED7DC105CB6B1E3E006A1EBCE8CA76F2A9C68185E7D0588C0CB543A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712885, "uuid": "611634c4-829b-4ed2-923a-435a7efb8c4a", "value": "6:Q2JM9z+tXJCcVn0RDSDX8Kz2BrhAUB2RSZ8KKq5SihAUwzIS5:Q2JM9z8j9DMKzYrWUavKKq5ZWUjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763712885, "uuid": "8eb85d20-2699-464f-9799-6eedbb1ffeaa", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763712885, "uuid": "c694e8da-cc8f-4333-84d7-360c36a39402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712885, "uuid": "af6971bf-73a5-4649-89fc-4a306263f38b", "value": "ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b0cb02-c68e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763697512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697512, "uuid": "79df8b9b-ff75-4cd2-9625-af7e79953096", "comment": "Malware payload (Mirai)", "value": "7ab96e49ec117071ab43e94726064554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697512, "uuid": "41f79815-2ed4-4bea-9eec-5220b732fd8f", "comment": "Malware payload (Mirai)", "value": "12d368c3a7f955d1c4c0a87f2eb604f94b55d5b8a3b7e310c523953881dc31f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697512, "uuid": "12c84092-5c9a-4bb8-a8ea-0c949b674bb5", "comment": "Malware payload (Mirai)", "value": "18a622f896ed6a8b64f86554c39454b5fce75d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697512, "uuid": "b06290c7-fe75-4460-9272-0aaf117d7077", "comment": "Malware payload (Mirai)", "value": "f878d6ed86b473b14becd8d1250c68681143367037f770773337a0ed0bac7b37af521be6399913e7a56ddb497ae037da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697512, "uuid": "e80def4e-6008-4dab-b4c6-3b54aebc9f96", "value": "T1C953027AE2A14F37D6BF2F705EA7ACC472F052C90F6A86A6D084BF410A3947A71145C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697512, "uuid": "2f390498-55ff-448a-b3f9-3c65d7f3426a", "value": "1536:IKax/6+ym6tf3FT/aUXVJ95rKzpqdPsu24Nz4u+qgw09I:IKiiVfFrhVJ95gAWubJ4u+qgwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763697512, "uuid": "cff06c3c-63c4-4446-a878-cbb402105c39", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763697512, "uuid": "a5a70c5a-7dd9-4820-92a8-8b7ecc7c2147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697512, "uuid": "50fd7b6e-4547-4837-a007-80d4d7cf524c", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ade694b-c723-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763761403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761403, "uuid": "b37b5f36-b2f5-4bd9-bfa2-64facaf0c798", "comment": "Malware payload (Mirai)", "value": "868e6dabd17e1bd2d9d6b413760dfcf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761403, "uuid": "5f929506-31ea-4ded-afd0-0cfe3431e8db", "comment": "Malware payload (Mirai)", "value": "134b8c6810862b7b7d199b66e362715ccc45c2a759db8ffa882b717840842d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761403, "uuid": "9a2fc8a1-3e7f-42cf-8bd7-2b8a0d8b9c63", "comment": "Malware payload (Mirai)", "value": "d8e9b1f407fba1c9a10d81c1ef57b597f7d788ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761403, "uuid": "c0802de0-ca74-4eb7-9918-ca10217067a3", "comment": "Malware payload (Mirai)", "value": "0e6c3b322b62c1761074627b8b6054060b109ef67f0ab576ffdf59cc545f1a2a7d9d34b963a139ef45fb395b2ce36603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761403, "uuid": "493230b1-9eb7-4162-a3b5-95de6641b6bf", "value": "T1E4A36CD6F243D8F9EC2241303176FB378E72E5BA2128DD83D7A49A72BC52942D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761403, "uuid": "98ec5593-b8c8-42c3-88c2-82ccbadf4219", "value": "1536:KnJyYba2qd7fRRI7GEBOkfmuWwqUwRBG03g4aKBtlgALf5SZ+ZeiNE/:qFbaViGs1fmBwq9RBGyXVtXD58iNE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763761403, "uuid": "090b7d35-568c-4a9f-a657-a9fba47c921c", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763761403, "uuid": "6ff7e7f8-3e96-41a4-9177-1392ad504ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761403, "uuid": "7a9b3ec7-d604-4167-b455-25fda99c73d9", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120522da-c72c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765254, "uuid": "eee1ab8c-7766-4c98-85b9-787d67064b9e", "comment": "Malware payload (Mirai)", "value": "70ff29aff40583dbde3cea843de7687b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765254, "uuid": "24d430ec-18c7-4c45-b5b7-14086694ea09", "comment": "Malware payload (Mirai)", "value": "134f8b3ab28a7adcc014147ab19756e22d983db77278103ddc2dc8461617de3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765254, "uuid": "fbcfa4ae-00ea-481e-b310-3d86da20451f", "comment": "Malware payload (Mirai)", "value": "bc2a05664d2574d4342d7a3b834f80645e1df2d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765254, "uuid": "498c31e9-a82a-47d6-9ffc-eb905c924694", "comment": "Malware payload (Mirai)", "value": "635043508218df4fd592e2c4eec5bf0b10cafc6470966382ee3ae2127c14e5d956ca5f9b620c097c172f87ad378d3f6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765254, "uuid": "60a12b08-e5f5-4dde-b373-fbc357a4780b", "value": "T173B34BD9F643D0FAE81605302176FB37AD72E9BE2228D983D3B89E367C12641D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765254, "uuid": "083ca1e1-ea9e-4816-88bf-a10fef540d73", "value": "1536:O1z5kayPMrO/5e2xKKO1lDbDYc+Wy7w5qR6U0NhbsnxA3S6as3n0:KkMrG5e2xKKklU7Aq0Uots2as30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765254, "uuid": "7090ec10-14ab-4160-9c22-588ac66694f0", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765254, "uuid": "2962de36-3076-4350-9c32-42d035ef4ece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765254, "uuid": "25b945ac-5e0d-45f1-b70e-1d7826a0bb6d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a35e8a-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711224, "uuid": "0fa29d31-8c46-44c8-b73e-c34658b4ef7d", "comment": "Malware payload (Mirai)", "value": "17c09fac39708e1f93c76dc858b13124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711224, "uuid": "e7665545-fc77-4177-87e8-622575ae3975", "comment": "Malware payload (Mirai)", "value": "1382e61009a959a78baad1ed49599c84509e99aad0f2b8aaf8aa34fecff6e61f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711224, "uuid": "fd7f053a-0b03-4f11-a67c-e9ec4c90be15", "comment": "Malware payload (Mirai)", "value": "1080e202c243bb85c02046c3cb6cdea17160eae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711224, "uuid": "fe95e5d8-854f-440a-b09f-5f2e13faeae2", "comment": "Malware payload (Mirai)", "value": "ec97dda88f889ccfcb6b909981452bfabbc16fba8203c679b9c04f0b3d51f258d9b9e484c62833b57231951ef43815e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711224, "uuid": "08c9ec5c-ee87-4c75-854b-041d897727d8", "value": "T12C739D12F8653D48D48942F4B1758A3C8793A981C1871FBA36A7C37D94C3D9CF94A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711224, "uuid": "8e6e0816-56b7-408d-8a1c-3a149d454b8a", "value": "1536:DRUDuox33t/gFwUx1jz7tXUpCUK+WVX0gGiAk0IHtk:DRwuoxHlbIJXUpy+YAlINk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711224, "uuid": "86e84fec-79a4-4c38-8915-f950f862b1c1", "value": 75252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711224, "uuid": "1166d111-46fa-461c-b8b7-8c9a63563265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711224, "uuid": "365b5541-6386-421a-9038-402e275bd4fa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f210aea-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715911, "uuid": "493d5630-63ba-4366-8fde-1f4df2936c00", "comment": "Malware payload", "value": "da72267f38e85b8a6f832e4798437657", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715911, "uuid": "d83013a6-15a5-41ef-953b-f4c8e18c1138", "comment": "Malware payload", "value": "138410de9f13c3b07006cdbe0768a6e6ee1536586c5533f7a3abec6b391151cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715911, "uuid": "7d807bed-b521-4ab5-abcc-4edc7d03e892", "comment": "Malware payload", "value": "b956f1cf239ab57adc4ffe7f17f3a1d461af1d86", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715911, "uuid": "49bf3cfd-d518-4bbe-ae84-fba2cb28c4d3", "comment": "Malware payload", "value": "11bf2d9841d58346648fd847a9bd7287d59ea1d2938ffba836a7a3295edc0c2c800789cd5c5f6ed82c0d0a58dc5ef02f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715911, "uuid": "9b4a4f68-96f6-47cd-91cb-f4a36ec70495", "value": "T15457229AF784EF1BC0F79332C9761637304A4D658B4392776508B33C29B79D44E8AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715911, "uuid": "b3959d07-5684-43db-ac25-fdc62b67ab41", "value": "786432:L8ardlUXLuvVBdnDL6y3iS2POWPruPWJcR7pVujBPhXDUl:bRlmuv7d7ixPiVGBPh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715911, "uuid": "77971b69-0e2b-4fdb-acf7-aace5049235e", "value": 28020864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715911, "uuid": "e0275967-8e62-42bc-8c77-edf632d76545", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715911, "uuid": "1284e8fd-fd85-45fa-a12e-54a42cc767fc", "value": "IBOVJ5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b5a81d-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765096, "uuid": "fc36dc3b-1079-4a57-a2cb-67e6d79bf76b", "comment": "Malware payload (Mirai)", "value": "604032bb822149680b323d88f28231a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765096, "uuid": "6f0c94bd-5916-4ba6-9cc1-91f6cdbe1a38", "comment": "Malware payload (Mirai)", "value": "1478ad5e74455de7b0542254ed9ea9966fd6ebf4a222096e36de955b34194e3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765096, "uuid": "1f4073e0-24da-4cb0-abb2-ef10262aae13", "comment": "Malware payload (Mirai)", "value": "dd01eeb68e4ec078c02586ff2fda7f1e86cdc43d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765096, "uuid": "2c3e07d4-c15b-4e51-8a95-abe4b39525c3", "comment": "Malware payload (Mirai)", "value": "e359caa7dbab0880c566d69c088d817eb3164830e58c55e6e3d8abc3a30e2698392c96a5ff3f7312aecb382638118f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765096, "uuid": "d6fa0d85-af8f-49b5-9fc9-fdc204d9f90c", "value": "T11604B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765096, "uuid": "33c0e174-3c54-41db-9b18-f4270484f44e", "value": "3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65/Vt:nKYeeNYQqmeqavlg65/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765096, "uuid": "76c2ce11-bae2-4670-8670-fdcbc2d7dada", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765096, "uuid": "9b50dace-5afc-47a0-9572-5cd112136dc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765096, "uuid": "c66f29f3-0676-4d0b-95bb-a9fdc53cff3f", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7adfc75-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765934, "uuid": "740858ec-8087-43e0-a7e9-6f4b7aab0757", "comment": "Malware payload (Mirai)", "value": "ed2ec3ca58fc70d40ecc8dc8e7012a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765934, "uuid": "d51fa882-4e84-4179-9f21-b8e2fe70fbcb", "comment": "Malware payload (Mirai)", "value": "153678cf354711103145179d675015b5e3f077e771dd997cc2cddecc81c92f46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765934, "uuid": "a20f8ea1-d7b4-4775-bd96-b567d90d8c41", "comment": "Malware payload (Mirai)", "value": "1d48b6bad2e863778bc9585b55f0cfef63db44f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765934, "uuid": "625a9e58-972b-4d47-a48e-7385540eb89e", "comment": "Malware payload (Mirai)", "value": "4e12d82af0481efdaf3c2304ae429058afee139a090a244d64ab0e5cf3d25d11f3836957c8b55d0863fb5eec83815e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765934, "uuid": "a83fc700-e468-4af0-bab5-bed7d5a1b407", "value": "T168D3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765934, "uuid": "616cf10d-bd0e-4f18-b5c0-62721216d0ed", "value": "3072:20H21ZnmZUjUGcF9n4FN7njJL3sdugpgy+Dq:2f1ZmaZ64Ftnj6kDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765934, "uuid": "a3de750e-0bb1-4514-b5a3-7815287db268", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765934, "uuid": "02b64cd7-6997-4c1b-b273-c60d81621cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765934, "uuid": "9369aacb-2e8e-416c-8c36-15fdec2ca2aa", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ed88f-c688-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763695028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763695028, "uuid": "227ebffb-7601-4445-9588-477eca181267", "comment": "Malware payload", "value": "b86e83dae9f6ac7782777240b2ce2cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763695028, "uuid": "1426df42-4fe7-4537-9138-c360719c58e2", "comment": "Malware payload", "value": "15d2567be9cff5347ec53761fbffbe22a1fa29cad83be27e65f0f7ac1f49a87e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763695028, "uuid": "31d131d9-cd9e-4ce6-a163-603f4df324f6", "comment": "Malware payload", "value": "7e28994f64f72eb1e8b1dcf99cfa229e797c394b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763695028, "uuid": "aa223321-0180-4ca0-90cc-31532404d783", "comment": "Malware payload", "value": "90617dacc8c9ded06ebdbeddca0ae8cda0e753a00f88cd65702195a692cac00b30623f92fc450d6e534a89adcd248f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763695028, "uuid": "5771ba62-3358-43fe-90f6-75f9f99a1492", "value": "T1F5363354A3E00AEAF9B3903DD9B4D851EB3374620714D8DB82B456363F237F09A79B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763695028, "uuid": "0a6e4f0e-52d9-4393-b239-3b943bd407a7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763695028, "uuid": "cbea03fb-9f40-4fc2-b9c7-57c1b9f54b81", "value": "98304:yFOVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAxNe0G8fqyaDGW0xx:luWJysVYvsOaoyMxxvjDDAxgypxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763695028, "uuid": "48665696-0136-4816-83e5-6d000c9d0221", "value": 5271972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763695028, "uuid": "4d70e265-4ae2-4a2d-a703-a0dd00d22c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763695028, "uuid": "5428f2ea-83df-4643-a9b1-62279c501bac", "value": "svchost_upd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7739df-c6b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763714965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714965, "uuid": "cbdf2e13-7792-42a3-80ab-1db71dcc8c9e", "comment": "Malware payload", "value": "290f1dfdbee5ba1f8dc20706f5110cc4", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714965, "uuid": "e5e3aad4-108a-4497-a61b-a0c3bd5d7373", "comment": "Malware payload", "value": "16d9ae3dc35e50224b76de59f6f1f713f57a72633eb27778784456ba3f35e1b3", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714965, "uuid": "1f955d77-f02c-43cf-9351-88fbed6aaf67", "comment": "Malware payload", "value": "a19d13f508ff4f1e6218f18d53d3865f3ce0aa50", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714965, "uuid": "4643eb1a-ef88-4d43-9f12-9316c341f909", "comment": "Malware payload", "value": "d30f1901ce38b450c026e952279bdc55581a7848754b4ca1c486d975d411650f26eaf7f43b8dbc5f15f6ffd304c303eb", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714965, "uuid": "aeb7e64c-b6d4-475a-8bcd-a74c0f77981e", "value": "T10836AE15A3D404B5E47BDB74CA96C333C6B0BD958735D20B0A59F6062F73AA18B2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714965, "uuid": "4bce13ba-fa9a-48c3-8d87-83a25f7c8786", "value": "6f45b15b6c3cf6d060e1da316f6f2fd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714965, "uuid": "4b503805-2306-40c9-aecc-43a3ddcbf56d", "value": "49152:F8FalbjsGib+G1ZFUF9pbR3PD9TtLC8gmQZNej3bD/jMuB+kwvYCz2SrGsPXsO:EdGprTwmQZYjbMoberG4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714965, "uuid": "869f2df6-6925-4b48-808d-5a84ccf1a545", "value": 5163008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714965, "uuid": "959cd368-f2ff-44a3-90e0-a4a9a46d7b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714965, "uuid": "c29e728f-1a32-44e7-98a3-9e1f4da0195a", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26226fd-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703756, "uuid": "1ac27695-69cb-42e0-9ad7-ede926e905d5", "comment": "Malware payload (Mirai)", "value": "1d14e110f3acd95053cd3f3788a323ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703756, "uuid": "b45c6d1f-8bfb-40aa-86db-574f9d1cd02e", "comment": "Malware payload (Mirai)", "value": "171034e76c4a4160d888e8071c53a626d82a44c3af2df0740d826cfe262232ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703756, "uuid": "796e957a-46cc-4b9d-8f11-b3b92b2c3f62", "comment": "Malware payload (Mirai)", "value": "47bd14afdbc7aaa3a4ffad733a3806b7b3c8b910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703756, "uuid": "d018cde4-00a4-48b8-872b-1e117b3b87b9", "comment": "Malware payload (Mirai)", "value": "40ef96d062a3f31bf52d53702d8d87aa9a1d29649e58968ca2c9ecab22aea4bb32a82fe8cbafa4f5eb6a9322403c4b2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703756, "uuid": "7c55ff5c-b1c0-4e41-b1cd-2abec0b4d141", "value": "T151C3122694221B7AE901A77D3F13535E43290EA3DDEB825CBDA47A6DA3834C2C4DD53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703756, "uuid": "8346a84c-cea6-45df-a3b6-76454dca49f1", "value": "1536:UAXRTOP+fE0fV6DwOTklK2/363m/jK6j13vggqmfpmZfKx4yuxafDOCVyeuvCq1F:UAXMmE0fV6EOEG6FI5U1uxa7O+uGJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703756, "uuid": "f75578ce-ecc7-48b6-9b29-9fcaab2e1dfb", "value": 121204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703756, "uuid": "9155f226-6ca4-4d0a-bd0b-34f1f381d23e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703756, "uuid": "4288c8c8-2e80-488c-9fcc-c240cded1084", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcae5b7-c6e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763733088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733088, "uuid": "75c6c08f-ff35-4b4b-8187-7edb74ceefd1", "comment": "Malware payload (Mirai)", "value": "8415fe7ab11d95f2aab7899bf0ef549f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733088, "uuid": "f7b5c82d-6167-469d-abb5-2e564c627bb2", "comment": "Malware payload (Mirai)", "value": "17b2afd64ba59efb0519b4e5e58751373ce7d694fd6659067aa6b2fbf793c0f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733088, "uuid": "92f0bfbb-b6de-4402-9340-6717f49e320d", "comment": "Malware payload (Mirai)", "value": "159e0cf23845bcfaa1fad3179170459bff22f68b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733088, "uuid": "fa9cff68-9116-44f3-bb97-d1bd91781bb2", "comment": "Malware payload (Mirai)", "value": "032c37bf875612080e6ae2b2fc32fc35e1dc0e7faa2fd590843c6eda1321fbc4a9e60df5c682056b924913a25efa1229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733088, "uuid": "1dff1d54-8963-47da-82c5-28d07ad06d44", "value": "T1D6144B46EA414E13C4D7137AB6AF4249333297A4D3DB73068D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733088, "uuid": "682892ff-3f4f-431b-b49d-60df855172a4", "value": "6144:bJT3wkaBVfunZslJaxTZb1chksNCW90xv3b5M/9PGg:bJrwkaBVuClJaxTZb1chkmf6ju/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733088, "uuid": "bd3178c3-aa69-4f51-92a5-caf50e36b814", "value": 201655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733088, "uuid": "185d65cd-9456-4de5-8222-0ff545c42859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733088, "uuid": "627f7ab3-7505-462b-9138-4ff48352eaca", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd4b590-c708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750080, "uuid": "4efe48b1-dd25-4486-a497-fd1ac6e0cafc", "comment": "Malware payload", "value": "98cf6ee6a9db1d7bd6e77da5a72e6e30", "object_relation": "md5", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750080, "uuid": "773ee7db-43ee-4c59-8ece-354a1a939824", "comment": "Malware payload", "value": "1883e59980185d3b3e43d2af76b0a8c4e51c0cbd19b06253f2e16558d23c9a9c", "object_relation": "sha256", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750080, "uuid": "cc88e5c3-fe4a-410b-be0e-7f416d76b968", "comment": "Malware payload", "value": "f569ffeba11678edd35505537e193158d5daf746", "object_relation": "sha1", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750080, "uuid": "f94d8142-95ee-4e89-9ce6-e074e4bcbec2", "comment": "Malware payload", "value": "22a44a359175b29ba03eb45c0d3f9acfefef09fdf4782345d82535e2225c9979840b0125a14dd0226dab8e52ae1fc202", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-213-239", "colour": "#B1A702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750080, "uuid": "adadb254-40c3-4e21-94d6-edbe1264fcc4", "value": "T19335236A63F02972D4FA5BB094F242476673BCA11A3889BF11D1C67E2E337D01836B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750080, "uuid": "3061231d-347d-448e-bd2b-f03ae238f839", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750080, "uuid": "fe8963a9-2ed3-4fe7-b59e-a9a774810c57", "value": "24576:BjlyzS+MD/SjdI6ffNWS3oVLGfB6XR3B7zvmbwK1DeY1zUbv:BjAzSl/mdnfcSYVmk9VcpeYUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750080, "uuid": "9da288b1-ac4d-493b-b508-f627abecb13e", "value": 1137832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750080, "uuid": "0933ae72-0f01-4b73-83ba-4446182b43bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750080, "uuid": "f62dbce9-81e1-407a-8c76-9da9b8c4ded4", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389362da-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739978, "uuid": "2380dbaa-58bf-4b1f-8431-a02c4c3c03e7", "comment": "Malware payload (Mirai)", "value": "2a3ffdd2366853bd73be328c09ae30e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739978, "uuid": "7a6e2fab-df3a-4871-955c-9d465b962f6a", "comment": "Malware payload (Mirai)", "value": "188ff4ffd6a3e30c8c6ae5a9aad54900093a97be0d190cfaf72a53b1517a124c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739978, "uuid": "b045c099-f85d-4df3-ac61-f50f0da0f03b", "comment": "Malware payload (Mirai)", "value": "87a320d7fc03821a68547cfb420aa3695b6f8515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739978, "uuid": "d0e36881-b404-4ae6-9708-4ca6cdfe1c8b", "comment": "Malware payload (Mirai)", "value": "2bfef0d686073bfbb3d3e634adf79e85c1fd66a9e3994f3e774728c73e9b53fb23eae0ee72f49100f6395e9a0537a2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739978, "uuid": "f1a0b0bd-c03e-4a87-a320-da160eb1ef9e", "value": "T10D430A59F4408A53C6E521B9FA9D554C37635BF8D2DA32028E205F307BEB89B0E3BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739978, "uuid": "c73bb49f-825f-4355-958b-2b3522173cb8", "value": "1536:T4xVe5koAKC7mR93AXbW3AZ7mn6I9LIgHntOEYwrNsDp3Eu:0xVerAXmbimzlgEfy0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739978, "uuid": "e3dd5bc0-b539-46b0-9d59-eed1aa59f7aa", "value": 58560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739978, "uuid": "cea4beef-9fd4-478a-8296-603a877f895d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739978, "uuid": "3f3a5378-b233-4cb3-bb7d-50a63821e94a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22579f63-c709-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763750249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750249, "uuid": "6132ed45-3d5c-44c2-a4bc-d5fcff3f432b", "comment": "Malware payload (Mirai)", "value": "a5c79d295d076f3e0897495d5a91eedc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750249, "uuid": "07e6bdff-b30c-46d6-a56a-478d3b5ea1cb", "comment": "Malware payload (Mirai)", "value": "18e6dee9524d54927bdd2690a0739409d773e743b741667abf80243dd4f0b618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750249, "uuid": "33a44979-2b6b-46d5-90f0-17d0170463a9", "comment": "Malware payload (Mirai)", "value": "352145eae05a394591018ac6b94e8b98bda700f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750249, "uuid": "da953635-42b6-4e38-989d-8a67a7a31bc1", "comment": "Malware payload (Mirai)", "value": "7a93a9a75bcb8e5f2b0bf81c08a376f875771426e8bcb943ef5793fff0a2d5517e337937f326638c46cf0274f3ad197a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750249, "uuid": "dbedbdfa-e3bc-4331-84d4-71882bb9431b", "value": "T16BB36DC9F643D0F5EC5705302176FB37AE72E9BA2328DA83D3E89A327C11641D456A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750249, "uuid": "0ce0c4e1-c143-4e3a-bf60-57785f8e93e7", "value": "3072:CkUEooY+GDO8hUdxxnjuU22mRs4ZCaBT:CkUEooTGqJtR34ZCaBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750249, "uuid": "aad49029-4869-473c-8abd-46848980a11b", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750249, "uuid": "abe17d24-3f77-4276-8464-48d69dfe29f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750249, "uuid": "51294eac-3f76-4b88-8c2f-eb53a350468a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4449bb0c-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711222, "uuid": "c981ee62-f6bc-4e36-b959-df08a77890ca", "comment": "Malware payload (Mirai)", "value": "cf2b1507881df9df06fe40fe603d20dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711222, "uuid": "31769641-372f-4f68-bf05-782f22ed5719", "comment": "Malware payload (Mirai)", "value": "1a7cc94fc56632039953e36a6c1deb26451416d9315e00ec0a930417fd443c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711222, "uuid": "894b1d81-199b-4fe7-8e80-e39932f55d7c", "comment": "Malware payload (Mirai)", "value": "1b8c0c9adc096b12ee965c8e3cc2c2fa2680804e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711222, "uuid": "1a07d2b7-9912-4d83-9f57-d10f48167ffb", "comment": "Malware payload (Mirai)", "value": "2c1de251d3e8edfa8c2c5482c455f4eed71bcaf9d873b116bb887e04fb592b1f3d5bda5126e6d9e3042697ef26234af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711222, "uuid": "7cb42c0c-1ec3-4ff1-8b10-5f32f2552717", "value": "T12CA3F70ABF644FFBD86FCD3745B9070635CC994222A43BB53974D62CB64B54B0AD38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711222, "uuid": "8f50c1f9-b8b8-42e4-b4df-6ede8c47df29", "value": "3072:tYpnWI7d7ZrF8vfQQbpmiK1qIbFUQ2Gy/EalJAD:te7d7ZpZQbpmiOqIbFUQnL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711222, "uuid": "1d8d4eb9-e650-4d97-bcbe-c37ab9fdcb73", "value": 105752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711222, "uuid": "7d7fc3cd-3e93-4b41-9da0-6f76ffca5bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711222, "uuid": "94e6dbd9-45ea-48ae-805a-ffdae6d55415", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd96831-c6d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763730000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730000, "uuid": "61fbaa9a-8485-4158-9824-f5023fd943fd", "comment": "Malware payload (Mirai)", "value": "edc1d57efb344cda175e437c1ec93446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730000, "uuid": "149cd7b0-cdc7-4879-b02a-d576fccb8d1c", "comment": "Malware payload (Mirai)", "value": "1a828cc404eec31ab3e08e620ed7512b6d307dc3f76c39fa7b9601ec1a80d910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730000, "uuid": "339565f0-e30d-44a9-add5-2b2ab089fb8d", "comment": "Malware payload (Mirai)", "value": "b5ea7b66b114efe95bac5bc33cd2992ff0069566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730000, "uuid": "de634a5c-e986-4b03-8c0f-a62c13992612", "comment": "Malware payload (Mirai)", "value": "ff2a559f5e086a5aa8d2c77e0c43c98314571529c0ec2677de83a171468c51394983d61e33a890c3b084aeebc8796a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730000, "uuid": "ef0b5613-bfc6-4f47-9d71-ea260a25667c", "value": "T144532A2272180D47D5A35AB4293F36E093EEAB9031F4F68C350E5B569275E3E1186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730000, "uuid": "e8be5ec5-c67a-4f9c-89d6-c1648e8f21c7", "value": "1536:q1437+SmqFmIb3mNN4k3x42G8IXdEAQsc:q/xNN2bd8ISAnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730000, "uuid": "8fc75387-ea4e-434d-96c4-739bce89f917", "value": 61336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730000, "uuid": "a810fb63-5660-43d3-b8d8-9bd77ce97ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730000, "uuid": "e174c7a7-ad64-47cd-a6e9-506e3936f877", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46779bae-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763766201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766201, "uuid": "2b976349-00af-410e-8feb-91bcd830fc67", "comment": "Malware payload", "value": "e6e185fc70105bade98c2b7bad840b7a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766201, "uuid": "a4e72d43-8366-477c-a725-1905998603fc", "comment": "Malware payload", "value": "1aba3a627489e076551fecc0d150c9a43c142b1628204e8bdcbd9f2b5f7ce4e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766201, "uuid": "e609360f-c359-495c-876e-e832369e0695", "comment": "Malware payload", "value": "457da2576f6df3cd34a29686e6692c1f87493517", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766201, "uuid": "653fb75f-9be7-4371-94bd-a0b9baa4675f", "comment": "Malware payload", "value": "6f776ab5ad3df83596ddd3501c45a58093eddaf81afbbdf6897a06ae60858b04c5813493f67c8409879860b26b5e6a4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766201, "uuid": "fbf53986-3115-4d8f-8fda-46db536050bc", "value": "T11A01EDCD34A02273D594DE807863FC5AA248D6D829C03F5DACED18B2D6F49147B15F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766201, "uuid": "4d992652-946d-482b-b68a-19ea9bb3e02d", "value": "12:GErXCkaNIl5emc0LKJPaCNSarX6MA417rXOf2OyzQBo:PS7NI7BfKR/MIsODv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766201, "uuid": "82dac176-1874-4621-a4e5-94b428f3cb66", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766201, "uuid": "663df7e5-c660-42d0-92e1-890e13f575be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766201, "uuid": "94a930e9-67d9-4889-a6fe-c71fa660ba40", "value": "jihe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa3c38-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763742155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742155, "uuid": "fbdad6e8-559e-48b1-8450-289ff741c72d", "comment": "Malware payload", "value": "8b3747b66ef9d3eeff72d4444ff9cb03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742155, "uuid": "42607218-dad7-4bb6-b2de-2789bbaa91b8", "comment": "Malware payload", "value": "1ae1ac98d620041c0b2a07029214b108ab915a7a2261ea89f9e6c9ca5fcc2160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742155, "uuid": "8931e479-c4af-4f1c-9089-f1549ea03892", "comment": "Malware payload", "value": "db641498bb7a17d6d17befa7bb15918b761d593d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742155, "uuid": "33a3ef0a-684a-4ecd-8864-1a1322904121", "comment": "Malware payload", "value": "c222c2566b99633fb39a5c97d5047ca765eb1ea96a94487b9953d5a6b8601ce2b1de4fe9ecd8a6eece790baa143cd8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742155, "uuid": "bdaa94ba-1b48-41f4-b9a8-26d677989d3e", "value": "T17E94F1623BD488FAD1432271DF98B7EAE1F5EB080810493763145E6D6FBE942931E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742155, "uuid": "b9194bb7-b4a2-4929-bc12-0798922538d9", "value": "4a85d3165f278469dc3d32b3d6dfcd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742155, "uuid": "4c54568c-202c-4981-acfd-28405a392fbd", "value": "12288:TsdXFfP7nn+brDT/nMmqRxFOIVdv/ZxJnwK6K9gzUR1LK6r:TOXFn7n+brvnvqRb/H3JwUnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742155, "uuid": "0b56551a-299e-4d2f-a923-fe41bcef0790", "value": 434264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742155, "uuid": "911f9229-f1e1-4ab4-8e8c-a264fdb62886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742155, "uuid": "8489f985-9394-4d83-8728-c138a7fbbf92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b4862d-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703755, "uuid": "9a235699-9835-40ed-b320-e9dbbd317686", "comment": "Malware payload (Mirai)", "value": "24cc4882fa730eb024ec0947233e754b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703755, "uuid": "d13d7d48-b0cc-451d-8f65-1bf25a2c1a28", "comment": "Malware payload (Mirai)", "value": "1b93c80200b8c3ca4fb6bb3a27b874ec78f5316653d3f637bcadf636a8124520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703755, "uuid": "f2a5a5a1-7a0c-459c-988f-f9ead581cbfd", "comment": "Malware payload (Mirai)", "value": "c9b9a2e5605c5d4de83b2f6158864cba4c5e05ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703755, "uuid": "779f3486-5899-426c-9d21-c3c6440416c7", "comment": "Malware payload (Mirai)", "value": "fed71eec0e5c0021a30fcc36054f4be94009a6f49a8c9e52ae18673198bb3ced0fee4d5cc596256df261f1d4bea4e0f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703755, "uuid": "8a04b3b9-8039-42ff-a223-6c82aa157f42", "value": "T1A99312C2E618947BF1009A77C2EB6A13F082BEF83577DDC88E5915815BF91CC926CE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703755, "uuid": "47093940-b045-491b-9b70-2328db2996d9", "value": "1536:WvZKJAaPzh6ZK85AG4jhshp7heYCH8+WE+3y5bS2suRxd1PeOo4HWusD2+50t10t:WvZKXPzKx5AGqiiZw/4xd1YSxt2DcWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703755, "uuid": "442fb387-5111-4e9e-b887-4745ae06425f", "value": 91236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703755, "uuid": "dde983f5-da11-4513-aa42-f8451d1a226b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703755, "uuid": "ed4660f5-ee34-4b13-9e9b-b79e4e4ac938", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315b9739-c6de-11f0-a129-42010a9c0007", "comment": "Malware payload (Gamaredon)", "timestamp": 1763731806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731806, "uuid": "655ce789-dcab-46d1-b2f0-ac3dcf4615ad", "comment": "Malware payload (Gamaredon)", "value": "d8837293971ecef13a1d5874720ac866", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731806, "uuid": "4c1bc798-36a3-4ab3-97fa-6abf99a22e4c", "comment": "Malware payload (Gamaredon)", "value": "1d4bdddc69d967eb03c50701b96e6d5bab016c7fb321801a5a6ba716410cd20e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731806, "uuid": "7a7b6d8c-8a7e-44c2-bc2d-01e60629df49", "comment": "Malware payload (Gamaredon)", "value": "f599c718b830e27faad281ea8442fbf6b3ebab4d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731806, "uuid": "6ee28329-1f2a-40da-a8f0-75459fd51f48", "comment": "Malware payload (Gamaredon)", "value": "5cb468d1c27dbf8b2e945b16f3015ea88f9b50ccbe55f1a4368ae8cf3ce52a6b5e48903571aacb9a9a48ab8fafb19eda", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731806, "uuid": "c8946496-11af-40cb-a343-f51f977f95a6", "value": "T1A5817D5AA880F5A9E347F03BC56E5E0F0EC6AB7191CAFBB10440291ECE6635302F51B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731806, "uuid": "837ae7a9-a35c-4571-8016-083957ea48b2", "value": "96:ZSjw5uP8fgZctWqmc3LN3YF35zK9x0MGJn793qQgHP2zu:Ro0LePzK9xcKvsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763731806, "uuid": "2703b225-6706-43ef-ab64-433fb90af828", "value": 4084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763731806, "uuid": "45f07ca5-4e30-49cc-9101-2b2945eb9918", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731806, "uuid": "bd540138-730f-4db1-8e9e-a7de650ddde7", "value": "8_3_7_1304_21.11.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb861d8-c6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725683, "uuid": "6c0e51ed-e6c4-413c-9467-b673093423bc", "comment": "Malware payload (Mirai)", "value": "99476d59075a930de05a1cca62b2c083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725683, "uuid": "59cab3c7-e388-45fc-ace2-6438e58187bf", "comment": "Malware payload (Mirai)", "value": "1d83222d7396ebd750c0b669b4e0fa0c54f2c749a3d7e6140fe4a6e25eef49ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725683, "uuid": "1d5d7e5a-c88f-447e-a8af-9d96c60d6fb4", "comment": "Malware payload (Mirai)", "value": "381b08c378643bd6c53b6e5692d79aa64d025d57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725683, "uuid": "2a640693-c823-454d-9d40-ab9160cb2c8e", "comment": "Malware payload (Mirai)", "value": "276a624ccb44d0ba7b9eae2b9bdd34b44c84d957cccdc8f52a4b618a8bf8f53a23f531be48d9bb021c5bc2d176595852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725683, "uuid": "ccd545a7-9b6e-4e27-83b5-735084b6efc8", "value": "T1FE23F10EDE821DD2F7B11073A4A8C787FE5A4DFD90DE721F42C08698FD8451AB964583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725683, "uuid": "98215047-bb32-43ea-8dda-46f97362563b", "value": "1536:O5FNoaXA+aM9weOtPWqNSkp+w24qjM52uhAkLy1:OSpgP8ui2B30Ly1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725683, "uuid": "b80786ac-bbfb-426b-a28f-03a5e3c1f2bc", "value": 50080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725683, "uuid": "15c50672-b8db-41c4-bade-9754077bc3b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725683, "uuid": "fb8e64ab-1e9e-481b-891c-d89fa297eadf", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720290e6-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764126, "uuid": "43e6d4f9-81b7-43b6-b9d7-362e02e929e6", "comment": "Malware payload (Mirai)", "value": "f956daaba308bd147bddc3a0065a84fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764126, "uuid": "f2fc3907-0fa9-46ec-81dd-7b130f8920f3", "comment": "Malware payload (Mirai)", "value": "1ec0f2561ddb1be3af92a07951e2f75bd929ab8a4709996e16702ff43d955653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764126, "uuid": "447ba1d4-88fd-48cc-b220-ab666e0029f9", "comment": "Malware payload (Mirai)", "value": "e5c238959a0f105acbf9d9b75962f4a0b04e9ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764126, "uuid": "b92832a9-a67e-40bf-944f-6db836436206", "comment": "Malware payload (Mirai)", "value": "501b2b2947606068630c09464a7b709d30626ebc67014859c784e465bdaf47cd135748425c47302f218f94cd4f3ac717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764126, "uuid": "abda5350-a935-4b69-9ff4-986d86da5ae1", "value": "T19F23F2E4A21798B9DA6285FDD7E21B910F7C5BA000D44E4CA811EB07CC00FBE7D277A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764126, "uuid": "b010ee44-b318-4cb6-a779-e1065392a2b0", "value": "768:seFEEzPeIJh4f4dSYMi14cJr1Lt8mfjBonOrZ5OraJc4n95U7j1pTCG67De8lSrj:rEEzGI//gZ6EmtH5Jy4g7HOeaSNx9VJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764126, "uuid": "68ecd9d2-2074-4dc8-8f3c-ab91ba69076c", "value": 48504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764126, "uuid": "1a2097f7-2da9-43fe-94f4-a6aa93e1a97f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764126, "uuid": "d40f86b9-f946-4e62-a88a-caa395283394", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc122097-c709-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750614, "uuid": "b3f9ae39-66ea-43e0-a6f5-587a8965cd9b", "comment": "Malware payload", "value": "049482d3f157091156aa87499ad17646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750614, "uuid": "58ec0099-e80f-4d1c-ab44-eced45f3a581", "comment": "Malware payload", "value": "1f9e65625630d142685f2ba408e6ce2619ad8fe18aadce61414be94560eeed22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750614, "uuid": "5afe8b98-8427-4bb0-8cb2-884817f146d6", "comment": "Malware payload", "value": "dd8dc2cdc831a2e744da8010093b1d230cb35f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750614, "uuid": "dcfff9df-704d-435c-b953-73564f7bf330", "comment": "Malware payload", "value": "488a970edca3999dd63cc9c8ca858c37568828a1a6f521dc3623003853b5a9b7ae4c094e13a8223fdcb72e319e5973db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750614, "uuid": "0b328409-237d-4227-ba8f-1f05a8a95c1e", "value": "T17895CF33F28AA73EE06A1A3759F292505D3B7A21641E8C4296EC3C4CCF791601E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750614, "uuid": "81d8ea8c-5bf7-4b19-877d-f7301003eb74", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750614, "uuid": "771b7286-20b1-4a73-8762-5a5f69f2a366", "value": "49152:/N61T1m3UlqWUWr0VZ9vFnIL4kOSxhpV8:/N66aqsr0VZjngxhp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750614, "uuid": "26534417-4d61-4a19-85bf-28d8bf23e6be", "value": 2048903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750614, "uuid": "8f3bed4d-2cdd-4983-b7c3-d12804da17da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750614, "uuid": "2c8e5535-0748-4f90-b757-eba0a41a26d0", "value": "IDM Crack 6 42 Build 3 With Serial Key Free Download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f92b31-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765695, "uuid": "165754f3-8963-4240-98c2-53c4c24d5806", "comment": "Malware payload (Mirai)", "value": "6517dcf8b8a3f18a8849963d04bdd4c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765695, "uuid": "2c9762f5-ba56-4a59-bcaf-a0ae4f0b2b0e", "comment": "Malware payload (Mirai)", "value": "2007593f4c36d82979e942311882b3f408c27df019d6beef809c32c99b935841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765695, "uuid": "a8195d34-1927-40a4-b72b-7812371839d5", "comment": "Malware payload (Mirai)", "value": "0a4c2c60eda9d58e376d4ba1ed3ca008ae668e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765695, "uuid": "231ec48d-63d6-43ba-9116-6aaba15b7c94", "comment": "Malware payload (Mirai)", "value": "cd56c89b392175edbec9a7fc6ae72d41cb579931697c85c8996630eb86dbc9aa0629e0da2d4497f0579be0342d1f6b2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765695, "uuid": "98cef1d1-8a9f-49e1-aa62-16a034eca3bd", "value": "T1DD932A56F9819B11D9C116BAFA1E524E332307B8D3EF72125E206F31638A96B0E7E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765695, "uuid": "cd1343f1-8e35-40ad-a48a-2f90eea503a4", "value": "1536:jNneeM+ivz7bERTww6k/Va3Rh5tpU3FagzGjhcdDi/1ZDkozA57Z1aYry+emn:4bnfEBwdEahhbpGFags1VkozA5V1aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765695, "uuid": "7aedaadb-3e5f-4b7b-a422-4783f569bc45", "value": 95440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765695, "uuid": "ee9ba9e8-5d15-46b3-877e-beb440ed812b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765695, "uuid": "ab4634a4-671b-4494-af58-54f5f7fbb498", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fdb997-c731-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763767574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767574, "uuid": "2ea881b6-de08-40f6-bb46-68a3ef561281", "comment": "Malware payload (Mirai)", "value": "21346b2190e892740576848fc36d6cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767574, "uuid": "d187f88f-ab26-4ddc-83df-be54c87ca7d3", "comment": "Malware payload (Mirai)", "value": "20c1de3bcbfedcd01ce7ddb214cea995246d5c96cc9af9efef9fdfdec0a482c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767574, "uuid": "96ff3594-d972-4617-8032-82cf68153a2d", "comment": "Malware payload (Mirai)", "value": "ccfa580c3c4da17459123f71d325df7295b51611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767574, "uuid": "cde6a644-71d6-4245-913d-c80ac58bae6e", "comment": "Malware payload (Mirai)", "value": "f63dfba9a8cc8a39d63c01267331bbb81c2b4e4f4a261cd18f5a8e5dd6738f2ba663b7d6b26fa3cfe9b11fd503828a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767574, "uuid": "71c1df86-bccd-4b45-b650-78f9e2d050b8", "value": "T1D823F236A2A99B42ED3380F6407D3D8E78F9D1EF755E4CE2D280502394827B37BA5196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767574, "uuid": "1b1f0c71-feb4-4be0-9be5-93f30db4c320", "value": "768:LIinmP2YwITjZDXL0LlHwWNE7IjNEbuZOawF/0mnlzJYfsPUJUv5FG4tIf3ttnbV:LcjLpLgPUFuZm0mJhhwfdtnouy8GyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763767574, "uuid": "ab54b043-d65b-4490-99a3-7506f69f3677", "value": 47312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763767574, "uuid": "5e423fee-af75-4050-a4bc-a1452c42b7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767574, "uuid": "d9845e45-6618-4c91-a6cc-42062e71f2a3", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4649a2ab-c683-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763692757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763692757, "uuid": "0bc97c8b-b718-4018-9ad4-2edf918af50c", "comment": "Malware payload", "value": "f4a7a8cc8cd3012e410d0eaebf432745", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763692757, "uuid": "7b2fa0b5-42a0-4b0c-91bb-e1e63c108f65", "comment": "Malware payload", "value": "216c2385e8cdf5b1c639c7cf4c1c048c8a903dcfb8619a37395825abcf7761d8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763692757, "uuid": "75dac454-a2f2-44fe-bc29-c3c2b431d228", "comment": "Malware payload", "value": "f969fd028dda30c447121bfb8e40a07ad313332d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763692757, "uuid": "9839fcbc-67b9-46b0-97d7-44eb0feae0ce", "comment": "Malware payload", "value": "c2e56c58e78b02d23b7fe2cf86c427509823a3b788874be6baa4ea49c149f0a1fac243f3deb9fce5ff9b00095e7e1235", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763692757, "uuid": "bd1df7df-b146-4562-8ca0-7e932311a173", "value": "T16E060213B28E673EE07A893949729910593FBE60651A8CA3D6F42D4CDF390611E7FE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763692757, "uuid": "ccabfe52-133c-4a57-bcc3-c4d067ca7b77", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763692757, "uuid": "f2857832-5fbc-498e-8ea7-a8f1e44235f4", "value": "98304:ZDb5pqc4mbkV5nPrJl3d0Pvl24xyImpXk2+0:ZDbOZLaXl24xyIKVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763692757, "uuid": "fcce019e-c399-4dc9-82a0-2906b0048161", "value": 3825989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763692757, "uuid": "71b034c8-d715-436a-8933-f62406129097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763692757, "uuid": "0bde1e3e-efef-43b2-8240-74b3be16791b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41d9403-c699-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763702363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702363, "uuid": "beef493f-3432-4ebf-a925-42e121685a40", "comment": "Malware payload (Mirai)", "value": "de5ed968248e6fad3ab179f6390a6cb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702363, "uuid": "9d1d75f2-baa6-4f2c-83ec-8eb35ab554e3", "comment": "Malware payload (Mirai)", "value": "21c59b88c1ddf3976121596b784d0f12b042379403217a5d6a1502c2b23cbd45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702363, "uuid": "af3f071f-09fb-4029-9a65-dce5c6d58447", "comment": "Malware payload (Mirai)", "value": "639b1af5ea9f53d38b877360f500dcce1ac274a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702363, "uuid": "26e8d8dd-cf5c-447f-8e86-10d182fcb7e7", "comment": "Malware payload (Mirai)", "value": "18e279e3a111438a1f41b0af853583a202edf18feab52a30fd018c524fc13e2e85f4432913b34925c83b8869138aba65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702363, "uuid": "958db19c-fc08-440f-98f1-977dd82180f2", "value": "T1BA430250606634B3C01B29B4E9E6C9C1986C8668E1FB3598229D4BF17DE7BDD353C28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702363, "uuid": "88f3bf01-7b4e-44c6-92a8-514e252d930b", "value": "768:gmLFJAxYT3sFFEQpmEQwDIbFjvlm6TdhgC4RZVQuM2FT69UoRSJZfmx3UW4x:gmYxcs3mEQw05nUJQuMz34x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763702363, "uuid": "2572a92e-512b-4eb1-bfc7-1c633e63b56c", "value": 58856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763702363, "uuid": "efe3711f-09c2-4ac4-96e4-4033664fbc57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702363, "uuid": "690ab2df-8ea1-484d-a396-e8fbcff5b94f", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c0927f-c6ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763724970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724970, "uuid": "5216e106-2dab-4b6e-b242-f9d76423513a", "comment": "Malware payload", "value": "e8220b145ea460bf1c8f79f5c85e2d63", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724970, "uuid": "e0a630e1-699a-4c4d-8d97-c5ec190f061b", "comment": "Malware payload", "value": "2214f1b9cf4da149c345cbfec5cd86c12e27eae348a7f8f4820eeee5190b3d72", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724970, "uuid": "8cfc645d-80a6-4a96-8785-d61566582c70", "comment": "Malware payload", "value": "fdf813dd109e24fff323b606b882381fbe54e827", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724970, "uuid": "7f8ff631-b42c-4ba7-90b6-347706aba1d3", "comment": "Malware payload", "value": "3b465568803d676a2171fb26d5ca001cfd6df9410ec052d5e8546063eb370a7af175ad9a7c2c1988f576fe2a43c8b80b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724970, "uuid": "8a53945b-abd6-43d9-bd03-4207b71cfb85", "value": "T13DF02E35C250B6C0076F3154D5212D1611D953B296A74F5FE7100C75BD3931DEF1B5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724970, "uuid": "4751c3b5-4ef3-4cc7-8974-9538726220ed", "value": "12:sn7pQVROVAixOLlkNGT1RvkOqIS7lH1k8wHkCC2C70mk71:i7pQm97GTnp8wHkC00n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724970, "uuid": "6242a0da-2ada-427f-b103-4b16b41e8181", "value": 458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724970, "uuid": "636f9eda-9b82-4f1d-a9f2-d08d6f504f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724970, "uuid": "8d52694b-a193-4741-968a-2759ad8747da", "value": "44.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc318d75-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766076, "uuid": "b8d5869a-dd71-47b2-a713-1ead7f175585", "comment": "Malware payload (Mirai)", "value": "c56c60b370cd9e2532b4bb10d207dc6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766076, "uuid": "48a3e5b1-086a-4a79-9798-894562204e14", "comment": "Malware payload (Mirai)", "value": "226e1f417c44288c2cfdd74065be38ba1fa704b133aafebedaa81a43714b9b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766076, "uuid": "e43de272-1744-4738-af61-107ba1572844", "comment": "Malware payload (Mirai)", "value": "f0b3d5ee5873732bc75659cee453342157ec096e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766076, "uuid": "07fae65d-7bf2-4dac-982a-bb05c941ee35", "comment": "Malware payload (Mirai)", "value": "d8c54e1d289d6ac6d0ff5d4ab0b93e518e71f8a574b8621e167a32649c8545ec943c68173e89884a7818bddc4e6f6dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766076, "uuid": "787a78fd-5f24-4b8d-92dc-f015f3994586", "value": "T13BD32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766076, "uuid": "c312b17f-e7de-43f7-bccf-9d10620502ba", "value": "1536:troGHNTUZNHlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg87x3p:3mWUiCxttqCwZ7lLhrIF3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766076, "uuid": "87e40b21-c619-483f-97cf-afe579699255", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766076, "uuid": "f8b9f960-f9cc-43ce-bc24-3b5b68fae853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766076, "uuid": "53f56276-02cc-4cf6-9c30-fc52a4b99fd4", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee5efd3-c6d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729761, "uuid": "44043d2e-43f0-4a39-a36e-99640e314d82", "comment": "Malware payload (Mirai)", "value": "53667eb92cbaaa072e0dad6cb70b0ffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729761, "uuid": "d927e7b4-e898-4898-820a-dfe4b4c1457c", "comment": "Malware payload (Mirai)", "value": "22fa976029697cc2f62d4cab3c33a9288204a30389d888a131643ba003aa0b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729761, "uuid": "2cb26ded-d6d9-4191-97f7-32f46d748c6d", "comment": "Malware payload (Mirai)", "value": "0592c6578111fbb7d71d9d60663f617dc880bb6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729761, "uuid": "1c7ec81e-fc08-4581-b4d8-659a9831d614", "comment": "Malware payload (Mirai)", "value": "4ad4878c2dcb872a0c6e7b87bc27cbbdc181b89199a0c4baad4a3986477408468aaf08cd1ca34427b0b115810a108eeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729761, "uuid": "38a428ec-ab4d-44de-b81a-85408529b429", "value": "T185D2E1D063166E34C2445D7B56684AC3AF8640B2D2A77951047212FCB64FE1BFEF88CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729761, "uuid": "d4fa67ec-8096-410b-97f9-c0f3f80a203c", "value": "768:W/ZRmFDskJo04UG502RwB++lb4itPzKs3UozL/:W/7ed4U24s+lbvPLzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729761, "uuid": "fffd6992-3104-4094-8f52-a701edbed97a", "value": 30952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729761, "uuid": "214cb1b9-f331-4c82-9d79-9f986dd77820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729761, "uuid": "ca980066-2a8a-4007-a8cd-73ca0b948afb", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cc1263-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732969, "uuid": "704dd647-af2a-4839-b955-a40c8f1747eb", "comment": "Malware payload (Mirai)", "value": "0f8b2899816597d7f2886a14ceb59830", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732969, "uuid": "28af232c-4d97-4920-89ba-227a03e35402", "comment": "Malware payload (Mirai)", "value": "23b0dd77e86c101b6760cfcf2f1fac35ee66c9fab858e6fa731921d28f2f008d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732969, "uuid": "adbb27e9-fcea-4bcb-a5f8-42e464d1b69e", "comment": "Malware payload (Mirai)", "value": "0a848dc99fa49a6ec9ae8e521710919024e049dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732969, "uuid": "a243bff0-19d5-442e-b37a-ab862d00277d", "comment": "Malware payload (Mirai)", "value": "c6f1c9d79b9082547f619928eb2e6d7fca466875dd0c46fee4956392b67222fa79c10b5412e5284f87e9cafa736f7976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732969, "uuid": "1631d8ac-558b-4414-8afb-358b88cb8c31", "value": "T102241919F4508B3AC7D1227AF755028D73734F68EBEA730589396B383BD6A259D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732969, "uuid": "de1fdcda-be8e-439c-b816-5904fd57b455", "value": "6144:gaTSdwC7L0Yt/3a7VqdUzxhUHwP4JP7eu:BGwwAy2qeoQPg7eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732969, "uuid": "2a84a130-a727-41d4-86d4-eac8014a18e3", "value": 225864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732969, "uuid": "19a1401f-7766-4167-bcb2-a025c3278075", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732969, "uuid": "15dd0068-0b15-4aff-a9ad-ae1fcec41d14", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd94e938-c691-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763699077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699077, "uuid": "1e887fbe-8989-4340-bb88-66ce92999bcc", "comment": "Malware payload (Mirai)", "value": "8e96096eac072b357240350fa840e2a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699077, "uuid": "a7d188d1-3f2c-426a-b921-30c29be1ea1f", "comment": "Malware payload (Mirai)", "value": "23b9202203d31db3ace9a63025fec43613806dd4451534b72bfedd393e4b9f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699077, "uuid": "c0f96fb7-90b3-430b-a96e-021fa6757e06", "comment": "Malware payload (Mirai)", "value": "0c9ae418b12c3e49d12d21622ed58f72082ba3a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699077, "uuid": "e4ceec8f-8dd6-478c-ac95-ee03e3f0a2f1", "comment": "Malware payload (Mirai)", "value": "fe87ff051efec6fad4eb95db0e01aac2e65f66689e4a169c38393b8cacde0ce75908b31f7d53120b3cf20714d4aaca4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699077, "uuid": "853db44b-e004-4d0f-a941-888ecafcefc1", "value": "T18D045DE3FC01DDBEF81EE77684074C15B230B76154921B3663A3BA6B9C3A0595933E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699077, "uuid": "0bf0763d-a893-49b3-a783-ffd1d2631501", "value": "3072:fy2W/PrMSk2vk5wmPCXzfHypUxIvW1APN+sDWG7DQ0aV9jbi3LUlIjn:+/QSvc56/yp2Iu1AIG/Q0PLUQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763699077, "uuid": "73e032c4-338a-4330-8b93-45ea46949b63", "value": 190060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763699077, "uuid": "2d1a1be8-3a6a-4998-b308-8c9165479234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699077, "uuid": "bb543c56-1ee5-4cd4-8339-755eb083c72e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd56032-c6f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741970, "uuid": "c8e24d2c-ecb6-4baf-af0c-ec861b1337df", "comment": "Malware payload (Mirai)", "value": "92f363c4a2a92515c014f63d5f7f01e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741970, "uuid": "0e600582-fd5e-45f2-85ab-98c4e39a95e1", "comment": "Malware payload (Mirai)", "value": "23d5b8c9ca4e9b9dbf9654e70c6acc2046f9394e76d1bc91c85335bcc1fe72ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741970, "uuid": "89c2e996-5caf-4fc9-9df5-e3cefdda4f85", "comment": "Malware payload (Mirai)", "value": "5743403267c1381c8a1ebdb93c194f8700bc534f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741970, "uuid": "72cd90fa-5a93-4262-967b-66ada0c704f2", "comment": "Malware payload (Mirai)", "value": "b49730024613599f09bd0fcfd399121e58180dfd02f9e41097349066b643bbdf59bbe658ed96a8ca0f6b6e0e4faee7ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741970, "uuid": "c196b0d5-49d4-450c-ba1b-cc9e7ca0f639", "value": "T144B36B21B5391A2BC0E1A47A11F74716F2F657CE11A8861F7E710E9EFF215503A03EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741970, "uuid": "ad394fd0-573e-40a5-bdf6-0b28add7aee5", "value": "1536:mt8pl3PLIsmUnXwPd9IIpXTyeuen8uvTRn7pEnN+zQPtD+rYm5rogcJBht2DQJ:rpcMLFen2o65+rYOpPDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741970, "uuid": "33d0e320-669b-4349-af65-958e8d35a58c", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741970, "uuid": "e31f4de4-2835-4754-93a6-fff63c960b5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741970, "uuid": "5fe01c12-7d2f-4264-a114-a2a61cada75f", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8515345-c6f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763743682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743682, "uuid": "e415b1e1-9068-4131-aa2b-fd644e071dbb", "comment": "Malware payload", "value": "ef8e0ff6bbb4ba6f211af9dffefa66cc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743682, "uuid": "f7a5377c-7132-4208-8c93-f1229479b31b", "comment": "Malware payload", "value": "24961c51e716317b76d2b2281f0064df91c74c6074b3f3e3508034d8a045029f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743682, "uuid": "70ce3dea-7642-418d-af44-07afe63ff3be", "comment": "Malware payload", "value": "17d2565f65f56b6c2310e82ad2ee15c0a642ca40", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743682, "uuid": "fe960d41-d14b-4ec5-bed7-6e90046be742", "comment": "Malware payload", "value": "a4eb22bf9d20b45b08790b7a2f4b0cfe1ae3c5804eb2cee9c131545e9a2b19997b515af6c04056b2f59ae249e8cf91ef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743682, "uuid": "bc4a6db9-911c-4ef8-a5ae-f23d992baa59", "value": "T178E53345B39688FDE1762A71C6D2B3F244B8E9110F1A8787ED500141ED64ACBAE3B7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743682, "uuid": "d61b0a93-a7f2-4565-86ac-3b69e12f11e3", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743682, "uuid": "a5241509-5403-47aa-9402-028759b31c72", "value": "49152:vf5Nb1h/ln03Js8eQks/u0BGWJ1cVbl6y7hiQ3a77CgqsbqAiY:vf5NbHl0P5//rqhjPuCgqsb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743682, "uuid": "4a5f2edc-1d71-464a-bd43-871a6f210892", "value": 3149144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743682, "uuid": "9571b325-81bc-4bd6-82c6-d19bfebe17ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743682, "uuid": "6bcdf77d-c652-47bf-99cf-574bac00c5f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d57750-c6d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763728105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728105, "uuid": "b249c2e8-8508-43b1-b21e-95b397c011ae", "comment": "Malware payload (Mirai)", "value": "5b622aec6466c80ad4dbf6b35bd75e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728105, "uuid": "26834d7d-4ac9-4fca-86f2-5306ebfe0b63", "comment": "Malware payload (Mirai)", "value": "24e1158304afaafaf819a1f16231bee58220bef88453b57b9beaddee34951fb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728105, "uuid": "23a1a596-607c-4295-8c26-eb5606ee4382", "comment": "Malware payload (Mirai)", "value": "c065481457184dce0304bc30dd5f80f0fd291723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728105, "uuid": "ffd17932-ed6a-4122-a686-3edb7eaccaa2", "comment": "Malware payload (Mirai)", "value": "2ef34d4d4ed69673dfa25b19d5de1ffa24b492c4cf35805210ab25a2dfeeddedf44cd70dcf17bc96c737c2383e3777e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728105, "uuid": "2ac4114a-65a9-4582-8f8c-9ad22d6dc24f", "value": "T1CCB37DC9F643D0F5EC5701302276FB37AE72E9BE3228D993D3A89A327C11641D456A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728105, "uuid": "01db3ac7-b605-4bfe-8344-700f62518c0c", "value": "1536:cRJZkUKQXt0PADMY+D6DO8urAUQPJbkNT8u5PUYz2/82rh1bEzaF3S/b:ekUwooY+GDO8xUAqUe202tREhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763728105, "uuid": "60a61fd4-1cc5-4d35-97a1-0eec44a0eef1", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763728105, "uuid": "766c78b0-867a-48c9-b55b-d9258e775769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728105, "uuid": "371d4859-343d-4a92-9ef7-308af7a5eb66", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a76d174-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703447, "uuid": "b496e7d9-89c8-422a-8863-f44757ee0372", "comment": "Malware payload (Mirai)", "value": "eeb5ebc30830b2e307731c865cab6976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703447, "uuid": "b91acdb2-e867-452d-aa4b-86113af578f4", "comment": "Malware payload (Mirai)", "value": "251ffd87efa681b27f1de066a6016336673d77742a283dac539b2481666b8f62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703447, "uuid": "8302d0e2-da8d-442b-ac54-14f6ed8a36b3", "comment": "Malware payload (Mirai)", "value": "5308640e39d5d587c8f919eb42dd9e7401357cfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703447, "uuid": "af933061-65a0-4ff1-abb4-b0e7396c293e", "comment": "Malware payload (Mirai)", "value": "a7da7c6c5c21b728cd534b0050804eef0c3431042a5df14ad5de184af01c6e821aa684624150c2f87af5171e550c5bde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703447, "uuid": "53952759-14b2-47b8-9e5f-97dfe33fd194", "value": "T17553F203B614CC50CADC4632AC79210AEA937B7295657B9520A4876CFDCB4FF46AEC39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703447, "uuid": "8a647753-62db-4133-9688-c07a74d69b94", "value": "1536:VEXhCYk+wiw1so1eyB0r79OSWaAoknRikf:VYhO+/o1rq7JWHbRiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703447, "uuid": "e01e1d58-6f68-4a48-96cd-519bc2b9fa4b", "value": 63828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703447, "uuid": "d50c5455-9ae0-43dd-821a-859faf1239ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703447, "uuid": "ead727dc-20fa-4182-b024-f4df26814bfb", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aa7961-c6fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763744319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744319, "uuid": "5ca7ab3b-2d7e-45ee-b818-5270cb319f1f", "comment": "Malware payload", "value": "04019ffb23a7ef50e212455ce487cf29", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744319, "uuid": "d0e6b448-efc7-411c-97e3-b039b7da2e05", "comment": "Malware payload", "value": "261e3c363c5201c288fe91d555de62c15194d33c604379123ef90d786b2e3213", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744319, "uuid": "80f541e4-c762-44aa-8f60-e8feca5dc379", "comment": "Malware payload", "value": "ae51a85b58003d7a484bc0ab4bd4484ea64c8409", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744319, "uuid": "4c0af901-7664-4154-a25e-daf1bbf03ce7", "comment": "Malware payload", "value": "e221f0509c06f4c38ee72b02f64bc6397a2a93b9712356388c4454ef5c52bf5b317a509f35426da4105d08146eb5d05a", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744319, "uuid": "4e475b4b-014a-404e-8132-c9be15a9a15f", "value": "T142F5330077172572F042EAB42CCE9234FA2A7E780D77B8B126DF6D5C2FA35A85571A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744319, "uuid": "61ce8142-51ac-4569-8688-c5ee11449b51", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744319, "uuid": "ed320edf-f7a5-4269-96e6-3d607273b8df", "value": "49152:C9cVMEpo/75qB2G3GHxF0zbZdKG5Uw1xOV9AmBcA2AlYyg5nurs/s8OX5BNDNv:McVTpoBn+ZNUw1xIKA2nygFGsdSXNJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744319, "uuid": "c7e1299a-44cc-4d74-a499-293cebd96ba0", "value": 3457700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744319, "uuid": "2cd7a5a6-272a-4032-be6a-f5d9ead05063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744319, "uuid": "025c425a-50ae-481b-990b-60b4ce694a6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb1dfb0-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732742, "uuid": "8a7e599f-aff7-44a8-b540-e0c4a58fab75", "comment": "Malware payload (Mirai)", "value": "9aeb5e951b442f5c8961ea438b1df99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732742, "uuid": "4827ec9b-eafa-4d36-9e0d-44267f9502ce", "comment": "Malware payload (Mirai)", "value": "267087ae2fc93bb1e3b191c9bf936b9ccdfb74e0d65f0e83dd55d13630470411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732742, "uuid": "27a15494-e346-49e7-8f1b-2fc7a4cdb8e2", "comment": "Malware payload (Mirai)", "value": "b61f3719133e67cbd023eabef7b4d73f5d527264", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732742, "uuid": "38b159eb-523e-49cb-bd68-aa6745f9c87f", "comment": "Malware payload (Mirai)", "value": "5071c815445c66a408e8fce6a49d8c670d4b1242a3f33ccfabb7fccf6ac235462a249481e43e13973db553e81907e827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732742, "uuid": "bbdace44-7103-4cc5-9ace-8f57ed1d8ed5", "value": "T154E3E71E7E219F3DFBA9C23447B78E25965933C637E1C585D1ACEA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732742, "uuid": "926c2c5d-5dcf-4a0f-9d8c-f2a38ece1707", "value": "3072:NkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB11J3OdPU/f8:iF+6uk9hckUGXZy9q/uleW0AJsPQDJHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732742, "uuid": "e504fb01-7f62-4fdf-a289-c7926457c366", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732742, "uuid": "d7944078-3d8f-420c-a77d-40be4234f4a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732742, "uuid": "85ab84d6-da02-4854-b47c-20997f26f692", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408ef9d8-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715940, "uuid": "b4bcbde0-f93e-4574-92bb-9bb5e31b551e", "comment": "Malware payload", "value": "048c590dfb0eaf8be7b0d0c1e804ab9a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715940, "uuid": "53d29c63-7712-4399-b405-40f3e77496a3", "comment": "Malware payload", "value": "26ac17da79d4c41644c74ef962c714d1f642001c04a200ad631d7ae26db88490", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715940, "uuid": "4e7695d2-3145-4efa-b90c-63877b678487", "comment": "Malware payload", "value": "45ec8e9f0c74d94c43002f99c998de3b0501dadb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715940, "uuid": "bdac62ea-ff5d-4231-9577-b0c3c94fa763", "comment": "Malware payload", "value": "9c3a6a8deee267b2d5a4340d1a83042549e0c578cdb6e506b819ed795023561711dfe250cf3b45f9bdfa5779be64c551", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715940, "uuid": "4d398b2e-d898-4ac3-8627-a1f4d4aeafa0", "value": "T12F46F1C6F7D8A92FC8775072C9BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715940, "uuid": "6cb7e632-eaca-43dc-bf4c-f542f6c5481c", "value": "98304:9SkpCsSoTwrYZKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltx:9aQKOfyaIbaciAFvrEZpXqmY9XrF/mpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715940, "uuid": "7c467db6-dde4-4dff-80f2-6b03c8bc7cc1", "value": 5869691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715940, "uuid": "c15e5101-a0eb-4039-a9f5-439f691518ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715940, "uuid": "47f63212-e177-4771-bb59-18c49c0d0326", "value": "Zenplay77.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a80c15c-c6bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763716950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716950, "uuid": "90ec8b80-85ee-45fb-a6bf-85a001b7ec3e", "comment": "Malware payload", "value": "45d33c0b97353a0b0685c145230ae1e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716950, "uuid": "1632a44b-4cc7-4adf-a88b-cdd6a97ed185", "comment": "Malware payload", "value": "26de14c37597b1962ece8ec3d7eeedf758311243c5627598b2ce679261591cb7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716950, "uuid": "e1da4f92-9292-4dd6-abc0-51afd0a5b2ff", "comment": "Malware payload", "value": "59cbc528bc4267a1a700636ea3b083ede5e1f8fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716950, "uuid": "a9f475f0-eccb-4a76-b416-a22df8ba62d0", "comment": "Malware payload", "value": "777e192dcc781134a45ea614c4fdaedc01bf1f0ca4962b230e021d0cd14977b354e8f6391317023cfa07e02d74666953", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716950, "uuid": "3563c555-6a46-4a97-82c1-b2f46537d104", "value": "T1A8F0477261125243FB7BC175F6E639C6600D2787F04ACE13544A03C02B791494507D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716950, "uuid": "2cb7e506-777d-4f92-a858-8e1290a06eea", "value": "12:5jnrkTce8LugnUdU0bB21UoJ3t6eNzxTeYnZmr1zjrrk7ce8LPa3X:9u8LuAUHkOSd6eNVr+1zji8LK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763716950, "uuid": "7eb9ed71-cf0f-4e57-bce7-2652fb2d6261", "value": 620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763716950, "uuid": "679329d9-73f0-4b15-b5cf-cac8963d082f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716950, "uuid": "9706ecaa-3fa7-4c54-a7e7-dd8c7cfeb643", "value": "faktypa-957623.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89c71a7-c6ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739441, "uuid": "da45377b-3da3-4a7c-88af-53fe9a88eaa2", "comment": "Malware payload (Mirai)", "value": "48ed91c8ce8a12cd30bf162f6cd3b9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739441, "uuid": "82f191ef-7ef9-4d8b-96e4-412ca412deb4", "comment": "Malware payload (Mirai)", "value": "2784433bfc06bcb4dfa7a92dd4043308b168c35094778d1556b9151e9878c1c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739441, "uuid": "76dc51ad-14cc-4f3b-8c02-5435a63dff6d", "comment": "Malware payload (Mirai)", "value": "c6bbb8754de0abe00fbb2cb838b54b5816e5dfc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739441, "uuid": "c95d2202-c4ef-4604-b103-6fe23b8d9f34", "comment": "Malware payload (Mirai)", "value": "d876f11a65121c5a93e80778cf104642174f89b37870b6440ee8e38776ccbd70ebd01bba4d483c0fe221e38aaa54622e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739441, "uuid": "34787eca-e5de-4fc4-b676-494f1abf46d3", "value": "T19C13F14A5A6819908FB4F833EDF9C5C4C99F90DE03DE39D62B0C8FD81452A23D999197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739441, "uuid": "250a6785-2f43-4b4d-b75a-9c295eed5415", "value": "768:xmGtV7cRt4xRBZt0mOuHfqe8IWLfw8eizzIZjLn+CfzPkcYkKs3UozU:x7+Rt4bt/qVNM8emz62CfplzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739441, "uuid": "ffa7ed3c-d817-4f1e-9c5d-9dd6debc3878", "value": 44152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739441, "uuid": "a2e9b0ea-4d0b-4c75-9ef8-653427b34cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739441, "uuid": "e2708d8d-2ee5-4229-900b-59a3c76bb8f3", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7a8d3f-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714483, "uuid": "123ff093-5aa7-4b41-9f28-9aa8442717d2", "comment": "Malware payload (Mirai)", "value": "131658cfb28aefa79642e9846de614fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714483, "uuid": "f4108cf1-a239-4ecd-806a-319d03f9348c", "comment": "Malware payload (Mirai)", "value": "27ca89f689d3c08c63c6dfb889629470edf2cbe1ab2f50762f6803da40b1fe41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714483, "uuid": "6a1325bd-a0e0-4c71-a299-3d0ead2808f4", "comment": "Malware payload (Mirai)", "value": "6674ec4b5855d854c4e16bea0bad696ae28fa6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714483, "uuid": "6b57bdbc-6cc5-42da-b79f-f35c2af77af7", "comment": "Malware payload (Mirai)", "value": "bafe46f60540253ebca65e40b5eeeb03d87f6f55ccc87cbffab981ba607a3b196f3a27aaa42b13f278d3517ca9c3e2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714483, "uuid": "bd88b3ce-fedc-44f7-b8df-f4755f3fa126", "value": "T15C247060FA0663F1CC720B3567952E5A6E7B04159FEB56312D1F923CDE628909B30F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714483, "uuid": "ee57b673-cfae-420e-bf34-810331c6ab9b", "value": "3072:94jyZirKvs71ypIlgHQVwnKeaWuK6gBkAjfJOzUjz5UXUKv:krcs0UgHQVeaLgB3jfJT1UEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714483, "uuid": "d136e024-9b38-462d-bfa6-e608dc706b54", "value": 218012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714483, "uuid": "f1cb4a46-c6b8-427d-8eb8-b68bb002d551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714483, "uuid": "518db040-a2f7-4e09-8ec1-e5fa5e443721", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a698c1-c711-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763753804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753804, "uuid": "6982b6fd-c852-4b7e-a8d0-7cfc9ebb17d4", "comment": "Malware payload (Mirai)", "value": "7d009c3b0c3feacdb42d338be10ad3ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753804, "uuid": "a93616a1-6b16-4af5-8026-4149ec63f794", "comment": "Malware payload (Mirai)", "value": "27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753804, "uuid": "332bf845-5ca3-4c17-9b25-77cc7566f749", "comment": "Malware payload (Mirai)", "value": "6da48eae36347b163df6be89b963c36acc6f8bf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753804, "uuid": "8e1fa1d6-3172-42a4-930a-9b00ad45b586", "comment": "Malware payload (Mirai)", "value": "d8c233b584250b59b289ba4aa62b4c919ea5b16f0238f6daa69069311a605a730a0e22ef17be261d5379c9d981b95cb7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753804, "uuid": "05ba1190-7665-4248-9f06-f9cda3ba7bef", "value": "T13A5129E5420A4D382C636A53E6BE412C32E3A56798F2EF95D9C4BEE8275EC343141B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753804, "uuid": "04377460-0319-464c-a5f3-d812480ac7d0", "value": "48:v/7s7N7h/p6G/gRzP/ZKW/DoU/7D7o7U/fC3b/89R/Hcg/opV/RSO/N+C/SfT/6C:v/7s7N7h/p6G/gRzP/ZKW/DoU/7D7o7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763753804, "uuid": "eec1491c-94a3-4bd5-8ac3-200a0f3f883b", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763753804, "uuid": "b8d4eec6-9fe8-4b93-9f6a-7a3527c20843", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753804, "uuid": "4e354d99-902e-43df-b1d9-d725d1e101fc", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452b6ef6-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766199, "uuid": "e87b7c1b-aa10-4a94-b202-035ea3a75e23", "comment": "Malware payload (Mirai)", "value": "3199cfa7642949646c1d69744fa08fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766199, "uuid": "a594d79d-a96d-49c2-9715-f870d01e6117", "comment": "Malware payload (Mirai)", "value": "27f5ac15860069a99ad3175072e216826ad04087171b99ab6882fc82b6f4a9c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766199, "uuid": "cda2bb40-2c4e-4a70-9e62-45e23339694c", "comment": "Malware payload (Mirai)", "value": "9d60666be0838f83b5f22c08a31b9ae435b14f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766199, "uuid": "55d1cca3-bbfa-474a-81b6-e7c2d8658db8", "comment": "Malware payload (Mirai)", "value": "e23aaab597fa254bc682e380cfc7b58c16c8b38f4c9b61bffcda0f8734250ca5608df6b6cebbe9810278916484c51c93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766199, "uuid": "721ec303-7abf-4ca6-b642-b24d754b7e14", "value": "T198736AC2E747C8F9ED660274A237E73B4672E53A0125DF06CB60B976DC16A01B32A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766199, "uuid": "f41fb70e-733c-43c4-97ff-5dca176b68c9", "value": "1536:YdNa84fThUTSECIAQrEkZT3/Igcs9T11bCELSa6mUT3d:NcSE5AQrEkZTAgcs1Z7L8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766199, "uuid": "f160438c-12c5-4b57-a36d-b06f49b97122", "value": 78836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766199, "uuid": "4e66656e-d569-4c5f-bdd7-825cb95a0028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766199, "uuid": "ab61c63b-3817-4e11-8de3-4e589faf8fa8", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4b8b8d-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711213, "uuid": "e7744c57-e42f-4afe-87f1-1417d9821b7a", "comment": "Malware payload (Mirai)", "value": "5b9de15fde2bdcae236beecfb31b15e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711213, "uuid": "1fb74b8f-1751-442a-8375-f6e097d33600", "comment": "Malware payload (Mirai)", "value": "28465fcb6f83ed1a53ce2ff7dc1b27a9a10d6f5471a3212823adac495aaf361d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711213, "uuid": "50faf68a-b228-4ba2-809d-276d3c62947a", "comment": "Malware payload (Mirai)", "value": "951f6694f9d3cb7e9ab1dda4dd94d6e8ae0737d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711213, "uuid": "5454f799-68f5-4231-bf2d-7f77ec030c2f", "comment": "Malware payload (Mirai)", "value": "cbca833db68a0781e5b7be3847ae037884812dac636d5f2beefa7812a81d7a67f558310f8ea3a37f42c2b6019e45791a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711213, "uuid": "f562f367-c271-45c5-be5d-dd1434019bae", "value": "T167735A07798591FDC8C9C1340A6BA132D576B97C13303B553794FF2E6E4BE221E2DAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711213, "uuid": "b8a524a6-d781-4efe-8ea7-4509fc9a72ef", "value": "1536:B4BHkoviQxf8HpREUWEmzsnHlh0/rWmnJO+E/HNiZWWk0GXFh:iBHTiQxf8iDC0/HU+EEWWl4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711213, "uuid": "a5a64e91-41df-40bf-8243-b9f081b3bf19", "value": 80192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711213, "uuid": "2cdd5db5-69bd-4197-8254-5ee68a672b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711213, "uuid": "3988d971-bdfe-4dcc-9dc6-a5999c3b8140", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d071ea1-c6ba-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763716524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716524, "uuid": "781958bb-2439-4d5c-8bec-65e31cd01223", "comment": "Malware payload (ValleyRAT)", "value": "d41d9e5fc1ca5aed8a039e583c60a300", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716524, "uuid": "bcfcc445-be7b-459e-9991-b4769afa7bd6", "comment": "Malware payload (ValleyRAT)", "value": "2a455e99def6cf4a381497524415fa3f30a7db6e2f5d855df1da08b1dbc8245c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716524, "uuid": "5e64c8d7-2af0-4d9e-9e9c-e8f7c455fe57", "comment": "Malware payload (ValleyRAT)", "value": "49fe4e6576f42d1fa3cc155d86de9e3b56d42bae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716524, "uuid": "57d59750-613a-4f1a-8eb5-c7fe9b481354", "comment": "Malware payload (ValleyRAT)", "value": "cf7818d7136c72519b7b2b453608652ebe3abb31d73d36da92530fee74642e27a395add68e56b03c648ce724a8791cd8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716524, "uuid": "4c8a7b85-c9e4-4ad8-81d5-8331b327f590", "value": "T1D6957C123A546066F16B1E34D918B368F7BCA1A307F642D75F90AA7C3932CC247197AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716524, "uuid": "c8c34a87-3930-4cfe-8c5b-dc3085f364b5", "value": "c9bb1b2395e5e1889b0b2a1968a209ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716524, "uuid": "3ec3ee8c-93a7-4563-8997-8d316cf6e0aa", "value": "49152:Es2DnxfqOFDD3+Wy0mpzJ/Ti7XMzAp8ELQLxrMOea6uS:EFcOFDT+Wy0mpzBTi7XMzAaaQLxrMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763716524, "uuid": "43fab90e-b63f-4bfa-889b-799ba6d45249", "value": 1982464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763716524, "uuid": "32c7d935-d384-4022-bbb5-0eb14e83d74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716524, "uuid": "8f5cde01-cd84-4ac3-ba08-810c84e2744e", "value": "2a455e99def6cf4a381497524415fa3f30a7db6e2f5d8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc9cd4d-c721-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763760762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760762, "uuid": "12c59e0a-9e1a-4b36-92b0-8c0f22c6a3d5", "comment": "Malware payload (Mirai)", "value": "a10dde51a2a657f1e294df316986d3d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760762, "uuid": "4fd399ec-9212-4d88-b1d9-9eddce155f4c", "comment": "Malware payload (Mirai)", "value": "2aa3ff96943219421cda83751760f79478dcdf85a62563d2e64cc27c17e154dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760762, "uuid": "5bc9a244-c1ed-41e5-a9ba-dfd0310e07d2", "comment": "Malware payload (Mirai)", "value": "2afadb5b483df10ec641db31482116307fd89fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760762, "uuid": "20349472-d6b4-479d-8e40-7aa307351e64", "comment": "Malware payload (Mirai)", "value": "4dea3ec6da5a773aa2a88adadeccc1d60d4e987f6a96acec8289bd4abf0908c282a9953c63b7525c8c460e7e47a41cbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760762, "uuid": "b9152ddf-06fc-4520-a9ac-dcfc3d3b292b", "value": "T1D013F165DAC47EA0FBF9DD78ECE412DD87B01D2837DA06A155D27B42042E83E5209DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760762, "uuid": "266dae3e-646b-455b-8db7-d8eeab80602e", "value": "768:Z3Lz1SGVh33PjBqXLFAtxhKlyIwObu7Y8Xr5UjdWDgjSSy4v7+U0E+H3A4uVcqgD:Z3lS6bB2At7KlyI7ALb5UyVh4va3vA41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760762, "uuid": "d367f28f-8190-4925-b00d-50f9de249064", "value": 45244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760762, "uuid": "af3e3664-a1b0-4db0-a502-d424b1856212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760762, "uuid": "8b80a998-5a51-457e-8790-d933abe6304b", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a640682-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734371, "uuid": "4d3708f4-8399-4416-b148-5bee5f93451b", "comment": "Malware payload (Mirai)", "value": "98af8a049f1f126317f4ae6589a0e56a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734371, "uuid": "b7d8d9f3-3f4a-40ad-be52-fede89f08ed8", "comment": "Malware payload (Mirai)", "value": "2b89f05280b73906f79e0813e78bb3f3ba6503a44f8d936486b20b93d6b282ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734371, "uuid": "2a9ffb79-ad57-4ed7-aa16-93640d50bfe1", "comment": "Malware payload (Mirai)", "value": "ac2f88b3eb660066d2078b09d4ce9ea32ba11bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734371, "uuid": "d6d521f8-df69-4588-8907-57be2f7aa40e", "comment": "Malware payload (Mirai)", "value": "14fab869a4d2d9a92f8cfb647e474bbe383f5c68fc9f90709c20d3fcbf05d7ede083a8cbd725d7a299df2747a46f7383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734371, "uuid": "71a7063d-f41b-41f4-96d7-d940767f23b2", "value": "T1B7A312B7CFDA4763F06CF5B5DFCACA30C38A0BE8366A4575A852603B71647081C59AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734371, "uuid": "2b1472b0-023d-40d1-bcb4-a1d96c992f0f", "value": "1536:nQLFB4NCro0F9WklWSe2K+57ULP/X/i9d4OpqqQSH8F+bSFeZehDpgSWu9Jg:Qp7oklWRdvSdru+OFp+s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734371, "uuid": "b241e23a-a840-4e65-a788-0baf9b6f0976", "value": 101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734371, "uuid": "c76058b2-6222-4fce-b8dc-7659d0beaed7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734371, "uuid": "f2740093-9389-43b5-9409-2b487c9b65f5", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d026fd33-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694276, "uuid": "62bda936-279f-4396-b71c-f819f6bf60a9", "comment": "Malware payload (Mirai)", "value": "780f46c51f9dd2188d6df3e804dc6180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694276, "uuid": "3d7fb480-0425-4aa1-9cd2-3f336b0816eb", "comment": "Malware payload (Mirai)", "value": "2bfdb1a0ff3ba5f88104437d69b386153d767d57595d97329429682046aba76b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694276, "uuid": "07693757-2632-481e-983f-4b9896963f48", "comment": "Malware payload (Mirai)", "value": "4d05599f08c05dcb1127596ea39a2a70301ceb78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694276, "uuid": "144d26ed-cefd-4ca6-9b4c-46853b065cea", "comment": "Malware payload (Mirai)", "value": "338d2c77e1f688aa7653bfc6fc8a834a2d61ab53426d0f65aed1ecd0a51e1ef855c0bd2cdbb7b2d2084deee1a027c686", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694276, "uuid": "84b6dc3e-e019-4be0-8745-e987e65284e7", "value": "T1678312F85FE47E02DF99422A0252D644429BFE0A11C4249EDA80F7E7F4867BAE1D49C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694276, "uuid": "68f0c10c-4306-4599-9413-dead1edad041", "value": "1536:3VBoYJvjAkwIzPNCgnyEoFGyiWbXxFgJFozAKCEpAkU9Fge3Wjv:3LPBkcNRyvFGiA7YUvgpjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694276, "uuid": "55eb21f0-5edf-413c-9d6d-0d2d48e7e29f", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694276, "uuid": "5fcfc542-89c2-40b7-998a-c51aa09ce4e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694276, "uuid": "43a83668-7847-4ecc-a662-ccf1250cc86f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8bb81e-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703828, "uuid": "f4ffd7fc-ef03-4556-abb7-513c9cd3a09d", "comment": "Malware payload (Mirai)", "value": "4d4f62e8c669fcd7fc9ad64d740cba29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703828, "uuid": "42b01efc-d054-4616-9467-92fbf8cc167a", "comment": "Malware payload (Mirai)", "value": "2d721e86572cf0dea69eee511a6a254720df4988afca0f0bbeff6d023b9ae3b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703828, "uuid": "10ee6a64-aef8-4362-804c-e716d8143345", "comment": "Malware payload (Mirai)", "value": "78501c7c934c1cd74fc6d8e1d7661e513f292004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703828, "uuid": "adaaf15b-15a5-4218-9e59-613fdc0d2b24", "comment": "Malware payload (Mirai)", "value": "56eb629f4b9da0c93081f36c1b4f683cbf5fd5abe7cdf91f82c2ba8c2b0480440b17d5c296076bdc98c9ef23ed2244ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703828, "uuid": "a9fd4d5d-7569-49c6-b98a-48cf7166c3c6", "value": "T144647C98BB0DEF42C18083BBED6B0623A37974507B4B97637815612DEDD3B8C9C5318A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703828, "uuid": "6fa18e4b-589d-4623-b9bb-a7f3b57afaf9", "value": "6144:5vB4CnzYgi4rktKTdGQWkHLohjE0pPzrlTO:/nU64QWkrohvrhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703828, "uuid": "762f320e-0630-46d9-95e3-24def47b9f44", "value": 309312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703828, "uuid": "9612cab7-31ab-457f-8115-2e2b2ef1db92", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703828, "uuid": "8a0f3cf3-a438-4072-a2ad-89a2bdd10410", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c942e86-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (LazarusStealer)", "timestamp": 1763715960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715960, "uuid": "0f43eeeb-e835-42a4-836c-e6736f414570", "comment": "Malware payload (LazarusStealer)", "value": "c12b3a8538e68b1d4812bda3859e67c0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715960, "uuid": "555148cf-7218-487e-9376-7306f5eef466", "comment": "Malware payload (LazarusStealer)", "value": "2f2ef1d5e36b81deb3e296da1ca0544e89e17c5f2bf3cfc3c8253d58d295bb51", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715960, "uuid": "90ba6f2c-f293-4789-b8bc-961d344f5191", "comment": "Malware payload (LazarusStealer)", "value": "d95214bfaca08ac41fe67bc3f17efbcce3cbf2a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715960, "uuid": "375af7f2-3776-4715-bf88-0f2ff2960e15", "comment": "Malware payload (LazarusStealer)", "value": "22d7394f3b9453b166aa17d66c63ae71b5c281b47923a1c7f4ceee626c15cd4dee2123a02755b78d2a5374613074060f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715960, "uuid": "2d7a1805-2f9a-47a9-9a07-71d839822f63", "value": "T14246D0D6E7C8999EC4FB5772C83A62E111474D26CB439E839D28723C38B71E01E59BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715960, "uuid": "bb6b9062-f3aa-4cd3-b0b1-3a44b7e9bed4", "value": "98304:zg6UDPHOIreOTUxF06AjNzwNEoS3+sn25eAQYLwF2+KaylQ8CqddboTwrWOsbb:zgHDPuIrevA6szwNETuk25elYMEFQIdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715960, "uuid": "9632d82f-9462-406e-b444-e45392c69f8e", "value": 5428767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715960, "uuid": "2139d2ad-1688-4481-82e7-b7e03242ea32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715960, "uuid": "1d011104-6da5-47a4-8235-9c33cc3a16cb", "value": "\u0412\u0438\u0434\u0435\u043e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c829f472-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763740219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740219, "uuid": "2eaf0e33-9898-4eb3-a1de-bca23dd2441c", "comment": "Malware payload (ValleyRAT)", "value": "6ff8d90b8d9205c58d266702dc6d81b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740219, "uuid": "95855085-7221-48cf-9c31-9dc1e6c65d3c", "comment": "Malware payload (ValleyRAT)", "value": "2f427c091401f25c800002ac613e0e141c0c3eb5adb619d9d17add8bf29f38fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740219, "uuid": "b49afc3a-8f96-47e5-9086-fab8a775fb98", "comment": "Malware payload (ValleyRAT)", "value": "0d4dd39d8851dcfcba33493eba304ee0fe2e71cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740219, "uuid": "b0f32a25-1f77-481c-ba0d-4c4eb2a3612e", "comment": "Malware payload (ValleyRAT)", "value": "dfcc979c9f80eeea7688bef288cba916e5a80502c3e02c31b6a8d5b3c2d763ab4afe6b5e9c5b254763c23ffa91d091b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740219, "uuid": "877cf5a7-94b3-4047-9747-6305d15784b3", "value": "T112C6BC026D4302ADFE1D73B937EE5225A9A04D5A0B2C45720BE2F9ECCF3915399D391E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740219, "uuid": "52c85e9a-3679-41cd-961c-8b95fc27099f", "value": "a148a8db492373de1476064a76421f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740219, "uuid": "f273e675-e1a8-4853-b711-cbda55dfae48", "value": "196608:Vy1B7cU5nVEY8rN0bfmsjPUEEpk4gYXzuu6u0FRVaji7i9wI+jDB:a/Vp8rNexxChjuy0UzL+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740219, "uuid": "c1d2805e-c2b8-4fa5-9a1c-ea57a4d6ceb5", "value": 11730616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740219, "uuid": "9f95756f-883d-4b98-8523-e8c36eb0a64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740219, "uuid": "4f564600-38a7-4caf-86dc-c405385e1e43", "value": "2f427c091401f25c800002ac613e0e141c0c3eb5adb61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dd8c0a-c6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763733630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733630, "uuid": "f505e57f-3e5f-49a5-9557-4839bd9d04b2", "comment": "Malware payload (Formbook)", "value": "df60566af00a9afc7ffb0298d04e5569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733630, "uuid": "b78f8af0-caa8-4371-b981-dc3b0d42f7ca", "comment": "Malware payload (Formbook)", "value": "2ffc09c5919fe2df671b92cd55793ee5dc68ba6f828d3f5510aa7b2dfab99d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733630, "uuid": "c0ac859c-34ef-477a-891c-ab6d17d075c2", "comment": "Malware payload (Formbook)", "value": "fe53db4396cb7c7e94a0b59eef66a4d44f016785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733630, "uuid": "c1634d43-a056-4c27-9326-fc8c5a91b497", "comment": "Malware payload (Formbook)", "value": "c8bdd5be9a06bbc5b403860ffc44cd0ff53be50e33e55d39503dab58e8f7ea71aee08c433df1584c6f296908340ace35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733630, "uuid": "422f9fe2-0428-4ac7-91e8-45066c15be00", "value": "T15535CF1273DD8365C3725273BA66B701BEBF782506A5F96B2FD4093DE820122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733630, "uuid": "c3c43b22-8bdd-41cd-8343-4859f4652b21", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733630, "uuid": "05f37fdf-0184-4f3e-8cbc-151c78ed1501", "value": "24576:Jtb20pkaCqT5TBWgNQ7a5D7Jr0XpY5Vch0rplfuUU6A:aVg5tQ7a5DNeech0lI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733630, "uuid": "76a1be73-9807-4690-bf97-848481d0e803", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733630, "uuid": "ac930a96-7613-4aa4-a288-1cfc0dd06618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733630, "uuid": "1aa71fe8-6552-4205-a1c2-c510b950cdd8", "value": "PO#3210046374_SALE ORDER_SN 8102024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ed52e3-c707-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763749387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749387, "uuid": "aee34b7d-ced0-4f99-b3f1-377a8772def0", "comment": "Malware payload (Stealc)", "value": "af41cc19536150aab184c5f46b4d4da6", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749387, "uuid": "a185e4eb-f88e-4501-955d-5c3567d5d26f", "comment": "Malware payload (Stealc)", "value": "30a8f992b98573881b7f0bf300a976f58151b80fdf021799ff3782bf98dbc1bc", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749387, "uuid": "e68b4b40-8fe7-4e4a-a451-ce37d9fa4a6b", "comment": "Malware payload (Stealc)", "value": "624c166cd1c16a7578a7222d0eb6bcfbe2d8bd63", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749387, "uuid": "2f142bb7-0b46-41b1-8901-82e87d89be5b", "comment": "Malware payload (Stealc)", "value": "01dbd6823630b6f3af72224fd10a4994d7d78409c5c6b11b6fd8ba14b329137fbfd3f6d13f5076ab2f021de0ede80fa0", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749387, "uuid": "30a067d5-b8ac-42df-818a-9698f10ea114", "value": "T1E7C6D2127B4545ACD7D6A234B8E2D239EE20788C633192D37F1F6B2A4F652D026F2717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749387, "uuid": "f9d0b850-101d-4d95-8dd0-c026e0119c61", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749387, "uuid": "39004aa4-544a-40a0-9c9a-ed5d93f808eb", "value": "49152:gnaX8o7ai/IbtbKDRX0lXAuSgAwAE9u6UUzz4VRxIMtFkReIM:glxtbKDRX00wAE9loV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763749387, "uuid": "0ea0e82b-5f91-4b6b-848e-ef0a78374c01", "value": 12455056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763749387, "uuid": "8af074af-3ecf-4a0f-9695-2409c63b7b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749387, "uuid": "c4b53c29-f8bb-4a5f-a7ba-90ce3b006171", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6afd2b-c6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729006, "uuid": "2c3e3a59-f3bc-48c9-bdb9-5abb626d6f68", "comment": "Malware payload (Mirai)", "value": "e69be705d8225356a09404031ab203dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729006, "uuid": "fe5ff898-e221-46c5-8916-8e7303fe09e9", "comment": "Malware payload (Mirai)", "value": "30d366f4f52eefbc244cb17c97c0e78660c780aeae7141b5f17cd0c1a0f994d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729006, "uuid": "c1d964cf-8fd5-447f-9422-0f5849316a67", "comment": "Malware payload (Mirai)", "value": "8a6c4ba8b2531c692512b90de5c6829aec78522e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729006, "uuid": "40e25a8e-e948-47a5-b3e7-bddbd914f566", "comment": "Malware payload (Mirai)", "value": "34b8c99dedbb3f6f3257297b6aefd7e094e2bf4214a5bc355288bf87be1a0c2e33e7304dbb1f80d75e813c7048342cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729006, "uuid": "3b27e418-ad8a-4651-b8fb-36831ae9011e", "value": "T1E9043A26ED50C0AEC182D1B8A7DBC1B2F731F8F80221365B73696A362E69F505B1D747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729006, "uuid": "415a8f4c-bfed-4455-83b5-349628fae3d6", "value": "3072:oYYSV3/+Wzf9zKfgo4kZOuOeD4EabfuYc7PTvswdrlO:ZYSV3/5sfgms8D4EabGjNdrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729006, "uuid": "cb56f37a-76b5-49dd-9435-7cbd2f9a69be", "value": 173536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729006, "uuid": "1d073c0f-4f2d-4007-bae1-132dc1339103", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729006, "uuid": "a47ef67c-b850-4b29-a920-a08ace02d8ea", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094f9050-c704-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763748059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748059, "uuid": "f3f11957-0f68-427b-80f5-95fa8c7db687", "comment": "Malware payload (ValleyRAT)", "value": "f59a51def2a92797e5cd64d17a8ac13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748059, "uuid": "d0dbabb0-4e30-4192-9ea2-9646eadeb473", "comment": "Malware payload (ValleyRAT)", "value": "32702fca4d60f1f28bebe7723fee707605f0961b181ab693d9a0142a857c5eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748059, "uuid": "3a951264-3361-40b5-bd4e-2979cfe3d138", "comment": "Malware payload (ValleyRAT)", "value": "6990e14e67958329e192d50013d31038d4696416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748059, "uuid": "77e598ed-7dad-4c3c-84b7-0ceaba641797", "comment": "Malware payload (ValleyRAT)", "value": "01a6b168dd5a812de8bbc140ffa59e595fd9ffb5115564243e5ee53abe3f866a566bf581fcfe54018f4eed1a3ad8b95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748059, "uuid": "cd1f07a2-9b10-40be-85f1-0f20a05386a7", "value": "T1AD853B06F390C59BE2BE227460748BA003B564B4469DD75F268E74A4BFB3356383277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748059, "uuid": "0efdf264-9359-4ff3-861d-afd09f820b4e", "value": "22fb5f0e6ea4ff0614c13395e0984667", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748059, "uuid": "85eef170-8b6e-4637-b8f8-7b01e1d48923", "value": "49152:qBioYuThQmC5Bz5CLgBFqGI1yi/UQeZndsqrkAVfQEyFg0F8tz+V4NpgFo0I3JG:eDYwhQmC5Bz5CLgBFqGI1yi/UQeZndsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763748059, "uuid": "2d58fbe3-2a29-4d14-bccd-f54aecafa724", "value": 1853440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763748059, "uuid": "1bcb1f53-09da-40c2-b157-f26327749cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748059, "uuid": "d02e4203-6562-4846-bb79-986ce3cdedac", "value": "32702fca4d60f1f28bebe7723fee707605f0961b181ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f69b72-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711223, "uuid": "b9136e0a-0fac-42c3-a7b7-5fd737576dae", "comment": "Malware payload (Mirai)", "value": "b11839c0349133d3b7f1378317adebd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711223, "uuid": "e656ab92-5cfe-4bce-82d2-23182c88b7f4", "comment": "Malware payload (Mirai)", "value": "340c7a320fe5f8c453436ecaef5ed866fde391429c4d260280b62e990e1fda7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711223, "uuid": "424791c2-a4d2-4edc-9e31-d94426e165d4", "comment": "Malware payload (Mirai)", "value": "cc68f505425239d20211d9a529651a55e2cde91d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711223, "uuid": "238c9472-fb31-4ec4-851d-8e1b93f84369", "comment": "Malware payload (Mirai)", "value": "35821785821130045c309b5f541bc34ff91dd8684d0a385bfd521925d26f9f110fe21db1d7d1f46c1001140873194e2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711223, "uuid": "eeee9e78-2609-4c2a-a702-ec678af883aa", "value": "T19801D69A6212FFA3296CBD16B9A1468D008081CF6A7F8B88FC734A2CCCD174311D8726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711223, "uuid": "edce4a1f-80fe-4f90-b820-5fcc4ce5a108", "value": "12:3J3U6EKwpUq9ohU0FUIUjQUqYdTCUbSYLp1vGZr4OGtEOXj:3J3TuAUQodTCs/LnGZNGrXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711223, "uuid": "4fce3f11-ff2e-4ec7-a1e5-27f81246b9ab", "value": 692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711223, "uuid": "1ca90024-593a-4a6d-9a9c-8a6baadb2159", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711223, "uuid": "6531f650-3ffb-4bf1-8923-19d795d86a3f", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f658c0-c6d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725938, "uuid": "474fb71a-5ab0-4156-b175-149e11bae341", "comment": "Malware payload (Mirai)", "value": "2209524b7de5270e12049ddbdb08ebf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725938, "uuid": "aa07f584-fbce-4a36-a438-b2ebb3e62077", "comment": "Malware payload (Mirai)", "value": "34da0cc6a315731021b2ebc67c6dc4ff155af7b5b711f79fece0442642759fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725938, "uuid": "4a6e61e0-8969-4537-9d1b-908d81674bd4", "comment": "Malware payload (Mirai)", "value": "58dece4a8255bb56cfae2787e0d7119f6316401c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725938, "uuid": "92f3e300-25f3-4c0a-bfaf-e62ca4a3a61e", "comment": "Malware payload (Mirai)", "value": "fafe63bc449ac93fd05e3c58e7afc3ed0dc695bc0518539cdd5cbe59f4784c5709eb1417378b5ee9d6032a5a32de55e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725938, "uuid": "402282c3-b128-4e64-9504-b152ac8b25f8", "value": "T10423F1575368B31CE4AE72B1A20EF6CCFA38B82DD80F47BF0994553CD8A3DA15912E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725938, "uuid": "25e2bec1-9cfa-4d80-a812-5e6a7343a84d", "value": "768:bX8NaZWjWApQhQaiz2FsNen5b47KA9RacmA3C/4niPNZTv5BshPUlx05f:D2jxpMQa5SNen5b47x9RFk46rjshMAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725938, "uuid": "fa194231-9338-4389-b79c-0a3af11dc98e", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725938, "uuid": "8f2f5766-b806-4795-8b70-6c4d2f5fb3f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725938, "uuid": "b641c3d9-920c-40eb-9137-53c60e66a004", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa1d012-c734-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763769000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769000, "uuid": "bee831ac-c0a6-4120-87df-1f69278b1ebf", "comment": "Malware payload (Mirai)", "value": "f30ebb42621d46c4a58cdee79050581e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769000, "uuid": "e5363866-e95e-4471-a039-75e7621d5988", "comment": "Malware payload (Mirai)", "value": "3755598aac566d4a158af06d0a191fa6ea812d1ef6af2383e7e3878c2d84c41c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769000, "uuid": "e2056261-e489-48db-8b38-dd298cfbe537", "comment": "Malware payload (Mirai)", "value": "0961c635d8fb5634a76197bbe29bf7552868b319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769000, "uuid": "cbe9f2da-fe49-439d-8eb6-b1e7ee805561", "comment": "Malware payload (Mirai)", "value": "4c7f6ad92bb0f8df359da6209fa2b3025ea5935401ac752020e101a01491f05694cd101bd491bfde3ed3f2ef2ab987c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769000, "uuid": "6b1ddebc-e203-4c56-9350-a6abb560b214", "value": "T136C3F60AEFA15EFBE86FCD3746B9074421CC655612B83F763974D928F10A24B0AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769000, "uuid": "34c751e5-dd4f-4feb-bb7b-c5bbf6323873", "value": "1536:QHMtqFNGnU5sJ+LWw6Kl6EiJ9/xb7QajYyebJAqvqXn349WdUX+shk9tSdaPsi4p:QHMtqKnU5sJMRsTh7QucqXI9IsaXPx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763769000, "uuid": "46265356-d5c8-4090-864f-5660b2f14ad8", "value": 118724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763769000, "uuid": "b38f806c-68fb-42aa-bfeb-9522a95e226a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769000, "uuid": "6b5e2cef-96fa-44e4-aae9-63ec332857cb", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b617b6b-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764008, "uuid": "c2cbfd18-deae-49fe-b195-e8355f9d3ebc", "comment": "Malware payload (Mirai)", "value": "680239352070afc0335a9c2e2a9161dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764008, "uuid": "b3d00c9b-b0b1-4e61-94b9-85999063db61", "comment": "Malware payload (Mirai)", "value": "3784fc535e82661f4ac978d9d99665d4ffbf3f862d6bc455575dbf818895018c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764008, "uuid": "3e156e44-f0b0-4535-9381-d79cd6b9800c", "comment": "Malware payload (Mirai)", "value": "fda4f91d770ebaf6b7a570dc40b3faa1400c235e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764008, "uuid": "ffba8c7e-3c4d-4406-9ba6-75880b5d669e", "comment": "Malware payload (Mirai)", "value": "c88ec540e5739a404c1f779e6193f61db16da18e89ec9abac44442e82bac451052ba28bb95555b92de96fa6fdc80e9fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764008, "uuid": "a0d84372-5c52-40ae-af86-7244bcf1c173", "value": "T12613E166F5A44892FFAE7C151C4AEF5AF72201AB9377DD6349E2834044232ABE7012CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764008, "uuid": "6a27ae02-fa51-483e-9120-bec3b6450d85", "value": "768:QnlKSSUz9T3bIeXodkERK45xeyxEPR5EuEDIrW6WDaLdYb4uVcqgw09b:QnXZ/4dkERKEe3XEDkrSDaL2b4u+qgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764008, "uuid": "40b7651a-3cb4-4ef4-99b1-45d51529a413", "value": 45508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764008, "uuid": "4cb4b850-668a-4e8f-81a1-172b51f37355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764008, "uuid": "80ddee5c-5e4d-4898-829e-83d78a083eca", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29516e5-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714494, "uuid": "dcdd4433-1e0b-4359-a087-a37989e9d9dc", "comment": "Malware payload (Mirai)", "value": "f4813dac96f2f30e72e0a2f7a84e92ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714494, "uuid": "8ef047e7-73ef-4d5d-9e63-3f4ee2ab0ed7", "comment": "Malware payload (Mirai)", "value": "3940c974e3a4c6f4dc6ab3b152ee87a301cc44bf1091ccf6f942c05484031f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714494, "uuid": "e9598f9d-f830-4558-ae1b-50b964910a3d", "comment": "Malware payload (Mirai)", "value": "5ff51ff772e073c1ee817477ef6110375a7779c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714494, "uuid": "f280dcb1-6f5b-4c13-a68a-dee4c6ed1e8c", "comment": "Malware payload (Mirai)", "value": "aa61c1ceafba61d928f5e0cf1d23e8618d87dbca1411b4c1be1d0ce600169fb57188e8f0ccfd5efbed503e5bf8b1edd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714494, "uuid": "9d3e8318-ae94-44a1-8e96-bc3e0da96aeb", "value": "T12E7302B48C16AA40F039947AEA076EFEA741C7C8E1AA77437F950908ACF48779462D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714494, "uuid": "64d1ab10-766f-4c8b-bc0b-5d918d889c0c", "value": "1536:3UKoqZdNp5Qi1kWL4Ya81VZ7pwzPFch79TUBzPx0yRIUhgH7ZovEYworm:3UJwdv5JWYaCRre/pIV7ZovEbSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714494, "uuid": "fbddb0a7-cf97-4402-a265-46d627902878", "value": 78936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714494, "uuid": "3fce02f0-2b23-43b4-a5f5-a0477455710a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714494, "uuid": "87ac5ab9-f9f9-4ca6-8e26-f86969c64e9a", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c781a8-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732422, "uuid": "f9c7e601-3d87-447e-8881-8a53c78ea6d4", "comment": "Malware payload (Mirai)", "value": "2fe51f064d0881821168d74de6fce704", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732422, "uuid": "fc9733c2-d071-42ea-8056-9acd3b4cdfb8", "comment": "Malware payload (Mirai)", "value": "3a362664e37fb610ac77e919ad98bdc363391b4b3a340370343ad464d80218f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732422, "uuid": "100816cc-b18f-4d0a-a505-df7bb37dab12", "comment": "Malware payload (Mirai)", "value": "aafe442a6a6f7ada8fd8d2624e4945ba74330f2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732422, "uuid": "16cd7657-f713-43a9-ac17-b4ac55eee278", "comment": "Malware payload (Mirai)", "value": "a4bd624502c26322854a159cfff5d7a722ed3b7c3a3488c102ce7b86491e00d2eb1e1b2473825ca8fb383be0f8199172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732422, "uuid": "bfe43642-b818-4835-9075-04c1f5c970a8", "value": "T15D130250F5CECEB7EDBA64596D14AE9C77B48AE10BE08EC2814C3538DA4BC121D21DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732422, "uuid": "8b9498a7-5774-4513-8ff1-d4aed6834bfe", "value": "768:3pr4m/CjTq1D5gVFqVl6n+JvOzHaD6ChcED/5lb9HI+Kgsa0ryk5hVE9uN4uVcqQ:R/ew5O40n+JyHaD8EjTNLjsa0rycVLNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732422, "uuid": "a2dbdc42-a5c1-46a7-9a33-28163452227e", "value": 45244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732422, "uuid": "34cd65cf-8deb-4c15-9e75-31d1791b6509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732422, "uuid": "02160d00-b472-4060-8210-22fd323a8136", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31777fb-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703757, "uuid": "cbfb02a4-168e-47f1-9b3d-723a9ca41047", "comment": "Malware payload (Mirai)", "value": "e26d3edcd091c626f3bf64c6b9831a0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703757, "uuid": "98a098b6-cd64-4fc4-bb6a-2581db908a00", "comment": "Malware payload (Mirai)", "value": "3b15b0fbe07c61fb8ed350fe5e3900109e21ded924ee9c59b0fe20fe234138c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703757, "uuid": "f6b2ed0f-d938-4a63-b81b-81f3a310a3eb", "comment": "Malware payload (Mirai)", "value": "25f2b08c62beab0d89284d105c69444381f29012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703757, "uuid": "96676008-09b7-4791-8079-06522fd4b3f4", "comment": "Malware payload (Mirai)", "value": "6867a457503f124faebbfd7fe69d2cbfd37d335db11e49ee3511747cfb0233980cc2f8c93d90738244a14b4268683ee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703757, "uuid": "5ba1b0f7-00d0-460d-9bfd-3fba14d0570d", "value": "T1F9146C92BA6E3D7AD7630F3FC54347547F3CAF424A012527A0AE629729BB6910F17309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703757, "uuid": "70c280f0-a320-4d4b-9b9e-b9c58228661e", "value": "3072:w+bZNXht0xmtBCLVB35CUYnvUas4/WKo+wHDvAeLfST:P3hqxmeLzpCPvUaP/WbfHLAe7ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703757, "uuid": "9d1f1bfb-6558-4806-8c3c-f53a4007cdeb", "value": 200884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703757, "uuid": "e685432b-fa61-4f01-8e3e-09b901f7514a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703757, "uuid": "93331527-2961-4c1c-a1d3-887feb274158", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15c9263-c6f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741550, "uuid": "1a04eaec-07ec-493b-9032-7f11c18d2788", "comment": "Malware payload (Mirai)", "value": "d158e5644724e4a8e1117bd3c67ef027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741550, "uuid": "8773d70f-d0af-407c-8dfd-3d8a7aa822ba", "comment": "Malware payload (Mirai)", "value": "3be292e49b1212cd4ce8fb1f63509544dec1688931d35c7df4c67dd95f9ca675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741550, "uuid": "60e75df1-ebaa-41e1-a0c2-5e7364345a9b", "comment": "Malware payload (Mirai)", "value": "45e7dd3c80af9ffef9c614e5dfb5632b14f1f937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741550, "uuid": "1fce75d3-8a75-4319-a2fa-5c1e35f9fcf8", "comment": "Malware payload (Mirai)", "value": "3cf021f2ec858dfc4d4afbaeaa5fc53bb1337f7caeee0873345a2dcc6fdf0be69fca06656b1ff09bbe5436ae20f244b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741550, "uuid": "75fc9c03-0c2a-4807-98eb-ae912d289941", "value": "T14AD3BE97F74B19A1C81302F40BCF5FDE2E5322929F5B98E76C6E617B18790CB1912B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741550, "uuid": "a74af50d-c4d9-410b-bc3b-f3bef57f756c", "value": "1536:EfE+/uEjEl8RZ1a+78ND9RazeS2JlnjcQVrpyvJOgxZJhnlxgqz/LW1:EE+/Lj1378ND9Rm9qnjNUJOEnfgqzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741550, "uuid": "25d213ce-e7fc-4ae2-a9a6-de574880b5cb", "value": 132548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741550, "uuid": "3621fc90-b851-469a-82f1-c6061b67644a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741550, "uuid": "f3aab06e-c762-480d-8bf8-0798ba92f309", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f0fd1-c6f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763743593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743593, "uuid": "289a3fc9-dbf7-4ae7-a26e-11800311dd18", "comment": "Malware payload", "value": "4385a067fa68b6ff58e3535b52052e21", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743593, "uuid": "4c7a19d1-c290-405a-b075-f87608cfde55", "comment": "Malware payload", "value": "3bf6f09c501d9ccdc8217d69c303c22223b946112c957b9a7ff2564f1e39c193", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743593, "uuid": "4b083b77-fd4d-4a98-85a7-ee47e68afde1", "comment": "Malware payload", "value": "52e14943dd997608121a47e8dd69ace373351a11", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743593, "uuid": "fce18535-1216-436a-9da7-bad5385b5b77", "comment": "Malware payload", "value": "77ad1d339cf9b297f0a036f2d04c4c065b64ba7b01e6208da23cf091253762855b22bb7a4e04f306fe712f546d9222fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743593, "uuid": "eae62647-386b-49b6-99f4-444f71130cdc", "value": "T1F8A35B1B77EA30F8E17A8678C8504A15E772B87607249FAF03E402561F276D18D3EFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743593, "uuid": "4bff9bfc-5525-4d0d-b220-59387779d8da", "value": "ee7da0dd65450a9d5de92943a4a91f0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743593, "uuid": "47494b2c-8ef7-4ed3-9cfc-510a15b2efdf", "value": "1536:AaE7+Pw2drzHLucoFjfFw3HeA/9SDjGRw3rK9ChZQHphzvI+nsW5jqedJ9dlEtZD:kyVWiHeg6jhrK9thtbqkhetZSUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743593, "uuid": "e792b360-d7ee-4865-83c9-2b2918fdd865", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743593, "uuid": "05e3742b-e936-4a86-8bb7-32f691303f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743593, "uuid": "b93374f9-a836-4e98-8bae-1941a2b78205", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea8cdba-c6d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729788, "uuid": "5f3f362d-5564-4111-8508-ba6a74d93cf6", "comment": "Malware payload (Mirai)", "value": "d0213c1bfabf898677c332b22cdc87db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729788, "uuid": "3e562a0c-bccd-4959-afd9-4aef8403fa41", "comment": "Malware payload (Mirai)", "value": "3c4bb14f0128ab90aef502f4681920f15e90c554bc403697c572f59386793636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729788, "uuid": "e6b3388a-8a7b-4a17-84ed-26c50a2d9f86", "comment": "Malware payload (Mirai)", "value": "6789d35a10c369aa015a46797e691b826934050f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729788, "uuid": "6d6b7ddd-fac2-4429-87ba-c882a4e1b94e", "comment": "Malware payload (Mirai)", "value": "ef53aa896a1a564e471026ee61734dc27be60108c8942bdb35e623458cf74e573da9ba0a90ab2719d596e02c7254d2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729788, "uuid": "4caf9ba1-a148-4a29-b353-d2e2b3de61d9", "value": "T1F2831882F8828B2AC6D013BAE6AF658E3361B3E5D2DF7517CD244B12378510F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729788, "uuid": "01e4e6bf-737a-45b6-87b2-674a4aa0a048", "value": "1536:zTxS0qyV2Y73aC80nElbjgqXmI7pOYfAWKYdYZ45GQEj/q:zTk0qyV2i3aZQcGJZ4C/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729788, "uuid": "80c33c7c-e639-4ad4-9517-4c9d433b9f67", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729788, "uuid": "36d35b5d-5ddd-43e9-9d37-3ce898cdd29a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729788, "uuid": "98cde14c-5743-495b-88ac-6a6b15c91de2", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42092a5e-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763711218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711218, "uuid": "22edbe56-c728-476f-afe4-18c164d9cda6", "comment": "Malware payload", "value": "44d165b56f291781a30063af41e2d014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711218, "uuid": "e4425f3b-8d3a-4a37-ad5d-0a4cb0d337f3", "comment": "Malware payload", "value": "3ca4cb5499ac164a6af42f3e852d4d804d0bd440739746567364c922d3be7b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711218, "uuid": "8f7ed02f-89c7-4a93-a244-6582e5a5e136", "comment": "Malware payload", "value": "d9a16f8b08b3b73e5df0ee544c31b335653783f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711218, "uuid": "b60da9e7-6502-4666-a363-c9837c8cdf95", "comment": "Malware payload", "value": "26b0d61d371f871013a6ea2ff385b1df1c34fd00848fa29396d4a27da53bcbef48a2dd50ca3831186523d7d71875eef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711218, "uuid": "16fdbbe3-793f-4e06-915b-8dfe1d7c089c", "value": "T18F439D60339D60B3E98C26FD162A29B8870846F38AD1EA53BB68737D1C764497F153D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711218, "uuid": "cc67d653-a0cc-4561-80be-ff63304f881d", "value": "768:UGeOD8DZrj2L0I8v6RuCfusVyG6fuvQyxwEj6Iv0eKZeWknbwcx46:UJOO52F8iRukTyNby9FhWk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711218, "uuid": "a2554cd5-04dd-4add-8a50-b82c744c9e67", "value": 58948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711218, "uuid": "ab48e721-29df-4985-b765-b65aec505384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711218, "uuid": "675e6364-6688-444d-8dfd-8f51d601727a", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d9955-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763742152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742152, "uuid": "708c3e7e-3d46-4cf7-a049-684f9ddbc5ae", "comment": "Malware payload (Mirai)", "value": "39f91c601379fd2c22fc0890a4732ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742152, "uuid": "7db41e93-cca2-46c8-b1e2-e949088b045b", "comment": "Malware payload (Mirai)", "value": "3d3bb6bcf308dd5101d5446f0d41ce4c71c6393689accd8b0ca10b2ca658f60f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742152, "uuid": "cc21cd8f-e087-4a9c-b837-6817adb7010a", "comment": "Malware payload (Mirai)", "value": "7f0a7a562dca6cde55ea647abaac0ead1ab02858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742152, "uuid": "53d219cb-b623-4108-8ce2-9f1d928e9068", "comment": "Malware payload (Mirai)", "value": "aad86ff614790ba8bba9e71c3337064b9c3257b05ce9f1c7a30577e81276fe4bdeb138e6669bfda6dd5a99f4b43f6509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742152, "uuid": "dfaa6586-3fe7-4747-8609-3a3d20e97b26", "value": "T19DA34A01F31C4B47C18719B02E3F6BE597BBE5D421E4BA89290FDB528271E37594AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742152, "uuid": "167429c5-59c5-4d30-8622-4df7ef5e02f4", "value": "1536:xdPps91AzSdXvthnrB1HphtKwo05qf9z+JuaOsT7W/dS7p:xdPpKVpB11O99muapr7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742152, "uuid": "70c2263b-ced3-4a7c-bceb-05b0fa311659", "value": 104012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742152, "uuid": "5ed9de8b-c009-455c-84c5-2fdf0cf6fd3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742152, "uuid": "309f6561-7e70-4aba-a311-148c24ad7182", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc587a7d-c6bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763717490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717490, "uuid": "5e12589f-f991-487f-9c83-230367d7793f", "comment": "Malware payload", "value": "b32b9231356f3f8fd1b489b185d170bd", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717490, "uuid": "ce0d6374-356b-44b9-a2fd-b969ef796f64", "comment": "Malware payload", "value": "3ddb4f78b60547aafefcd557c20919f7530c43b6f06edee6f3ca9dd52809801a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717490, "uuid": "ce4491d3-a4a8-4174-afdb-ddb144e00bda", "comment": "Malware payload", "value": "006895e73085449f2a220e2caf7bb20b0d3463c4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717490, "uuid": "9297b6ff-9a29-474d-ab18-d307d42e9805", "comment": "Malware payload", "value": "2c9505ea93d8cabb817de0dada032e46f30a791181d9713485a2a4ac0b19aa2fbf29fe3147b1d01aa3b967230658b4f6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717490, "uuid": "42f3f0fd-1049-411f-97c3-0d6094a34ca4", "value": "T1F9E02B57B4347402F923601006DEEE4B3128DDC3794ACFC1071068D4DB49B4CD5991F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717490, "uuid": "2e614734-2beb-423b-8bb2-eca35cda7967", "value": "6:udVyYsi6DT1x5V6Q/DUMqaZ5SuH1MUmt2fNSAP5QTCl:oVyJX1rV9rzHSuVM1t21SAeTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763717490, "uuid": "c47a9025-9493-4d18-be71-02867b6629a2", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763717490, "uuid": "723361ca-468e-4daa-98b2-fcfe151fa182", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717490, "uuid": "af2a0e1a-863e-4733-b7d4-321342f02991", "value": "aaa.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439ea454-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711220, "uuid": "17bbdccf-1116-4bbc-95d5-717de6a67970", "comment": "Malware payload (Mirai)", "value": "641a2dad237ad946933e2c3f821a9096", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711220, "uuid": "f775e87f-74ae-4031-83e8-9b84770f3064", "comment": "Malware payload (Mirai)", "value": "3dfeaec000f3ed10fcc5e73e4511c8fae039625abb7c3ad78bd0494b9e806248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711220, "uuid": "7711065f-2858-434d-88fc-8564ab824dd5", "comment": "Malware payload (Mirai)", "value": "2f498c6a5dd9f77254e8fd8a526b03787c671f14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711220, "uuid": "4e23c830-74c1-44b9-ba8d-57049049785d", "comment": "Malware payload (Mirai)", "value": "ace61379e453f4ab72aacd7c5f31344449fb0caf6bd86e9823bafd10df329cf16a02dfdc7e431088d337cf3b1f8d8822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711220, "uuid": "231923fb-6dd5-49e3-b2fb-75cccfd02570", "value": "T18DB33A0AFC819B11D9C521BAFE5E518D335347ACE3EA7202ED145B2D67CBA6B0F3A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711220, "uuid": "0d19a5fb-00bf-458d-84a3-26bdee699886", "value": "3072:1muw1IBUmWriV5eT9X7NRUeaoYY7Krqlpe:1e1bZrg5eT9X7rUeahDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711220, "uuid": "5e0d9947-9b84-4516-98a6-9797a7431622", "value": 108124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711220, "uuid": "c8a171f9-651b-4f8e-a1fc-009257e4129e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711220, "uuid": "831dbe47-9663-424f-a30b-fb53a5cfbf5f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca8a3e8-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763716255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716255, "uuid": "d52670f5-77f2-4123-9884-b1a26e8408be", "comment": "Malware payload", "value": "2b85c34a7db9fa6822363fa5959830be", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716255, "uuid": "510b1a5f-e445-481a-ab8b-bec01038fa30", "comment": "Malware payload", "value": "3f2260d99886ccbd5b73b551cf6022d51c7beea5e7273472e2da8371aa1879da", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716255, "uuid": "a8dac953-6036-4442-9978-fe7af3756f95", "comment": "Malware payload", "value": "a8dea1f25a1568ac83fd426b521c217fe4e65dc1", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716255, "uuid": "cc34463f-338e-4246-b5e0-c0e54acb9bea", "comment": "Malware payload", "value": "03f0c2b7b0e54c0bab548152c17b10a532a8d8f3b20be8c37fd238fcfcc9d139b8bc801f1d733201241602794b950f6b", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716255, "uuid": "cba98c9e-724f-4d3f-982c-c255ce43303d", "value": "T197452B1AF6A511F5E0B9D274DA632127FD7238558335ABDB47C19A0A1F32BE0DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716255, "uuid": "eb12a458-6e30-49d3-a2a4-5a1d6fe3a10b", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716255, "uuid": "f3681ecb-161d-4c69-a124-25b0d8282804", "value": "12288:oo1GX/Gedp7BgXG7aP8QGHPl6OFRef/AIIFJbiXhgE9b4VCCp+pfp:o5Gup788QoN6OYAIIdE90VOfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763716255, "uuid": "82c40302-783b-4495-bd71-0a1ee2d8f9c0", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763716255, "uuid": "08bdde11-a4b5-4c97-9473-2a2826e2e3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716255, "uuid": "e0b82f2b-227e-4ab1-8a21-0de860fdc886", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7139d06e-c6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725470, "uuid": "c8edc32d-6389-4011-a75c-dd575b245c2b", "comment": "Malware payload (Mirai)", "value": "8b9a923e86fffc9118464f01b7b98804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725470, "uuid": "6403f8ba-7644-4054-84a0-7306ecc07365", "comment": "Malware payload (Mirai)", "value": "3f5812dcd054c3e40078679d365320d4c310bf5dc40bdeb21104309c5d9a8a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725470, "uuid": "884f7d3e-3016-490b-9537-c6e1b967e64f", "comment": "Malware payload (Mirai)", "value": "cba7fc1eb30d174605071b8ace4add5910f199d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725470, "uuid": "3d91b0fd-6925-4cb7-8a46-4575c9525725", "comment": "Malware payload (Mirai)", "value": "0f92a1b4d3b603a2855f80b131815822aa54c366759ce6f69ed8a03aed94806445d043a6e324532cc1eb4778614c88da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725470, "uuid": "f8f65476-9f69-4a5c-aba4-1764fbcecd65", "value": "T19EE3E71E7E215F3DFBA9C23447B78E26965933C637E1C585D1ACEA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725470, "uuid": "65c91e62-7a63-41b6-9dfe-6b2ea82b7d37", "value": "3072:9kF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5Dt18lwLN/kGfR:SF+6uk9hckUGXZy9q/uleW0AJsPQDJHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725470, "uuid": "bc062eb5-3a3e-4a92-84f0-070e7feeb510", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725470, "uuid": "242d5db8-e0c8-478f-a9c3-298e8133f61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725470, "uuid": "f7c0584c-c2a7-49eb-8be4-728dc09953a2", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5a536b-c6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714567, "uuid": "4ca5b5d8-b6fa-4982-aab1-296b34ac588f", "comment": "Malware payload (Mirai)", "value": "825ec2c10bf82f2983b960c13819528f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714567, "uuid": "59562f39-3600-4214-b74e-0a0a399602ef", "comment": "Malware payload (Mirai)", "value": "40af8fed89c2ffe82d3c7d01e6ad9002d1b5e293268c97f404af4570cc47dc8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714567, "uuid": "d3a2540e-2f3d-43bc-a7c2-f2910e6118f3", "comment": "Malware payload (Mirai)", "value": "858b7efb972c0a3178ba8184053ec24bcec46b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714567, "uuid": "a808199b-6c09-4614-964c-46122fdf795a", "comment": "Malware payload (Mirai)", "value": "543bf5bd0e274443574b88d83980982ba615b3073763826dacc07550c93341130ec8f52cb2071b00501fe3119fa412ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714567, "uuid": "e72663c2-4495-444f-a624-1a89da6cd740", "value": "T18A144C0B7B118FA1C329D67009F78BA79BD6265216E19886E76DDD007A7035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714567, "uuid": "52365cda-302d-47ac-b1aa-35d27c2abdb8", "value": "3072:Tbr/uLDbN//JTyBPuQCqirU7PNDvL7Ysx84xp9njJzcY1faK:TbrCp/JmBGQCqirU7PRL8mLp95X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714567, "uuid": "05770c63-6553-48bb-9bae-8d56bee9de75", "value": 199348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714567, "uuid": "c617f392-8890-4331-bf3d-f1ef9ca0e4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714567, "uuid": "77b0a995-544f-427d-8033-b4b89dc49ced", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374307b0-c694-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763700033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700033, "uuid": "9ed4a7a8-0ff8-4a7c-bce1-9a8c5de12fe8", "comment": "Malware payload (Mirai)", "value": "c5febbd360c9674f99b40ae793c770eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700033, "uuid": "e6192b1c-389e-4f95-8df0-1b3c39dc2858", "comment": "Malware payload (Mirai)", "value": "43604751bb329959a6e5dfb42e544486fdbee855233624e040c5d473624f393e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700033, "uuid": "dc99852d-956a-4fad-a8a3-7d3dd3db7433", "comment": "Malware payload (Mirai)", "value": "fe38d5cf623edde55e540a23b84e90bc340dc93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700033, "uuid": "969239fc-cc23-446a-a089-38838a64ff2e", "comment": "Malware payload (Mirai)", "value": "3b3366469edd4f1a081b9c7f8ae4bf828c8070402a511db3ed7e6ce3815eedd645baedcf3e5ade7b881fba4fb9d7098f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700033, "uuid": "8e26dde1-26b9-4987-923e-94922ca089a3", "value": "T1E7F31951BC505F62C6E623BBFB5E428D371553A8D2EF72078D226F203BC695B0E7A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700033, "uuid": "f19ec9c5-be0d-479b-a237-637ed0f4ad56", "value": "3072:/Jf+Rt5mTtxh9+aa1XDMGK6gBCrfdgdd/FAe4BD9MtDJJeVkpwlFB:/JahfdW9Ae4BDetDXekpwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763700033, "uuid": "abdfbd0e-0665-4dd6-a528-863b78f5b029", "value": 170380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763700033, "uuid": "21e648ff-5e02-4014-899d-531cc5798795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700033, "uuid": "adc6eb7a-a834-45e1-9e14-6796d753d041", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bdd644-c709-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763750208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750208, "uuid": "127b172b-62b9-4b25-8aed-1f702a37d0cd", "comment": "Malware payload (Mirai)", "value": "923844b2101c699831a09a7db0380f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750208, "uuid": "c0d2d40a-d177-4a0d-a5e1-a181e5945ce6", "comment": "Malware payload (Mirai)", "value": "43ad9b312d57ccc876a65f0992fc8119bbf5fb9f2d6ca8570b518904bf514032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750208, "uuid": "0656971d-0ffc-4f8c-bbb5-66a95c4b4b52", "comment": "Malware payload (Mirai)", "value": "28bda1182fc6ae4b8c233903692f06397d6dbaac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750208, "uuid": "676800e5-f804-405d-a5ac-51b7e5eb9be9", "comment": "Malware payload (Mirai)", "value": "1acad7fb6074135f12f6754d061c0c95c64e9d21b248f53aba4ba987ee763be2f7712859e72fe5af437be76329be1648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750208, "uuid": "0ee0a162-cd82-416d-ac42-7b4fd98c332a", "value": "T15923F127536C876DEC5A42B303FF278E1205D14B62D644EC2F90A3BBA03AD7466306B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750208, "uuid": "13bba481-3b77-4267-80f5-4ea6bc8827c7", "value": "768:JDFjdHw+OaaPC74Q2uGpyQJpgNkf+QoMqVDDiupKnbcuyD7UHQRjL:JDFj++Bw9A0Ekf+xh0nouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750208, "uuid": "9c5c066c-d379-4dc2-8c66-523d7d63cdef", "value": 48036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750208, "uuid": "d01354b0-9936-45ce-b18d-d3754dc110bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750208, "uuid": "23d98dcb-4fb4-46d3-a334-fe44eb82e228", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d30c1d-c6d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725711, "uuid": "3c8716f1-00b6-4708-a88f-daaaffffcce7", "comment": "Malware payload (Mirai)", "value": "d4c52364272806c4aa6da954b5e0baf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725711, "uuid": "6d30adf7-7d7b-4a05-821d-f87ae83b9403", "comment": "Malware payload (Mirai)", "value": "43bf4e54e936f3d4747566d802244ab1b7ca3d9a3537c48feb9f0db33ee32c01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725711, "uuid": "6d782b9b-6f5e-4b4d-a727-54b35c96fc95", "comment": "Malware payload (Mirai)", "value": "f9e8b4a058fd9608f53a70bbbf24bcf802690231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725711, "uuid": "2b4fb36d-0217-4826-a94d-26b1c0825d56", "comment": "Malware payload (Mirai)", "value": "6a6922a861859b606c9ec33a580893372e20b7b36cce94856c1107aebe48ea1875f594ccb33c24f025db2e6b16cec2a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725711, "uuid": "68f7f3f7-d97a-4929-9651-74adaa50af33", "value": "T1FFC32946F9828A22C5D713BEFA2E118E331357B8E3DE72129E105F2573C652B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725711, "uuid": "163adba9-1297-47ab-9c38-e1ef1603ad70", "value": "3072:vg0cjLarsxYI2/d7TuaO1TZcBaeRdrF9T:vg0cjersxvGd7KaKIaeR39T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725711, "uuid": "7fd2984a-fc44-488f-ad8a-a5444ee5b24c", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725711, "uuid": "1bfa5d31-89ce-4259-9348-82f4fa5edefb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725711, "uuid": "82e377bf-b6a0-4580-8116-9efc0f3de6d7", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b41dd5-c6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763727323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727323, "uuid": "d7c77cc1-6042-42cf-8278-e1f51e1a6587", "comment": "Malware payload (ValleyRAT)", "value": "21a3d14ab991672f5bc6c0dca29bff5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727323, "uuid": "4affc58c-79b1-448e-b616-f7fba143dcb7", "comment": "Malware payload (ValleyRAT)", "value": "442f714943a4108a29512997a634ffc1dfe9b761865624388f49cdeb03032374", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727323, "uuid": "fdd47112-813d-4cd7-8f7a-e5ab265fba19", "comment": "Malware payload (ValleyRAT)", "value": "3471b4d47d4f9fc9028ffff5ca6dc2c44d219945", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727323, "uuid": "ebd70b8e-9ce3-4edf-9781-0ed21e6b0280", "comment": "Malware payload (ValleyRAT)", "value": "75b7f087b124e01294382cd86ba702db3a14e848c2740e57aec8ba63dc0c171f9da403801a69e372e4f416b13d1cb126", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727323, "uuid": "9f81beca-ca28-47b8-964f-5db190782e39", "value": "T17A569D21F71083B7EC07D2372968E31941FD9E396697941F369BF05B8D3A881CB94A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727323, "uuid": "18d951d2-f516-400a-8440-0f9b812aa0dd", "value": "474397e203a821af8700ef6ce122024f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727323, "uuid": "5ff50cad-0064-4b38-aba9-aa6567d87975", "value": "98304:t02QFwi/RIj3FaTlc/WxgHavddcQrcBruMllmKHf6sk4Of:tdRi/MWxgHcHcttllmKHf6sk4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763727323, "uuid": "ebc4b384-7515-450b-841e-39db1a36bc4b", "value": 6221824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763727323, "uuid": "ad916613-7aea-4b9a-8482-66c7bfce148b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727323, "uuid": "079df7c5-a32e-46b9-8d0c-ea56e3b83aeb", "value": "442f714943a4108a29512997a634ffc1dfe9b76186562.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27ce1f8-c6d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763728694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728694, "uuid": "87e006de-660f-415d-bdfc-aff5f5c619a9", "comment": "Malware payload", "value": "2871135dcf988b6f09f52e0875593c4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728694, "uuid": "8b383e37-9e65-4737-bbb4-4e933c3bd11a", "comment": "Malware payload", "value": "444837ab41577a1aa7a1c83a150b5e1077db949defec2eb2f7dc79ee4ee1dd71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728694, "uuid": "ec76c7c0-755e-4ed6-a4f3-f54397c88d43", "comment": "Malware payload", "value": "bb2d1353b899742382b35c2de3bfea5e8f346d2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728694, "uuid": "278018cb-ac86-40c8-91fc-61ef7fd783ab", "comment": "Malware payload", "value": "fd206f5edb66cb9bad53ad8ca89d0069e151a34f06ce1889ce3113723e88daafd9dfe508acfeb883b08c3c638ec4f603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728694, "uuid": "11f40dab-874a-406f-94e8-5493d8754385", "value": "T1DE862907ECA141E9C0AED1748A7792637E727C895B3023D72B54F7282F36BD0AA76750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728694, "uuid": "6205077e-46e2-4c5b-95e5-371e1d12a927", "value": "49152:uuhLmR8e7xOfkfVyROjD+HcgXeOSN0YNdTtuMxuD7k3RBGZsp2ZRFYNgaYn8gHfX:A8e71yImH2NZUM8PeRPEF2PcWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763728694, "uuid": "ed268ed0-2860-4984-ac2c-faed5ed04bd6", "value": 7962624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763728694, "uuid": "6c03cbb2-3220-4983-8b0f-f37e0c6c98ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728694, "uuid": "0a3e3445-cedf-43f4-acbd-2f9ef867e7ef", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a031c94e-c720-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1763760338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760338, "uuid": "5a4bd622-0268-4350-aadf-fe3234bff65e", "comment": "Malware payload (a310Logger)", "value": "5d4ffa7e3b2145243327530de5b8bb20", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760338, "uuid": "caa5d553-a130-446e-a23e-ac0ba95619ef", "comment": "Malware payload (a310Logger)", "value": "4526771f047305b7786699d197976567fe2b20b3c2bd9230d2391ac8436481cb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760338, "uuid": "1c98c4ea-1a25-4413-8b2a-e5dad0fa3fde", "comment": "Malware payload (a310Logger)", "value": "2b6c199dfe783b45e01f79a3026f7c09d2215d89", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760338, "uuid": "92459b5d-05d2-4061-8a43-6148e568c9a9", "comment": "Malware payload (a310Logger)", "value": "9ac4838d6399684e5da41e97e633599c1a4826b7043edab983b5896cf81eaf9ce83b7117886feffd9aafb156df27689a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760338, "uuid": "b30cfcb8-91bf-457a-9f6c-4eb7050b5ef6", "value": "T1F175D066A2F14C76D063DDB58C179399182DBFA03E65A8053BEC3F9C9F356213C261A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760338, "uuid": "743b5e8d-cc63-4efa-9ea0-431bdc918e4c", "value": "f039c5cb2843cd9baec0bd54bcc8a1b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760338, "uuid": "c3a2fa3d-467c-4c3a-9e44-4c4b92e39b13", "value": "24576:i2WRMG6YoVcZw1FrKt1r4SB7FqyJPVtRvmFzVC7wmuLD4IZjiU+/A161111:i2WRAVoZ/jPqyJVvQhh7jiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760338, "uuid": "7247ef21-c887-4c72-aca8-c3a566a8c511", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760338, "uuid": "bdae1a73-cf52-488e-b8c8-81f6fd9d2700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760338, "uuid": "b1ec2bf8-49b4-4dac-a85e-023d17b4ea54", "value": "order.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41641a64-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711217, "uuid": "091518f6-6392-4cc9-b189-2ee7c6610de8", "comment": "Malware payload (Mirai)", "value": "0a5816be719b0445f90e66ead4ac489c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711217, "uuid": "ec607997-7129-49a8-b090-0704ec6e3383", "comment": "Malware payload (Mirai)", "value": "4554bddca6b9ff692d22bf72126d2206f5bf7430b8c29adeee9866a781013463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711217, "uuid": "74d3fc28-239a-4169-90c3-2fe82353f74c", "comment": "Malware payload (Mirai)", "value": "631c783c73ad04b316a859f859b2125f676b9149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711217, "uuid": "61735be3-ae7e-40f2-98ab-d16c07c9a24d", "comment": "Malware payload (Mirai)", "value": "84970fdf6aa8e7ec80176970314095867c2d7eb36611d7f87cd407dcf3d2c8b712d1e584b82c313809241089cd277439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711217, "uuid": "761f6569-da72-4cb8-825e-756c96aae6d7", "value": "T15793295BBC919B11D9C102BAFE1E518E331307F8E2DE7213AE146B2D778796B0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711217, "uuid": "5f8a77bb-9a6b-4f48-a37b-7e0546d5adcf", "value": "1536:lInL1mndSmv03/ZITq+WvDwJnY5RJaMDiEk65PPSaBJLgyT5XYbk0psl/:gVmy/CT7W0mk65PPSaBpHTR8lp4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711217, "uuid": "619ee4bc-38d6-47b2-b2cd-7c986841fe48", "value": 95668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711217, "uuid": "485812a8-54f4-4b54-9c3f-2291690068c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711217, "uuid": "a3936b76-70e6-41cf-b2d1-83c0e9c968f1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3205598c-c731-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763767455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767455, "uuid": "648a84f2-d8c2-4289-984a-f9c3779f3c07", "comment": "Malware payload (Mirai)", "value": "e52051daefeeabb6003db23dcd650053", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767455, "uuid": "7ff1d397-d641-4bbe-bfe4-bd749ba283cd", "comment": "Malware payload (Mirai)", "value": "45e2ddfc299b00a7cb4e64ce6a632c7d56a35aadd544de231aab969356d6fa7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767455, "uuid": "c384eb90-6433-450a-881b-ce448772f42e", "comment": "Malware payload (Mirai)", "value": "394d37feecfce4e5d35e7df2ff375d0b138f3473", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767455, "uuid": "798d2b90-a71f-4d82-887a-7596a61fe5c1", "comment": "Malware payload (Mirai)", "value": "7421347ae9ff6ad11a44fbe151c8c0a2cd0932a9ae8e9fa6224d97b470c5bf09f16b09a8709214d92071d52cf2a1aec2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767455, "uuid": "9a99b7de-dc19-4c51-9bc4-46ec2aaba40e", "value": "T13BD2E1261A0A7CA1C3205CB2DBBDD8C3245C69F88BFB051311A59DB9BC5C25E29FCA13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767455, "uuid": "82e28b8f-44a5-48e2-ac3f-b04204c0282a", "value": "768:DSqEkxgmuaN5QRrY3Zz92R9rGMHpdzpMts3Uoz+aF:DS1CuaQRrYKkMHpdtMwzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763767455, "uuid": "deeb878a-28ee-4a8c-b39c-d311a14f35ae", "value": 30984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763767455, "uuid": "1de55229-74c2-4888-b99e-0de4eed13bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767455, "uuid": "63d7c49f-b77a-4019-ab77-8676e625aa7b", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad25cd15-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732443, "uuid": "5a6c1e06-2a30-4133-9423-33d89c6d33b4", "comment": "Malware payload (Mirai)", "value": "1f5646bfd7b0aaa9b16461a940464fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732443, "uuid": "46e61d9a-2c91-439e-9c85-67b9344f337c", "comment": "Malware payload (Mirai)", "value": "4609d98b845634880e732d1ca3281527218389377d20e833c04e9e117e0f8a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732443, "uuid": "fd5dee8c-e826-42a0-995f-873973a0b78a", "comment": "Malware payload (Mirai)", "value": "ffa14183aab573750f10e03cded7be1a5cc888d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732443, "uuid": "2136a9d2-19e1-468b-b0bd-b23ce2ebe20f", "comment": "Malware payload (Mirai)", "value": "276a9a78d628e3fef58629f8cf977d8a70e68bec8cb96e62746f34d1c3c21a74bbccc882f72157485b9f0fdbf4055ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732443, "uuid": "1b047c9f-c745-4c83-bc13-652eec5a4070", "value": "T1CBB34A4273180F57C1970AB02E3F27F687BFE5D021E4BA89650E9B5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732443, "uuid": "448fb568-75d0-4ec9-a6e1-a06635c479ac", "value": "1536:aXXfJWeuWomtxzUZN/fyWpGi8pnKlIxoCwtxKDd9L+JuU1Wg6HtQvM:aXXfJ1uGHwzpNKRog9eus5vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732443, "uuid": "92f77648-5229-4151-b474-664f569f366a", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732443, "uuid": "f33ecb7d-0eb1-404a-a60e-18a8c229d98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732443, "uuid": "aabb577b-b8c0-41b8-824a-9cea72c73d5c", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7748f4-c69e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763704628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704628, "uuid": "b058ee71-b8b7-4dd4-9b3b-c0088bf0f00c", "comment": "Malware payload (Mirai)", "value": "5b42dec22260f26ab6923d6a4de9aabe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704628, "uuid": "67bdab63-1f67-4f4e-9e90-4eefe270e754", "comment": "Malware payload (Mirai)", "value": "4631e9cc9adc54b36676eae1b7f229f18badce503a9c7d4b73eb30921f05a55c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704628, "uuid": "e9a988f1-753c-4f4f-bf16-d264642f4bb2", "comment": "Malware payload (Mirai)", "value": "c6ee16b7b412d3421b23a11bcd490283d133c304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763704628, "uuid": "c7b1f1d1-13dc-4a68-bde6-d5ababb7a802", "comment": "Malware payload (Mirai)", "value": "1bd89cc35c462dcfff6f98ed71c9e24e7dc0f8ce719ca333e56638ad7dc082cdda33d4b7178eb1c81c973bf31288ccb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704628, "uuid": "91fe0b84-c51b-4db1-90fd-d3bb2953db6b", "value": "T19033F1F8C29C5E49E13DD47E670710EB9980D7AAFAD0652F1AF03B364802118782F6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704628, "uuid": "a5e896db-07e2-492f-a836-dccc9a7f72eb", "value": "768:eemWhUN0CjEr8kOpN8aranG7CAcUUlLkrxSgajM/XCRWm2QWQ9g386nbcuyD7U9T:eebBYxsaunlAECcKyAS9Gnouy89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763704628, "uuid": "73a70434-5605-4067-aee6-ace59cf2bf61", "value": 50284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763704628, "uuid": "3964b95d-62d1-4b65-a9b5-0d199840ecdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763704628, "uuid": "6b85739d-7790-4492-a33d-341cf72291a2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84184ebd-c734-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763768881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768881, "uuid": "050dcbe1-0758-4a14-941f-43e73b877e67", "comment": "Malware payload (Mirai)", "value": "e50ec95737834a33d94d9d082dbaa6c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768881, "uuid": "c8e47710-7074-43a0-b77f-fe0799e913e3", "comment": "Malware payload (Mirai)", "value": "47aff64a94753c1e22b1babfecfc6c4d82cb79b6a919008ee4222fbf6143565e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768881, "uuid": "7e595f05-75dd-48b8-b6bc-e335a93df05e", "comment": "Malware payload (Mirai)", "value": "b57d3f5ba5fff9fe1c84af213dd3d7535011fd11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768881, "uuid": "84a30337-df8a-468d-bdea-7c8a803741df", "comment": "Malware payload (Mirai)", "value": "75e91d34e529c7166a286d7c90744df6135c90747cc7582ceb4acd89bd7cfacb63e19ceec0907da8e81e96424fe9e49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768881, "uuid": "8b789aad-494d-49aa-85b0-8276c4287f74", "value": "T1B9C32A56B9819F12D4C331BAFA9E414933136FF8D3FA71018D20AF6523CA99B0F7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768881, "uuid": "11760186-1904-4971-8110-060b8a72eeb1", "value": "3072:qvmuIQmjxGlMP8uAasEWmdMN1ZFUFOAcXzSnRhVzj:qf08lGVAasEWmdQ1ZFU2zinVzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763768881, "uuid": "fab86203-ff9e-4ffd-a569-a7fa5d12a5dd", "value": 119536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763768881, "uuid": "8de1cae0-1797-4c52-891f-0e19612bcae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768881, "uuid": "1f77f2d3-f94b-439f-8f50-ee75ee3c80e3", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1084f27f-c6f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763742917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742917, "uuid": "b2043876-c339-428a-9aa2-1ad74f4a6089", "comment": "Malware payload (Mirai)", "value": "7786907e30ad3b8fffe810d5e6c88cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742917, "uuid": "5a9cb8d5-755e-40f0-b532-c62306b2ff2f", "comment": "Malware payload (Mirai)", "value": "4869a84ee81ee91a5bb0e04f5ad6ef7e421c9ffbff22298e93f2c28a80942d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742917, "uuid": "16e406d9-9936-4f41-bf9d-70a8eee57e51", "comment": "Malware payload (Mirai)", "value": "7aeff2d58efa9d4eca14283879fd3c273962198e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742917, "uuid": "62d1334c-8ca2-400b-8ffb-4e963ff8a77b", "comment": "Malware payload (Mirai)", "value": "6625af7136b37e2f2f7789836c86e0fa21676110ef858439f4fc53a464b3710d150bc2f1d2bf8b2320c704d40f60e1e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742917, "uuid": "5d6e31fb-9b49-4b2a-810c-efc65dbd1c71", "value": "T1BA432950F957C1F0E44305B0016FFBAF9B36BAA60236D5ABEB943932BCB17920C5695C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742917, "uuid": "99bc423e-2cca-40ad-9434-49327806ef84", "value": "768:y4TE+5JYKFl0Ogw+RINPKIvoAfSeYtKXD+cJXImo9D3Zma+Gi3VznYPk3gmzPRZy:yOB5EeY8z+WImoBJmuidg+RZaho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742917, "uuid": "e3b1deaa-29db-4dd9-b9e6-229fd8e41726", "value": 58364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742917, "uuid": "88cf44e3-168f-4153-a082-161d2ef27dee", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742917, "uuid": "737d7255-9f0a-43a9-bf9a-0f5c99c9697d", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b72173-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703761, "uuid": "ccfe63dd-87f4-42e4-97c3-82d33e933c83", "comment": "Malware payload (Mirai)", "value": "0e3977ff8558f0c6252d7a082e85c2e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703761, "uuid": "99d62378-0dfa-4ff4-b8a8-2732b171763c", "comment": "Malware payload (Mirai)", "value": "48d9e72bee21d5b35487634f5d4d98c8db15b57fab2b45045265d9b44410e754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703761, "uuid": "9dad4f3d-e6e7-4ed4-b8a7-7e00c4c70ec5", "comment": "Malware payload (Mirai)", "value": "a31ca1b57f1fa8d37bcfe3617b6ddb3eaa38eb30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703761, "uuid": "18192c72-7456-43b3-9866-938ff73d53f1", "comment": "Malware payload (Mirai)", "value": "903e0923704874d86a69abb4b276e546d6926a3e96f20e94f6e51c85669fa827bd206365713e58dc628465f28de578f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703761, "uuid": "b9e69044-f760-496e-a3f9-2339d6028338", "value": "T19CA3121A639B8ECADF1EFAB5BD0749C883F60B5E20B944B7DAC8A12710353087C59599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703761, "uuid": "5e0716e7-5db7-4f35-8c56-460d3f3277ff", "value": "1536:KQLFN4NCro0F9gBvhMHqgX68aRFtLGqJv8eXOgyDErYlxTt/NhDpgSWu9Jw:bpfo7chaxLGG0eXOgyDE8lxp/z+sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703761, "uuid": "0753aec6-8f76-4461-94af-53b8f4b27051", "value": 101704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703761, "uuid": "ef393465-87d0-4acd-9b4b-36350501e09f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703761, "uuid": "869e405c-537d-41f2-8abd-0cfc80d046ed", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bf12ee-c6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763733670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733670, "uuid": "6605d26b-db4a-46a6-9f64-4d8940b2947e", "comment": "Malware payload (SnakeKeylogger)", "value": "18d1f9c5fcd0c58fbb5e1ec2791781da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733670, "uuid": "fdda71b7-8502-4e38-a29f-e4db8888ec35", "comment": "Malware payload (SnakeKeylogger)", "value": "4aff42459dff49e82320ca2c7c02958f4135549f1bb21168cf42bd06eabd8306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733670, "uuid": "200cf59b-e7b6-4ac3-b241-fe2ec3f86f43", "comment": "Malware payload (SnakeKeylogger)", "value": "f985ef2e9ef8e7493e6cbaf550915ba247b760ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733670, "uuid": "3aff73bc-409d-43a8-96cc-3422b9692206", "comment": "Malware payload (SnakeKeylogger)", "value": "05a7f480c0d3ed7fabca86f4311e29368e1ca10a411b0844250bd753af1ec792137bfc738c60fdab8633b4f997e9ccb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733670, "uuid": "2636f103-782c-46c3-ace4-e55382a078c0", "value": "T12925BE1363DD8365C3B25273BA25B701AEBF782506B5F56B2FD8093DE920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733670, "uuid": "11841429-79c9-48a0-9363-b83de9e59168", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733670, "uuid": "6a57b97a-275b-4abe-a00c-81ad02e94d57", "value": "12288:6tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgahTdC/TsVuI6XKl8t6A:6tb20pkaCqT5TBWgNQ7a1Qc+xt6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733670, "uuid": "e5081433-72f5-47e2-9f53-1c0a1d664224", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733670, "uuid": "37bc7e0b-8ea3-4cf2-858b-c3ab301253fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733670, "uuid": "a0b86e03-b254-447c-be4e-9fa32ad62507", "value": "910742360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaea5b4-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732440, "uuid": "8b211bc2-67b7-4246-aa0a-37e9d9c160d8", "comment": "Malware payload (Mirai)", "value": "5690bd7d1f950a97aa208e35a6e324d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732440, "uuid": "6e9820f3-dd3e-43fd-b3cf-98f3c32cf087", "comment": "Malware payload (Mirai)", "value": "4bcb0a9c2d1b21b4ccc23466f94cf077cd35df25469093a23ef7128f4adbed1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732440, "uuid": "953f1713-7a85-4d13-b345-74254e8e660e", "comment": "Malware payload (Mirai)", "value": "ad61f00a2849ce20e168143e9761155096c16727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732440, "uuid": "0735f6bb-5c70-48d9-a8e9-d04ca563fc93", "comment": "Malware payload (Mirai)", "value": "a2cc114cd31d24a5121a49d78b814262224295c4c66b9b23a42b58c874acfbb057efe71ed3abdf9dbfa3d1a0b5d8dff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732440, "uuid": "a938f79f-2ba0-4bdc-9532-a14343785ca0", "value": "T1E7047B06F642C1F2E18301B26057C7655B30D932032ACE07FB996E757E726099E9B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732440, "uuid": "b6dc7993-37ba-43c7-922c-3c934008ee3f", "value": "3072:VU8+ErxDBAY74QcnRmllaSOaaPd/5VeIz4wTL0K6yZhTmjvqKmXx:VU8+bW4Qc8gnVeI106ZsTbmXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732440, "uuid": "f8650382-991c-4970-94c5-f4062b6e5d6d", "value": 183560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732440, "uuid": "f9c1f1e9-9d90-49b1-9bc3-ae0a16d11ed9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732440, "uuid": "1ebbd091-aa7a-40bd-96b4-f9940eb402f4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1edd5a8-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714493, "uuid": "be7cd4a9-8ae3-4615-ae12-399e85e7d624", "comment": "Malware payload (Mirai)", "value": "366f0c19551768078c644f8ee9ca9736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714493, "uuid": "2704cceb-a768-4c94-b386-2cc11798f556", "comment": "Malware payload (Mirai)", "value": "4c83cc1dc10a3eb858d90b81a1ac0a196ec895c6c197709800e5f35884ec89e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714493, "uuid": "8892aa8a-7bba-424a-a9a1-9495be396c84", "comment": "Malware payload (Mirai)", "value": "5d30105fca63d2f3098225bf99619b8a299aab97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714493, "uuid": "2a42fb9a-e156-4183-bdd1-953d43d3b97c", "comment": "Malware payload (Mirai)", "value": "b3d445b772f1e5c5294ccd11d6a8d4d5965e7c5e625d37f97cf9acd42b8b9e4b69f311dbe8be19503ddbbb4ad68a3271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714493, "uuid": "32acc29e-8713-4a40-8f2e-34c5c71d2f02", "value": "T13A630113E0D9A165CE778FB4874D835F53BA22D4A30D960639BBAB44B58CC17E1DC887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714493, "uuid": "87837ad3-fb2f-4824-8579-16286a402528", "value": "1536:KcDKiblecHk1WJpxdPZz1pBGwL0jNeb4+GAQ8:TVxPHkwJxZLcwowZhQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714493, "uuid": "94c60503-bfc2-4a2d-b817-f59b1267ce6d", "value": 66756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714493, "uuid": "592589ab-07c0-474f-aeb4-e6370b575a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714493, "uuid": "7d45724c-83fa-438a-8725-63c370e48726", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb39edf4-c6ea-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763737271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763737271, "uuid": "3b7ad5a9-eaf7-49aa-84b1-45e440ba4e78", "comment": "Malware payload (RemcosRAT)", "value": "93f04c2e665db03e6148d08fef6a05f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763737271, "uuid": "293dda85-0776-4060-a550-0b89f8b79121", "comment": "Malware payload (RemcosRAT)", "value": "4cad35c7b3d251c14987b912c966caf59968b65dcf37e4e3b577a3bb3d63bef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763737271, "uuid": "57b36d2c-09a2-4177-a4d3-15f23ba1225b", "comment": "Malware payload (RemcosRAT)", "value": "a4e1df9c40f430aff59f14af48972a18af00285f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763737271, "uuid": "9b5eb186-e103-415b-a6f8-16c582d6dc55", "comment": "Malware payload (RemcosRAT)", "value": "9d3f9aa7e49189046d0e679f4d9ab6662940f81770d0824cdd32e4a3f88e65191efd164e752bb69c80f791b905a4004e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763737271, "uuid": "5d3730e5-0e37-4d24-b535-9564eb3cf2af", "value": "T16EB49D01B6D2C1B2D57654300D26E775DEBCBD202836997BB3DA0D57F970180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763737271, "uuid": "3b2cf647-fb89-43fd-86b9-d150fe36b93a", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763737271, "uuid": "959713cf-5d10-4b1a-9451-151792ed8692", "value": "12288:CN9WLGVGUYcvqvvCNQzvCZQBm+sPZ6sSw:CN9sGV5YYqzvCZQBmtZvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763737271, "uuid": "ab7095d8-fffe-444c-b23e-78035e78689f", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763737271, "uuid": "55e0a7a8-2334-4dff-80c6-8e00e987bc6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763737271, "uuid": "41e7b197-71a6-42f6-baf9-a09a08a79178", "value": "sd989f99s9d8xc9v8989890ds9f090sf909023909029f8s09d8f098f8098ddsf8s8df0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752a5855-c6ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763738362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738362, "uuid": "d22638aa-3e60-4106-a2bb-f4bc331f885a", "comment": "Malware payload (Mirai)", "value": "2dedf2254cf5f9d9e25a964692ccd841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738362, "uuid": "14e001ec-23d5-4283-82e0-7198c15fbfeb", "comment": "Malware payload (Mirai)", "value": "4da260c7f69f15f8dbd7b5ee09766c266502aea5c5c5e71426838432eb99b4ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738362, "uuid": "6e5eca2a-6428-4a20-8fdf-f3ed9bba697a", "comment": "Malware payload (Mirai)", "value": "f3eea0441b0ceed0cf7654181a7fe40e42aac3be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738362, "uuid": "16ac84e4-ff0f-443a-baf6-51bfa622b5ff", "comment": "Malware payload (Mirai)", "value": "19774c447d199dd7bb5d67d3d3d0ca3f4e53c936dd9424c7560cecf9b4b888dff2cf399cf1853d02bd0719d3b625bf88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738362, "uuid": "91f03109-5b8a-4163-897e-653e4136c7a5", "value": "T1A3A38EC9EA43C4FADC5205306077FF375E72E2BD232ADD83D3A88936AC62541D516A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738362, "uuid": "f51a239a-4cec-4ee1-a4cc-3230b1dd88c4", "value": "1536:s0yS2BhrM2R7uvNElhWCw0vaLZ+4b/oVdpx6YEtBF7ljaj3SYUPC:s0QhI2R7uvNElPvkdbgVdaYEzBlIUPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738362, "uuid": "161cd038-8685-4837-bf9b-3d97f5a7aee3", "value": 99732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738362, "uuid": "4fd703e8-bf34-4578-8443-c3702237c0fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738362, "uuid": "2583fe7b-8bcd-4aaa-b0f7-c8f1e82a8df9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeb4c28-c6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729139, "uuid": "a5d114b9-0735-40fa-8f09-2b58f1db1cef", "comment": "Malware payload (Mirai)", "value": "62e51e3064b96428c4b88ab7d8f87971", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729139, "uuid": "64a087fa-5537-4cb5-8e72-f78956af970d", "comment": "Malware payload (Mirai)", "value": "4f5777ede0b5e1c643958b1db7bf91754bfbdb966ba5bb4f7bb6f6c8897b5715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729139, "uuid": "a07414d9-e2ef-4c4a-b41a-3ecc3f3e9221", "comment": "Malware payload (Mirai)", "value": "f741843eef9687d6e6e2ef35fac21a4294e6f984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729139, "uuid": "469a962a-3e39-49da-a4e0-6178fd4dd177", "comment": "Malware payload (Mirai)", "value": "b844e4313545b9623bac3eb6b7cf06ae83ccf5f9e66dd825f3b3a337bdf1bce1d022eb2459e15d2e071fc962648661c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729139, "uuid": "1936604c-06a3-4613-8f89-65ba8da3058e", "value": "T1A4E3F809BF610FF7E89FCC3709E91B0528CD556732A93B36B534D918B64B20B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729139, "uuid": "35500445-73ce-463b-ade3-2bca6687df60", "value": "3072:W/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSnZcKhJS6tc5u/KYb:W/IWWosd4Bi3u7KGzJtcMae10lJiZcAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729139, "uuid": "2d28d392-1924-4d88-9114-7dcf636fe55b", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729139, "uuid": "dc27f169-2568-4da8-ac14-e49c9a235947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729139, "uuid": "99ffb3b2-a876-48a1-b63e-a72fdefccb20", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d2e646-c71b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763758299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763758299, "uuid": "13da199c-46fb-4950-a2cc-59b87ada467d", "comment": "Malware payload", "value": "240b12c5fc75d056be036dcfac32a642", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763758299, "uuid": "013d1281-c420-42bd-8a8e-20c7c1369d4b", "comment": "Malware payload", "value": "5096014a5a4e2ab460f650b551832c3360279ae63fb9038affb51c8cde92d6a3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763758299, "uuid": "892aa2fa-6e34-4a68-b52e-9714d61ef21c", "comment": "Malware payload", "value": "0fed15d6dd9ae8bade633b7622165600e8fa2741", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763758299, "uuid": "7f330168-54c7-498f-ad0c-ecca31cccd47", "comment": "Malware payload", "value": "f7b70a214dfba5d1a96e338486c4bb41f2e48f7083f652562f735a06ca0109aef37202eb121c87c5414062b2952d842e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763758299, "uuid": "01992a9b-b97a-4398-ad61-70e54cde5607", "value": "T154B45BA3A39613FCC5A6C374C012362CF5B23F555729469A919AF7210F37A886F3EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763758299, "uuid": "945a4d14-3244-41b2-867e-07044fcd97c2", "value": "3f585fa656f08ba8563771bd5af1e931", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763758299, "uuid": "d4ec9c3b-6a47-44bc-bf41-b0770051f6ca", "value": "6144:dbvGHsGukvjre9EJpHSZfOZgYNl9DYcsUB0TScAk2ihvDQQu9fDR8xdVVhfx2blo:FZAq9aSsWAbCTwh80flsLheDUKLx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763758299, "uuid": "7a93b613-972d-4dde-bffa-5806713e8e53", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763758299, "uuid": "e26615bb-fce5-47fd-8983-43a5c38a8f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763758299, "uuid": "57c9362a-0607-4a7a-a77d-abfadf4e7373", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4bb46a-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732950, "uuid": "46f3a693-4ed6-4729-8575-fe3b8da0731d", "comment": "Malware payload (Mirai)", "value": "be1507e9c69ab6dd9ddf63df507d0e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732950, "uuid": "b4e925f9-7b4c-4934-bfeb-6287468d8334", "comment": "Malware payload (Mirai)", "value": "5230d1a78cec93cf3ba8fdb6d99c35570d8a238e5e5645565378797177c9912c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732950, "uuid": "1c4420d4-23a4-45b0-8d6b-441f0c004a3a", "comment": "Malware payload (Mirai)", "value": "6462a3fbed4452d923c768184dd8b62679617896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732950, "uuid": "259de6bb-9ebf-4990-86ca-1eb4600a2002", "comment": "Malware payload (Mirai)", "value": "5150960916d7502a084959a4c662d1307b44c294c8a16d14f4d16862bce404a1b1de86b5a32873066bfa58820c46af7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732950, "uuid": "c0c22b71-d85c-4bcf-a3fa-47271e62c688", "value": "T103930298D52869A1F192D6B9D09ED47A13821DD10EB3A24EFC94F2CB5B122DD43BF037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732950, "uuid": "d2e3f0f5-f03d-4f6e-b021-76bd9d8b0f24", "value": "1536:6m1XS3870USeTauEQrlxOlCSKlwzvj4o8yErG02YSaYkhySZsPaI+DBlbbXcCw6I:6mC8/92AlxD/Ly10UtB+lbbJDT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732950, "uuid": "5820d347-5a34-413a-be0e-a8991b59d439", "value": 95680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732950, "uuid": "20a8588b-ea77-476f-9f65-374f1d71d10e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732950, "uuid": "b3895f5d-285a-4f81-bc7a-5a7dbbf1e5a4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd35756-c6db-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763730837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730837, "uuid": "de054db4-45a8-490b-9b27-e8ca069acb10", "comment": "Malware payload (MaskGramStealer)", "value": "cf0ded050378cb476a2a30de73152224", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730837, "uuid": "9709761c-ada6-462f-91d7-507c1bce69ca", "comment": "Malware payload (MaskGramStealer)", "value": "540c3a52fee60aaea28abc5b11a5327d8ef435d425ddbec13e0adc1afd027b2f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730837, "uuid": "d29a3ab7-9808-45cf-ad52-8d7a12adc4e0", "comment": "Malware payload (MaskGramStealer)", "value": "c3f7a6f1a88a44eaf42e175743643df7ddb2ab1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730837, "uuid": "26266658-3d44-4ab3-baef-595cd0493972", "comment": "Malware payload (MaskGramStealer)", "value": "c1406daf8a04cc1196f331b77efb18ce8da00293fc8bdc00b984ba96637420990dfd1f1ccc342f1dbd09bf0dc255f785", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730837, "uuid": "e069f110-4da9-40d0-91ae-839b44813b37", "value": "T1DCB56B0BFCA158FAC0A9A23188765186BB61BC451F3123D73E90B7B82F72BD05D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730837, "uuid": "cf089552-b76b-4a64-92cd-6c309a9c7cd2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730837, "uuid": "417ce8f3-b9ef-433b-b2b1-a89f423c479e", "value": "24576:BZnAFEM3uYD5NDdGGd8qIPVRnCUgjtEVfzGS9xGmcoeleTNj4HGu2U+cVTFPd:BZnez3XbDMGmlHngjeVnUm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730837, "uuid": "22455905-2889-4946-b0da-f27c517cf171", "value": 2383360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730837, "uuid": "195ae299-2047-4cd8-be2c-3839b12ab64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730837, "uuid": "1e9400be-f70d-4e6a-a747-1816e1fda3f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50518a1-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765098, "uuid": "d07af849-570b-4382-896e-17af9ad7719b", "comment": "Malware payload (Mirai)", "value": "59a803200d14e681b38389ee24949e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765098, "uuid": "415a81f9-0286-409a-845b-7bfd872b8d47", "comment": "Malware payload (Mirai)", "value": "560679b45c8f78457cd1e09dc6a2ef3ac45b7b4b1afcf6ab5ed9892e82d4ef16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765098, "uuid": "20cac9bd-221f-487a-a185-d06494587c06", "comment": "Malware payload (Mirai)", "value": "53c62636c5f784762897b95287aeb46cf713e4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765098, "uuid": "2244aa33-3c23-42bf-b28b-69b626b0d0a3", "comment": "Malware payload (Mirai)", "value": "b56a68574e8318e47aca08e1db71c2acb323d86f70ec16afb95605dceb96bbdd9f7b1b584bafa5a9348276f4d5b8b541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765098, "uuid": "7bc6ae66-02b4-4c4f-bde1-5a7a0c2a093d", "value": "T18D937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765098, "uuid": "1e991f72-cf75-4dbb-99c6-7f77193f0a7b", "value": "1536:W/QCZaxGdvts3i5JPhoRsxPu++4HRsUIKqI4FrS4LSa:WYCZa8dvm3oJPhssxP5lR+KfUmDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765098, "uuid": "9a6edd46-6d30-4f03-bb43-4881175ca31f", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765098, "uuid": "90b4fe81-8136-4978-9405-d7a633c37c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765098, "uuid": "3f1f2eab-26a5-4284-9d52-967606eaf165", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2c515d-c727-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763763288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763288, "uuid": "ac5ad0ef-ca47-4948-86d4-330e8dd967ed", "comment": "Malware payload (Mirai)", "value": "f4218aca95bcf230ea18bc25c1bde5f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763288, "uuid": "a4dd6c50-2c9a-490d-8422-29ce8c7ff339", "comment": "Malware payload (Mirai)", "value": "560ff3969aaeb7bd6d66c5adde827c20a1ae1745be67d570e2ed3b78ccb7d76f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763288, "uuid": "73a29562-8892-4e3a-a452-7104ccf57872", "comment": "Malware payload (Mirai)", "value": "089a7b300c150138a53fa4e6fe9eb24b6d865e9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763288, "uuid": "a72b2730-8f31-4f61-a263-77ea52f0cd72", "comment": "Malware payload (Mirai)", "value": "05ab5660bc6a9ddb7af490bb5b694db1fe724ce0713c9882dcedbf1126781280b84830b2b99ee1fcdc6eddcd3ede5dee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763288, "uuid": "6d2dbaa9-1371-458c-95da-6c9a5587c507", "value": "T14E01CCCD66B57263B644CF38B06680AC9275FAD0B27C8B16F9D40CB6C4D9311322AB7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763288, "uuid": "bb241ac9-2a63-4b2d-a808-b9564840254f", "value": "12:3J3L4yXBJL4y2YVL4y3NIl5EL4yc0LKmpL4ym+OQJL4yjjMVSL4y9T535L4yCSOi:3J3eYJNI7kKt+XNjFT1Ylut4ErRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763763288, "uuid": "a500b943-8308-42f4-af30-43f1427cc7ab", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763763288, "uuid": "c64ca8c4-fc80-462c-a31c-2300fe779449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763288, "uuid": "08b138bb-b6d2-45f8-ba5e-a1d009d4dcbd", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ce3ae2-c730-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766971, "uuid": "9f2cf4d3-70d1-4dcf-bb20-09f6d4dbe81a", "comment": "Malware payload (Mirai)", "value": "8e52258611f2f04c19c73102adfbff85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766971, "uuid": "2861a4c5-4f29-4754-9a49-3a226da25dc0", "comment": "Malware payload (Mirai)", "value": "56397c64274abe4fc956cfa96fa0a8229b385b339a959a467c4295c824968601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766971, "uuid": "b4ef4795-f599-4fe7-9fe0-2eaa9c3126ad", "comment": "Malware payload (Mirai)", "value": "df7c036a6044f8d73ba953dff537b2c2fd00e21d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766971, "uuid": "b37cc66d-27ee-4529-bbfa-ec599f40ae53", "comment": "Malware payload (Mirai)", "value": "8ea6502d1c509e60bec9ddabe620e3ddeb27b4894a36f7b33aeab0f45fba3a64c52c4e926ebd379a63d7d7eebabbd134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766971, "uuid": "fe50c2d0-bb72-4a73-846e-e553c138af43", "value": "T19E13F162E18ACD43E44D04FC59FE3AC64A60F75E8E4A45E01BDC24281D3AFD32B997D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766971, "uuid": "9c1b4193-b353-48cb-b5ca-87694092a7b6", "value": "768:Fpf/8KshvtflEvvMYx/jXZTTRJfSyKZ13v5/KbPiDcfrAGRALJ65w7EC8/tJnbcT:j/yFfKMs/jNTRJfSyINRybPiDcDfALGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766971, "uuid": "46a5f053-e6e2-466b-b575-e2f0827f906c", "value": 45432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766971, "uuid": "3ce15f82-8a5b-4167-80f7-9b9447476c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766971, "uuid": "9d8e2154-a382-4aac-9755-969120f3239f", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf018a3f-c69b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703294, "uuid": "52010da3-fc33-4a04-968c-16140e814858", "comment": "Malware payload (Mirai)", "value": "e9f2ce7659237f4306b47471a3438ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703294, "uuid": "c8b8928c-3a2d-44f7-896a-33f3ea7a96c1", "comment": "Malware payload (Mirai)", "value": "58cfa6e06713e1a03b09bd29cec82f4aae4990f02d000824cd36b4af8ca3e53d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703294, "uuid": "395f6895-0dad-4bd6-be4e-d4570db0c2a3", "comment": "Malware payload (Mirai)", "value": "7dc4ad7ee55e1c300607742ff4ace4d38437b9f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703294, "uuid": "8c02bb05-65f3-459a-aed0-635954bc16a9", "comment": "Malware payload (Mirai)", "value": "e288a0cae54b6cb261f88701232349c15370d98fc9a56a420dca9cbf16ab402bf2ab677ac82f3cb2c0ee58236a9679db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703294, "uuid": "f70ccb6a-522f-429d-a3bb-1c021ec41ddd", "value": "T12553F11E5D98F845E29DA43C9C78F7BBC8EE5895257B938816300C18EFB1A47399E0E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703294, "uuid": "8065dcbe-c15e-4937-8260-2105abc4b6fc", "value": "1536:64YAsVTX8FMxSgNlVaRcMEZTVi7mopeDQqJFeK:64YbsF3olQRcMEX+mgqQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703294, "uuid": "69b9c8a0-109b-448e-aaf1-2dd9c736264d", "value": 65092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703294, "uuid": "35cfa547-909e-4057-b73b-e717033086b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703294, "uuid": "16863e2b-41cb-4214-87e9-ef82844b3c67", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bc1606-c70f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763752966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752966, "uuid": "86109248-e70f-4c1a-b11d-f2b746fea41c", "comment": "Malware payload", "value": "1afce9eb7850e07a5238f2e86cfecb9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752966, "uuid": "33432362-19c4-4829-bff5-db9adbcd8424", "comment": "Malware payload", "value": "5902640be1d1e83848e2ba869e5acbf8317470993943c237666b7dc617ed8628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752966, "uuid": "d91768c9-1f47-44db-ba2b-496119b9d121", "comment": "Malware payload", "value": "840cb0154ed13be2ee587d4e3cca585c01c1da81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752966, "uuid": "fd1e3f70-3a69-48a9-961a-1b9558c70dd0", "comment": "Malware payload", "value": "25376591db27d479949ffc7bcdad2efedb018a17902f6d991e9d8e44266fa1f18bac7f524a4119a2508a31aa8291956a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752966, "uuid": "d6f33357-ae28-4551-9882-082b7299ede5", "value": "T1D5461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752966, "uuid": "6b41902f-0489-4106-b2ef-4197ba201849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752966, "uuid": "e6183a66-c5c7-4680-b2d1-dccba5f2c90a", "value": "98304:4h/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:4h/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752966, "uuid": "8d020281-2ace-451d-92e3-a4da274ff5cf", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752966, "uuid": "1220c1f8-2862-4cf2-915b-bd52c2a2897c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752966, "uuid": "6360dba0-a3a9-48f4-9f57-a03e2533268b", "value": "exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497c9fdf-c688-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1763694909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694909, "uuid": "957c852a-c5ce-4479-a758-e96107d7c8d2", "comment": "Malware payload (DCRat)", "value": "0d143aa10eae99e51887ebcf9bf82042", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694909, "uuid": "7ccb5a71-49ba-476b-a7ed-f270a3342fc3", "comment": "Malware payload (DCRat)", "value": "5928fc679943aca8e9c19dd90d57ef8b4bf871b9b5b79e6c6acbcac9cd301d7e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694909, "uuid": "3c3cae46-2033-4c66-93ac-572ce8470544", "comment": "Malware payload (DCRat)", "value": "427de648f397954ee7e7523fb0e6e9fb9d0859c7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694909, "uuid": "05aadfe4-2594-4bcd-8bfa-f323c8322302", "comment": "Malware payload (DCRat)", "value": "970762407f11555208e2f4a505edead4274641af7d7b42cb7d10d8133c12b6b267a5bbeb8d0306a4e7ff149baeeb034a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694909, "uuid": "980771d3-c214-4e36-93d7-1c627585dc52", "value": "T1C6658D417E44CE51F0191633C2EF49884BB0995176A6E32B7DBA37BE55223A73C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694909, "uuid": "65f081e0-b43f-42e0-82f4-54281cede91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694909, "uuid": "6c489c3c-c3b6-4e50-80ad-2e374a7d4a06", "value": "24576:dZMMkehlV2LQ8G29L0BNzZc6QRGJJDHu77RuZSOB/3fhRC:dZM2CVecYJy7WSOB/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694909, "uuid": "d302948e-aba8-4f83-af8a-86d36166b2e2", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694909, "uuid": "1496c65a-399b-4663-bd70-f46d1539a351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694909, "uuid": "9d1dbbbc-db41-449d-91c1-732fa715dd49", "value": "0d143aa10eae99e51887ebcf9bf82042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bb9ef6-c6c9-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1763722812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722812, "uuid": "d39dffba-dcd7-41bb-a3d6-cd42bc010e7a", "comment": "Malware payload (NanoCore)", "value": "726efa8d5fb1d31b30946ca592208c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722812, "uuid": "9ec786ed-f51a-4c49-bb4e-5590168817e5", "comment": "Malware payload (NanoCore)", "value": "59aa39aa8d8db4824c9f886bdb041af41e8fde2da59ebcc873b47a1ccbff814b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722812, "uuid": "b5bd22c6-ccc0-4589-afd5-4e55191f2488", "comment": "Malware payload (NanoCore)", "value": "445325793a9062a8655007a258e780781a78cf85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722812, "uuid": "cddffe99-0f34-423a-9649-91c1f62e554e", "comment": "Malware payload (NanoCore)", "value": "8fb9c2ce2497ec76aa4de95adf1d478921929fa082502d076bf2972fd31ddc8e8b09e9acbc5f91e58c6ee563dd6e66d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722812, "uuid": "d72ceca2-8c08-4078-b588-e45587a567a5", "value": "T1DCE40218118ADE03D4A35FB026B5F2F127B9BEADE821E6164ED73DDFB4557002A403A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722812, "uuid": "73454214-ab31-4d41-bfc1-1c404c16eda6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722812, "uuid": "f5e706fc-df32-4413-a51f-0745afa64ad9", "value": "12288:hSDER0GYVIpU2KDhxfyb/k8P+s3JHae/6I9MCiZuqPyUd:gxVz2eht8c8+CJ6A9MhZVyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763722812, "uuid": "e1e0a6b7-5ad8-49c1-9240-e36b7abfd457", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763722812, "uuid": "08e38749-e523-4b5f-b966-bb861b8f6c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722812, "uuid": "f29f5989-4b1a-49cd-8b08-105cf60f6f3f", "value": "WE2R08U5F6NI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ae49dd-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765819, "uuid": "7998c0c3-1b42-46c9-b0b4-a6a5044bf8e9", "comment": "Malware payload (Mirai)", "value": "f57970f865d257a0e5306e9543d24f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765819, "uuid": "91416173-00db-4a44-929a-c433c60088d0", "comment": "Malware payload (Mirai)", "value": "59ba07d5b5d679c3815d5ae90b3a8724a83e81171ab409534c06d1db60716036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765819, "uuid": "1c71e62a-2060-4475-a8d9-f3dc9543706c", "comment": "Malware payload (Mirai)", "value": "fdf80238850b4e8239ffb32ddd28a453b6bda4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765819, "uuid": "1f8746cb-a613-4fa9-8959-1b852a1eac6f", "comment": "Malware payload (Mirai)", "value": "0c13b50c7b7d0ba802bdc5ab4482529185b1c49d05f5bb5eee894696947875dc894a7e65d3c6591f11adc14d8bdae27a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765819, "uuid": "05a7088d-d30b-4bba-bb2a-1206c47daab5", "value": "T13433F1A9D205F0E6CBBC9E78424E9E5142C5B068625F27820722DFCADB4890B718C8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765819, "uuid": "38d5d4e3-dd17-4a94-8237-2ecf1186d227", "value": "768:AZtFqEBJ8r1XHfJZVXxhz+55BuEGGwEoSw2qcEiAzhfX1OiF7FWU8:gwyovJTzBGZ1ZZE7fX1Oix58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765819, "uuid": "f2272710-6ec7-4510-bac7-3e5c419b0ee8", "value": 50452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765819, "uuid": "6b2fef25-9491-4f49-b9e4-0666a3e26440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765819, "uuid": "0f82ed77-3069-4bd7-93f3-e93a0bf1afd8", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cbd27d-c728-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763763648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763648, "uuid": "4803216d-46d8-47e4-a795-ea5948b18978", "comment": "Malware payload (Mirai)", "value": "b251361ebf1e96ab1a5fef1fe3799aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763648, "uuid": "5a1e6856-864b-467e-8d6f-e99e765c1920", "comment": "Malware payload (Mirai)", "value": "5bb4088d427c21074192c359aa6adcfb942326f319bffa7b316afddac7266e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763648, "uuid": "ae2e73ab-2089-49fd-bce6-3c8cfa512564", "comment": "Malware payload (Mirai)", "value": "4296d414109247d4289282efa163a6fc279c9d38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763648, "uuid": "a86058e1-4f82-41a1-acfc-2bcb5639e006", "comment": "Malware payload (Mirai)", "value": "b8749e74bbecfa1ec3b6bd402b2450c4edf0cc69a1796538ec9eecc1ae234c89d490b987ffa16f5bdb8b3924d01e8431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763648, "uuid": "5f521fb6-3a06-41ea-bc65-771166966627", "value": "T17823F168D11FE771DB74D8BD86BE498834B6A5F6C0DE377D0D004B9C6980C0976ACAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763648, "uuid": "b51637d0-240d-44ab-9269-87b7d733a9c2", "value": "768:Ax/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg47PSuyKaOEw1iJhiDbKoUhyFELabtC:RnoTBJKY6xeTsWWelPfEwchW/UhyFEaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763763648, "uuid": "9f8c08a1-1e91-4421-bcdb-5b1013684fd0", "value": 47372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763763648, "uuid": "55d2bc1a-6e94-4c50-b63d-f4c01c611f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763648, "uuid": "afe349dd-e586-420a-8cde-6463b55267a3", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ffd66b-c6ab-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763709909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763709909, "uuid": "6cbdf1e3-e888-4b16-b864-7225d22067b3", "comment": "Malware payload (njrat)", "value": "894356261240ca83d917cd5a1254076b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763709909, "uuid": "5e61f5cc-0880-47a2-a18a-7e70d1571c63", "comment": "Malware payload (njrat)", "value": "5bc0dcb006307b8c5475a301c3396feed74941d577c33cb65aa8a0ae3bbccf81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763709909, "uuid": "f5df89ef-a094-40ab-bcde-1cd95dad0483", "comment": "Malware payload (njrat)", "value": "9d1ede39caf270af87c50db8dcc5a56f269663ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763709909, "uuid": "aea7bf9e-30ce-4cce-af8a-db5ad895c181", "comment": "Malware payload (njrat)", "value": "40e6c34e14547cd480cf71d27c0fef779ee0b5e141d0c89f114fc2193dbc70a4e63cb6a370f94a22b5aaf7aad8ffcbfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763709909, "uuid": "86798c31-c6f3-4071-a148-c62f4e8d6636", "value": "T1B175F16423539533CCEA37FBD6DAB26063309EC3D30597B269CE6615A817BC7160829F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763709909, "uuid": "b4785264-3e90-47a5-a239-af2ff266998e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763709909, "uuid": "e1c1f332-4390-473b-9d06-e00cfdac51bc", "value": "24576:g11EjzQIEjzQIEjzQIEjzQ7EjzQIEjzQP0ZifKG5L9ixT2llvaG8+R:g/cccvcr0UfbsZ2SG8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763709909, "uuid": "e3c2b904-fa4e-46a1-8c7a-9bb10e76c78f", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763709909, "uuid": "243ece2d-7034-48ff-91fe-d80de64590cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763709909, "uuid": "0885c7ff-0a4e-45b7-bae3-a0020a88780c", "value": "894356261240CA83D917CD5A1254076B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10adbb3-c6d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763726007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726007, "uuid": "9fc3aaa8-14d5-4826-a055-06df422b30af", "comment": "Malware payload (Mirai)", "value": "fff407d46f8851f8ccb80d2287602546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726007, "uuid": "0ecb025b-1ca0-4010-8f4a-1933120b4f60", "comment": "Malware payload (Mirai)", "value": "5ce6bc124864363da3a6227f009d253dcdb09bbf04a798a33bb8f3c4d439a2a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726007, "uuid": "08be4007-c4cf-4afb-ae5a-da72be7fdf06", "comment": "Malware payload (Mirai)", "value": "78a6817d0a58b9d61a86650900f936d89312db4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726007, "uuid": "813c91f0-dc7a-4aeb-9c60-ff0bfb037f62", "comment": "Malware payload (Mirai)", "value": "09d6ca808fd3d27ed4e3e43023256e2bd152d27b2cd036f46e08eb1ed9fbcb5023f5542a6885ccb2dfa60543a6ccdebf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726007, "uuid": "4a0f242d-901c-47ea-aa44-14a9c54a145a", "value": "T1BCB34A03B9C28DFDC049C038437EB536D925F0EE1739B29B67E5EE266D0EEA00B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726007, "uuid": "737e5787-49a9-4d66-8976-a99ff94ed067", "value": "3072:5Ku4lbmjzXIei+vgQed+G5ELlCvTjiu+90FDzFDya:5Ku4FmvXIei+vgQesibjOSVea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763726007, "uuid": "1a9b277f-3d09-4f81-aecb-76c9838ee98b", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763726007, "uuid": "072f039d-de15-4f29-b143-a63833ce800a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726007, "uuid": "a81daf6d-6931-4ca2-ad19-9232a5330af5", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6653f0-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714480, "uuid": "7c630f7d-c1d5-4b1b-8f0a-ca2e22f7499e", "comment": "Malware payload (Mirai)", "value": "3cb1cfd31483c92227847744595e9fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714480, "uuid": "5e7178d6-9015-464d-9ebf-9ed78459d405", "comment": "Malware payload (Mirai)", "value": "5f0f39365f6409df14c648f42dca41142d9b296bbc5e6f8ef374636fdc1bd5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714480, "uuid": "a8907d2b-ab44-48d0-813d-d57bc0be2603", "comment": "Malware payload (Mirai)", "value": "187ae47b3cd9b75445f30233843d3e1a1892edd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714480, "uuid": "e931ad89-cc82-4d7a-a474-937060613c52", "comment": "Malware payload (Mirai)", "value": "2b0788625cd662b54d32fd1a1f1bd323fef264cf67a5c5abacec7033330e601acdcdb05e993e5861d35290cd5f875cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714480, "uuid": "c4e8597d-177e-498f-b353-25638317ace4", "value": "T1CF7302293AF8A5B4CBA13DF3472270B1824F51BD98A963C64F5D9C648CA84EE644C46F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714480, "uuid": "cae92391-e0ab-4c29-ac16-7e73f263a97f", "value": "1536:RM8bhFxD13QC8Rf3VsktjrP8aw3kAtmSL9NCkL2SIDNj:RM8bhTS/r7hBAtZNCU2xNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714480, "uuid": "2ecfdeb4-92a8-46bb-ba8d-608b74dcff5e", "value": 75620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714480, "uuid": "6b5da1e4-ea2b-4591-b754-00a17daa990f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714480, "uuid": "4fe08279-3d48-4fa0-8ce2-b6e71b19ec0a", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22154828-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764851, "uuid": "38b59f0d-a7ba-4207-a072-3a83d6c38cc3", "comment": "Malware payload (Mirai)", "value": "c46841de88d00810142be7753b8b81c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764851, "uuid": "ed7c7ffd-60ad-46f5-bc72-29af3dd91a41", "comment": "Malware payload (Mirai)", "value": "5f6d315261a928c32802d53c6ca693c57affda17939b3a7290ed5d8ea9138f4a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764851, "uuid": "edc4c7ed-1ea4-432e-814b-a74124c1c23a", "comment": "Malware payload (Mirai)", "value": "2837f44a08d92758db975b150726dd2aed11a4ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764851, "uuid": "9e808b2f-bf56-47b1-ad02-fa95d56f3a13", "comment": "Malware payload (Mirai)", "value": "842c2415d4e915a9566a904cd8ded8cd9d5d4cbdcbcbf2f74c05491ee40e68d6c81dfc767ebaa13469bab44194821d72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764851, "uuid": "835c70da-fa28-4c9c-b297-01377ee0d51c", "value": "T1545142DD2AA05A215810D8BAF2AAC5CC7195A2F71CBAEF4098DF36F5C06CD447C7C762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764851, "uuid": "37417c12-e446-4ff8-bebb-db7c3c414a86", "value": "48:vJACyfJMO3GJ//JJllXnJOwjJhBEJRURWTJRRGJF7Frb0SolJ6sCsKe3JZeZgrBw:vJACyfJMO3GJ//JJllXnJOwjJhBEJyke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764851, "uuid": "dd4189d2-bc81-431d-998a-418e1cd96779", "value": 2778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764851, "uuid": "062fd9ce-e718-448b-bfe7-1c8fc546855d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764851, "uuid": "cf23749c-20aa-442f-9efc-80f24150021a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c596b9-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703758, "uuid": "a2552ea6-e3cd-4842-9764-89086d9b367b", "comment": "Malware payload (Mirai)", "value": "a29989e541b2e7a50106d137fc77c275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703758, "uuid": "02f3cda2-5e88-4824-91d5-0cf2d95916ef", "comment": "Malware payload (Mirai)", "value": "6014ec0a24a54ac8ad933530e2d11f4c5a5f500bd9b283c7225c99a3d7207c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703758, "uuid": "bf9e2ed3-c05c-410f-ba75-51690af9396f", "comment": "Malware payload (Mirai)", "value": "cda585c701fae0336c9f1eef4a9d4675b83eaa61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703758, "uuid": "831ea4cb-6ed9-4047-a416-fdb627fb4b96", "comment": "Malware payload (Mirai)", "value": "93f9aa5cbce194d2cb13c2d6f466a8500c507104be1ae59aed3bb435625b55890681070a5e6cb68e6c33ce5583f78196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703758, "uuid": "497e0a72-8ea0-4466-8688-a66922683847", "value": "T1838302E43BDA8CE2CCE327789509D6A617C3377B514A41F1825A1FF265E30472BC8A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703758, "uuid": "342bddbf-d33c-4dca-a6dd-c8500745cc21", "value": "1536:ZRYUCzZeXf+ZPO8/7zw7F6ytFt0+uJiyYSmstKtWRhxhx:nCzZkfj8Y7j231YJstSWRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703758, "uuid": "34076707-b80e-4ae0-b147-103e7b27f2d2", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703758, "uuid": "92624eae-4d66-422e-bd25-5cee0d4737c0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703758, "uuid": "215981f6-ac7f-42ee-aa2c-55e36f3ee2c6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b034c8-c70a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763750786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750786, "uuid": "12f4c0bd-6e1f-4d8d-b930-44681f602b48", "comment": "Malware payload (Adware.Techsnab)", "value": "eaf461bd46aa4022c06bf829c430eb9c", "object_relation": "md5", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750786, "uuid": "26ba6872-ff8c-48a3-ae5d-0c7a4b5ec4a4", "comment": "Malware payload (Adware.Techsnab)", "value": "605555134954007a52f2d6045662f9edac55208619b2d20917e296a6a3a42f27", "object_relation": "sha256", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750786, "uuid": "31d078f6-e233-42ef-9255-e1ac9aab7d89", "comment": "Malware payload (Adware.Techsnab)", "value": "da33ffb61c6b81e814ef17d9980410b645c67dbf", "object_relation": "sha1", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750786, "uuid": "76166b9a-5a6a-4643-a62e-05bd9bd346e2", "comment": "Malware payload (Adware.Techsnab)", "value": "843466ed812256d2b7d5f7cabe6b1aac12506802b8fbb4c86fc4f64c7353b92494f90ac045804e5f92dfc5218ebde8e5", "object_relation": "sha3-384", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750786, "uuid": "5e140d0c-0771-4bdb-9966-9323aa196707", "value": "T1057733D001889102E6C4E5F962C872E9D570866639DEB86F377C2DBD2DF7EB046272C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750786, "uuid": "76fb63f3-3066-4f66-8ed5-f0323dcf08ca", "value": "786432:KUmekzwmD7xoixfzzcGSUOjxMunnaJ7AiYwds7Kju3//2:KHZxoszc4OjxgdiKjE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750786, "uuid": "655c66da-b001-4a8a-a781-fe1803a77713", "value": 33895635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750786, "uuid": "57d7bdf3-e653-48b6-9d9b-b50a737797ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750786, "uuid": "447cbf47-dbe7-49b7-84e4-e8c97af80332", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63aeb45-c6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763733747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733747, "uuid": "0bab0e89-e516-4b85-a456-e4696679e347", "comment": "Malware payload (Mirai)", "value": "cf217bed23f02c6046d797098f337000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733747, "uuid": "f21755ac-bad2-419d-aa4e-f67a79e8bd19", "comment": "Malware payload (Mirai)", "value": "629fe88d4c1f2e43314353472baac182c1b21592979933f80464a17d5af18035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733747, "uuid": "735ffa09-e4fc-4009-a983-fbaa4dedad9f", "comment": "Malware payload (Mirai)", "value": "87435741df9dc811b6172dc00458ab9f596f0899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733747, "uuid": "61f67cd5-197e-48ed-b585-7bc3a299f0f7", "comment": "Malware payload (Mirai)", "value": "824a9fccfd35cf48bf811ac905647ea02ea11b0fd903f34419fcfbc99a05b9f68412eb9e997735947a714e4935670012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733747, "uuid": "608b330e-e82c-4550-9a8c-3504541290ed", "value": "T1DE2309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A499236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733747, "uuid": "cfeaeb5f-8c21-4066-af7f-e75f2a86e9fc", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG929/4Qwbbn2i2e:Gv4QPfZfW5XTOeoEzA9AQw/2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733747, "uuid": "b6874670-5caa-4aa0-a88f-643eb4379eb9", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733747, "uuid": "f30bd3b6-550f-481f-9559-eae71d1e9a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733747, "uuid": "f35e5cc5-4609-4628-ae66-4dabe1312af7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf40fed9-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763742378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742378, "uuid": "fa990e5d-4c9c-418b-af35-119d7a8001b1", "comment": "Malware payload", "value": "52a061bb71c67555425e909529f347c7", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742378, "uuid": "1ef95b04-a883-47a7-93e1-9711448d7f4a", "comment": "Malware payload", "value": "638d8387177af5c5575e9a816ecb49d06fc680c4a191628a268b349ac0e770d1", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742378, "uuid": "ac80b161-d4bd-43be-a0de-72a0623156b6", "comment": "Malware payload", "value": "3fabc68abeb782cb3f7e295999794be3f1ee91a4", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742378, "uuid": "4706f08d-de2a-4c86-8ef7-60cbe9087c8a", "comment": "Malware payload", "value": "450f6245a4359c61a2dc7d026607df5435304ca859e520dc6bf10067537d6253f5a2ec3df79606c79e2067a85c8cc2cd", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742378, "uuid": "0aa12ec5-6930-42a5-96e4-7372b2bee3e6", "value": "T13F85232121D56091F8F78B7159B212175632FCA14A7D82AF1686A63D4E333C0F27AF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742378, "uuid": "444b08b1-5db4-4244-925d-5bdbe134263a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742378, "uuid": "6ad807f9-945f-4e8c-8c2c-8b86b4d08678", "value": "49152:Bjd7HUqtZDBsGmsggGtE1emH7XcgCyIdOfI0UPsBZvFjTKnwjGjkQXQr9dD:FifgGtE157cafIFPG8m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742378, "uuid": "d34ce4ef-7de7-4b00-b168-3c1a0765d9fe", "value": 1780904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742378, "uuid": "a56f15c1-6c6e-4c76-a630-b9276273362b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742378, "uuid": "ba273311-bedc-4fa5-947d-71d213415bf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967e7845-c6f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1763743572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743572, "uuid": "f9a1952c-0720-42ac-8494-081618658cf7", "comment": "Malware payload (Tofsee)", "value": "929316343d2681ae6fb43c3700403d4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743572, "uuid": "c4bce4cb-ef78-49ea-84bb-4d4f83c585fd", "comment": "Malware payload (Tofsee)", "value": "63f72ec7cd6d87712ea2ac3c6078cef33d44c33eb7837cc35fe3dc6a27bb7270", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743572, "uuid": "10e687ef-287f-48d1-af2c-af29a07c03cf", "comment": "Malware payload (Tofsee)", "value": "4d51ed71e03a7a9f567906d9584c4184814bd9cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743572, "uuid": "692357bc-8366-40bf-9e5f-2b37ccd1be16", "comment": "Malware payload (Tofsee)", "value": "896104827f6b85d1675316e12de7693fb6ca614a2520e7426ea9dcf29d439c7c7cda3717ca329ddbb63a735cf38be60d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743572, "uuid": "5f4af738-93ac-42f9-b275-4db4283abd55", "value": "T1D206F133B24E273EE46B46350967AD54547FAB13650A8CB38AE40F4CCE2946C1E7FE16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743572, "uuid": "ede3dedd-a925-453c-985f-525e34d327e8", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743572, "uuid": "414922ff-c9fe-4cb6-9acd-28d558a32892", "value": "98304:oDb9gCWm/4fpYtIr5KeOIaMh4r4CuowQuvA+J:oDb9gCJ/4RY8KeODMhq0ygj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743572, "uuid": "873aec71-0456-433f-b8ac-07239de0425a", "value": 3667623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743572, "uuid": "002098b1-23c8-44b6-809e-f3bd2f2293b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743572, "uuid": "1be7aff7-5917-4b24-bcd6-dfb7a2260694", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3d5971-c70d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763752228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752228, "uuid": "19cd4dd3-4367-4085-a878-5c4f2d304ef3", "comment": "Malware payload", "value": "8aca621280d292af38db82b1fa2cd05b", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752228, "uuid": "c726e5e8-a7f6-4d27-812a-859f46446c80", "comment": "Malware payload", "value": "6408b414a2046d65937e93d6b2fb4d5c8f20a089608620df7deac48ec2757b5a", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752228, "uuid": "85dfe3de-e508-43ad-97be-c6c0763da553", "comment": "Malware payload", "value": "e49ed007cdcb4c5cb54ab4ec407dc1a7a23ce36e", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752228, "uuid": "fda8a367-3a8a-4aae-9a5f-fc3cd300754a", "comment": "Malware payload", "value": "a83998f0f277e336f62f1822033c0648a61c2af012e9c0cc43fe89864225cee1c537c08db05465f4916277b49ec26a83", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752228, "uuid": "810949ca-daa8-42c6-b19f-5f28c3026529", "value": "T16AE6232BF2A8507DD1BA863145B36224BC773DA1A7298D9B07E8750DCF327A05D3E706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752228, "uuid": "b24545af-2e2e-4f87-b970-3cf198d08662", "value": "8eb686a90719c48bad521b1416987472", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752228, "uuid": "3ea4e70b-cd0d-4291-9afe-8de827e95e04", "value": "196608:j8jddB9k1L9d2kFA1NYPHbkP1SHXWPjo1PHO0i0HQjg4:ATqJ980A1+zktYEjqPu0ZQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752228, "uuid": "12ac035c-70ba-4a5b-a1e3-494509cb301a", "value": 14684419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752228, "uuid": "4df8f6f7-31f7-423a-8710-982e7124fb01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752228, "uuid": "ecf336e2-6049-4077-8ddf-55b5683efb71", "value": "build2_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d009bae-c6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714565, "uuid": "5588f3d7-45a7-4b63-adf5-a866edfb3836", "comment": "Malware payload (Mirai)", "value": "66969e0d864026fdb25b4a1bcea9df92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714565, "uuid": "98cda001-293b-46f1-ab24-71386aba4b78", "comment": "Malware payload (Mirai)", "value": "642b917ea6a9d0f0e9ddcf422c769d7cf085de1554298de9e4ab7dfd5caa12cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714565, "uuid": "e62af079-44a5-4164-9a11-f423015b2c5e", "comment": "Malware payload (Mirai)", "value": "30b546baebbc166d118c3a51a6bafdd001006f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714565, "uuid": "cdac8970-f9b1-4fde-a1b8-f9ed8c2d819b", "comment": "Malware payload (Mirai)", "value": "b72bfb2237c04a2ce784d7d4b8c28156cd49642f057afaa7813d2c252ff626b9daa793e01f024ccfe88ac9b2d66544f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714565, "uuid": "534313f9-c991-4775-b16b-4293627edf50", "value": "T1AEE34B0A74D270FCC68BC13056AF9F71E936B49C42183DAFA386AE711936DE06E15E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714565, "uuid": "93168481-7e1c-4323-bead-34721740a555", "value": "3072:AwKIwb7kJWpLe7LC1MHx39QIF0iFfpq+:A3b6x39Qc06hq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714565, "uuid": "76f52c01-c2b8-4778-959c-a553168ca993", "value": 144960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714565, "uuid": "100a9f78-b7cf-4b76-962e-2846cbb3c946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714565, "uuid": "bdfd538f-7df4-4a83-a355-8135735a6217", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65b1c21-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703763, "uuid": "b6647337-a541-4109-9c0e-3335c1167e4c", "comment": "Malware payload (Mirai)", "value": "a8f31fa7ba0282e9fd52f8e169c3ae35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703763, "uuid": "f71891e1-4c88-4a9d-aebc-6d596bd6d8d6", "comment": "Malware payload (Mirai)", "value": "64504397794069428ced03fa56ee54b94aae2ef70e7da7eaf727db3409fc9657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703763, "uuid": "bd3b944e-4bca-4f70-bdb9-3f3b933b76c8", "comment": "Malware payload (Mirai)", "value": "b64981c878ced757869575e5063ab57f2fc1f9b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703763, "uuid": "93b6639d-04ae-40c8-aa61-62e6fc8b39fd", "comment": "Malware payload (Mirai)", "value": "570e07727f6b155bd083ea834b696146b9dc3241fb15932bd71f7985605ab6d3899d59ca356e37cf3a375f33783c29ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703763, "uuid": "260381e7-c7be-4850-b368-912fa7d3669e", "value": "T1F2C31290E84B8479F30E4331CBA51FC5B9BD744E762B62677DC0E96434E87E6E188643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703763, "uuid": "932bdbdd-610a-46f5-947c-e07912fb8349", "value": "3072:FHx9IcZGDrlVspiOuAI4eZyXMEDRtGhZIH414h1Vku:FHx36r3oiO/I4FDfGhZC414nVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703763, "uuid": "6967a502-0f28-409e-90e8-6d9a7c1c5700", "value": 129696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703763, "uuid": "4ca11d6e-6880-4962-aecc-759bdb2fe987", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703763, "uuid": "7975dcde-ef0d-4525-ba75-24f9eae3a166", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262c701d-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715896, "uuid": "ce650c3a-28ff-41e8-b620-67b186fd812f", "comment": "Malware payload", "value": "94d2bc30d22368885183fd7e2e926b5d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715896, "uuid": "6a463339-2ef6-4556-8d63-0be0e1874f5d", "comment": "Malware payload", "value": "64e86716d6ab49271201dfe9c9fe9a8d7be8ac97a8c641eb712f987c5945d26b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715896, "uuid": "befe89e5-ce52-4233-86f4-2bbbed141fab", "comment": "Malware payload", "value": "4e326c8730503b8c35e92817ba75461e9449651d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715896, "uuid": "f4540bac-4879-4df7-b7b7-2395379c41cb", "comment": "Malware payload", "value": "9ac20f70ee668ba7f18793d7eedfcef3ab69245e67f21cd4f3acddcde2751e9af9c029e5c4ed68affc2bef2d1bdba083", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715896, "uuid": "51d0ef72-5f7f-4307-a4b1-5c9f873b56c4", "value": "T13AD62283E38DA826D67BE43393764267A9A40C459953E7123A1DF11C5FFBE809346FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715896, "uuid": "6cd13ada-2f58-455f-bdef-10293a2d1d23", "value": "196608:xxGHxSecJAvcqZAHK92md6o4WTYY4QvOolvnp+RQR6kBR8ACHvJvDESZ1yZQ:xxE799Z0W4WT1DlvnpwoBR8AwvDb1yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715896, "uuid": "fecb1591-ae91-4f38-bfa9-214fba0ee84b", "value": 13489071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715896, "uuid": "9a7a45f4-868a-41e5-bb24-e99a7559e539", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715896, "uuid": "0ce30acb-e0ca-4c94-98e6-1ebebb1373db", "value": "Android2.2.1.3.3.4\u7248.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3608980e-c6d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729666, "uuid": "47c4ef4a-96c2-4602-92f6-24ce7d8a0463", "comment": "Malware payload (Mirai)", "value": "4727adbf6e808a23583b03009ac97062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729666, "uuid": "b2f7a00b-65e7-4946-8485-fa73078d47ad", "comment": "Malware payload (Mirai)", "value": "6580499f031ebd823646e1eaa97116b8a874154511df3105f6b59ec0894c936b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729666, "uuid": "a3129239-cc40-42ff-b848-0ba3cb0c35ca", "comment": "Malware payload (Mirai)", "value": "c1d25ec3a5680fa6f4a500d31b2be77b4b1fbc0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729666, "uuid": "c205e622-5a79-4916-9db6-399cce3450aa", "comment": "Malware payload (Mirai)", "value": "7d9037386867961128adddb970167eef00ec1d961493dc9916a9d75641c80adb4dd446a1058d70617209f8a81c23eb80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729666, "uuid": "1017da00-79a8-43dd-97ae-ffc7fa1f7aa1", "value": "T1C3B34AC0F98B81F6C40B8C306166F63FCE71D5A94231CAADFF969F36DA77A019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729666, "uuid": "47d983ad-4fa0-4731-aa22-e952589057f2", "value": "3072:bqyLpO5iL2SNPNmIrAzRzBV935rzKqgptWsRCPU:f9OgL2mPNPA1BnpDPPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729666, "uuid": "6198ac30-4990-40f6-b3a1-3f9950540986", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729666, "uuid": "02c9a31f-59cd-460e-8e94-ebe51dec6eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729666, "uuid": "d6d34917-480d-4004-b07f-92d1fb2eb5ae", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8996e04e-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764166, "uuid": "4d63c53c-58fa-4b55-a3f2-cd2532ffe809", "comment": "Malware payload (Mirai)", "value": "4f3e00eb08726b20069262b4358f578b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764166, "uuid": "e6daa9cb-e32a-4afa-a69a-dd6813707474", "comment": "Malware payload (Mirai)", "value": "65b3632c7e7ba5ea2a62b4f748f6395a89ba8a6641a888108008e5bfa8874e72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764166, "uuid": "37846cef-55ae-44df-aafe-ff0ae1408a64", "comment": "Malware payload (Mirai)", "value": "80f1c17103a30feb5c9e096462212bcec7a92490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764166, "uuid": "91d6c3e7-2429-41b2-ab41-572bca78b175", "comment": "Malware payload (Mirai)", "value": "1a7530ba38976d844c61821331fc12bc0f626d77f5453a77215b303bf7fd2af658db2aa707e1befd2c76d401ca34aa13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764166, "uuid": "8d635057-4212-480b-a242-e337616335f1", "value": "T1D3E3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764166, "uuid": "f430c767-df16-492e-b2f2-d2fc2b96de98", "value": "3072:Zbp/QdERKjZyMk9mBeqUlnM9G3IqW6L4:Zb1QdERKjZyMxBzUlnSG3IG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764166, "uuid": "812bc096-9df7-414b-a693-b83f1e86321a", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764166, "uuid": "09766da6-a3d4-405d-b6e9-3224ffb47f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764166, "uuid": "facd501c-36a4-4632-9355-04950c83ef6b", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612a288b-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763703539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703539, "uuid": "c588fe34-16c7-4cdf-8d5e-454a4f0b9319", "comment": "Malware payload (Joker)", "value": "8cfd84656c93ee0f50100a5bad5e5e41", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703539, "uuid": "5955dd33-fde0-4037-a313-453f9c1cef7c", "comment": "Malware payload (Joker)", "value": "65ddcadd5f92ef291aebd1ddad36b611dfc6d6287050cb63e30aca88634248d6", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703539, "uuid": "3b2a7f12-6fe3-4d34-bdb4-b3de7a68f276", "comment": "Malware payload (Joker)", "value": "e28438844aeab61ebf8d5e1ef0c7408764e04bbc", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703539, "uuid": "b7f0ad7c-b751-4288-af80-10b6935b8c9d", "comment": "Malware payload (Joker)", "value": "1223f65b25d0dba615052715fdec98eb43792ccdaba39607406ce3345068e620f0766c27288d81e0986be1f8d5ab81b4", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703539, "uuid": "6cd22f15-346a-4037-8079-2e04941a6c2f", "value": "T1E0372209EF4C792FDCB7B4390F56527274295C5AE600A793E910736CBAB3AE84E113E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703539, "uuid": "7a1f00cf-5ffb-4bb4-9c0d-0bba2ff5413c", "value": "393216:OdjAAEAYPOCh5PLgXH9rZR77HpbS7z0Q4hk5lj48YbBnULhAYiSw1Zu4Lg:OdjAAETOChdL2rXPrGabBnvYJw144k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703539, "uuid": "d4df3af4-7e39-42ce-b0ca-074246ced2f1", "value": 22377741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703539, "uuid": "3c13272f-88ce-403b-bdd9-6aae6a17c772", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703539, "uuid": "aac0ba87-7431-467e-a53c-3fba6013d2d9", "value": "Pure+Cleaner_1.2.41.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30cbb7c-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763765094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765094, "uuid": "b706526a-389a-4c36-bde8-88e9da1fd11f", "comment": "Malware payload", "value": "a5b334f1a45b3516d6e69acc52c1a33e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765094, "uuid": "3e2b85a4-feda-41db-8a11-368dd7083d19", "comment": "Malware payload", "value": "67386fc509cd12619d6bcf11e55e3bce8b6dbd028f4c474ae8ef0f4a5f6f860f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765094, "uuid": "21d4909a-bb5f-4580-9923-ae8596bd208a", "comment": "Malware payload", "value": "e543ddc0e8ce0cec0e01d7fe228b2ea063ee4ab8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765094, "uuid": "0d1a2435-0b06-4b1c-905f-f6a7dec2c065", "comment": "Malware payload", "value": "da3bd25e45e05a06bf49e1465151e27c2f6893266692688b0681ed46979126b74838692c6ee47740ac7d048c650dae35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765094, "uuid": "8d90b585-0522-4ecc-94d9-834f74c39f8d", "value": "T1F61184CE09A924799CE8DF8C7079C018BDF4D6D97AA1CBDC5CACA8B362959346D00F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765094, "uuid": "0cb491ef-0156-4479-b388-2e4d7b183719", "value": "24:xf81RfYBgRfYNIIoRfCKSfRfS2Rfel95Rfu9mRfQlRfITlRf8qRf8/A:a1GBg0o8xfQ2295g9mOlGTlSq6/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765094, "uuid": "59020d0f-e74f-4f74-ac33-91a8500552de", "value": 982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765094, "uuid": "547c257d-24d8-4bfe-a7de-274c378ec3fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765094, "uuid": "20cef031-ddd6-4e28-8a6f-b925350d738f", "value": "abc3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f824eaf-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734406, "uuid": "a93639fc-5057-425c-8c2e-11f16dd75fc2", "comment": "Malware payload (Mirai)", "value": "9ead9897cf03efa5f99de1c502b5d566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734406, "uuid": "20a27c37-28d0-4c40-bbed-7bce125b2f8d", "comment": "Malware payload (Mirai)", "value": "6ab13edd57895d0127939e047e14f2c58ece65e15e1ab228e803f6a0e911a214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734406, "uuid": "72ae5d3a-698c-49cc-89a2-20c411c2f453", "comment": "Malware payload (Mirai)", "value": "13d57d28a3b671b874ffee56052be5025745b2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734406, "uuid": "baebebd2-df5d-45f8-8668-bec9569a6a6b", "comment": "Malware payload (Mirai)", "value": "cc65bd31fb2208e5f7c2b269d92861f32a60660150d9dd57504525b1b7d3c570bb4e3abf3b75e9dcfc661a504089146c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734406, "uuid": "fb3c2531-0f1d-4698-9ec6-e2a10c6e5c7f", "value": "T14AC31946F9828A22C5D713BEF92E118E331357B8E3DE72129E105F2573C662B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734406, "uuid": "4812cd28-6773-4856-9c94-d74b6c0b8b0b", "value": "3072:vgIcXParsx0waUx7T6ahCTdchKKRtrF9IVs:vgIcXirsxrZx7OamUKKRH9IVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734406, "uuid": "bf0982b4-c13e-48e2-a915-44bb6565cdb7", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734406, "uuid": "292239d8-8dc6-4d3a-a8a1-f4a841c28fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734406, "uuid": "6cea39be-1aa8-4eea-bd16-8ced3ecda304", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031ec484-c723-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763761363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761363, "uuid": "f23f912a-72ce-482a-85ab-0a96d7f44f98", "comment": "Malware payload (Mirai)", "value": "e1d98c68c5c9f5cc9645e7e09730cb98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761363, "uuid": "88a4e3d0-26c6-435b-8ec2-d072c1e9750f", "comment": "Malware payload (Mirai)", "value": "6b9da634454d727ef4945e5aea7eef814bc95b55663d85423971641f31b80b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761363, "uuid": "df598a04-9478-44b4-81f0-f532f28f9855", "comment": "Malware payload (Mirai)", "value": "3e78fb8f4c49dd2ccc6e995e96c058832a3951ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761363, "uuid": "ad3c6147-fe07-42f8-ba50-b216c4e3bf63", "comment": "Malware payload (Mirai)", "value": "6d2cc45fead28155f6bf24251d2e4c1752c1058cb26064736130fdfd04df0eba21cfc660c6ec2af26cba51ecde97e0e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761363, "uuid": "8035935e-1a35-4d51-8b5c-89aad670e1a7", "value": "T19513F242869C8E59E0AF82726DBF7E5A2D20A2165118CF7CBC049127F867F40B63EF55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761363, "uuid": "2288e0b3-1328-4cf5-88a0-9853709492a3", "value": "768:UcKmeLMxHfx3DKQsfnwGaE/NIpODDKgF3lvjS9nzezpY/MjdDGTCADEYVg43e2En:aJuJxsfapOfK8Vv2opLdDIDEX4O2OXn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763761363, "uuid": "55074684-8886-4327-9b3f-7f153c9e9ed6", "value": 45112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763761363, "uuid": "d52ccf3c-e537-4f8f-bfff-61353a63524b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761363, "uuid": "141ff15c-177b-421f-807a-f9a8193a3ab2", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d5dfe0-c712-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763754308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754308, "uuid": "f5bbee4f-eb61-423e-b34e-4106eba67505", "comment": "Malware payload", "value": "43d232dda125e3315d914930c5c9386a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754308, "uuid": "73d2cfab-58d1-42e0-8350-f485dee303af", "comment": "Malware payload", "value": "6bd8c8a48953a907b670f411e80bee624bc7383abcff1b8c46eec41752382079", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754308, "uuid": "43410211-0562-4697-aa5b-d73b9a5dbbfe", "comment": "Malware payload", "value": "9b3f57f6c45bca72706ea305cb5a077624b4e595", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754308, "uuid": "353e8250-e4c1-437c-a2e2-6f4b7bfe5552", "comment": "Malware payload", "value": "988e34f7a8a1a02cba0ad3e4bede7a7a328cb760b46eff479fd9faf02e016f9ad667421a4c2332bef4259cecedf979e2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754308, "uuid": "c2b27b22-8745-498b-bc0e-7204746c33a0", "value": "T13DB47C137D80943ADABA0E36893A97615F3DBD245B30855B6388751DEEF00C06B77BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754308, "uuid": "4ee3ea17-d87e-49ff-b8a3-338cc05d0d67", "value": "6144:l/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkaNeiz5p2rrvr:l+8jOZy2KsGU6a4Ks41x5VkViw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763754308, "uuid": "c0ac2c42-f5a6-4c72-9f72-5dbd19321e5d", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763754308, "uuid": "622ada46-5975-4543-ba02-e62b78eda322", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754308, "uuid": "b2f8aeaa-ab5d-4c80-9ed5-840bc877b23f", "value": "e58ba27506.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27656c-c71a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763757515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757515, "uuid": "9f8ca83d-4e67-4315-a398-72aa0d650d16", "comment": "Malware payload", "value": "246a5fa21f25f4461a89ca53040f4600", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757515, "uuid": "33fdc7d6-879c-463a-a06a-a55f67d53039", "comment": "Malware payload", "value": "6d29e4352ae66c81057ee4ca4434857ca062ca4617442d969acd42adf46de0e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757515, "uuid": "356fe815-2b84-4fb4-9752-a1a1ff4b9e84", "comment": "Malware payload", "value": "ccc5c3cacece29f225526b66afbaea000cb47958", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757515, "uuid": "ae3bea55-2b13-4059-b3fe-fe2e36a7dba7", "comment": "Malware payload", "value": "836e693549c6221d0feb2185e29e91d044489f3fcb9eb876ffd30ae25970b952913bfcfd04774673d3a4c392bcadc265", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757515, "uuid": "b984eded-3575-4b8b-b2e4-e9d6e1ece3c9", "value": "T18E61D7A83BD1573B82C68F47F221BA697B0F99CED8850ED865DF68F5CAAC8047031517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757515, "uuid": "159e23a6-ba95-4dd3-8bdc-7ac642a8d7b8", "value": "48:QvZi4whMSGdnHxDUPUq5EIIICmvYTndPrHcYHcPBr5JMIVMICiz8Wv+156fPgf9:AZijlZz3C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763757515, "uuid": "28111d2b-2986-486e-a406-c41da3864bf3", "value": 3191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763757515, "uuid": "b0c48ee0-f07f-433f-abb3-3080599c884f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757515, "uuid": "b0f1a256-1ded-4799-8fa5-e9fcb13a2eb8", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e75ea36-c6f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763743048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743048, "uuid": "f94f17d9-5011-43f0-9188-1fcae95a21d9", "comment": "Malware payload (Mirai)", "value": "7167c1dea6c2ba596e68c47d94a8d66a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743048, "uuid": "8313425f-4259-4b55-9030-d057e2580b2d", "comment": "Malware payload (Mirai)", "value": "6de79b98380f591c93f949848b3cd73a5c089945f87467a14305ea844f98740b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743048, "uuid": "ae18e871-4b24-4127-bbb3-a4f1390aafb9", "comment": "Malware payload (Mirai)", "value": "c0b75a05ecbf60ea1a66126caaafba18485d3fb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743048, "uuid": "640a5f2a-71ae-48c4-bfa2-dd211fcc4f65", "comment": "Malware payload (Mirai)", "value": "2589ca60301338f0fe26047a2d93fcdc416c1ca1a4a17f1e532c14bd4e31c687d78efcf3b1ec7ded8fc1b6d2c269eef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743048, "uuid": "37e25577-c661-449c-b9d5-3758f6a09560", "value": "T11E23F16CF5A079EBCE7C0DBF5A9E1F9C49B5B481312F9F47326A8D40634368B7509828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743048, "uuid": "00426bb7-0aed-48c4-b756-d7e3a0259be5", "value": "768:Gvs9SU0mZxL8NxP946wgn2Y4cH5nVx86JoYnM4bKsHHC3Y6bPqzvpGW5:KsdZITPa63J4cZnL8KoYnBbKP3Y6bCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743048, "uuid": "261a83b0-ccd8-43ac-afaa-9d989d9c57c6", "value": 46820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743048, "uuid": "5c8308e6-7316-4700-a005-ea66c7a47dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743048, "uuid": "64ba7401-c59a-4371-bfcc-5c704dff3d1c", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e968a1c-c6bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763716795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716795, "uuid": "8c6b742c-3122-4dea-97cc-90fe75bc2531", "comment": "Malware payload", "value": "4a714cf65b00e927dd2e27634db05b9a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716795, "uuid": "ba1c24fd-ca27-4836-a3d6-e058551026e7", "comment": "Malware payload", "value": "6f8e75f5cb427396c2b647d90bab236f710cedfd1371556ec7b5f73526e69d31", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716795, "uuid": "2cbdb3e7-11ac-43fa-9cc6-f1c44cb524bf", "comment": "Malware payload", "value": "436d17d4f6c70aff4a0e7662527e41606edb8dd2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716795, "uuid": "81dee02e-4a61-42b1-8c10-4d07e22ec5f6", "comment": "Malware payload", "value": "a6c6528f6d91390de26af713238c3f311406de21da4220f56fe858567ac7cdef74e713f3efa41bb2b685a4d435350b1b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716795, "uuid": "804322b7-0912-4903-b7f2-f70f1a081ce6", "value": "T12CE1FA127B46E679238A23B6E8AFEB1570204357145A6C017ACDC8C87F5397BD7EC588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716795, "uuid": "0a6c1053-7aa0-4e77-bf11-8c0766359dfc", "value": "192:hNhfHSetJTkaGAyaztUS/ptSHvYL4XsKSAH2jL:JSejl/yS//HSHvY623", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763716795, "uuid": "4a33285d-bb49-4f28-b861-9acd2097fcca", "value": 6818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763716795, "uuid": "6ba0fced-91ed-4dd8-b8c0-53081ecc8c8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716795, "uuid": "d329bd63-5dd7-4543-9d22-24feb147d2e4", "value": "Invoke-PoshRatHttps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ab4855-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763740029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740029, "uuid": "9b2b91fa-107e-4959-b64b-f1be4c96fbee", "comment": "Malware payload (Mirai)", "value": "dd62fa3e5c81869c4d91f08494685ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740029, "uuid": "a4cb9da1-7aed-42ca-8108-67e868f87fb2", "comment": "Malware payload (Mirai)", "value": "6fed4fd04ebc6cfe158e868e01ab973d0f27a02c029895ec735dc632384fd4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740029, "uuid": "495a9548-4ab1-4344-aaed-cdffbed3213a", "comment": "Malware payload (Mirai)", "value": "77a9ce6ddea18549f34b6696ada54cc2f88f11ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740029, "uuid": "6fe53f44-4c54-42ac-a73b-03a79dd99b2f", "comment": "Malware payload (Mirai)", "value": "e5def513048ff794710359ec3e0e47f0e36089568b5d82e595c4b601e5e4f9ea109c3628bb13e4a71f1fe0cad2166700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740029, "uuid": "d54624ad-01ec-4dd9-810e-10d7d0c02dcf", "value": "T1AE23F1A1164652F19AC18932BB3DF3CB6F0C23BE74DA79F02ED84A2466D97453FD0609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740029, "uuid": "c37a16dd-a453-4f30-a8bc-558a3c593741", "value": "768:lhiWlWLbQearw65rBKkj57c0nvDMiAX/Z1vs/i17XajuSrFTY/9TAGqjC0PjW7C7:XULbQFrhmUbNAPnUq17n2c/OGmRCCXlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740029, "uuid": "f00a19e9-3117-43ea-a9fb-5e61b4578483", "value": 47348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740029, "uuid": "aa786d96-c45e-42e4-a03d-85530eced15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740029, "uuid": "d96b3482-a101-495c-b3a4-b4d06e932143", "value": "SecuriteInfo.com.Linux.Siggen.9999.7193.11734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472fd8f4-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766202, "uuid": "c20a5cb9-6076-467b-a736-18301a865195", "comment": "Malware payload (Mirai)", "value": "a5b53671ec09fdbff5a2f4ad5781e4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766202, "uuid": "0c1d73d1-3868-4282-acb2-d4d0c3f8e3fe", "comment": "Malware payload (Mirai)", "value": "707290ec0fb1c425e747f78ad55667c58766df0be8a2babbea65d31ec7a87ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766202, "uuid": "dea145b2-c36e-4fda-b40a-9c7bd007edfc", "comment": "Malware payload (Mirai)", "value": "8be538eccd76298b1dccfba28af1a341bcba252d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766202, "uuid": "d71f8a56-eb56-4e17-8648-035f3fe6186d", "comment": "Malware payload (Mirai)", "value": "0907772904cc18ccbefc90279de85e4350468843f8b4e6d91bef66d24c0a7be7de0f9e7f3c4f755c8e1525b64cace03c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766202, "uuid": "01ec55b9-29f9-4e73-8f60-8fc632542aab", "value": "T1F6433A99EA0F2E81CAC7C534ED5A8F623027B4E8624983365F11112DA9FDDDC9CF1C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766202, "uuid": "696a7c90-9d01-42b9-b8fc-eeffbde479ce", "value": "1536:z+bDunhgRffQUpRI0ADYs4OcjJTpvZ0bk9mUK8ipU4s19z9bZSgOY20hyio8vYS7:zeoqfxRILUsWShsjN+8BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766202, "uuid": "1c3c3c2e-8f11-4f2c-b3c6-11f061e2c14e", "value": 58688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766202, "uuid": "a13cbe19-894d-4787-b8e0-34165f150ef8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766202, "uuid": "1abb3a44-1f16-4a11-b2a1-b1d06787754c", "value": "arch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6283af-c734-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763769001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769001, "uuid": "154a4365-7d05-452b-b62d-e06ef170730a", "comment": "Malware payload (Mirai)", "value": "3ba4d82cc14c067b4b37a9cb22f88385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769001, "uuid": "aa9be6d4-4310-4b5b-813a-2bcebacbb010", "comment": "Malware payload (Mirai)", "value": "70e9ef0bc045b5e8372365a29711930cac12a6fff8ca7a2086d79c43d7233ec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769001, "uuid": "7a8a2283-9b14-4ccb-8540-e5a1c58a279e", "comment": "Malware payload (Mirai)", "value": "4845c2fe84f113a815e9c0639f4a33221c7f67fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769001, "uuid": "9e0a0759-5c32-432e-96e7-b0a92bb8acbc", "comment": "Malware payload (Mirai)", "value": "5103a15163cbaaa586a4648aa6ebe6b259ddfbe029ec88b2bfdb0118c7ac922049e8039441d8aa4fda39764d7086bfaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769001, "uuid": "c4eb354c-4295-4f3e-a3b3-f2628701e418", "value": "T196834A92FD81D616C6C06277FB1E428D772747E8D3EA32038D216F21638B96B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769001, "uuid": "a1814f6f-af90-45d4-b792-2f1601195691", "value": "1536:9W7muDVE2S5nGqqSsdPX/tfKJNrl2gEjVBzddCVemqM:9W7muq2g7sBvtfo2PbTHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763769001, "uuid": "f7cb46aa-9d12-41e9-953b-28de0fe89f06", "value": 88108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763769001, "uuid": "6027ecca-33f6-40bd-9ebb-2dff90be3952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769001, "uuid": "d34e0532-337b-4328-b358-9d79e488a4e1", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e821861-c6f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763743424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743424, "uuid": "25ca4a01-c4d3-444c-96f7-4269190e4a8f", "comment": "Malware payload", "value": "0a8bbfcda3dd19578874767817def0e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743424, "uuid": "6ce30af9-d666-4534-aa09-204acc49d4d4", "comment": "Malware payload", "value": "714d7115584e06c36aefc21072564eccf0cb279abff6bbc2828ec34c1188e8c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743424, "uuid": "a2133b11-d73f-407d-b76e-ada96eedd6f6", "comment": "Malware payload", "value": "ccc17ba42d4a085613d292f7b91adbfdd9e1162c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743424, "uuid": "1e007abf-a6cb-41d3-90df-44105b9cf807", "comment": "Malware payload", "value": "87f1185b8a96447a3a3be50bae852f6df4491e8f81031793fd2490d70abe32efd7113725b83bc93371bd2d7da7a157a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743424, "uuid": "ba7b9bd1-97c1-44f2-8c51-fd156b5f8fac", "value": "T11686F6123B4144ADD79AA238F8E3E128EE25784C133167D39F1FAB261F652D066F6713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743424, "uuid": "9ff2c100-b3bb-4ea3-a401-41205920375e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743424, "uuid": "e21396d8-4255-4aac-b183-6de700d408ff", "value": "49152:QxnXIoGUVVKNhSs+tLztfGjoRIMtFkReIM:Qow1fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743424, "uuid": "31cfe992-e65e-4006-8ff0-788a2b80cc39", "value": 8340104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743424, "uuid": "b2944661-bf15-4e41-a84d-229e53fd0c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743424, "uuid": "aa0e4462-8724-428c-b3c9-6314f168ee5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6b228d-c6fb-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763744439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744439, "uuid": "249d6b88-3e28-4326-b179-795c0f98b5f7", "comment": "Malware payload (LummaStealer)", "value": "ba10f2f2d93cc0a861d205336f0f3358", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "h", "colour": "#E8EE60", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UNIQJJTWO.file", "colour": "#0B3C55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744439, "uuid": "e082171e-22bd-4db4-99c3-26f333258a55", "comment": "Malware payload (LummaStealer)", "value": "718d663076d1737a548dd3d9ea2b0554e7018a586b3cae959b1669da9a9ded47", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "h", "colour": "#E8EE60", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UNIQJJTWO.file", "colour": "#0B3C55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744439, "uuid": "a225ccee-ba42-4f30-a68c-98819f97f8b5", "comment": "Malware payload (LummaStealer)", "value": "4d78fd2e50743cbb03a6f053692c80ca302ed014", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "h", "colour": "#E8EE60", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UNIQJJTWO.file", "colour": "#0B3C55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744439, "uuid": "c7e0947a-e671-4217-bf09-ea9b1b0d881f", "comment": "Malware payload (LummaStealer)", "value": "391f4ab563b7339f0987ace64d3264f57a80b43c642ae7b4f98f784a395268a8de77b07e56e9a6d676b52cac17836cdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "h", "colour": "#E8EE60", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "UNIQJJTWO.file", "colour": "#0B3C55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744439, "uuid": "986b4904-7161-44a5-83ba-723db911b482", "value": "T1703523722E68AC72FBB52FB02EF60B219275B451BCB59A337B990ADE3101103D534776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744439, "uuid": "be1543b4-cd5a-42c8-a608-9857362476c9", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744439, "uuid": "54627ac7-61e6-4b84-9853-654dfbe3ae11", "value": "24576:XpRqtrbbVJyAWBBxEReyDiVxo6DSvbWE22qVflW:XqtHfW7xdm6sWEQdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744439, "uuid": "6455f266-cb20-4cc5-bda9-fb591d251d12", "value": 1105720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744439, "uuid": "66932f62-a414-46ea-b212-11f27e8fedbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744439, "uuid": "af19ac2f-726b-4c84-a36a-7b8ac16fc635", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f208d8bc-c68a-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763696051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696051, "uuid": "8f6a8fd5-f441-4a99-9877-e1c0eca10dc6", "comment": "Malware payload (Joker)", "value": "45c83de9d6026140658fa91547764a34", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696051, "uuid": "7b60a46e-7802-401c-b209-c23c58d50cb2", "comment": "Malware payload (Joker)", "value": "72a80bc2e824eb2e13151c4524f9f5133bd7af95033c63613c76cf16716426b3", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696051, "uuid": "da92bd75-e41a-4b15-9b79-afb4137c412d", "comment": "Malware payload (Joker)", "value": "7594c81e70835f985aed5b35144d6b85c3a951a8", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696051, "uuid": "953a317e-8fe5-4863-a7bf-3dd1a3fcca52", "comment": "Malware payload (Joker)", "value": "d291294b245697e7813d50fe3289731b9d8f22b54978fbdf51f5b3ae45c4e26619665fea507662ff2d1176adaf9eaa27", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696051, "uuid": "93241d5e-97a1-48a5-a2bc-6274cb4e6417", "value": "T151772206FB0D992FDDC2F1784C6512523A636CA5A202A7DB5911F23D7FB3AC88E497D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696051, "uuid": "9974d02b-7d22-44db-acfb-5b9e7fd16098", "value": "786432:bWNvXpzRSMn8981UjHnjjgkKwfmoa/4rcroNv2EzLF1T08:bWpZzRhL1UHjjTKJ4grwvPF1TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763696051, "uuid": "14561af7-1770-4b83-96bb-50a2af2d3736", "value": 32772275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763696051, "uuid": "49b1c042-235c-4d88-8dd3-d0fb2efef734", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696051, "uuid": "d1021a7e-4b6a-4e8c-b5eb-3fb3c5fac8d6", "value": "Quick+Cleaner_1.2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b520cf-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714497, "uuid": "0948daec-6968-4b91-9dbf-2ea750348b83", "comment": "Malware payload (Mirai)", "value": "2a0c87679362dea0ea90cf01fcb73f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714497, "uuid": "d0800cc9-4da5-42d7-b223-77d2417ba0ec", "comment": "Malware payload (Mirai)", "value": "72ddefc469660fda28695a2cbf00a55bb4c3f793578878c8fc7f2d7066d1c3ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714497, "uuid": "80fab805-2b65-494d-b547-918dea8305a7", "comment": "Malware payload (Mirai)", "value": "c7e8b078cd43b9e2a3e50cb40fa93dbc8732a577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714497, "uuid": "da621f46-1821-4ba7-81e4-19b33491df1a", "comment": "Malware payload (Mirai)", "value": "bbd14dc986b3732a91391a0c041bd309106016239935b720332305fdc90c3c454159cd5d82c24b9e691d915b7e404455", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714497, "uuid": "afe098fc-e3cc-473b-a314-014f86284693", "value": "T147148D75FE8FBCA2C2C3F23EAE4A0FA3701B39748255C0B11A51939FC5EAED54850646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714497, "uuid": "da563a85-3acb-41ae-a01e-da5806f4650e", "value": "3072:sGWkb/Xk2kzavK84QhTI4k/dfrt8CbdLR7iY6n8NCzPxn:sGb/Qz74k/dfrSCbLitb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714497, "uuid": "5af49393-50c9-4a59-b9f5-08275ff0aa02", "value": 198160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714497, "uuid": "c8a7f8fb-570b-471b-acde-78471d26668b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714497, "uuid": "8c78bcc1-5603-4077-ae21-12e874d1c52f", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6c337f-c67d-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763690106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763690106, "uuid": "e7518fff-cbaf-4501-bad6-ab509672d84a", "comment": "Malware payload (QuasarRAT)", "value": "16a6cfc794b58a4f5da25ae5e544759e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763690106, "uuid": "1fd4a453-5481-449d-aece-db1541ade5ea", "comment": "Malware payload (QuasarRAT)", "value": "7386b1c538113a745d3daecfffbdaf6e8d730671214982fbfb0117bd76aeb2b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763690106, "uuid": "429e70ea-f7d8-4576-9e45-f28010fd55e8", "comment": "Malware payload (QuasarRAT)", "value": "daab8454f59e98d2eb5035296cbd553ce1131a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763690106, "uuid": "a7ed0b3e-fcc1-4579-a444-dd6beeed152c", "comment": "Malware payload (QuasarRAT)", "value": "f28433041b27f064829e1043e22c2071e84f1981db29caf74ad5e9b49bc298cb271f87a18aebabeed99dce3a4e53b125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763690106, "uuid": "66a4aec5-e0ac-4e2e-8580-a96bc668d962", "value": "T1A9E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763690106, "uuid": "6c1de244-ace8-475d-a7ef-0b0204803631", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763690106, "uuid": "2fcd3d6a-611c-4f10-b46e-658432624057", "value": "49152:Cv3hBYjCO4Dt2d5aKCuVPzlEmVQL0wvwka0yRJ6KbR3LoGdfTHHB72eh2NT:Cvnt2d5aKCuVPzlEmVQ0wvwf0yRJ6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763690106, "uuid": "6c60a45a-1bb7-4c63-a63c-f50f31be68d8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763690106, "uuid": "b3a6af90-3431-4ea5-991a-6ccff4fbaeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763690106, "uuid": "6fa39702-3f25-42f0-b69c-504b3af7a9e9", "value": "casinohelperv2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3716fa90-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715924, "uuid": "ab1dbebc-650a-4861-a5c0-32d2cb75e9fd", "comment": "Malware payload", "value": "5bb5bd89daf7d73d953af3bfb5b139f4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715924, "uuid": "77dfa138-5961-40da-9def-c2b4745a90e0", "comment": "Malware payload", "value": "75725bba1885875d80ba7ef1a84132c4e6750553e33b51035c80e9b86c75b7ce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715924, "uuid": "bccacd39-380f-475f-8b4b-93535818ab5c", "comment": "Malware payload", "value": "02180dec2da135e8cbdce373174316d78804c3dc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715924, "uuid": "6d4a7d12-ffed-4858-b287-62f62376f7d0", "comment": "Malware payload", "value": "93c6edf8eb7f3398cdd1a101e3a3a0356f31f147ef6cae2e8769f71d6071dfd1bc0a908d6bfa1f953e84cc1b592ad2f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715924, "uuid": "6fefc797-fb22-41ec-818b-63f2812936ad", "value": "T1E0C71286F385FE1AC0F367B3C831116B624AAD209B23926FAD097779A5732D44F116CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715924, "uuid": "d888465c-9c4d-4839-91f4-b35c906fea85", "value": "1572864:ZF3CYa4LsJvHimpW0SIEtslYiBjZtQMi/:ZZa4s5B80SsTtr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715924, "uuid": "b7950597-47fb-42ad-a719-9c0bfed7e843", "value": 56541904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715924, "uuid": "32112584-2461-44c9-a334-eb1322de8c6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715924, "uuid": "8748b510-37f8-4491-87c8-77211f545e15", "value": "XTREANVJ4 (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2f56cb-c711-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763753784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753784, "uuid": "7dbe82d2-a213-443b-9d23-c2406f9d8480", "comment": "Malware payload", "value": "9035d5e2e1e37c4b654c7bcb9d36cf2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Loader", "colour": "#5D61D7", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Barys", "colour": "#B5248B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753784, "uuid": "52336c67-926e-4436-b985-728ab5adf7de", "comment": "Malware payload", "value": "76114790d9c8dc354bb29391dd0ccb47c2cd1c8cc90c335fa248420e3797f585", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Loader", "colour": "#5D61D7", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Barys", "colour": "#B5248B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753784, "uuid": "fc9c20b3-3aff-4714-a0d2-451be4c4dbb7", "comment": "Malware payload", "value": "80fabfd632680eaf1d8fbf375959f617aac6bc26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Loader", "colour": "#5D61D7", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Barys", "colour": "#B5248B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763753784, "uuid": "1677efb9-ec1c-4697-bff4-2167184974fd", "comment": "Malware payload", "value": "4880a81e96f7288e868d044c6d31fb8d77b22e485554775efd0389d42ebb3ac4de2b864f3bbc8e053d7dc8acbb729b11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Loader", "colour": "#5D61D7", "exportable": true, "hide_tag": false }, { "name": "Win32.Trojan.Barys", "colour": "#B5248B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753784, "uuid": "8578f3c1-e653-47df-8f78-f7e2fb99b91b", "value": "T1387429117BF0C9B7D27E4532DEA8ABA8B5F6BD724D308A171360356C8D34F418958B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753784, "uuid": "d8be380f-432f-4116-a538-2b80f236f09c", "value": "bbb4722322d53baa093caf0f09753f73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753784, "uuid": "89fd4118-1e62-40a7-aceb-8c7f0f24b951", "value": "6144:lFm5ELk6WSdzJ6qlpacau7SZwTh3s3pdjD/UsFk8gM:lU6p/7dVxu3pqYgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763753784, "uuid": "7bea36b1-bbb6-48c6-a565-ccd8533de3a3", "value": 339984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763753784, "uuid": "e65e3a76-912e-4707-9d8e-eb0e8a769229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763753784, "uuid": "72029eb6-56e2-434e-b381-149f2a3eb57a", "value": "adsiedit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a5ffa2-c735-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763769122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769122, "uuid": "85f65114-bc15-4ad5-b32d-d70ef3a7952d", "comment": "Malware payload (Mirai)", "value": "3ff9727b8833a052d0c51c4666352319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769122, "uuid": "ce3c7c65-53d3-48bf-b19e-39b6f52b5f60", "comment": "Malware payload (Mirai)", "value": "76dfc221cf91c3e2b850dcd4c39c191164048cbbf615a34a58ca375442a6807a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769122, "uuid": "e7c9dfd8-cbe7-499f-be7f-fec2af5d486c", "comment": "Malware payload (Mirai)", "value": "775a24eb3b973e316f1d3a4f1ec4e31564659fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769122, "uuid": "523891ee-fcc5-4efe-a0c7-89c931b7902f", "comment": "Malware payload (Mirai)", "value": "b9725c7abe3a5d05d8bae57ba415fb916d13dc82ce1ee9f3d439c337490d2fc9d9f64191d18ab7ac0f11f911b236e30c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769122, "uuid": "4d476ce5-142a-4ea1-96e8-27335fa9d8ab", "value": "T19BB3D70E7E314FADF2A8823443B78F21A35923D626E1D685E6ACD5146F7434D281FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769122, "uuid": "51d94a46-cd5a-46f1-b312-971b4a0e0c77", "value": "1536:0XDeFSViYFSiEIf4oIKYtwLZC2cX1VHU2mEyo7e2h3KC2IKemHP:ED2JYFSef4oIK5LwvlVHU2m/a32lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763769122, "uuid": "94bddeda-a77d-4339-8f9f-7b719fdb60c6", "value": 115364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763769122, "uuid": "d27f05b4-9376-4023-aa3b-ca5af19b4c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769122, "uuid": "512981b7-08a1-4d9e-8fdd-f197e3a1e168", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817c7cb4-c70a-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763750838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750838, "uuid": "6a969e08-163f-4868-b8ae-dff1418c681d", "comment": "Malware payload (Adware.Techsnab)", "value": "2089f8eb18c5be71c8550b723647f120", "object_relation": "md5", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750838, "uuid": "2aaa83a7-1ff3-44bb-8d99-7bc8e55c4211", "comment": "Malware payload (Adware.Techsnab)", "value": "787cb98047d59432462618f4f93162dacc240ef5d1937632408d28f32b621d2c", "object_relation": "sha256", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750838, "uuid": "57f544af-9461-44de-881a-29bf649b965f", "comment": "Malware payload (Adware.Techsnab)", "value": "3a12e0d54e48f1d07959f419e0ae4a5f0dbdf285", "object_relation": "sha1", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750838, "uuid": "61cb8984-c421-403b-bbc0-242e8942595a", "comment": "Malware payload (Adware.Techsnab)", "value": "fdb65b450d06f115bc8dbe9c12c28743c6584b95c344be4d92b7cc9faf1664ef0857786eea952e710479a845094ada4d", "object_relation": "sha3-384", "Tag": [ { "name": "65-21-253-78", "colour": "#4DD55D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750838, "uuid": "c84b1577-f571-4b69-aad7-0a267bb511cc", "value": "T107A67B10A4C82607FD7EDFBC999E76540F7AB1952941BB388F5209D97AD1B68C8038F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750838, "uuid": "f5e67a08-71d2-4b45-8cff-42951898f241", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750838, "uuid": "c1fa2b4e-2ed6-4989-99dc-d80173b05775", "value": "98304:mEDOZV9UiOsejwT2UvBn3oJxmxj6P3LK82lP+MJ/azuwIiHgbfR7/QH8QOUyCe1e:mAOf9UiRgEZ28m/tmzTpiWTQ8rQe1ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750838, "uuid": "c8e11c4d-e3ba-4da6-8553-79e0cbb7ca83", "value": 9761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750838, "uuid": "ca0556d2-02f2-45a3-9fbb-f84fddbe1125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750838, "uuid": "a0768ccd-2446-4979-b3fc-93c921ad19d8", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95fffd4-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765105, "uuid": "7aa3a8c9-0673-4c05-80dd-3328dc4512ad", "comment": "Malware payload (Mirai)", "value": "db9e75a11323becfc8500e756a057da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765105, "uuid": "9313b4c6-c86a-4e96-b433-14828342228c", "comment": "Malware payload (Mirai)", "value": "78c378c3e55dd7fa4490d05eebe961af15c7ac7932d1d99fc2d7c0149c30b263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765105, "uuid": "0bf79a42-069f-4fdd-9e76-d5cbddcd540a", "comment": "Malware payload (Mirai)", "value": "8aec2c77e00d4ce4242331f4bea1e14b4dc26bec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765105, "uuid": "09f613e5-551a-4e78-8a2c-39c8636b8de3", "comment": "Malware payload (Mirai)", "value": "6bc1719c42c2870be08e8ffe1635b0d50ba9c11003fd7bde3e1d0a62af6065223a88de5869c382b4b58b111e42b40351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765105, "uuid": "2d2f09e6-e007-4b9e-bab5-504fa2aeea2d", "value": "T119C31B45FC405B23C6D612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765105, "uuid": "62692160-ee9d-4137-9c1b-8315f91097bd", "value": "1536:p/Ka0rG5yC/cMChygtiOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQm:ZKaprMh7sOXWFh4UXcYFkWpZlvWNUmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765105, "uuid": "76c0b8ac-66f5-4724-bbcc-6beade799749", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765105, "uuid": "1b28c766-78ca-4ed7-bee9-d082d9375e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765105, "uuid": "12dcf0d3-983b-4937-bab4-3cb6c458b8c4", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673ee306-c6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763724595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724595, "uuid": "e6a51899-20c9-4a52-af39-c98c7790b476", "comment": "Malware payload (Mirai)", "value": "90df5d195d9b4d115cb514de80432eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724595, "uuid": "91d4c527-f251-4e0c-bc44-ce2bc0067be3", "comment": "Malware payload (Mirai)", "value": "78daf8b0aff6224d4133db7a0e39d65b5d7a67947a5ee949c4e162bbe72a7e13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724595, "uuid": "b507785f-695b-4f5c-83ce-cfe412abd0ed", "comment": "Malware payload (Mirai)", "value": "4b05fec2b6d1dcf0e0c870d9f3975dece975c71d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724595, "uuid": "08c9db6a-b0ac-4dd2-b1ad-ac0142ece734", "comment": "Malware payload (Mirai)", "value": "f243872b2193b16ff1799363c712d4f048b695bdc27fe53815aa6f1f3ab13786b5bb3b4c928b870434af6893c8c7f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724595, "uuid": "bd04a795-3668-4898-b49c-6935bc074e07", "value": "T145D2E1309626BAB5A7B32E36FFCDC9CB667213FED2BA7220980401943751151C7B26B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724595, "uuid": "83a400e8-9120-4ba8-8326-93a1f5521d2e", "value": "384:GvZICwhfrV5kCGMnbv5IY+gW9xqq59HKPxpPHdFNDNjYGIPXVMARfOBehymdGUoU:6Z5Mnn+f9k5Hd/xBIvtses3Uozo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724595, "uuid": "baf6c250-3848-4af3-b1b7-55e648de1bcf", "value": 30920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724595, "uuid": "cd57d040-8f69-492a-89cd-c24fb2220445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724595, "uuid": "56ea993b-0e92-4dcf-9d54-3d0687d4a0e8", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b0b281-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763765099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765099, "uuid": "cbaff170-bdc2-494b-b6a0-77b5fa509f5f", "comment": "Malware payload", "value": "dc00a174277d472e0a0a0d627ed8cc68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765099, "uuid": "ff7de50e-715f-4978-90b9-ca975bf38bc3", "comment": "Malware payload", "value": "790c6ea3855c59fccff2e4d4191522fea6e5367753b9ac3c6163dc2e2b0b2dd3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765099, "uuid": "72a3dc2f-6d4b-47eb-9298-65a119e57a96", "comment": "Malware payload", "value": "8065663b6891f3d16f17aac7689b1603c70a481c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765099, "uuid": "ff789f29-ecde-45ba-bc4b-8aa8358af1dc", "comment": "Malware payload", "value": "6ed13a86881ed2c0e237039987f5c898b8d8e0d1b99aadc099a40bf40bb22ebb0d63fdc0a52376da949cd4f5e83fad47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765099, "uuid": "a91a1bb1-88a4-430c-8500-150edbccfa31", "value": "T1D411A7CD09A964AAADE8DF4CB07DC10CBDF1D1C9BAB1C794E874A8A341961311C00FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765099, "uuid": "f226fd21-0b30-424a-8ca6-d15aaa20a261", "value": "24:3J36f86fYBNfYNIIFfCKSQfSPfel9mfu9ffQKfITKf8bf8/A:j5BQgxZI9t9gpT9I/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765099, "uuid": "d802824f-9481-4d4a-a905-12755d5bafaa", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765099, "uuid": "48dfa59e-e2c3-45cf-834d-2b55ca040aed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765099, "uuid": "e9eead2c-f16e-4b97-bb41-3eabb3e3c1ad", "value": "abc1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb0f41f-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763742133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742133, "uuid": "634a6133-b579-4263-b220-d3079aacb27c", "comment": "Malware payload (Mirai)", "value": "fd5f3913d5c3e90d84784aa302de2c45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742133, "uuid": "57c38a0f-b493-4fc8-a4ab-eeaee1614bee", "comment": "Malware payload (Mirai)", "value": "795818175919e3c98a4a0316e4a7ef6f74e3fc11a022e59b22d3a06ace3afc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742133, "uuid": "869c89f0-ae89-40d1-a784-ebf910be62df", "comment": "Malware payload (Mirai)", "value": "313711cd3ef7a112bd8d334d40df2a85efb74112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742133, "uuid": "bef56a51-067a-45fb-83e3-e5f54914a54a", "comment": "Malware payload (Mirai)", "value": "594e0fd463e2927ef8ff719177ea4991d65f62e62c854ac9534083364cb8a17fecfab807d6e3789b4be1abbe049ca684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742133, "uuid": "6e382592-67e4-46eb-abfe-42893a7d7be6", "value": "T12A1302B8E149ADD4C33FAA5A6F5C87D4D3E98F0C93F269C154856AD39A4BC360B48DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742133, "uuid": "b3e5bc02-7359-4301-bfee-aecba1763033", "value": "768:RutvyGw6n8zoVP6iud6JvAkzkghuykd3qlxOKPsH7ZyW2DHz4uVcqgw09J:RJGwE8/iud64cJh9kd3GYKPqoJz4u+qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742133, "uuid": "b2113cf6-803b-4f71-9672-f590f5cb8efd", "value": 42592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742133, "uuid": "660cd059-f0e1-4102-8411-d49c6de1d454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742133, "uuid": "ff0bbeb9-9e97-49f9-adc8-1c1319e4c29f", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0926cb-c6b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1763714001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714001, "uuid": "30b5012b-bdd1-4687-9aa2-01d9ef6adfdc", "comment": "Malware payload (Amadey)", "value": "068f9afc99f12768ccee26fb82b4d61d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714001, "uuid": "772dde9f-5d72-4162-9e88-e1850aee516d", "comment": "Malware payload (Amadey)", "value": "7970e1539ed52f372b48787b8f60f5dc2e497a242907bdb8e9dd4a435686574c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714001, "uuid": "aad81c19-0a16-438a-894e-d3f1cbc20bf7", "comment": "Malware payload (Amadey)", "value": "4afe9423bf366729b424fa93ab37f29fec813a40", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714001, "uuid": "944341b9-5d78-4e60-9261-d751402a97ed", "comment": "Malware payload (Amadey)", "value": "298158d6dfb9a9d13bed6e51a3ebea8b3931c0280eed5e832a253bfa402791300d9c10b74aada8dfee664097172bd035", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714001, "uuid": "5e5f65b1-67a3-4598-893e-c11d01ac749e", "value": "T16E557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714001, "uuid": "b2684a5e-6e9a-4f40-acaa-1794d41e7334", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714001, "uuid": "70db2db5-e466-4d88-8877-008e00a3c4bd", "value": "24576:crR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRjNOnW:ckHmiyCkhh2Bamituw+UhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714001, "uuid": "a5e4e06a-b08c-4179-9070-16eae26f6763", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714001, "uuid": "02714f54-d19a-4168-b2db-389598e34717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714001, "uuid": "57e4b3af-1c04-473e-acd8-cbe57f586b95", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe6a4cc-c720-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763760284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760284, "uuid": "d4198e0a-f168-4a07-89cf-cd08f15facee", "comment": "Malware payload", "value": "3abb2abbe588a8588afdb0212cbfd37f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760284, "uuid": "da970141-4aa5-4948-87d9-f8e304f152e6", "comment": "Malware payload", "value": "79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760284, "uuid": "656250d3-a4c1-49c7-8299-f7e13a563900", "comment": "Malware payload", "value": "a6036cdb55a0d10d36b8e6881c8da0da6c79bcff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760284, "uuid": "83ec68af-88c1-4620-9b53-5547bd0b7adf", "comment": "Malware payload", "value": "1d8da4b11aac6a3fc4aaae9914fe9f1b37b4e55199dd21bbb28901255a2a127ad1cd0c26474b168f3a3002f2bf3d7c84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760284, "uuid": "5694e118-a02f-4f87-817c-6d0c92cc66eb", "value": "T1C92163CB11F6CD702CE2AF673279960934C8D0AB71EB5F58E8EC35E6448DE146480EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760284, "uuid": "5dffbe53-9ac4-44ee-9cc9-5c7c5235b195", "value": "24:vlchflohuYJ3SmsYnL2FbWCJR205LcNIlT:vlchflohuK3S3YnLEb1JR205LHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760284, "uuid": "685e8a9c-f2d3-43b3-81e8-b44d862504a7", "value": 1144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760284, "uuid": "00f25195-f298-497e-8193-84e1eaea7a80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760284, "uuid": "80ebb007-e91e-49e2-9a23-badb78baebef", "value": "skid.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5afa6-c6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763726486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726486, "uuid": "af576d84-8e7c-449e-b165-5ad07b13f4e3", "comment": "Malware payload (Mirai)", "value": "4794a0f379c2feac6be035e6a8cfca57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726486, "uuid": "c7adbe3a-6e03-40cc-9d78-90e08c21ef1f", "comment": "Malware payload (Mirai)", "value": "7a6a27247b46727d32c17960e101417215b840dbb2c69e0fd2d786153b0666cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726486, "uuid": "2e92c29c-74fc-4b48-abc5-94bb48d728df", "comment": "Malware payload (Mirai)", "value": "d3605da1325cfc67024289f1e6906a546245caf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726486, "uuid": "c0e7beb8-aa39-4c0d-83db-c94383914f8e", "comment": "Malware payload (Mirai)", "value": "44da8d70d72721eb334609732f41d5c93813c8cfd55c27d8553ea8bfc9b02117e789d59aaefe1b39527f482dd7aedbee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726486, "uuid": "44e834a2-df6b-4c36-8884-5362410044e8", "value": "T176144B46EA414E13C4D7137AB6AF024A333297A4D3DB73069D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726486, "uuid": "92f157e1-2450-4a94-9d12-d6a820d55bf0", "value": "6144:uJ/fEAaR9r+tbFalLB7lcDLsMCSNs5tl3b5M/9fmg:uJHEAaRB+tbFalLB7lcDLbrCtpu/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763726486, "uuid": "0fff71d4-6d51-43a1-8f44-93d883ac0b5d", "value": 201663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763726486, "uuid": "59a873d2-0b89-4376-98f2-71ecd11f5f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726486, "uuid": "fa11a870-af22-43e6-8cc4-e9afb17c9cee", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d15369d-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732845, "uuid": "e75323b2-6b5c-4eea-a4b5-05d5d45cac2c", "comment": "Malware payload (Mirai)", "value": "83081dacd3b93e7b32531ce4b654a0d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732845, "uuid": "e7b1b277-eb3f-4869-903b-d7df1b9fe819", "comment": "Malware payload (Mirai)", "value": "7b7f28b66889026b3944a57112bb2f17bfd1c6900c558e3bfcd8c42aaa1be67d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732845, "uuid": "ccfaf97f-fe68-4104-ad84-8dba2ccb73c2", "comment": "Malware payload (Mirai)", "value": "39c24222ab74efd6a6ae641b0bfefb827aa34ea6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732845, "uuid": "05f9784d-0681-42ed-9d33-3c5b9b38b7c6", "comment": "Malware payload (Mirai)", "value": "5b8cc994e13c544b87b1d35557b16367a1a22bde265447ef9edc57b8cfcd6935990da87347c1c9000ff8ec9e3ec29201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732845, "uuid": "84fa624a-4b15-4554-9ff1-40e8f72a7744", "value": "T14E640892EB412EBBC00EDE30011F87D911AD849953FB572BB278C51EBB8EA0D69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732845, "uuid": "ce30cde8-f9fb-4762-8944-1f0efc05cca2", "value": "6144:unktNOObxMlw/SM/SRzgV6br6eo9+ro5jamZQWl4345YGi//Xwgef1XdvdqOYWcn:unkzVf3vdqOYWPfybN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732845, "uuid": "2e05ab4b-66c9-4e48-9ef4-8c562ea0369d", "value": 310648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732845, "uuid": "49b6f370-209f-4a91-913d-20261c8bfbef", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732845, "uuid": "755234a1-7dba-4ca3-9557-3283d1036d12", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d3658f-c730-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766985, "uuid": "ef6fdb69-f889-4006-8741-03b5daceedaf", "comment": "Malware payload (Mirai)", "value": "15875a209c11fada0ec5b0821482d774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766985, "uuid": "40303ea9-05da-42b7-b681-cab430961be7", "comment": "Malware payload (Mirai)", "value": "7b8fba91fb6b21ef96f7f2e9db1542665056d0203a16436c560d580947055767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766985, "uuid": "b36e413e-72af-49ca-b701-ad876608f24f", "comment": "Malware payload (Mirai)", "value": "c67329708e58839e1dc4ff6a18e96569f0cec23b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766985, "uuid": "ae9d045b-772a-41e6-991d-7dab0a6a4efc", "comment": "Malware payload (Mirai)", "value": "203023fadf4f3a81b72326430ca37c531cb865ac7f7c0c640f28ef4269b8bf624e09bb7e5f6990c14c6a56ec32e76cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766985, "uuid": "8b3695e0-0274-4503-9bf9-c5611213c9d9", "value": "T11AA36CC6F643D8F9EC5605343132FB379F72E5BA2129DE83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766985, "uuid": "6d4c4515-9282-45ba-8051-7bf651f50103", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1QEUSr1pAm3Jn5wR54yfZLi/sd:FbhWbT+c+sxK2mlQEUs1Z3vY5Xi/sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766985, "uuid": "3a30b637-2b83-4813-a3b0-ff57052c0558", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766985, "uuid": "c4a6f0f6-5bb1-4ba6-bd17-bf3b9d0c1627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766985, "uuid": "60278f6f-053c-42b5-aeb4-9f6f9aac7a01", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7256cd6e-c6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725472, "uuid": "6c2e29a0-b0e3-4fdc-b0ca-348aa7bd1ead", "comment": "Malware payload (Mirai)", "value": "d1a7d49fe9911b2f11329521a45d7986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725472, "uuid": "ccc69e87-3068-4fac-a941-c2fa905c9838", "comment": "Malware payload (Mirai)", "value": "7ca40b245be0bc7a3ed6fea92209ac402f2d94254fb3c44a4356d8d73cbcb87d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725472, "uuid": "9edb8816-1e2f-43ae-b3dc-709a1c99cb97", "comment": "Malware payload (Mirai)", "value": "d6244d1f0d8848355aa7eac14ab704afa955d56e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725472, "uuid": "fd74b5ce-ce84-4cef-a118-9cec4e354fcc", "comment": "Malware payload (Mirai)", "value": "09a24b0f6b132bebfc2a04ae0a996e78f597c29ad75553d8b04b3abb0ca4b19967459abf8b693c03896b308a5c531a99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725472, "uuid": "be93fcbb-8d0d-4c1a-b7ee-adf2349f833e", "value": "T17EC33A81F8C28A62D6D723BAFA6E128E332263E4D3DE7103DE256F11378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725472, "uuid": "7a76a73b-b9f4-4d7e-aa04-00f7cf92887a", "value": "1536:ywmsAH3EkMW29QxhAH1BflYHfrewkdAtj6KsulkRV5qrEJX6s0ud98voB:fm/3ED9fqkd2lQV5/J6joB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725472, "uuid": "5d1b58b7-2021-4fa1-b75c-81c10331c41d", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725472, "uuid": "d79bb70c-4633-489c-9b6e-513ce80823db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725472, "uuid": "5be18440-01e2-4b08-ba9d-0b9e940b467f", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5927c1c-c71d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763759086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763759086, "uuid": "fd49a9bb-a6d1-4504-917d-2816f41ed5a9", "comment": "Malware payload", "value": "fe8342efcdf78a60516cc01341192cc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763759086, "uuid": "b2772372-0580-4e84-9a3d-f577cc8c3609", "comment": "Malware payload", "value": "7cd572424bfd85641dc4ce3618860cb4f2616d1216a3d6b3a264ba413df7744d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763759086, "uuid": "0800bc0c-d85b-4f82-b12c-d4cc6d27fe2f", "comment": "Malware payload", "value": "7f98172a7f6cc5d47fe481a2e687504cb707f0ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763759086, "uuid": "3ea675dd-eccf-4542-a7bd-b0d9cb4f95c9", "comment": "Malware payload", "value": "57e3df3d4d621284cfcd06789c633db9cd09f6ae7c5cb901ddf72852604b0c921ad75afdea9119fdc477ab64f80acd7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763759086, "uuid": "40dbdf08-ecfb-4886-8ba3-e2a64b304381", "value": "T1C313F2982F03468BC53224BBB54BDC557CC71F1A341F48AC15BAD5788AF321CA6FA326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763759086, "uuid": "771f5233-f061-45a5-b3f7-4b07fcf69f02", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg4Aud:XtBTX941eYF8NblpuvnwaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763759086, "uuid": "f8a5e3a2-1701-431d-bece-663e5b7bae13", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763759086, "uuid": "c347d147-19ec-418f-9e57-3bda519a017d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763759086, "uuid": "9288ba6d-6653-4e96-a063-8b5097e2638b", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a6943c-c69a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763702817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702817, "uuid": "9edcdaac-2dd7-4653-94c4-275faa7c1377", "comment": "Malware payload (Mirai)", "value": "aefed3d698461ca9f2d7ef98cf3b76ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702817, "uuid": "91ed177e-645c-47aa-b71d-b5d9b9bc377a", "comment": "Malware payload (Mirai)", "value": "7cd91758cad26d19fc4ef9f0c744de4c48fc6e71f9eef2e92bdd19aef10983d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702817, "uuid": "6a20fdb6-5928-451f-96d8-dc8af4d98cb6", "comment": "Malware payload (Mirai)", "value": "7823a42851652bdb9a3bf4d170f4fe826742867d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702817, "uuid": "bc54b702-60fb-4263-849b-7857f17bb4b9", "comment": "Malware payload (Mirai)", "value": "c374ea511de9e72a6437b58d8b3a77032b698936d181b8b51624753f17c7ca8b05a0a7517732346bc201568b009fee70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702817, "uuid": "0f31dba0-16a8-4254-9d37-7043a6a3fa23", "value": "T172A2E07DF730C1CCE482847E1957267B465FF8A207D4420AA909D0D702C39DEA49EEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702817, "uuid": "0d8207de-afb8-4352-8dac-16bd5f44ea1c", "value": "384:pDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRx6V:pDZ5Dw7RjFjcU+O24sDSNifHhrhpEguE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763702817, "uuid": "942b4c8a-337b-4a06-8348-2173ef8dd772", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763702817, "uuid": "84effcb2-4fc3-4a0f-a387-95f4cf9d8d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702817, "uuid": "1d9e8587-97e8-4347-8378-ac67de2f98ab", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0999bc2-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714490, "uuid": "ea795f9d-2935-4e25-a77a-ebb6ed4ed061", "comment": "Malware payload (Mirai)", "value": "290dc59e1638df4e045b815277757702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714490, "uuid": "af061cf3-e28c-4ef3-b0d2-5beea304e934", "comment": "Malware payload (Mirai)", "value": "7e197774b6d07284f9ee3615da54c5932cd2e74cdd886684cdba6301c3f1f8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714490, "uuid": "81e34e1a-1c37-4367-a0c0-78a61bb487c5", "comment": "Malware payload (Mirai)", "value": "91ff1d42abb9bd3b15e8736c621ff2142d59ef56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714490, "uuid": "a4ae8c4b-ac75-4169-89c2-2fa5ff59c2c0", "comment": "Malware payload (Mirai)", "value": "c2ad3d5c48d28393f97688befdc5f35e2f57439c67a50e9ad9736560d2ec893ae67dd32ea18af72bc0beaf9a79cf8d4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714490, "uuid": "f3fed366-a34a-4dac-9606-38c41169f25c", "value": "T118146C2BB3C3ACD6D11167309D317362375FCB052A18EBFFCA1A3784A5977129A24687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714490, "uuid": "aed0a710-e807-41e5-abc0-d6f063673c62", "value": "6144:2xdOm515sdp8mgrT+kS88RfHi7IKTtGf:fdp2rURZi7ILf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714490, "uuid": "b7ffc076-f106-471c-9e88-5a0c612ea39c", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714490, "uuid": "e78b914d-e3b2-49b7-b678-94b2b0812030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714490, "uuid": "b5c10632-84f6-4708-aaa4-18eff03cf75b", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2961c5-c6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763731612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731612, "uuid": "bf3e26c2-e0a1-46a3-a1df-6abc15a43278", "comment": "Malware payload (QuasarRAT)", "value": "d3bb9512e272f22ed7e685e9f78f44ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731612, "uuid": "60c2c40c-ccd1-4d44-85ac-bce25325389d", "comment": "Malware payload (QuasarRAT)", "value": "7e9868f4da3238a549866769de126d9ef902b19c4760701d8f883f54bf8961c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731612, "uuid": "71db6592-0d0b-47f8-b518-3e20b5e5b7bb", "comment": "Malware payload (QuasarRAT)", "value": "3c0323a96c199fcca8225cc467e9421cba12ac78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731612, "uuid": "37c356c5-10c2-4815-a5f6-f910319a8861", "comment": "Malware payload (QuasarRAT)", "value": "37fad6b840bb2c9b86ce808b9ea595dffcb30d56b29c47c64e4279614b755befd648bc672175f628774b2895b06ac5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731612, "uuid": "35d7c613-385d-4550-8175-b245e4e82e60", "value": "T114F522D8324079AEC857CC3195641D74A2536E6A3F0FF243AD137D6BBA3F8DA9E14092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731612, "uuid": "be950142-5d03-4d35-890f-949893a3e8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731612, "uuid": "2a862b7c-33d8-4712-bb12-0b819d7a83aa", "value": "98304:i6Kgf3HGZO1S5MKVBbwhpW2ywHNd2/G/5R:zKg/H82Sa0BbMkAHvL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763731612, "uuid": "6d69dad9-f37b-4396-bad1-a0d7c8327b99", "value": 3420672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763731612, "uuid": "da8ff721-d474-4066-a906-617a6e08771f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731612, "uuid": "dfe24e6f-85bb-4931-bb20-0d2373910718", "value": "Transfer.11202025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cf9513-c708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750125, "uuid": "66ffbe94-77fb-44ac-b23f-570e258e832a", "comment": "Malware payload", "value": "c7af6822587dc25f057926201d10e256", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750125, "uuid": "8d9bead4-8fb5-40dd-aa79-fca57404d218", "comment": "Malware payload", "value": "80b53aac281dd3dde41bffde4b5bea721cade8223f0c6d4868bb57ab4a0d54bc", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750125, "uuid": "a80516aa-1bd1-44ae-9d67-0e1288743822", "comment": "Malware payload", "value": "8dccf19290bbaa9ecdfd4de03a47414bbc016740", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750125, "uuid": "5d3fd0fd-c2d6-4c7e-9a54-9e362cf7dae3", "comment": "Malware payload", "value": "df142b71bd6634bab9bcffc8306c37e9650d94f0d0e73f7b4ee9263a12818ae20bfcefc556b6f2516f7e483cf6cf9571", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750125, "uuid": "b2d9fc17-d4da-48c5-b052-01528d56d641", "value": "T15AA633DA1D285194E6207331730B188B4D45AAE3F46C61A9BCFF33EE5F6B257C56B022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750125, "uuid": "84cd0aab-5304-4136-ac6c-3d70d23dfc48", "value": "196608:GhIC8l3yf08/xuk1THfRhCvSfJb2Of/XVR7wsZ0uDDL9W5ReNks:GKC8lt8/soHJh4yFLfr1ZRDV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750125, "uuid": "aba6c642-1868-4da1-88d7-9e279ad20e20", "value": 10391552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750125, "uuid": "923c1e1c-056e-44c6-867c-26bfed5c2d93", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750125, "uuid": "40156169-5d8c-44c6-a514-188dc1023617", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07da1ea3-c70e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763752352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752352, "uuid": "c38d23ea-291c-4112-b458-1168e81f8009", "comment": "Malware payload", "value": "7f7e57d962963dd69fda23d8980acff4", "object_relation": "md5", "Tag": [ { "name": "85-209-155-2", "colour": "#65C1FF", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "SGP", "colour": "#8B26EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752352, "uuid": "9f3310ed-35ed-423d-abca-8c81a77ab5f6", "comment": "Malware payload", "value": "813479ccd5fb355f3a1970c6c87ab2a74a1e70ca55b1b540f4f950862a64ac36", "object_relation": "sha256", "Tag": [ { "name": "85-209-155-2", "colour": "#65C1FF", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "SGP", "colour": "#8B26EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752352, "uuid": "7e277760-60d2-42b3-82a9-7754b3cef780", "comment": "Malware payload", "value": "8caff28e02c8f1d8fd8d9adf6211200033c10dc6", "object_relation": "sha1", "Tag": [ { "name": "85-209-155-2", "colour": "#65C1FF", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "SGP", "colour": "#8B26EA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752352, "uuid": "b319fe17-e93a-4676-95c5-e49a98b9aa01", "comment": "Malware payload", "value": "dcafaa073d2e42221a5803576258b2e732b44ef7ca68ce18c1accff33b80c80242368549a2fed3fcb88c5c3fed6ea242", "object_relation": "sha3-384", "Tag": [ { "name": "85-209-155-2", "colour": "#65C1FF", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "SGP", "colour": "#8B26EA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752352, "uuid": "bee6938a-efe5-4556-9c59-3b6082c7e8f3", "value": "T10607BF5AE1B800D9D47BC078CA579606E7B2741913F04BEB26A45AE91F23BE03E7F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752352, "uuid": "b7baf984-7a65-4486-b561-60cfa56c229f", "value": "d76ed98b00ad8c99f25c7d513dbec6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752352, "uuid": "f9175434-4bb4-43bd-831a-80cf108740ce", "value": "393216:Wk7eI5B76EkawiuNyjIQ7V1DuExSaeoosWClg:EEeoiC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752352, "uuid": "2ead90b0-91b5-44ea-823f-9c922b414558", "value": 16819352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752352, "uuid": "330df927-4bce-452f-8652-6c50004225ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752352, "uuid": "a2d11124-5f3d-4d4f-8fd4-e5175558ff10", "value": "build4_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2fdb41-c6e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763735775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735775, "uuid": "ae5f9625-2751-4d47-a113-56f4f001090c", "comment": "Malware payload", "value": "1ba402cd0c0459a581e1add5c2a999c8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735775, "uuid": "92beb996-1e85-400b-958d-7757c9433118", "comment": "Malware payload", "value": "818dbb421dcb451e41e266be43cfe238dd88c5ac6ce34622f85a9e67551c7583", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735775, "uuid": "7cb72349-ee5d-4524-9c6b-9f6e5c7bbd54", "comment": "Malware payload", "value": "d210ffa3e29e763ad15a4285f134bc6f877f0dda", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735775, "uuid": "88b37c64-7ac9-493c-8b14-49e10f04a646", "comment": "Malware payload", "value": "d51a624c2057228680a17b133dcd7ed1a85cd56b7c7d6b8a6475397a69c6eb2e8afb4c579a33c5369b4baae9af1e8c4b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735775, "uuid": "1e985428-e314-4c94-afb5-2cb16f9bcbbd", "value": "T1F5753300EFE69AA24F167CD6C36E9085CF44047A16DB9F1EDC74DF8782D825E48E643A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735775, "uuid": "1d534fa4-4107-44ac-924e-04bbd072ec2d", "value": "49152:sQMNWGkeaTsPH/fXCbgm9NWS6kmyNEr/4YfE07ibN:sQMMeGsnfyPN6kri42EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763735775, "uuid": "80bb03be-4a69-4cf0-9d59-7731d6679c74", "value": 1613766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763735775, "uuid": "f5c68b93-f558-4014-8fea-f76e5cff176b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735775, "uuid": "e85e19a7-1a0b-4ad6-add5-ce31326ca074", "value": "China\u2019s Governance of Rare Earths and its Global Implications.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df768454-c6a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763707187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763707187, "uuid": "28e60925-e19f-4c24-83b3-e476cbd6bd91", "comment": "Malware payload (Mirai)", "value": "d0dff99dc98d67b781581a2980886e32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763707187, "uuid": "7c3d8cc1-8990-4afa-9859-a41936283406", "comment": "Malware payload (Mirai)", "value": "81a917839ff4249951ecb0ae7e21d57b1d5218ae34007ed3e015672f3e54c306", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763707187, "uuid": "ba1d3dc0-6a1e-4c04-b152-fe0dd9af1b09", "comment": "Malware payload (Mirai)", "value": "f89c89f911dcff81430c4c6f8249e508b4199853", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763707187, "uuid": "7a60caed-da98-4b93-8ee7-e37cc485273a", "comment": "Malware payload (Mirai)", "value": "85b014dbef3d3393be9d9c8f3963bda5d4d64c7cb5b1a676eb5efac97ccf8834a69f0b47ea8907ba9da63d99bafcc1b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763707187, "uuid": "2ea38dc4-fab3-4559-9b3f-2edce278253e", "value": "T1485190ED11E04B7EAE5A9AA332A8CB95398970D7ACD39F0C9CDC24F5084DF043100BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763707187, "uuid": "44d5bfb4-d7a8-4858-a759-1e53cf874ee8", "value": "48:iFIAFPmFqMFXeF9CFRSF0a60aX3KLFEnAFBILFguJFPOFD6F28FmYF3bh:iFIAFPmFqMFXeF9CFRSF030E3KLFEnAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763707187, "uuid": "3303521c-c33b-475b-ba67-9060d3941ef4", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763707187, "uuid": "ee467bfd-01b2-447d-9c98-0b6906fe4862", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763707187, "uuid": "1f5e5008-ef27-4427-9fc7-20f53450b42d", "value": "qkuys.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5dc4b5-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703823, "uuid": "5965bb60-5e29-4ec1-80e2-e37c8b84ec23", "comment": "Malware payload (Mirai)", "value": "750b25faa09a8e8ae86bf4a36ad55d2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703823, "uuid": "8868a025-faa8-45b8-8db1-cde31e4508ea", "comment": "Malware payload (Mirai)", "value": "81d3343d23d56d65caa0e2aea1a7b98045bd891f2a79195fe45ed8bccf7d801d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703823, "uuid": "59991288-f18c-44d3-8ae6-4aec41c41602", "comment": "Malware payload (Mirai)", "value": "cfb7679c761039ed6d9390c6768d5f2bd219edb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703823, "uuid": "e3f38974-6340-4dcb-b96a-ffc95c64ac1a", "comment": "Malware payload (Mirai)", "value": "4f124fce8c7b6d7f46bd62662adcc8f5c7cd94a0ae4a6adf8686a4d9ee237c73347c443553718ffb45906daf111f5541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703823, "uuid": "a1696491-5cfe-4ea0-ab8c-116ac446eb63", "value": "T119241919F4508B3AC7D1227AF755028D73734F68EBEA730589396B383BD6A259D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703823, "uuid": "9aa6dab2-ab1c-47e3-865e-6cd962794de7", "value": "6144:g2TSdwC7LBYt/3a7VqdUzxhUH6P4JP7eu:dGwwty2qeoaPg7eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703823, "uuid": "0e42ad8a-cc39-4ab4-be7a-1b0059c91555", "value": 225864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703823, "uuid": "243945bd-69ac-4d04-b40b-2265437ce3e0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703823, "uuid": "49aa247a-addc-4607-98b8-5194076da4e8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c2e6d2-c718-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763757049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757049, "uuid": "fbd67304-a2b6-45ca-8bad-35bea0fb068f", "comment": "Malware payload", "value": "358f03ffd6e734584f92f916ba1fd647", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757049, "uuid": "4f6b9226-35dc-4c0e-ae38-fd450b881432", "comment": "Malware payload", "value": "8200b00a02c29b54d8018ba33bd1fc697c4cc915e67775bf8b8dc08510dd9de6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757049, "uuid": "6f2d8144-3784-4c1e-957d-ccc5181c5c18", "comment": "Malware payload", "value": "817aea41628bd01bf8b8d9a4fff7bfcd4dd0cc2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763757049, "uuid": "76cf8878-f8e2-4d78-b60b-f08498bc9909", "comment": "Malware payload", "value": "a33127f8f8d69b38f898ab74a8f8752ca23015250b736bbdfe6269fb71ab397fbfcd68a3c4463d6bf8729e08ad6e2cca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757049, "uuid": "ef140c0c-ca3b-4103-9e32-3451d91f3efc", "value": "T178218BEE76D163359AD88F02F292A931B71F5BCDA4541ED8F58F38B1AA5CC007025B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757049, "uuid": "5b650d05-2c47-48a2-9c61-d64752ce089f", "value": "24:boWBGhBh9Mk8QoOwIStCdnHmUXmqmFmiiPmjmSKLH2Kpatkk0:boGGhL8QoYSodnHTJUPiPq5aH2Iat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763757049, "uuid": "ddca9def-c95a-4159-86ff-14738b81236c", "value": 1253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763757049, "uuid": "e7a5fcd4-c407-4e22-aaab-fdcaa1def96b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763757049, "uuid": "b30a951c-c008-4b7c-acb6-dea548b5ca3d", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45e0451-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765097, "uuid": "99cf13b5-fe20-4484-87ff-be7451ac7c50", "comment": "Malware payload (Mirai)", "value": "8baa874576b0e1d42b8b17ad30a12cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765097, "uuid": "58420890-c0ab-49ae-b524-036185451866", "comment": "Malware payload (Mirai)", "value": "82351c3d62cf110b0da95652d363fe6160d976a2df853c29c6bf4847b5c5d774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765097, "uuid": "0602ebeb-5aab-4bbd-952c-a38e9f93834b", "comment": "Malware payload (Mirai)", "value": "7f38727160686027a08e5210b506c80684e4ffa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765097, "uuid": "af1497eb-a0a5-4c6b-9b5c-486d194bda70", "comment": "Malware payload (Mirai)", "value": "9b554b2100603a3724c573898046e11498e44e2ad6be793de5ef8eae7b6dc5a7b83c648bdb5615b57aacb1051e10c85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765097, "uuid": "131185cc-80ef-436c-ba45-865495c63853", "value": "T11FB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765097, "uuid": "c2029dcc-90c1-4277-a99b-d577a09de027", "value": "1536:OTW/VCxsHZusN2Li62C87mKjR5fvPVWARouW8j3W+gJH7k:OytCxsNx62NVjzVWxuWM3byY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765097, "uuid": "2596cb1f-1c59-42d4-a95c-8e6aaa9cc008", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765097, "uuid": "3c41834e-243b-4200-a956-c1c20dbcd65e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765097, "uuid": "7f2a2a8a-ac98-43be-96a5-df290cb281a7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df7c2fa-c6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725438, "uuid": "7ab9fd7d-f640-4aab-9585-0fd7ffa27827", "comment": "Malware payload (Mirai)", "value": "01e01d2f94964485a28c42193ef60988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725438, "uuid": "b1e79c14-cebb-4c21-a9b8-c0c1b57c6c70", "comment": "Malware payload (Mirai)", "value": "8348f3d2125541b14587ef8d6721020f9162c8c808e02cf2f057e636fc122a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725438, "uuid": "111167fe-4cee-4557-8197-2c3f8a3e6ffc", "comment": "Malware payload (Mirai)", "value": "834467b5b36d9a25cd1c9a0fefba51d149a1876a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725438, "uuid": "e18efb93-f3bd-436a-a268-4c60b7180b72", "comment": "Malware payload (Mirai)", "value": "d8913a155888f76c29b1d04f42008afd212ae36964d6a41720c2c5602b7d1ef56128385d56408b7c8165ecbc67a813e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725438, "uuid": "58f485d9-7262-46b7-b052-e177d2e36297", "value": "T16523F11E32896C60CB728EF704FC468459F945FDE0FABE31021C4D7067D641E96B89EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725438, "uuid": "bf237073-d161-4df2-98db-94a801bd4992", "value": "768:eJVdLbCKvx9oYWMIDgi/zmy5byXPZ1ac7HA6zt0sNSC7awCo62aKmVgB8zs3UozK:27J9uMIMibUvT7HA6B0s82ai6hKqgBRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725438, "uuid": "12610446-6642-4490-9907-168e134c77b1", "value": 47340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725438, "uuid": "acfb6cca-2aaf-456c-afd5-05986a09cefb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725438, "uuid": "59552a94-6484-4140-9211-a1dcde17eaaf", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de836b92-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714487, "uuid": "b2d50a42-d726-4ae0-b283-63c7a6218d5e", "comment": "Malware payload (Mirai)", "value": "d0b199da5555da703148de7cc7d93962", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714487, "uuid": "dcd67425-0c01-44e4-8738-e223aa29cca0", "comment": "Malware payload (Mirai)", "value": "83b628a580c1fb473a0a55efb1dad03f6a81f1a5c1e0ae99f550a764fd9d9efe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714487, "uuid": "773cec30-2858-4972-a5b3-44f4e056bde9", "comment": "Malware payload (Mirai)", "value": "dbad998fd60417d391617caee2e1704f7287cdb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714487, "uuid": "48c3cb4c-5567-4652-945c-89ec1b4c798e", "comment": "Malware payload (Mirai)", "value": "2ed0c4677d3abf64c0df45fce75e672dc5ad9060c5360d85d16a4757d38de7aa4f43ba7b8167a5d9e25076b4beb6a2a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714487, "uuid": "e99d6033-f51c-45db-9b7a-c2ca435c4c3c", "value": "T1625124BB01094B359609864FF7F875B4722BB5D796EBCE04E944281E5FC5D5C3292E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714487, "uuid": "4eff35be-bd5d-47be-8abc-37b54d33965a", "value": "24:6P2JMOIbiBG5uZxEaEnE2EhEkuQbw5KJUflChM34:6P2JMOIbiBG5uZxxcvyqQbwRChM34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714487, "uuid": "d68eebd7-c0d6-4b55-9e2f-aa9cf429467e", "value": 2907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714487, "uuid": "0380184b-8a6e-4053-bce9-92e4b591e888", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714487, "uuid": "f39a50ea-f016-41ff-a328-5a2666404a3d", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae95375d-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739747, "uuid": "5e6344bb-1df7-403c-8ab6-1db0b6178b7b", "comment": "Malware payload (Mirai)", "value": "50f2623d4a15d8b14c36db1788f46f0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739747, "uuid": "392bbe2e-e8d9-45cd-8854-6d122e0a9525", "comment": "Malware payload (Mirai)", "value": "84c4caf1b4098bc57ce9c13ed5f98f7adb2cf71fa8d16feaa2b9c00aa035d357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739747, "uuid": "cf2fa6fb-68c1-49db-966b-3c9f2f0c20ac", "comment": "Malware payload (Mirai)", "value": "4378baece62f2033123808807be337bf82cdac90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739747, "uuid": "138cc775-9e3a-4635-9674-324d19fe14bc", "comment": "Malware payload (Mirai)", "value": "c5d3c20d7ec680a09479d1bd4c27cf65c602ba0855b456fced4db3ed6108446325e0448fe7c1ed8163d96e0ff88ee845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739747, "uuid": "9ebcd47b-bf81-4eca-aa83-ec53a1d991c3", "value": "T10224F81CF4508B7AC7C1217AFB55428933734F68EBEA730589396B387BDAA255D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739747, "uuid": "13194652-8852-47ce-afc6-61588fb78963", "value": "6144:7Q92pG07KIgM4akHibridGkk0AE6KZn7Gg:UkTI/HiPQKvIn7Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739747, "uuid": "ecc3296d-9a71-4341-ba1b-0131d866019e", "value": 216548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739747, "uuid": "acfcb602-b54b-405e-9496-39ee19f6bebf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739747, "uuid": "2bad0f49-f64d-4cc3-a935-5dd535990892", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910ec0af-c6e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763733684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733684, "uuid": "b508a08d-7503-4687-a2e5-ce573568e0d9", "comment": "Malware payload (Mirai)", "value": "03faeccedb91a0e3c681dc6428e0d991", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733684, "uuid": "d5bf181a-cfa1-4d17-bebd-6c33a152de65", "comment": "Malware payload (Mirai)", "value": "85b64a644dff16df2592cada5f24849257187f7d97949b10e8f5c85fe5cf5cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733684, "uuid": "b9b57afa-0d6b-4b0c-9a0f-c88c4ef6bd39", "comment": "Malware payload (Mirai)", "value": "f9adca862f5fa31fc92a7131a4b18db7a8a8b413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733684, "uuid": "16c4bc92-0a1c-4938-bfbd-7221ae8b9d3f", "comment": "Malware payload (Mirai)", "value": "ef97f812afdfe19a026de42d7951abf233172aae255ed282d12750c097384ec3dabcb68eee229f2e6a840f1bb9e6e85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733684, "uuid": "4894df3e-6fed-468f-ad56-9f6b051456b4", "value": "T1ACA2D059BF18858BC936293442E9E9C612D1EC61F3ACDD5A0E90C0ABB5A33A57431F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733684, "uuid": "b32a2e11-5e26-45e4-b265-3b53c7630895", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaz1Hb+502F2vwA9B1fKVVX5hSyG:k98o08kxofBE+ZkXaVbp2F2n8VVXBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733684, "uuid": "19a1678d-4adc-4a25-9d57-4abafdeaf9b3", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733684, "uuid": "93b6b9e6-664a-4926-8f1d-de98d80ece38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733684, "uuid": "15d98bc2-615f-46b4-a2b1-779131ebbcdc", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e52acc-c709-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763750335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750335, "uuid": "86690e60-b404-4b9f-9e76-ce71b65e7830", "comment": "Malware payload (Adware.Techsnab)", "value": "5c54c82348b4fad41378f8b8021136d1", "object_relation": "md5", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750335, "uuid": "0a30c066-e1ba-4ffc-8940-a1e8af1ceef6", "comment": "Malware payload (Adware.Techsnab)", "value": "86367e421b4383a6f1fae0430dfb98c1161df1c4bc7203d93f8c0579c92c9a67", "object_relation": "sha256", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750335, "uuid": "0e3d9a99-a83f-4b27-bd16-9880b12d1c57", "comment": "Malware payload (Adware.Techsnab)", "value": "a78bd43bcc9f97a84fc2a1c8a759442f309484f1", "object_relation": "sha1", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750335, "uuid": "74dd2cc7-d659-4771-976c-2d8fc4b13534", "comment": "Malware payload (Adware.Techsnab)", "value": "7b8545e2eaf46b708e6a0409432cda4e85fa2f969f697b3e311041119450037264d04df01158edb54cb3df70fa6e43b9", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750335, "uuid": "db2b6af2-8a03-42c0-8b8d-f947af20790a", "value": "T1B97753A8BA8C8C26FB2356BC492793E9095C32DC3EB957334B56A74049DB540BC53C6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750335, "uuid": "65a9b69f-30ba-478b-9845-348d0585a768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750335, "uuid": "646a7caf-9a4f-4687-adf7-155e84be94a0", "value": "196608:t9bu3qCEEkDhSQd4zgdFpcHPHpjooIC566i2EJsXPNqZBUHW0X/af2Q:HS3qEEuHpjooIWNPNgoW0XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750335, "uuid": "6dcf2097-0cc9-4716-8042-470b43be4430", "value": 33728468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750335, "uuid": "f80b6511-9c88-453c-9af7-006c658604f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750335, "uuid": "e4cc579a-ee59-46d8-8b90-75f304666ad3", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400754d1-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711214, "uuid": "5635d859-e1d0-4f1c-a677-e152a3e123d5", "comment": "Malware payload (Mirai)", "value": "27e33f2f1a79b3cc07be0dbbc79dcc50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711214, "uuid": "94880dee-c4a3-409a-b890-5ff6c3b15cc6", "comment": "Malware payload (Mirai)", "value": "86623fea2bd4b84059577d1af23790421a9a054f8021c3628f5f4e45feb292ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711214, "uuid": "30ff97dc-0469-421a-8b3e-deea99d940e5", "comment": "Malware payload (Mirai)", "value": "a4c8a6c959527de95bec8d09d4a17b4d777122bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711214, "uuid": "b21924a6-a5eb-4be8-98a6-3578fbaab57c", "comment": "Malware payload (Mirai)", "value": "452ce26fa3a03191eadbcbf6580b9c545a821bb81e22fe7ec456440f93dd4ad987231cbf74cca580e4f167f1b20c62e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711214, "uuid": "37c22f06-969e-42c1-bffd-2cca7397fe3b", "value": "T1C2837E02B70C0953D1B31DB4293F27E5D3EEAA5122F4D548390EA78E9171F329686EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711214, "uuid": "2dd61450-0b7e-4c52-96bf-ceda9468359c", "value": "1536:6rydDVGJiI7FKwiy2Xz8BFWqS0B0IAuNnMitcVXQ+ZnzjGF:6sEI6otX4BQE0IBdRcJZnzSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711214, "uuid": "fa799d2b-e33e-4ac6-ab42-b0ede3c14889", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711214, "uuid": "888de57e-6b48-4a1d-9656-45b269d34645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711214, "uuid": "948dc72f-a968-4f5a-b81a-62a15570f14b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d4a5a4-c6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763731464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731464, "uuid": "e9ccd03b-30aa-458e-8a00-79e6220f9d17", "comment": "Malware payload (Mirai)", "value": "22a6ddacae9c6b004d19f08b2f9791a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731464, "uuid": "c8fe3e41-e379-4f13-a042-cff1ba5fb997", "comment": "Malware payload (Mirai)", "value": "86e6960c0ca40fc357b5619b7e130e4a78243aa09c4c4e3c833dce03a90ff2f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731464, "uuid": "6455e4fb-a859-41e7-a86e-d763c18f50f9", "comment": "Malware payload (Mirai)", "value": "072803ef9be4fb1ff39a00b214a66f82c5de3c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731464, "uuid": "100d95fd-8498-498c-a398-19fbd56357aa", "comment": "Malware payload (Mirai)", "value": "88a342d1bdaccb52a950ac40bd754e9d2f897bc864e1e649ff7b825ef6bcaafe18a85977df8ba765288cbd992e2680df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731464, "uuid": "d521a8fb-fb36-4878-a32e-7e53746b9405", "value": "T117647C98BB0DEF42C18083BBED6B0623A37974507B4B97637915612DEDD3B8C9C5318A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731464, "uuid": "69aea4b5-7414-46c8-bdcf-9e13dc5ef4e1", "value": "6144:5yB4GnzYgi4rktKFdGQWkHLohjE0pPzrlTO:uLUw4QWkrohvrhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763731464, "uuid": "97178186-467b-424c-b460-6a52bbce3eff", "value": 309312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763731464, "uuid": "a952d0f1-5afd-4fda-a9fd-073827275c40", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731464, "uuid": "4c8f4a6e-ca7b-4e48-bd40-b81b940f998e", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71544709-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764125, "uuid": "f2c2dc3a-629b-48be-85c3-d10cb816ba71", "comment": "Malware payload (Mirai)", "value": "a7023629fbf8176bce69c6da6477cf54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764125, "uuid": "8106ac4a-a1fd-4af6-a345-e4fcc6f13261", "comment": "Malware payload (Mirai)", "value": "8843f90d69d0f7f0987657b06e994cc53ebd9bff50d4785f24e6796d284c9ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764125, "uuid": "47fd1e28-20b2-4f26-9843-19824390db8e", "comment": "Malware payload (Mirai)", "value": "127f9e9662e7fe92c742f66b7406908a4807a13a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764125, "uuid": "f4ad2042-46d0-4970-b6ee-ab89f22f1015", "comment": "Malware payload (Mirai)", "value": "919fada2facb52a30dfbeff369e641425f5e1cb73cf11ca6aeaca6ccccf3124a4b2c120f1a0b0e78b39b61959c11a9f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764125, "uuid": "3dee0b52-8232-4187-ad00-c032af72dd9c", "value": "T121B3D81D7E624FBDF3B8823447B78F31A758238626E1D685E66CD5052F7024D282FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764125, "uuid": "e751abf0-de48-4f17-8332-6d8ba1a1f87d", "value": "1536:IL92eizhXFKVVigNSIshRVIxab8U5V+bDpnXeMauOsYuKemEpe:e27TKVVLSIshRu8bbV+vFYspe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764125, "uuid": "93f28a06-284b-4d4e-bbd9-cdb3c9ff682a", "value": 111596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764125, "uuid": "16b974e1-6e42-4e57-812a-268722d4a7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764125, "uuid": "8e5f523e-5979-4118-981c-66fe171c0e3c", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d56272-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763766200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766200, "uuid": "adb480e6-bfff-472a-a721-f9d1044aa799", "comment": "Malware payload", "value": "8efbfda37d38e77eb52eca8b5a0b795a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766200, "uuid": "74c81ebd-213e-4e76-8c4e-0e828655e4e3", "comment": "Malware payload", "value": "88881ceac1e99b2c087e8bcadd57bb4858e846b50c7b507d1a6779a22a9204a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766200, "uuid": "d0bd9866-41ea-4d3f-9878-e83118c77b02", "comment": "Malware payload", "value": "b1c7bb1e38b907c8a30fe3a0b68ea6a987792cfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766200, "uuid": "f417aaa3-710b-4e89-844c-b37b4affa719", "comment": "Malware payload", "value": "c479005db9d2a8240c0087dbda0e97b9870a463adceab902f905c26e39e9af99562cf35e53151c4c6f90c5ae3099531a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766200, "uuid": "a7e8c9de-2405-4ffc-8af5-414731607767", "value": "T11D72350E52A0CE3ECCE9A3354AC74A3952B1E470BB71152B1B4477B72C933984E79B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766200, "uuid": "97184386-bf79-4251-8f8a-043215a25902", "value": "384:gPpVr+MV3E/3PHfXvn/3PHfayqC6SKiab71rjlD42:qQOE/3PHfXvn/3PHfayqC6SKia342", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766200, "uuid": "8fb8c87d-8ba6-4b8a-8e79-0412df4d571d", "value": 16968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766200, "uuid": "3589dd29-8642-4dd9-a9af-a927cda56afd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766200, "uuid": "eb60f0bc-3f52-4acf-8ce5-8a65a489169d", "value": "psh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8ad2b9-c727-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763763287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763287, "uuid": "2df18bfd-0036-4809-ba29-1d30ab5b5145", "comment": "Malware payload (Mirai)", "value": "3e82ce1bb4fcdcd7f98078e08282ed48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763287, "uuid": "09b2cc94-fa0d-477e-8036-e9b6de73d9da", "comment": "Malware payload (Mirai)", "value": "88bc27cf8ca6da091db35632ad5ec739c8613d4a14d20a4341a16b74c6c639e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763287, "uuid": "5da85c92-297a-41f6-8923-e2f8a77b4c04", "comment": "Malware payload (Mirai)", "value": "b03a176a8131e5c55bf1d74608bd2a28ec8300ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763287, "uuid": "fa4772f1-b538-4400-a2da-518ed1e84a8f", "comment": "Malware payload (Mirai)", "value": "567beb11e43ee186d4bd448b1713558e03a6b7bc7a1a5177da419bff5fb24e5e3940c3e02f6d1b263e8a48eb8216d8e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763287, "uuid": "92364813-55e7-4672-b8b4-048e056f1501", "value": "T10F110ACE226562229480CE74706584B89178EED072688F5EBDCC0CB395D9A29722AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763287, "uuid": "b54ca7a0-a269-4944-839a-4095d290ba71", "value": "12:k4yXa4y2YEv4y3NIl5B4yc0LKmk4ym+ObD4yjjMN4y9T5k4yCSON4yLty4yEN4yS:cYEfNI7JKU+Kj4T9lxtpzMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763763287, "uuid": "f0d4d426-734b-4077-92ac-bf34ad73df4b", "value": 931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763763287, "uuid": "3e47e835-fecd-42d6-ac7d-b489ddbca935", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763287, "uuid": "9c30756c-caf5-4ac1-909b-941f25368e4b", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f082dec8-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734703, "uuid": "18cd5eda-8172-4ff7-aa4e-29186471ffbb", "comment": "Malware payload (Mirai)", "value": "48bc89ec9865ecaa943cdd9a2a53ae5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734703, "uuid": "4c401026-fbd1-406b-96e7-c601529822f8", "comment": "Malware payload (Mirai)", "value": "893a078d57bf178befa75b2c3429acb9cce9b133482e18d12e1c8c07374fc100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734703, "uuid": "c4e6bb10-4f2c-43c0-9b2c-47ac7c92017f", "comment": "Malware payload (Mirai)", "value": "fe3704c6dbcd51f9d2d0d2ec947a68fcaaa88a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734703, "uuid": "e6d216e4-d645-42f3-9ffb-ed5e32a215d5", "comment": "Malware payload (Mirai)", "value": "df238f6f49de1c83eee60d41cfd9cbc93c5ce3790811a94cde6b67a2339b7edad06a152fc4ea83d74e704f08d73950d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734703, "uuid": "32b4c558-8219-4e3d-ac7b-c91b0900ee81", "value": "T1CAC33A81F8C28A62D6D723BAFA6E128E332263E4D3DE7103DE256F11378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734703, "uuid": "715606da-f16f-4142-a3dd-62d0a8c647b7", "value": "1536:a7wCsAH3EkMW29wxhAH1BflYHfrewfBAtj6KsPkFZlq3QJX6s0K598voC:a0C/3ED9/qfB3EZl3J6ToC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734703, "uuid": "1b0c8498-dbdf-4c1e-a045-4f6ab26b1184", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734703, "uuid": "d97c8a81-eeff-475f-b472-113c69b51557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734703, "uuid": "94e1fbde-f87f-47ee-8a4f-ae93c6789116", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28915818-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763714182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714182, "uuid": "cd42595f-ba51-40d9-9d61-4412187e5ee3", "comment": "Malware payload", "value": "47e90716bcba31502f3572dd0f7dd9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714182, "uuid": "9b399f45-db70-428c-8282-2f06393e4603", "comment": "Malware payload", "value": "8a5943f9d397b38d86a4ff3c5f14f5976f8f1cc11fb06481d24833e74b8b963a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714182, "uuid": "0e9301d6-e849-4e32-9974-158fb1e09897", "comment": "Malware payload", "value": "47767d55767a2ba33d49f6b281d07053fa18f231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714182, "uuid": "b7ebaad3-7dc5-46c5-9366-13e401326d02", "comment": "Malware payload", "value": "d965e764814aa0ae6b076ffe2b89b99da65f59334740415b713da75accd616483e4f2b3877ec96d5d91c5b18f13ed803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714182, "uuid": "89459b5a-c221-4f50-9039-3dc8e77ceec1", "value": "T14CC4C51AE6F610E4F5BAC13899A3312AFD7238644734A7CB8780561B1B31FE4EA3D751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714182, "uuid": "aea6701f-9ee1-498b-87c8-3a64def0a8a4", "value": "2a2cfaab3fba07900b34585ec67abe9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714182, "uuid": "107c4946-59c2-4797-8882-e0a9f671aaea", "value": "12288:jvf/h5kvsqv4qhFBq0Asg6YigAS24iXhgmv+jYHOqW2ApiP+vJyVL9p1:jHbMsqv4qhFBq4hg04m2vqW2ApiP+vJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714182, "uuid": "e6914fbe-e605-4cb9-a02c-ea64529acaf4", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714182, "uuid": "b63b1ee3-c016-4e64-b5cc-e2985cb24fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714182, "uuid": "2a87c0d1-325e-4e6d-9b19-d23b5328c013", "value": "SecuriteInfo.com.Trojan.GenericKD.77843214.3034.25268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23991f6-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694280, "uuid": "c7f5132a-688c-4536-a7af-64e5f313bb99", "comment": "Malware payload (Mirai)", "value": "366dd337a522591b247825be2a8ae66c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694280, "uuid": "9720ba02-05f2-43f5-ac87-4c0c12e462d2", "comment": "Malware payload (Mirai)", "value": "8ace4e3efde30f300d3c116b03ddf62b3ed8b289363f6cb97f441229b9765786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694280, "uuid": "aea99c23-75e9-49e0-a90d-03ccfaecc6de", "comment": "Malware payload (Mirai)", "value": "6c91a9ed85870f2ba353fb453ac5aed3a9e320f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694280, "uuid": "131ba4ae-cd7f-4fde-8f84-18f48db81cec", "comment": "Malware payload (Mirai)", "value": "3266e3ad6da9576e8b87318ac374202c7c9a28a0e523ba2ced030ad2dc7b83babdc83c8979e70f94caf340da4f8918c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694280, "uuid": "30979304-1132-4799-b480-5ad1e5d0aa6f", "value": "T104A3D85E7E214FADF769823457B34E30975433962EE0C584F2ACE7091E3424EA91FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694280, "uuid": "4b0f88c7-ccdc-4c15-9870-ba12cdcfd11f", "value": "3072:bWvmlb+blQQzeAOUl/916kkcv5pD5ZmIW7jxcY+mZn/kWY:bWvmlbSzz0Ul116kkcv5pD5ZmIWOKcWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694280, "uuid": "de791793-0698-444e-b78a-d0af163a7d2c", "value": 105672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694280, "uuid": "f22c757d-a432-42fb-a128-73b746ffde7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694280, "uuid": "8533b80a-a360-4c93-8a23-b16530c6e089", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e713f77-c708-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763749840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749840, "uuid": "4208b581-1b61-4c9a-b003-d47d70053b15", "comment": "Malware payload (Mirai)", "value": "69d9a015a213baead0a8f47715348411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749840, "uuid": "899e63b4-1256-477a-9ab6-b60f788fcb80", "comment": "Malware payload (Mirai)", "value": "8adf00a7b5338d10d3ff26b62c316eb94630d156a37577304b42768e1a5ac952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749840, "uuid": "75d16300-98ed-491e-b9a9-528c77366e93", "comment": "Malware payload (Mirai)", "value": "7fd3dc72a423be17248edb8e92ba65432085a917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749840, "uuid": "3274192b-5959-45be-9960-1ce0937464de", "comment": "Malware payload (Mirai)", "value": "6ba9372bc064c01af6b29c8292da2165646ac50532ac59d9e067c7ea3501b73d10ea3b42a8f02862e6931046837e83b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749840, "uuid": "37c8291e-8481-4b64-a60c-36bb0e495c4b", "value": "T166D35A00F7090AA3D0931E74133F0B769778A9C266F5F1055A06BBA52B31EB76587FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749840, "uuid": "7ac10839-c6f6-46c9-b883-ff21fa79ae29", "value": "1536:levWcKr9te7hpW4KLjgOPyzly2jStUuR70LY5ZYI/IiIfJN:t9UzWPy5y26UuR70L0CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763749840, "uuid": "8589e426-ba2e-47e2-9542-3d00029a3f26", "value": 132108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763749840, "uuid": "e6a72674-1098-4e9f-8aed-76b10a994c04", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749840, "uuid": "708f2075-e186-42e6-83e8-57bd251d3d72", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de7b940-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763742081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742081, "uuid": "d8fa00d5-4636-491a-9f03-bb0cb22ca2df", "comment": "Malware payload", "value": "2b62733e719c354d82cfae4a99ac7be0", "object_relation": "md5", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742081, "uuid": "529bb880-b3bc-415d-88b2-f1f321203a51", "comment": "Malware payload", "value": "8b4e15a98255e4425c519559b34e729cb6e43e650546d34b515cffe80bd1eded", "object_relation": "sha256", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742081, "uuid": "0933ec9b-fad5-407c-ab86-8b62f859a2c8", "comment": "Malware payload", "value": "5a451873b748eb6db4a15084ce0cc62cd90c9aa8", "object_relation": "sha1", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742081, "uuid": "0e961900-83bb-4962-88be-13589466989c", "comment": "Malware payload", "value": "158c32f39313ee4c579527686d1e363fab9af1567ef3784fbec568c3eb59c5690511edd174d954e4de39bc0713fc351d", "object_relation": "sha3-384", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742081, "uuid": "0d492df8-21df-49b4-a7f3-410412f347bf", "value": "T172A35B41B1C58071D87F253E06609AA06F3E7960DDE69E9F2BA00DAE4FB52D0DE30D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742081, "uuid": "c570eda0-f5bb-4549-8dc8-f056b34547cf", "value": "302f4ebdce63d1e3cfae816587e486af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742081, "uuid": "ebdd381d-78b0-460f-b669-a488e1fc9b23", "value": "3072:oV04cEua0Uy+RydGWxjKCkIzl10RxSJ/N39j:5gd9y9GkjKuaSn39j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742081, "uuid": "480a1eab-d522-416d-83ae-abf7876da3eb", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742081, "uuid": "b6381947-ed1d-45f7-a917-e403b62f8fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742081, "uuid": "10b4c078-3eb8-4ae4-9cbe-24a65643649f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089674fe-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703820, "uuid": "d897dc39-5e63-42f6-bf0a-8f3b74f83d6f", "comment": "Malware payload (Mirai)", "value": "094775bad16084917b528c8b455c3cc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703820, "uuid": "baab0eae-3b5f-4bf8-aaf7-e820184445dc", "comment": "Malware payload (Mirai)", "value": "8be0846e7263424851849da92bc1dae84c16cdb71c1958c9f4dda26acb1282dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703820, "uuid": "3de3c87b-5def-4ba1-b8e1-96c335c3ef01", "comment": "Malware payload (Mirai)", "value": "350bded915b2dfc69c53c80e010205a1121d702d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703820, "uuid": "451d6080-9e36-4eab-a304-9f5386c2a798", "comment": "Malware payload (Mirai)", "value": "20eaa794a9469e7e9699a98febe2c8f21cd9a167cc1d7870fff6bdd0cf6eac22db52f587abe8c089babcd51097e840f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703820, "uuid": "9425a553-96a1-46c1-b99f-3b33f8472786", "value": "T114043A26ED50C0AEC182D1B8A7DBC1B2F731F8F80221365B73696A362E69F505B1D747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703820, "uuid": "532c53a5-587d-4101-9505-c7d816824cb1", "value": "3072:oYkSV3/+Wzf9zdfgo4kZOuOeD4EabfuYc7PFvswdrlO:ZkSV3/5Dfgms8D4EabGVNdrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703820, "uuid": "d44a1037-9bc8-4269-be5e-3cf553960a13", "value": 173536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703820, "uuid": "907e9078-eff9-498a-8949-5013f348e30c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703820, "uuid": "3c1f26f4-39dd-4ecd-b313-782a3605996a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17e9432-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732423, "uuid": "8b6c6591-adc9-4fa1-8ea9-ca054a80ffe9", "comment": "Malware payload (Mirai)", "value": "63832324d0955f29e2dd79936dec3815", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732423, "uuid": "8f94547a-8543-4e9b-875a-58a9b4c915f8", "comment": "Malware payload (Mirai)", "value": "8beef51eca97be3883e209a50642ec35499a90bfa90eaaa553ff41b9c2f3a08f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732423, "uuid": "4ef3b2e3-c3f3-4abc-9c48-15fec0ed5bd0", "comment": "Malware payload (Mirai)", "value": "5440a1bb563dda5e205d7541282de8980784a3f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732423, "uuid": "6ae21de3-17f4-4b67-aa24-2f5e605ea322", "comment": "Malware payload (Mirai)", "value": "7bf21fffe989bb67fcc8153cfe0dadb48fce4ad98984aecc7c48594fed30a1ccca5bac8d209eb89dedc13a6430ab219f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732423, "uuid": "84479c20-b95d-4842-b02b-41bf92ba29da", "value": "T1B5230283EDEB4BEDC2EAA13C446F6583065991EDB682CE776F4D742FC406F162206742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732423, "uuid": "1a8b6ced-57da-4efc-b581-d7f01081436a", "value": "768:oMxa+Kqs+LOFt47TbIX29hPd3UgmUkoX/9+sbMUPBepYx5Z+UU05IAdL8GzQpXaV:xa1qsf47TMX0M6FjPBepYxrU05L9wOn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732423, "uuid": "99943076-8622-4aa4-afff-9dc13dbeeaba", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732423, "uuid": "267f57a5-a207-4c58-81b9-4e6a940bba9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732423, "uuid": "dfcf5227-3747-45a2-a539-275c08df6462", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a891aa2b-c715-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763755628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755628, "uuid": "060926d8-83e3-4d05-ae04-2c06c6667db0", "comment": "Malware payload", "value": "c42ae57d00edd4c5343f3639d434664f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755628, "uuid": "dc6d0ba9-3d4c-4544-988a-8f48ebfd78cf", "comment": "Malware payload", "value": "8c2def9d3346a1f96b43c8a915d9585e742351b05a1887b2ec4293712eb64af7", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755628, "uuid": "e8a18b15-843f-43aa-9dbb-78647b60412a", "comment": "Malware payload", "value": "b91ad7fc830469ebc2dcfce085f683d927c91073", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755628, "uuid": "6c29e328-6e1e-43fa-a919-ff9f7c43f15d", "comment": "Malware payload", "value": "edf8e7219845bcbc05a5e99bc64a41d916b6003efa9de1cb1a8d69aaaa88d42c84b314363febea32094ca553f8baaa31", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RomCom", "colour": "#3E17A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755628, "uuid": "55bda361-0f9d-4832-bbc1-b346e8a2ee41", "value": "T1FDB44A1AEEAC00E5E06A91B889738D01C77638653774DBCF07A4C9A6DF13BE15E39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755628, "uuid": "a9a131fc-807a-495e-81ab-2ead43b75134", "value": "6cca7e75b412649b6f438549de300123", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755628, "uuid": "14415072-fbf4-4572-9a19-8cfb15fc8909", "value": "12288:Yp59DrP2j8l+bbUnla52Wals5FWULZR5lLeRWfQ:OZrP2j8l+bbUnKals5sU7LeRWfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763755628, "uuid": "fe0cc245-87c7-44c9-8496-e484ad29aa6a", "value": 505040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763755628, "uuid": "63fe8a2b-1fa8-46c5-829c-982b70cb970a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755628, "uuid": "4406f0a3-143e-4525-9856-c72129370a5b", "value": "windows_notepad_with_sign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e5db68-c694-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763699972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699972, "uuid": "da3df3c7-a7f5-47e0-a6de-3d77221c386b", "comment": "Malware payload (Mirai)", "value": "c3414de79071d25f594ea203ffb21534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699972, "uuid": "ac3b4327-c233-4244-aa32-b3b5641b4d6e", "comment": "Malware payload (Mirai)", "value": "8cad3cfa14354f91a55ad56758709800b453e0a82479e824863b513f33991564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699972, "uuid": "4cf7be05-b857-4205-b610-1fbec1dc8f15", "comment": "Malware payload (Mirai)", "value": "48e0c62ac5e2d7994d5e93b314603965b0fe9df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763699972, "uuid": "022e6868-ca36-43b7-9e11-57abeaf5f5b8", "comment": "Malware payload (Mirai)", "value": "9548f0757a37d84d0912bc9fe476a08d10d73be4122f6dfb1c6fbe6e4c3ae779cdbaa8e4cb6ed44be2c0e12ddef8a9a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699972, "uuid": "8889f47d-74d7-43cf-9819-10f399659a16", "value": "T13543F26A3362A5CFD4B04D7FD50524363E92F338E4F136BB15688E9F3686407F629849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699972, "uuid": "22b72ae8-4332-4ffb-850d-e1921f8b1e46", "value": "768:vg3GHODh7mACRi6gnDzt1kZkHv1vGJeKgeTUcSEy7vkkrS+q/DBD8xeIl3UWF:8TD9mASgnnkKP1vZiTUcS5brW8eWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763699972, "uuid": "51315619-ac2c-4bbe-9717-9dd293dd81b2", "value": 57168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763699972, "uuid": "1f8d31b9-8a9b-41a4-9434-cc3d641535a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763699972, "uuid": "cd8a2c51-5fe5-4476-b4b3-b1927bedb5c9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f21966d-c66d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763683242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763683242, "uuid": "3417ad50-1de0-4602-ab00-ba5874d0ec68", "comment": "Malware payload (Mirai)", "value": "3a01b2ef1421708333d7840ba0cea166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763683242, "uuid": "34c382c9-7d94-486b-8db9-86626f6b425e", "comment": "Malware payload (Mirai)", "value": "8d8914c04156426e5ff3438778518a15d8ff1b6045d57b391929996d27a7d9a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763683242, "uuid": "35d71aa4-5ddf-49b3-b531-ea1f31baa763", "comment": "Malware payload (Mirai)", "value": "a12fd6a1b5d9cc19486ef81237fdb9da63fcd3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763683242, "uuid": "970b1517-8e83-419d-bc97-fb2843aff53b", "comment": "Malware payload (Mirai)", "value": "85144dcd9e82c7baa51fb933624351d00a78fa7c388ac3bd3abfee619e0c878f979e8fb2fc7b356ba2392af09ec8a527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763683242, "uuid": "57bf2298-8399-49cd-8e32-20d7af6ae629", "value": "T123332989F747DAF0CC4305B0115FFB3BA936B9A12224DD77DBE0BAA37CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763683242, "uuid": "370eb99b-4fef-4bfa-b1d9-b2348c6ee92a", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpOR9s0v7l/iE+nKPaO+hTvlwas:oSfvufWuq96f58X3jv7lSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763683242, "uuid": "11ddd802-ecc1-4cbf-b300-221f51d8d90d", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763683242, "uuid": "694110df-cdfc-4a7d-8e95-c450b507449e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763683242, "uuid": "16f63c5f-862e-48d0-a5c4-7962d3a44cb8", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec9ab20-c6fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1763744928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744928, "uuid": "c3d92c19-f54b-40b5-baaf-b2eaf5e29f24", "comment": "Malware payload (Kamasers)", "value": "bb8e884ad3ab8abd8c02fedec204a922", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744928, "uuid": "751e0da1-e1c9-4d3c-8bd0-4ce13c70ab6b", "comment": "Malware payload (Kamasers)", "value": "8e040631194121e1177880c9875d671d6d646a7bf4cfe52da863659a35f08fc4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744928, "uuid": "be62ae31-bad0-4b42-bd08-520382bf1335", "comment": "Malware payload (Kamasers)", "value": "2774d842323bccbdc481e2d1e53b0c9dd556f183", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744928, "uuid": "6ac0b652-e442-40c5-ac16-cf2b5fe5454c", "comment": "Malware payload (Kamasers)", "value": "753becd8c4101da5d9d8573a86b3837a220bd89bccb48deb69e11d22267638fc2a2774087a6b439587addc43972abb96", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744928, "uuid": "cc1e6649-6f8d-4cb2-a133-aa3ef2a7839d", "value": "T1FA85239553E42495E975533994F202579632B852EBB482FF06C2DAFF1C63BD0B232F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744928, "uuid": "cb3d7718-98ae-4f1f-8289-8da1c106d521", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744928, "uuid": "248ec0e9-eced-45bd-8947-c9cf3e256809", "value": "49152:6jGudObRbe+ZhlwkW7Hn8iXfR38dI4YjKOXQF96NyHxs/O9:cdAvy57HBOv0o9GO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744928, "uuid": "127b5e46-c0d7-4582-874b-4baeb7da4e84", "value": 1724528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744928, "uuid": "a4173ad5-94b3-44a2-a8ef-41203dd3a80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744928, "uuid": "f7546072-a014-40ca-a8ba-d890ddceaf83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29629fac-c6db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763730504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730504, "uuid": "b6b264f4-5ecc-4af6-b9d4-2d77e8d009d6", "comment": "Malware payload (Mirai)", "value": "51bfac9c08bccc74e4c7fa41ec1d8d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730504, "uuid": "0bedd327-597b-4b41-99e7-7006fb4d545f", "comment": "Malware payload (Mirai)", "value": "8e19d4dc5a6ca4e77c3d5f98718403d605cca9815eb9d06055ae14336f1264e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730504, "uuid": "c47cb29e-bc3a-4521-b6b6-27e3028de02e", "comment": "Malware payload (Mirai)", "value": "cc38dc5d9c742f53410f688276d871495e9459f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730504, "uuid": "e4c1c415-c0d4-400b-aa8e-5d3c9c2a5b9f", "comment": "Malware payload (Mirai)", "value": "41ad8a57a924424f6c0790c94e43743f0f8fb5294a069c6156a31e67ae425f7b8f2fb09576cb6ae19a7769b3f21fee3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730504, "uuid": "0b6db032-8b5a-4808-a765-15a55b1c779d", "value": "T1F0C31292FE55CA88D72926D4028787B88F24D0FBDA4CE711E827D55C3706D2928DABD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730504, "uuid": "7f75acfd-e8dd-40f6-a821-7406abe5d41a", "value": "3072:rpXsNcXM+tEHwQxPbW8ZqCS9Xs46QPmcUR2maccqd:rFsx+azW89L46QPmF2mkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730504, "uuid": "a9057b15-8aaa-49a8-b526-b2ade4582444", "value": 122416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730504, "uuid": "97c53d9a-3a68-4ab5-b7ae-1a25e39b2b5e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730504, "uuid": "1392c62c-053c-44e5-92a3-e6942f08327e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746f54be-c6fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763744374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744374, "uuid": "31899e8e-a123-4122-98e9-409b6330d722", "comment": "Malware payload (Mirai)", "value": "f38a5f79d7d5337dfe3aab43591d4015", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744374, "uuid": "76cc12c9-5be2-4f32-9261-819ed928b058", "comment": "Malware payload (Mirai)", "value": "8e3639760b99df53e460e2b3a0659117eb52fb6b11481c1aefd1b54745eb660d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744374, "uuid": "4fa79200-0cd7-49fa-8f3b-8340d7b8656a", "comment": "Malware payload (Mirai)", "value": "6e2b84db02b4edd6c0e60a3b780ed0c007223918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744374, "uuid": "32eac62a-7624-47de-87b7-9d05358706e9", "comment": "Malware payload (Mirai)", "value": "440cfefb147eb86b1fee01f0478313c263a222a11dc15c500ac0c098f9a927ef4e121d0b28a61cb73f58a55d4f7177cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744374, "uuid": "8236b8a9-4bdb-4323-94e1-c35eff0fbf86", "value": "T110933C02BC6191FDC08784356ADFE517F731F8895214762F37C8A6312FA3F655A0AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744374, "uuid": "05018a1c-2d48-438b-a8e7-624ff10323bb", "value": "1536:uVad11RGBGyuNeH96LjsMrG05AkhdZ3aor+8RBJuUOl:EgkGW0vn/BlT3R/uUOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744374, "uuid": "4e2ca9b2-c2a7-4371-a8ed-96195f719d92", "value": 94864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744374, "uuid": "ae43df06-d1c8-4c97-adeb-49d92fd49451", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744374, "uuid": "3ad97a9b-9efa-4c00-a5d4-dc60d44dbc28", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccb2ba5-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766507, "uuid": "5ff47046-f555-4c5a-b631-3e369e6f65c5", "comment": "Malware payload (Mirai)", "value": "ed070844a8f2abfeffbf915cd4c29ea1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766507, "uuid": "d9c05616-b865-4f79-a068-b06cc1a7f90f", "comment": "Malware payload (Mirai)", "value": "8f8edefa938844a4b029e27527903f5e5e8e600781e38012da4d52f004fab69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766507, "uuid": "ea10175c-8f5a-4383-9e7e-4db77bd95311", "comment": "Malware payload (Mirai)", "value": "270f97e0020b5c5e3da85151a06a12f0506d8788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766507, "uuid": "5749a227-ef5d-448e-902c-495f47be15f4", "comment": "Malware payload (Mirai)", "value": "d2106fd654ab7ac9b9fbca7c76160c3d00677a61bc7b9a1693f7e32c6354def6bf14462c49b7476d70c62e8a3604ba11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766507, "uuid": "004786ac-4af1-4b0d-9147-8cfdf713b491", "value": "T134144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766507, "uuid": "e56f3bd7-b2b8-4aec-84d2-cb06eab28c66", "value": "6144:9MygR/fQdiYpYN4aTBMvlZe5cgCHMhMm3r5M/9pTKF:9MBR/fQAiYN4aTBMvlZe5XapMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766507, "uuid": "2b4e57b9-8deb-4924-ae9c-d76c2d7cb6fd", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766507, "uuid": "8327cfe1-9a76-44d3-8bf5-690807a90dcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766507, "uuid": "2a87a026-cc93-4289-ad09-57354b8c79c4", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e7c30-c733-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763768278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768278, "uuid": "c02787d6-248a-4a4e-ac06-c8f7c802259e", "comment": "Malware payload", "value": "03c63fc64383f30f36131baa9c5736c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768278, "uuid": "dbe16bd3-a5d6-42f4-80f0-6607eb125535", "comment": "Malware payload", "value": "8ff39072d8f7cdf6e8e67f2eb34cb2c69400daa3788a2f0deb9e3450c6de19eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768278, "uuid": "288bc32f-f416-4515-901d-d835f2246fae", "comment": "Malware payload", "value": "b546753a06d7798b3775107f0bbafec8fc4cdc4f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768278, "uuid": "a9704be5-1922-4087-b687-369a8402b039", "comment": "Malware payload", "value": "0727b2306d1aadb73a31daba945e69703c8e6185c4602f45ceb5518c7160c8ca643f95baa6caff60a9bd7986535ed1ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768278, "uuid": "2250f0c8-4474-421e-9677-d6c3bab760ae", "value": "T12002F6157086787F55835833B137321BF572E0B69F3211AE807F42418FAAAE1259B9BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768278, "uuid": "c6476f88-e502-422d-add0-e8ddbd42cc25", "value": "96:u2vwpKXg5YyHrZL+8H14TVk/3lKWBPjQDQyQXVQaiQBQYRQsQXXQBQEgMQQZL+8H:j4VKW3fULHSOyeLObNYswjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763768278, "uuid": "bf550040-ab0a-4335-aee3-08d97ba8d6c4", "value": 8210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763768278, "uuid": "ee476c92-fb17-4bf4-a5c4-836e1a1d563f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768278, "uuid": "f067e135-b4c0-4753-a049-dd2f2c63360e", "value": "build.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bf9ca9-c697-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763701287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701287, "uuid": "c7a5cf41-234a-4c33-8022-e8ecfcc84c2a", "comment": "Malware payload (Mirai)", "value": "ac93b519bf2275e90a1bdf4400d55577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701287, "uuid": "e49b6b04-e0c7-47b3-8151-a6a79d46bcea", "comment": "Malware payload (Mirai)", "value": "90e4c273928aedc62dbfffbf1a70b9a62ca513c2182f2e8c9e36e354c122b775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701287, "uuid": "3a7baa47-2ae7-4cf3-9bf6-64101246ed6e", "comment": "Malware payload (Mirai)", "value": "65361a4b7d2f9a1a3cfbf67f931b4401c175a94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701287, "uuid": "15d410c9-293a-4606-8663-20f1174b5a0c", "comment": "Malware payload (Mirai)", "value": "d4a374cbccbd797b05c270f6942cebf3e6417940c5b2712fc3f65854a5875ed8635f2b292beca35409a04882dd69b60f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701287, "uuid": "99765e49-9bd3-43cb-8e16-b06ac3ba4415", "value": "T18E24841E5E228F7DF7A8873047B79E20975C23D637E1D645E1ADC2205E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701287, "uuid": "c60028fe-a8e0-4478-817f-a63563e17e62", "value": "6144:4FEhusS8OcikMUH1yY+vYXy3p+F/1FRLMeTpdnZode8WUb3FNXOlRf:l3MWEIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763701287, "uuid": "86df91fc-8d81-4e18-84f5-b460c9fb7083", "value": 222384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763701287, "uuid": "46ea23c1-ec7e-4931-ac5c-089d4986d055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701287, "uuid": "d194e874-e91d-4834-b2d4-680123c6a596", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f0800-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714495, "uuid": "36a39079-fc89-46f3-87c6-e7b0e6ed45a5", "comment": "Malware payload (Mirai)", "value": "95d799158233702f42425f15b09a63bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714495, "uuid": "5175edc3-5734-46ea-baf1-9620036844ec", "comment": "Malware payload (Mirai)", "value": "912b8ad970a5590c50607331935fe7e92bee47132fb223714b6630c5f04e2c08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714495, "uuid": "bdf2d5a4-4b0b-4cc2-bb5b-7f6d15f238ba", "comment": "Malware payload (Mirai)", "value": "bd33dead8fabc48ea2746de12647d6c110d87556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714495, "uuid": "141b3968-446e-422d-8ab8-5325b5d514cf", "comment": "Malware payload (Mirai)", "value": "692715fea4062cd686cc42038cad6827ddd2d1f210736d53b0867bc2737c255c5001c86a946720606e4cf92fac541b0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714495, "uuid": "f10ad3bc-a2bd-4e76-bdac-968fb7883af1", "value": "T1CA146B12FB0C0863CA431CF04E3F07F9A3621A9104F59116291C7F5E6676D77A68BBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714495, "uuid": "235865a2-2309-4463-ae47-cac1717dd484", "value": "3072:TpRQrKLGWjJIyDu6HpRWp6hBatQZkifaRak0ES+Ji8iZ2GscU6nwtKUaO:krWj/WpIgKe0ES3ZxUC23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714495, "uuid": "afc009cc-3b95-48a1-9572-7c65de217cbf", "value": 197616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714495, "uuid": "4ddad206-521e-4045-b7be-f9877153e5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714495, "uuid": "249087dd-e8db-4c32-95d2-7d817f5e2bd2", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38842a9f-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715926, "uuid": "d65bd422-cc6e-40db-9799-056ee6d44b92", "comment": "Malware payload", "value": "dd5e459cf46d29f64575a0a9ae9ba2b9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715926, "uuid": "9e936341-11d5-420d-a7b1-2b0ad010892b", "comment": "Malware payload", "value": "93499a280709249791d50da9c4eb9c1a9acddfe9789ebd3801715f435b80e9ef", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715926, "uuid": "97f50231-2318-49cf-a321-b3a4bfc80901", "comment": "Malware payload", "value": "f435c23f0b84f496f0dff8e60a4b36d433a9972e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715926, "uuid": "6d791d30-8b62-4eee-a2c7-7b305b1e919c", "comment": "Malware payload", "value": "aea99e3608479e8b903eefd81012a75aa53dea860f483cb51831f4708a0096c1cd1438104d1816328c0f9dddc505ced2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715926, "uuid": "e052d1e4-0701-408e-962c-398d24153d63", "value": "T15EC5E8E730A44DFED5A0E013F41B96FB05C64688DA7E10B56A09C52FC7EE4A0D9EB781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715926, "uuid": "a8a7ccb7-8969-44c4-a0ff-358e8a948ad6", "value": "12288:AocEbJO2vb9h1fyRJtSed3iD4simHZik8x8YGdnjGNQwI4HEECf7IZkAOjAhVhus:XbtmwKjQGdCBFnfn+rOf+VTL1yzrJ7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715926, "uuid": "6e292c06-ae1b-4589-8590-b01c78552586", "value": 2537276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715926, "uuid": "9bc4e152-8c40-4783-bdec-f82303618655", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715926, "uuid": "3928cfb6-6f19-4a1f-a32b-4cd601c86ff4", "value": "amsibypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8ddc4e-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764169, "uuid": "1e18cbbb-4cf9-4c50-ba51-ed09e07ab48a", "comment": "Malware payload (Mirai)", "value": "557e4293356ee0ce56ecdb46bb5da2ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764169, "uuid": "998a4485-85da-4461-99c8-4fad53ec7599", "comment": "Malware payload (Mirai)", "value": "93c0c7c20e9c06926e2df0d86aca79cea754adc7915bc21af79cf91ee2652743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764169, "uuid": "bd2f3cd1-f653-4977-8937-53fc40657d6d", "comment": "Malware payload (Mirai)", "value": "da6096eb438597b728b20005c4dd0a3c7bcf255d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764169, "uuid": "30e5d4e2-618c-483c-98e2-21781604dcfc", "comment": "Malware payload (Mirai)", "value": "f696db6e8e2ff187d6df5e837c8248b02f4a5fd78e00f68154c5a583abefcafe4e75bd0da7c23bf3e9384729d8b72e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764169, "uuid": "70788ccc-70e7-4d54-ac3b-36f26516975f", "value": "T1C5E3E71E7E219F3DFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764169, "uuid": "9d699fac-dd84-485e-b68b-47ba9c7f6135", "value": "3072:ZkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB1L5XyJjo3fo:uF+6uk9hckUGXZy9q/uleW0AJsPQDJHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764169, "uuid": "1427c00a-df91-4629-a155-c41090acd858", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764169, "uuid": "35719525-4289-4818-81e9-fa6007a711d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764169, "uuid": "2cad06b6-ddc3-4ef3-89a3-cbe3156f560f", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f2cd48-c6db-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763730471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730471, "uuid": "c93c8112-5745-4ad5-b025-666c1b9214a4", "comment": "Malware payload", "value": "f9a2466d2a43c38ed91401abc10cda59", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730471, "uuid": "8042eeb4-14b5-44b6-ab6f-f4acdb971e00", "comment": "Malware payload", "value": "94bf3a8efd43d552ae4fb7645f1f3c429e975dbb04a01525c1d1bf2a83bb63e8", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730471, "uuid": "90b8b51d-f749-43ec-a481-dfdbab20fb18", "comment": "Malware payload", "value": "c023d4b7b6a86d5a811801c5e857d3109089dc33", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730471, "uuid": "9ac15af5-9351-4c39-922d-fa3a0323e7a1", "comment": "Malware payload", "value": "b39c0fd8fc163371dfc29877b0d11c9f126c9dffe0136716c904689fbad8899c8b5ad4247bcf383407e216d64e2e2b36", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730471, "uuid": "de1ed5f0-735f-47bd-acdb-62ff4958be36", "value": "T100B1B5E7F2E8DA5F646500E8952A311B64E1C2BB4CAF834465D2250FE62F850BF1B7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730471, "uuid": "f45948ee-369c-40e9-90e4-188908ecf45b", "value": "96:neagnW6yuE2jfR/uU/7s8+3mJXb0iMtMP5+3mJXb0uiBmKFdx90hR8:n5gW6yuE2jZr7l+iXb2tMx+iXbxiBmKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730471, "uuid": "f2fb12de-ddae-4232-952b-48c18ee1625c", "value": 5315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730471, "uuid": "fbfd6b53-efb1-4345-a7d0-9fceb56de464", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730471, "uuid": "1b3cec92-e38e-42bf-a569-c85f10355b35", "value": "alph", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbb596a-c6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763727266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727266, "uuid": "bad1f3f7-6357-4071-8642-eebef980a635", "comment": "Malware payload (Mirai)", "value": "cc21630a4c90b9103cd3d26c1e168da0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727266, "uuid": "e0ec8d68-beac-4796-85cf-013610bf8b0f", "comment": "Malware payload (Mirai)", "value": "94d2ddd4e597a4af3e783a7a275df93e748049d0b89ab8f1fa75fb33ae546d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727266, "uuid": "4bdf8cea-4267-48fc-957a-27a6e4d4add0", "comment": "Malware payload (Mirai)", "value": "28030cb87e8bb8dca2b51e27dd6b39134797c89c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727266, "uuid": "e564f331-28b2-4e60-8e50-9ba87b7ba455", "comment": "Malware payload (Mirai)", "value": "9f7adfccf7a19ba7fb7b9f298ac0f75ec816a228299bdf8435f7c19fbc821ea44f97a3a4970201658ba7e0c7b2ac4a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727266, "uuid": "50a795eb-b030-47d0-9c44-dcb07ea9f855", "value": "T1C3B34A4273180F57C1970AB02E3F27F687BFE5D121E4BA89250E9B5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727266, "uuid": "fbbb13a8-eda2-4198-b40a-6dc483855598", "value": "1536:srXXfJWeueomtxzUZN/fyqpZO8p2KlQ+3wxlKDB9P+Juk1GQRHtQHs:srXXfJ1uOHwfp4r2F9au8sHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763727266, "uuid": "75c08212-119e-44f3-9ed0-44662f250792", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763727266, "uuid": "f6c1a361-cb75-4931-aba8-428c6395521d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727266, "uuid": "ff358293-7def-4e19-8050-69ca0c8adbc8", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4701a514-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711226, "uuid": "e232f86a-fd20-465b-b41a-72db2d351b73", "comment": "Malware payload (Mirai)", "value": "cb79c415de00295c24743909f9f37566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711226, "uuid": "49ad4009-659e-4e80-baf3-62f80cfee02b", "comment": "Malware payload (Mirai)", "value": "94d887bd9e17ef1d032b1ade397c8cdb06ad5bee97ee2acbea986815812e7833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711226, "uuid": "8dfe7e7a-f988-42d7-b279-8a43d05ac7b3", "comment": "Malware payload (Mirai)", "value": "19b718784aade079a26c5ce8a1f5ae60a37be134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711226, "uuid": "17488d82-c69d-4cc9-9ec9-fa9315e6ccc4", "comment": "Malware payload (Mirai)", "value": "cd0b682b91860564bc64fa640badc28d1ed2372b23edd204bad30a1019cab4fbee7c8e941f4f6a0596360d4869fa5c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711226, "uuid": "fe99fc93-b2cd-4f10-bf31-70adec945579", "value": "T185736B55B8D19A02C5C152BAFB1F829D371613E8D2DB3203FD256F2D7B8B96A0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711226, "uuid": "080981c5-93f8-4031-9e58-c3a9c6f72330", "value": "1536:fZcOAs1Z6e5UAbVPSKmf0mbGcOk7JqijoyikF/1k0VV0:+vsmBAbVqymb/qij+kblVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711226, "uuid": "dae2d593-f4bd-4c4d-8701-97eea8caf528", "value": 79296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711226, "uuid": "b91d69df-5ebe-4333-b82a-882cde318725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711226, "uuid": "d13d382d-0350-4574-8ad5-3562a2a61dd1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c1d60d-c6d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763728078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728078, "uuid": "9cfe5acf-c1bd-498f-9b14-a49191bac753", "comment": "Malware payload (Mirai)", "value": "bfb1621f550e8b3ad115102e027f4ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728078, "uuid": "abb3a43e-48c4-41cc-94cd-2fe476f224cb", "comment": "Malware payload (Mirai)", "value": "95a1e8a20e63bbe0bcd01c794e8a118466b36d0d87afe826f34fa9a813ab2e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728078, "uuid": "8481652e-8407-4fa0-82fc-2c274cf59c3f", "comment": "Malware payload (Mirai)", "value": "0e0cc9ba0c9978dd714dc8f915b404ad5a19d0a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728078, "uuid": "cfe53892-5ce3-4891-867d-0db6f101ad64", "comment": "Malware payload (Mirai)", "value": "4b366327772ec90d74c022179bdc59928f4d13defcd161ea51d6b4052f9c12fd567c7362fd07567cd1433ef252f866ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728078, "uuid": "ebdd8f3a-8ad8-4f75-aaec-df8285f51642", "value": "T1952301573AE65F41D9ADE13B2CBEBD4F41B8C41C2210D9B1F64A71B65E42FB821298C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728078, "uuid": "87dd2f7d-cb76-4287-9e5f-102d77efd3f3", "value": "768:O45fEmnG/+tB9Ht+FyEUE4Mt619kqFGwn4E3hlTftCzobgQu73MosMNzOIbMDHwY:O45f3ttw6EM7kqFG+J3hlT3bgQspsZQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763728078, "uuid": "ffc5638a-1795-4ef7-a692-88f728a34293", "value": 48068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763728078, "uuid": "ff3f849f-27ea-48a2-83fd-76d4dba3b373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728078, "uuid": "0e8f6da9-2a72-46c1-a96d-efb6df1e4402", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856134b6-c6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763728940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728940, "uuid": "e5a5cffd-a475-41d6-8f07-a2f66eb60e28", "comment": "Malware payload (Mirai)", "value": "8205acfcc6fbdaacec223922109aa8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728940, "uuid": "041f425a-e604-4e17-b658-b645c0db112a", "comment": "Malware payload (Mirai)", "value": "96c9c12329cacdf654d2a7ba78bbd47bc27949735d5433130b799b2308424e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728940, "uuid": "dd904fcb-4aa7-488c-a3f7-20fa640eaca5", "comment": "Malware payload (Mirai)", "value": "c5329e2d995979837959e2d130805352c85d38d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763728940, "uuid": "68a0fbae-c2e9-4031-97ea-31108f5b95cd", "comment": "Malware payload (Mirai)", "value": "797f44ba6e0fd3dfc4ac3c25822cd032ecf56c79a7ca28b5311499a608e6ffbfa9970cc6bf1a5d3b41010e0ce34c9a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728940, "uuid": "b30ad7fb-964f-4b83-bad6-a1052361bbf1", "value": "T1AC7312E811AC411FE08A9E390E481B9879AA318FF75D167025668DF86FF49977FB0813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728940, "uuid": "0b75ff0e-3d80-4ee3-8ca5-d22f26197e93", "value": "1536:xMC0v4FvUKPwH6kgzf9kp4YysOHRoToyZP0p/E+ItJqzI71lU:IgFvUKPwHbgzqpOx/2VtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763728940, "uuid": "328a3a8c-5a4c-4306-bb4e-47a4550f91f7", "value": 77784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763728940, "uuid": "188a6f1e-4971-40e6-85ff-e5413f36bbca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763728940, "uuid": "23dfec81-f28c-469e-bda8-77bd387600b2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e34ae4-c67b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763689377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689377, "uuid": "3ee6daff-e25c-42b8-b7ed-d4ec4d7a5dc0", "comment": "Malware payload (Mirai)", "value": "e651b2e5478d25bd6b85d24f876705da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689377, "uuid": "367e87e5-64e2-4c36-a1fb-3b021ad3b584", "comment": "Malware payload (Mirai)", "value": "98fbbda4ccfb0cec52770f3b654b1f271b43994a9a66a70d2f908dbfc4d4f893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689377, "uuid": "de887f5b-dfe4-45ff-894f-91ef7b407385", "comment": "Malware payload (Mirai)", "value": "9d22c85228d5a06506696ef28d7af2c34ea9943b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689377, "uuid": "247fac23-ddd4-42ba-8a2d-858ac946cc10", "comment": "Malware payload (Mirai)", "value": "bf9afc17a518a8ef2fb4e11f82bdc75d4b672150c1ea0f01dc79804e0b528e2f19b0fafb794d5da01a5454649a566ce4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689377, "uuid": "62cde753-abd4-425e-b6b2-98bad57385eb", "value": "T1AFD2E05CE0F92D98CAFD187D63995B710E20D0D4736C0BAC83120D9DBA2BD9B364B879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689377, "uuid": "7147ceba-a01c-44e6-ae3d-0fbe640299d0", "value": "384:hik4Ij7K8Nkarndq6zLJucYmOdm3tkkh7/c9VVdt66ErW2UsLENrLroFVVtWRWG9:hicjGSrnP3wcb3trSv662UCALrvWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763689377, "uuid": "dc35ffa7-ebe0-459e-bea5-653a1d3a3140", "value": 28848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763689377, "uuid": "3e77b703-aa6d-498d-80a2-95efe8f1c084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689377, "uuid": "0e0afab8-bb44-46ad-8305-df77ba51dbe5", "value": "apeshitcrazy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d46e75-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Havoc)", "timestamp": 1763715950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715950, "uuid": "96d9e572-aeb7-4e50-bf76-6cf4f868c4d0", "comment": "Malware payload (Havoc)", "value": "6da15cecb7a7c9269dfdd379edf039b8", "object_relation": "md5", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715950, "uuid": "fafc0451-75dd-4e16-93fe-95ae45966d6e", "comment": "Malware payload (Havoc)", "value": "9913f0a46a0b295cb1f1e5bf4f728374b11e575e2c99b5d1d053ea0b9634f272", "object_relation": "sha256", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715950, "uuid": "19e6b12c-9448-4777-a72f-a8fbb8b579f0", "comment": "Malware payload (Havoc)", "value": "9a17d999c3f653a82862aacb698bc8bba5d211db", "object_relation": "sha1", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715950, "uuid": "16220416-e18e-4d39-82fc-eece6dd1a753", "comment": "Malware payload (Havoc)", "value": "6a5117e6b59ef475b4447bfa743e1675fd2eeb79c3a11acd9b8f0beecb65b83e8cb3de20e3ba0f4f4cc9c35781902c51", "object_relation": "sha3-384", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715950, "uuid": "c7c8c782-6e8d-47e2-9ca9-2c0f28647c3b", "value": "T11E82D02EBDD806C9100CE1F36C1ED0DCEE09785DE7CEED15ADD4799C12D8C20BA199A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715950, "uuid": "1e73257d-d475-43e5-8df3-f542153cc25b", "value": "384:bteV0+y6Ze9P3cg9RN21o/xVSwZbxUySrpi7isGSPZFd7awNOc:b1+yu83M1o3NMU2wNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715950, "uuid": "5e78d3ea-7478-4169-ba34-6d2398e53f18", "value": 17572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715950, "uuid": "8a47d1c7-7e82-4089-82f5-1c80920476e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715950, "uuid": "86b29842-fb67-43ef-b99b-8b84c787d9de", "value": "stage1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cbbfb2-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715928, "uuid": "6ac9f9ed-e502-4bbe-91b2-8c17ba53c09e", "comment": "Malware payload", "value": "514e0f58845f53885b99d281c0e58ec7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715928, "uuid": "7aaca475-c0c0-4149-bd5a-837d8f524dc2", "comment": "Malware payload", "value": "99fe08f6347800ba2540269e71cb53ab8fb2df7466c381c13d96cbcb7333b635", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715928, "uuid": "4e3101b6-bc60-4127-a3aa-9814324ac7c5", "comment": "Malware payload", "value": "e74eb13d2d6c9a3aa364dcaa98b8557ecca70a86", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715928, "uuid": "9570a6b2-acff-4b33-84cf-757df3e86d72", "comment": "Malware payload", "value": "6e7954827b7ec4ab207c2480de7477c73764209767a1c4730c98e54cb45c4d843b5174ed23a62e30023db53d862a554a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715928, "uuid": "cf9c3f4f-61f6-459c-aa56-e075bcd3d79b", "value": "T1F1D5BE8BFB58992FCC7700B249AE523162574D568E839B477C48371C287B6D82F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715928, "uuid": "c1512fb5-322e-45a8-b88d-c2155c3ba0dd", "value": "49152:Fpzx7Qm0XQU6L/KBC+B+esGPf816pyc9GngZm7i0rOGe:FpzxEmsQxL/KA+VMGo7i0rOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715928, "uuid": "04ab7564-1ee4-4d97-a553-b89e361f73e6", "value": 2916567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715928, "uuid": "5c1ff4c1-e1cd-4084-ae94-230ac6c77713", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715928, "uuid": "aa61fd25-8358-441c-8ef6-bbe1eeb9f636", "value": "NG128_1_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca5546d-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739502, "uuid": "ba9cace5-b002-4354-8ee9-a4e263923ed1", "comment": "Malware payload (Mirai)", "value": "af45136e692cc8d76d6f41fe6fc05d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739502, "uuid": "9aa8cabf-bbf2-4d7b-bf72-09b2572ad0ac", "comment": "Malware payload (Mirai)", "value": "9a8dd13249e2d002c482872d618647bc57b637414a04643269a3a67666890c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739502, "uuid": "3bb48ee7-3b91-40b1-b2a0-6f41a9857126", "comment": "Malware payload (Mirai)", "value": "f787eaa24d9ff9ccf677706a8c7bb167ce9f929f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739502, "uuid": "0128ad94-6e44-4c32-a09d-8a164927a4a8", "comment": "Malware payload (Mirai)", "value": "11204f0cc41d3cd66e25cfb541c075b4430c0becf5a61229fa9c9cca50289a22fd9c07273154d4caf03cb8d8e74b274a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739502, "uuid": "96910927-0e66-4a1c-9f1b-255617381f0b", "value": "T190B33B55FCC19623CAC522BAFA6E428D3B2563E8D2DF3207CE256F2133C651B0E67941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739502, "uuid": "c5693d84-70b9-4e50-bfe8-642e644f3185", "value": "1536:qsuSap3OcO3JVoxbAore5dCrs47i3QHLkv8jqhim3pB73kpv9l:q/Sap3Oc2J147h28jTUq9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739502, "uuid": "6dbf85b6-84c1-4176-84b7-fb52791c2b6d", "value": 108012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739502, "uuid": "5e38b8b8-9118-4710-a526-6cb084b5bc63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739502, "uuid": "cdcf06d7-30f8-4d1c-a798-e6fa12d8ddc3", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aae18d-c6d9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729642, "uuid": "2c871f4d-60b8-41ba-9785-4f261614d7b0", "comment": "Malware payload (Mirai)", "value": "1849f99ade0df70cb4df1f2607e4ae8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729642, "uuid": "e3904c95-e59c-4064-8688-df855f7b237a", "comment": "Malware payload (Mirai)", "value": "9af71338fa73b1518844a488360b8a789992161902a08525da1caf9bb0be8f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729642, "uuid": "aa1012ef-3dcf-4d38-bef6-92cea0a7967e", "comment": "Malware payload (Mirai)", "value": "f905168c0de26be758262495f4a1e815c4fa5fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729642, "uuid": "60f064db-5663-476f-9b33-764e4e2cce4d", "comment": "Malware payload (Mirai)", "value": "4d6d1178aaa861eff4f2cb68160cbf4d07781904d5ad600ebb8c10502f734b667751d1dbd7859eb952194c82429b1a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729642, "uuid": "4a230c69-835b-458d-afa8-ce6910f66b3a", "value": "T10F23F282E6AE9FD8DBE9E135EA7E318B55101D0A1576C7FB3E00620EC444B683736362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729642, "uuid": "fbd59c88-8999-4530-ac44-03df26c34b1e", "value": "768:6Mxa+Kqs+LOFt47TbIX29hPd3UyRSieN7NVwOJJuuHlSac1dUSZ9b6dhBZDAaUS3:ja1qsf47TMX0LRSiSVwiEx4SZ8dh/w8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729642, "uuid": "7a49a212-6afd-4b9d-8980-5c85b54c1ee4", "value": 46936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729642, "uuid": "1e8099a9-09e9-4406-8efd-f3c255c25aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729642, "uuid": "37ea57f5-a790-409b-9079-a48f87fb4674", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a0f2bc-c68e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763697564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697564, "uuid": "ea920e86-2959-41d1-bb41-3b7c669a0968", "comment": "Malware payload (Mirai)", "value": "512475c3837d28a92ddc383b4a6f8ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697564, "uuid": "cb15daaf-d500-4ee0-8767-fe7209f92076", "comment": "Malware payload (Mirai)", "value": "9b587fd1c1961913e183a8d58ce541bb7106bdbd22a93f0a63b12f7234d45663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697564, "uuid": "d6c59f44-8bbd-4803-a371-2d0a73e89891", "comment": "Malware payload (Mirai)", "value": "7a6aacdfbee217bf0149a901b350b90bb170e9ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697564, "uuid": "d48bfef5-14c8-4654-95a3-5951a638ee0f", "comment": "Malware payload (Mirai)", "value": "b7322baddaa2e3fabd3a5267542343f02a737402cbf0140c005cbc4c207c962d213b8d53c71f787ddcba99dd62b0aa90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697564, "uuid": "0fc6e60f-ed1b-4872-bc77-727e385a890d", "value": "T164F33A02731C0807D1632EF0263F7BE193EFD5A125E4FA45654FAA8A9272E72154AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697564, "uuid": "e1c7c231-526f-45c2-8e69-663d503f1cb9", "value": "1536:ZdwEzRUl8riIHoBQsxdTTzXsEqXzRxD5QgDGG55VjiVw8EOUehqUBvAMh0wEAwM9:ZdyiipBfdTTTsPRxGBIjl8E5nTMaSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763697564, "uuid": "eb95bd09-6e6b-41fa-89c2-640ea1f63286", "value": 169784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763697564, "uuid": "962cc87c-7212-4e86-9205-dcb91c7ef11f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697564, "uuid": "43063142-ef5c-498a-b265-d0a6d69cc443", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3266fb-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714488, "uuid": "1f7fbe81-08ff-4b26-9e4f-7d2974ed4944", "comment": "Malware payload (Mirai)", "value": "d03d419cd77d1a6ff32a900c928f811c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714488, "uuid": "03e28754-4308-4617-8fe4-319900056df9", "comment": "Malware payload (Mirai)", "value": "9bd176eb133076dea427fbc4ba6c2a856fc0e76b8d6ed8c021b15175232a89a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714488, "uuid": "36fa0e5b-961d-4975-b8bd-68b5326d0339", "comment": "Malware payload (Mirai)", "value": "55d07596f9b965b3f6be4ad48bd21dc072f8f0c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714488, "uuid": "cdac9c27-a83f-422e-be58-b4a418f5d03a", "comment": "Malware payload (Mirai)", "value": "71e26273f7e6e7594ce119a8aaf1f6ad2f86ff57005be1612118a0dd6482812e8a24093ad168b4022c62b764553ca337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714488, "uuid": "ef2acb71-8471-43a5-8724-57fc87f8c4a7", "value": "T137D3E095FD23AC92D1B302FDE8C016C387911D72CFA24208028DFBB828799FA5B65DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714488, "uuid": "2fa67f46-a1b9-449b-ac61-2df2845d6483", "value": "3072:45Fvib/3ahSKCnTQ+5pZNgLq0SMPhkiZ2+UdxxdMMTnU:wvib/3ahgTB3cq0ZPhkPxvxTnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714488, "uuid": "5166d707-3bb4-40ff-9204-1baa3df401fd", "value": 136316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714488, "uuid": "be2c0bdd-fe3a-4fb0-918e-40fe6bd916be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714488, "uuid": "bacbd66c-1654-4015-9125-365784397519", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df462ac-c715-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763755503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755503, "uuid": "0e418578-97f9-4a1d-9c74-f1664e9e22d7", "comment": "Malware payload", "value": "8c0255552445edd5d5313f79d732a6f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755503, "uuid": "9568ced7-7a5b-4082-b1c3-ad7a43fc09e1", "comment": "Malware payload", "value": "9d669404f58ee1437e23ea74e3565a7d445142e0a428d3add6e633b691426e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755503, "uuid": "1fd8abb0-4d95-430f-9da8-186e0337f60d", "comment": "Malware payload", "value": "b81978e34ad79155baa6fd3474d088ee7b969eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763755503, "uuid": "fc75244b-d915-4f6e-86c9-535e862061df", "comment": "Malware payload", "value": "f18e8e580f0cde86f6df4f4072c2926f0b716b0340350b1229901f4216ed99a23262bcdd799ae81f7d98649720f59dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755503, "uuid": "178e257d-cdf5-48b9-8feb-3125f5b7861d", "value": "T1BB9407529ABC8654F172C23D2297E36BE27A3C0CD664F1BB8E9CCB0B2354746315DB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755503, "uuid": "e2bea666-4118-460a-a130-711ed0fd33ca", "value": "cb86b9a2463d9766d3083a7bbe2db1ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755503, "uuid": "5eb3e680-6725-4d94-ae7e-b192714209bf", "value": "12288:ObUkAXZfXN5/EG5PGFXG5wvYzBO1qHynQE3sZQeT:ObU3pfXH/E6Pdw+BO1qLEeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763755503, "uuid": "9e053d78-6bf7-4c62-bce2-f912a0ebd86c", "value": 426720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763755503, "uuid": "77df4538-e844-4acd-908f-b191f21f9d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763755503, "uuid": "09f99688-06bc-4443-b9ab-cc0f5ae8dcd8", "value": "meet_v4.56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09218c76-c684-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763693083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763693083, "uuid": "7eb948a1-1ee1-498f-a374-7ce36e8edc75", "comment": "Malware payload (Stealc)", "value": "80f5bc267e7d9151ca87e84c3c2aba30", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763693083, "uuid": "dcbe54c2-46bd-4314-a7f5-a44b6b21fbd9", "comment": "Malware payload (Stealc)", "value": "9e383eb4eb99b76f00ab9012ed640da0445779d9a69feee95f0044d099e4353a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763693083, "uuid": "7f62c2d8-6f61-4f33-9926-dadf61beef1b", "comment": "Malware payload (Stealc)", "value": "70b1be9905e9906d64bc89b6fcf2ca8b0eddfe2e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763693083, "uuid": "10b3ef83-244d-4426-9507-39d4a6ce7733", "comment": "Malware payload (Stealc)", "value": "56498fc06e5df1471d934a960d3a82e43a91ac3a8eb8df5addd21a0538b0c0429c665325ba8c040d2eae2a8c2d31a4f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763693083, "uuid": "74517eea-f086-4bad-9732-891271b05ef5", "value": "T182A5234657D436B6E1B967B628F703636231FC64A76086FF3180C47A5D23780DA32F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763693083, "uuid": "79a3e7b8-0ec4-4c99-8fd5-06759f00aa86", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763693083, "uuid": "5a5475c1-e6bd-4b67-950e-dcf7c7cca4e3", "value": "49152:+gtOlxElKn3L1xDjBWKFpUuTgVeUE+FY+j/4QXxYt3tcJ+:KxElKn71Fj8KFptgSO/4+xYhtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763693083, "uuid": "24ffa7b2-76ae-4994-b5ab-95b0bd3954a9", "value": 2062240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763693083, "uuid": "7550d80e-0d79-4c65-a862-59115fe21418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763693083, "uuid": "45ffc730-3e5a-4afd-ae33-2d66c6a03916", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd29739b-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714485, "uuid": "7182f9c1-fcad-4b2a-858b-d50266a74b04", "comment": "Malware payload (Mirai)", "value": "ae38aa3b4955d3ad4ea5328aaed74cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714485, "uuid": "8f60a3f0-1ee6-4b7a-9cdd-f1a39b7b7db1", "comment": "Malware payload (Mirai)", "value": "9f5fcd8c3657d152c37e6a591b61679e358bce2fa1243f1c76f345d1fe5f391f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714485, "uuid": "b4f67109-cc3e-4ffb-91a6-fc1eb138bad0", "comment": "Malware payload (Mirai)", "value": "741d571214c2ca95137c136c6bc83202b9b16318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714485, "uuid": "27f211cd-21bd-403c-ba25-4e63ae2aeb03", "comment": "Malware payload (Mirai)", "value": "3f21e76f4254e1b413ff20a9c42b13079da89466693554d63d6ba72b9e0c9512e8c0f4f5dcf9acce42e27974401e078b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714485, "uuid": "884d0df6-174f-415f-ae9a-3a3e72255331", "value": "T14BD3D032E4186CF0CC1002793876967C17149EB40BD562C3FFEDE59E18B7D95B9AEA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714485, "uuid": "6fcb755b-8ee8-448b-b2f6-a74264856ea5", "value": "3072:jZ6+9J9bXIRgbf+8QDmm/Q/Hg88wYtnGpaBNXJtoSZHd:jZHRbfNQ5oPgpVGMXXJm4Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714485, "uuid": "6b680094-c756-446e-99b3-7161fe72bfb9", "value": 131964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714485, "uuid": "0b196b75-3abe-4aa2-80bf-1d9ffac88909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714485, "uuid": "435c7e2d-96f3-49dc-b402-fc61c4272140", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d262d7-c723-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763761630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761630, "uuid": "8e93ec79-58a3-4633-8d5b-3a080f23a76a", "comment": "Malware payload", "value": "ca26e0428f9a90a2939e7de7c5e6d4b4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761630, "uuid": "ce0b600d-b1a9-45d7-ab76-e0493c70591d", "comment": "Malware payload", "value": "9fce2caa306e95f5343de4647fbef8f58cb5ec3039c7225fe15a5e94308343b4", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761630, "uuid": "654d3220-8751-4478-a4eb-99ccd36ddc1a", "comment": "Malware payload", "value": "348af3a72351f82984ebdea3f4f44dc324447af1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763761630, "uuid": "3bec02b9-dbd6-40e9-a2b0-a9e3eff43184", "comment": "Malware payload", "value": "926ec71e9e6b286721dac8841585813e2491792b5fe235938adaa76b847beba5f92919b20ad28e58c5b2e03512b52de2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761630, "uuid": "8030146c-bbdf-4cc4-a992-1db056d0f97e", "value": "T135E533F0814117AD1C77D81CBB66A43A3F67854CE13075EAB626D7A10093A6EFBDE1C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761630, "uuid": "93cf33de-eed6-4454-89e1-7e3f2ec925a2", "value": "49152:h5JM7QMWZv1iT2WPypvw9F8I0EhzGf+Fcip7/I/S0LwZLYM1ei6BnyD4l2KWf:hdGZPyW8I9hzGRiF/I/SGmReblWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763761630, "uuid": "873d55cc-b374-4a53-acb8-50e5c8f61b91", "value": 3261377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763761630, "uuid": "25553ad5-9d32-4e04-ac3e-f6b54eaa8071", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763761630, "uuid": "9bf0df5e-c4dd-4d6b-aae9-36f79ddb9b88", "value": "GTH497.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5502c4c3-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763740026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740026, "uuid": "1182583d-5ab7-4555-af05-0e91c6a4c393", "comment": "Malware payload (Mirai)", "value": "eec06f04279843b51dcccfd8daf473e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740026, "uuid": "fbecf132-2f7e-471c-9f58-7a7c828edb5a", "comment": "Malware payload (Mirai)", "value": "a13e88065c5268d0759a1559ed1efdd83a210566859adf69ceaeea34041c3bdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740026, "uuid": "b07c1df4-fcd4-40a6-8404-cccf14655d05", "comment": "Malware payload (Mirai)", "value": "7f65e4f9ac4aad6a2d5762ae28cc961a63b1bd61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740026, "uuid": "921bd1ef-adbb-4fb8-9385-fff2f4334563", "comment": "Malware payload (Mirai)", "value": "65e17ed1153f74f7afe95b56d4ae4c6924dc3a98d297fac1d198964db1a9da56ae4f3bc5bfbc91650e13899edc81a656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740026, "uuid": "a9bf1727-eae6-4936-b892-ee9dc662ccc0", "value": "T11523F1B5930451D4CC0DB47117A50F2936651BB1B142EA09AE6EBE4EC69E9F7F8C32D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740026, "uuid": "9fddceca-2b87-4b4f-8bf0-6db4586b43c1", "value": "768:01BGzN3Ayy4nNVuCkAPs8Lwc9VpPqrD77fO1zZHQRm33cIE/JgGlzDpbuR1J0:SBGhB1nNDHL/3pPU7G9Zwsc7VJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740026, "uuid": "e98c9ecc-7d09-4728-b88c-e3513d6ba94e", "value": 45600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740026, "uuid": "2b103780-e3ba-4aa1-a23f-6e2435450289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740026, "uuid": "5fea6441-1959-42f7-916f-259d98a30704", "value": "SecuriteInfo.com.Linux.Siggen.9999.11870.28835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdfe5a9-c727-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763763286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763286, "uuid": "a5ad5b5d-7fe3-421b-a93b-ad084f5a1abc", "comment": "Malware payload", "value": "6ec73c36203fbaec8cc4f2bc98108122", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763286, "uuid": "f1e56d8d-20e1-4736-abf2-443e299c1362", "comment": "Malware payload", "value": "a146c769410996e827c0efc098e87d451dc7a413406ef9da7536d1578aa98d0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763286, "uuid": "ca42c994-42a9-4a98-a3bc-2403f7abc37d", "comment": "Malware payload", "value": "d1e4940d5c4c2f3054498a49a22e613d15eb0356", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763763286, "uuid": "4f6193f6-6c15-40f0-bd4b-9299ace08d89", "comment": "Malware payload", "value": "791bdd82e0e21ee9a326b81689f5cc5e8409cb562f1114312024c56d3118434c10bbc19c5dc5b2db268a9dee0440019c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763286, "uuid": "be1413e8-8ab9-488b-acaa-c0055220f04f", "value": "T167011EDE663562629584CF34706644A89178FBD0B27C8B2AFDC51CB3C4D9B01322EF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763286, "uuid": "81dc0aa1-afeb-45c1-80ba-aec29aa71b37", "value": "12:S4yXhJ4y2YN4y3NIl5e4yc0LKu4ym+OFS4yjjMa4y9Ttj54yCSOZY4yLtr4yEa4c:rYVNI7iKv+Isj1T5Ul0tYiPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763763286, "uuid": "7cb28cc5-cb40-4b4c-9c83-9a792387b94f", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763763286, "uuid": "c97f7a39-fb23-43cb-8c13-8ed3a77b58f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763763286, "uuid": "ea685f6c-8962-4ea9-8aaa-bbae3b54a7d5", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a750ef35-c70d-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1763752190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752190, "uuid": "2835be4d-9c36-420f-8ac7-0145aaa25e75", "comment": "Malware payload (Rhadamanthys)", "value": "f1dab4eb829860dfa1877b2f1d166d21", "object_relation": "md5", "Tag": [ { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752190, "uuid": "17aca592-c8d1-484a-b34e-89b8ba92b72b", "comment": "Malware payload (Rhadamanthys)", "value": "a26a119dad63dfc8017c5e5af3ce9f090840986dadfda254843aac916eff8fd2", "object_relation": "sha256", "Tag": [ { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752190, "uuid": "24d65d12-f1b1-449c-8deb-dadfca5862eb", "comment": "Malware payload (Rhadamanthys)", "value": "4f4123f706afa7bfa6a12d751f149fd2cc81eae0", "object_relation": "sha1", "Tag": [ { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752190, "uuid": "94738ade-6799-462c-9798-c44328da7c78", "comment": "Malware payload (Rhadamanthys)", "value": "b4efad52499b9ea95bddfb7fcbfa02aad2c244bdf531cd666e6e5092bb3479c8528f9d1b3f64a039fee0d1d6bb8496e0", "object_relation": "sha3-384", "Tag": [ { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752190, "uuid": "cafeae59-b4d5-4213-b1e8-35c6731ec083", "value": "T1CAE62337F258903ED5AE063115B38660593BBA216B0A8CDB03FC798DCF766E11E3B546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752190, "uuid": "0e3ffc2b-baf3-4d5a-b589-adf685e08209", "value": "2431d0c4a05d37b301fc85bf05d709c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752190, "uuid": "ebbdac17-b56f-4765-96b0-aa66f2993cb4", "value": "196608:5p8jd3I7FpsPQXdps7xFMZizkui5g1y13WIESd1sBog2KV4ukct3YpBiN7:s3I7gPeg7DMZ21y13Z1sv3htYBI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752190, "uuid": "038b9705-583c-4573-9b26-b59e50545b6c", "value": 14689948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752190, "uuid": "bf983c0e-058f-4cf1-8512-04a8c5c4df08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752190, "uuid": "05260260-1151-4d05-8061-fb84493dfb46", "value": "build1_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655600d1-c6ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763746066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763746066, "uuid": "8df270d1-091e-4393-b3e0-dc7f45b154be", "comment": "Malware payload (Mirai)", "value": "c2a5253f7d20402fbfff03e5ae6c9f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763746066, "uuid": "80b8fca8-33d8-49d3-b309-103a93b3af83", "comment": "Malware payload (Mirai)", "value": "a2b414d5d16af0e67f849240dd01658a46873a0bba5ec404351941e1350212c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763746066, "uuid": "fe43d431-e23b-47be-924c-1ec3bdbe31d9", "comment": "Malware payload (Mirai)", "value": "0cdd092f29af997bbdf0b4b5edbeb5103c116ef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763746066, "uuid": "4e66f48e-a40c-4cae-b390-66378ff46c12", "comment": "Malware payload (Mirai)", "value": "038274e9c383a4d079e87be9c9d160feeb711e6551cbdf8bbdf092dee161171a0621cb0637b94799734cbf146e601b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763746066, "uuid": "0cc121f8-9564-4b58-ab44-55275a406739", "value": "T100938D36D4361994C1990178FCE89F361B73A5C0A6532FB706EAC2AAA057F98F405FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763746066, "uuid": "5efd0dfb-715e-4eba-b168-07db6d1f91b5", "value": "1536:0/V9CjtornlQnFBMG5zrr01iK2iB37EQHyE3C1EUEFw1fOnWWOnWK:0t9CxyQnwIrrkF2EdHyE3rze12WXWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763746066, "uuid": "78b9baf7-225d-47a0-bbc8-73f3c885e455", "value": 95780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763746066, "uuid": "387e5798-10d8-4009-9322-b2101eebb1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763746066, "uuid": "db00caeb-df34-4df1-b2ec-03690e157b68", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79809f14-c708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763749966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749966, "uuid": "02dd83c8-7a0b-4a60-a909-0bfcaefe4178", "comment": "Malware payload", "value": "f1e6a8b5fe3775cb1c51fe0dcecdcb9d", "object_relation": "md5", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749966, "uuid": "47011e67-9b90-4c06-a883-10bc75122555", "comment": "Malware payload", "value": "a2fd6bc6d01c2d84ee85b5436778f581e08946658a1c026d2ddd6c64db2332e0", "object_relation": "sha256", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749966, "uuid": "75b9695d-48db-4b92-8bff-05af2749ea9a", "comment": "Malware payload", "value": "ece55ac15cfefb8a2f87bb8ac52c53536dbbfc85", "object_relation": "sha1", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749966, "uuid": "541b25fc-3ddb-48e0-ad60-b6f8953362f0", "comment": "Malware payload", "value": "1bf14cf3dd823ffc5826a301888c58e79df8e3afe82bdcf93990e6b5895a234f1640be0e6429480a056850c21a0c2eb2", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749966, "uuid": "4ec80604-bb2d-4b11-9542-0d9899317982", "value": "T1922733241B584F5DE636BFBF8299141935925F0A7AA3BC1E944213137DE3BEE61B002F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749966, "uuid": "8500fb3f-06d1-4a22-abf1-f1081debd9be", "value": "393216:GWlXLoIqhGJawPOXnSHaeq1iFesMYSu6DkqwsaYZpaAM2jeh2Wu/L0THR80tLh6C:GyXmhGQ73SHXp8Lm6IqwXXUO+/LWHR8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763749966, "uuid": "ae7f41c6-5735-4530-a5a0-3e0662a4e9c0", "value": 21825995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763749966, "uuid": "4d5a4862-6536-468d-997c-2f32f0bdf617", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749966, "uuid": "5e75fab1-232c-4871-97e9-c007db648059", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860d8464-c6fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763744833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744833, "uuid": "dbf85c1a-5db5-4bf1-9e47-1ddb471fcae1", "comment": "Malware payload (Mirai)", "value": "6a1651c38f348651439b6a025f7d652d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744833, "uuid": "d2b28c23-cb7c-49ee-9555-418bf2ee6171", "comment": "Malware payload (Mirai)", "value": "a37469a29336f1c74f42278258f45a9f777e840053f5d97973d23f49799fc9a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744833, "uuid": "95ec019a-5057-422e-a7d0-2f15c4a06fb0", "comment": "Malware payload (Mirai)", "value": "adf024e3ac355fb5e442eb42657fe4a07946f7b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763744833, "uuid": "86dc38f3-d25a-43ae-aa85-a7d83e11a801", "comment": "Malware payload (Mirai)", "value": "5f5c8ec2aee90a1e082f224fae624df5cd683c9ed03835c2f163d45d4ed864572288d74cd7936468b7e77dcbc2a6796d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744833, "uuid": "dd4f57c5-63f6-48cb-986c-f66d434412b2", "value": "T16D433A50F493D5F0E1834270016BFBAF5F31BEB14229D99BEBC43A72ADB1A814847A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744833, "uuid": "e6978bbe-cd23-486c-948f-d74a19e48b54", "value": "768:pVh9aNyFhch5pLKinXWOH/8e7NyNHxTFNlkSgE15PcZGtUPthasW:fYy3inXWOH57NyNHxQQcZGqthn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763744833, "uuid": "555e93c6-092e-4ede-86dc-5d3972fdf3d6", "value": 58364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763744833, "uuid": "69ed0e85-b049-475e-9ffc-a1ab935566c8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763744833, "uuid": "30c5a2c2-3727-420b-a6d5-0e947cfa4895", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81979be6-c725-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763762435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763762435, "uuid": "e9bf2bf1-9c05-4a29-ba05-e0c3cb45b9e6", "comment": "Malware payload (PureLogsStealer)", "value": "a1b6105739c58073918d3f559ff88a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763762435, "uuid": "698a4c72-c34a-403c-a7c8-7400ebae0eba", "comment": "Malware payload (PureLogsStealer)", "value": "a39b7ded7c3df0fee89b50673407cafae85883839977b7fd2cf0ad1339afe2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763762435, "uuid": "d86ad6e1-6322-43cb-a4cc-ad152466a6c6", "comment": "Malware payload (PureLogsStealer)", "value": "04defa51c107053f482d3ba0b6fc9d73e5226537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763762435, "uuid": "2d93211e-6350-4ed9-b8e9-b7bbd1843d40", "comment": "Malware payload (PureLogsStealer)", "value": "0d23878cdebbb9a26199d76ba3237b404be7f45a034b55c525b2688d6d145f7bcbee8760d224fb9f74b389172012ad4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763762435, "uuid": "747da3ae-7799-4492-a330-d167f36e8f5d", "value": "T16FC4230D76292725D1FF9A3B80DEA2420BB251F9A08E0B59741B174E3B92A57DF037D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763762435, "uuid": "6e43c1cb-3874-425b-93c6-77ef1b00015c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763762435, "uuid": "9d9fca47-0a02-430b-92e7-ddcbafb00121", "value": "12288:uNs2fN4jAVC9K+v1/9JTaBT8EjJ5liIdfGAKBPwQ04QSU8Y:Cs2FyE+2BQQ+PwQWSfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763762435, "uuid": "83ac63bb-0b97-4828-b893-1099e7551239", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763762435, "uuid": "7495995d-29d1-4743-b619-a4be39142573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763762435, "uuid": "f94c9cb5-d5c8-4089-ba7e-5f458a3948e3", "value": "a4sUNYJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b398cbe-c6e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763734802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734802, "uuid": "ccc712e6-a521-4e66-8d55-360527863147", "comment": "Malware payload", "value": "194ee3e904deeb377d6c78122daabde5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734802, "uuid": "1e66c2da-6260-4e8e-9df6-b6f99b0b0991", "comment": "Malware payload", "value": "a3d28aaa6d2d9b62452a9bc6ac57eca5f5f6a39131a943723ffe6202908eade5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734802, "uuid": "d9f8aa27-0fe8-4f9c-a1b9-5271190b86d5", "comment": "Malware payload", "value": "768504462aba857e8c4c80e9f4315e8f8a78a6b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734802, "uuid": "35a4e434-d1ce-4655-bbf6-239372ad7010", "comment": "Malware payload", "value": "d1e89f16f30fc7e1b121f230ea61c42779fc0fe4e17ea445c6eaaf7506e163aff92927a6d94e7c59bddd53249b88b2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734802, "uuid": "06e5bb1c-116a-42fb-8ae3-c563e55b4f3e", "value": "T15C5612D601E9155E9A6803E97F31992CF1318A974BD7C93A32E304EDB75F02A22DCF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734802, "uuid": "52a207eb-03d7-47d3-9715-3feec941e223", "value": "384:ffl2ZCu6k5wcdpFiP7qupMNhmSV8OhDOgI/G5:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734802, "uuid": "741cf09f-7d3d-48d7-bf01-5144d473cf02", "value": 6021089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734802, "uuid": "73759c23-64c7-446c-9687-4d401d2a1f9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734802, "uuid": "4ec63513-cfed-4fa2-a222-70e2ece425c9", "value": "Proforma Invoice .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27786d79-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1763715898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715898, "uuid": "d6fce312-7c11-49c2-85d0-64ddf85b6989", "comment": "Malware payload (GuLoader)", "value": "b4691ff531364fd7ef388299ec6c8b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715898, "uuid": "891ce6aa-4cbf-428b-be12-d665f0e6e017", "comment": "Malware payload (GuLoader)", "value": "a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715898, "uuid": "fcbeddaa-7146-4082-91bb-5dca9f41a484", "comment": "Malware payload (GuLoader)", "value": "1eee672644375e37ea708a8417d0ab3128826211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715898, "uuid": "556852c9-765d-4a44-977f-16d6e4e0c377", "comment": "Malware payload (GuLoader)", "value": "00b3f1f4c337f548d96919ccd378b927b6051bc3c055245907620df451553522459b288c99fd27d9acaf671f8d1f240a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715898, "uuid": "a18b62b9-996d-4b06-be7b-5ef833be6b68", "value": "T18D547B416F38D8A2CA505172C826E6F63DA61D84ABE4DE972BC23F9F77351E1057E00B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715898, "uuid": "d668fb4c-6529-4ec0-8c48-d2d6d4d0631e", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715898, "uuid": "31ca772c-2a71-4b15-af9e-5ba3ad6a3dd9", "value": "6144:T7e/FDS+SjYV8PNoM3q0oQxbfOqNenyw0lO+p:fYSRjYV0NzoSOqQyw0l1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715898, "uuid": "63dc87ac-dc08-40cd-a13a-5bfe46f34e44", "value": 279588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715898, "uuid": "09b846eb-507a-46bf-8af9-75d6082b16c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715898, "uuid": "a142b1a0-a802-4d45-91fb-393ee94b9134", "value": "Bexitor Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a68ad7-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763740047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740047, "uuid": "9095c6f6-ba6c-4977-abac-7e0f93b65db5", "comment": "Malware payload (Mirai)", "value": "adf99b92c949f9ba0fafa8a1cda3332e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740047, "uuid": "dde6320e-8efa-449f-b305-f814671a120a", "comment": "Malware payload (Mirai)", "value": "a3ffcd6470c07335ef5aa25fee95565adf443c8e08612851c453c5d9be2ec98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740047, "uuid": "7644868b-0814-4353-9dda-42434f5cee27", "comment": "Malware payload (Mirai)", "value": "f07586d90c5acc3f8b8bbde3fbb87ad7f73d9aa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740047, "uuid": "0d868bdd-d154-4615-ac26-429629cb7310", "comment": "Malware payload (Mirai)", "value": "d953efbd8878e9cbb1a50a5897dccfe119646e37e551bc45370a4231c82e8d2c0477d58cd000f6fe3c2d1fcb992390e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740047, "uuid": "106c6c37-5090-4a2a-b5d6-f91719245845", "value": "T10FD3B60E7E219F7DFBA9C23447B78F26A64833D627E1C541D1ACE6011E6024E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740047, "uuid": "5d3be2c6-93af-42fc-977e-74a24e843ae8", "value": "3072:G2VJjF3m+J4J7rhevgizJhhnWOR40FcL+Xhg:FJjF3m067rhevgizJ7jzE+Xhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740047, "uuid": "7fda2d6b-00d2-4436-a8d4-57d111987617", "value": 132412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740047, "uuid": "eaa8e43e-d14b-4b19-8c79-b6d6f33bbb85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740047, "uuid": "220cc5c0-1bed-40ca-b87b-59773a10fa36", "value": "SecuriteInfo.com.Linux.Siggen.9999.11870.28835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479c8066-c72c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765344, "uuid": "cd2bba3f-db5e-481c-8102-40464cbf5eea", "comment": "Malware payload (Mirai)", "value": "75c8dee99b4593fdb45c83a43fae4640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765344, "uuid": "49101e68-c0b7-4b45-b858-8d911a6c06b7", "comment": "Malware payload (Mirai)", "value": "a47c3dcdf5ff20dd757e2dd11aa196c10069febe808a24b5645c82cee1b9cc3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765344, "uuid": "2116b08e-ae7b-45f9-9de0-7393ccf4b907", "comment": "Malware payload (Mirai)", "value": "580cbffdda22de41e7aaf168aab138523f68c519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765344, "uuid": "a8710ccc-87e8-4273-85ed-d51e87910001", "comment": "Malware payload (Mirai)", "value": "5da7433318378d025516f975c632b4199354a28c2fe78a9ff457f327292aa85be299b9daf983184d92440f8b1e584b4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765344, "uuid": "10c8defe-5c09-4d9a-aa5a-36fe70cd04bc", "value": "T1A323F16C5E5485A7D81315B003E32F203DE61B7387ABDE93635485A89A9B3EC38C7DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765344, "uuid": "94cc787a-68b8-41b3-bc8d-2fc51494e4ec", "value": "768:d+jm/igUe0HCLCO63QTxr4p8EJNZiRKQBQ8iMN8hGHbQUWDAgFDR53slxqqc2JgB:dFigU7M6q4mE7oLj8hG7QFvigiVJu95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765344, "uuid": "4c2fbd18-b2db-456e-b5a5-b9e67b830a42", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765344, "uuid": "fe324160-c14b-4782-8314-9c51f87a6530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765344, "uuid": "9dee8a60-fb37-4218-919d-0d1a4f65f01a", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021640a8-c6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763731297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731297, "uuid": "b93de850-04dd-431f-8935-6b97e20929a8", "comment": "Malware payload (Mirai)", "value": "c1597c0d12dacf7a5773f2764c33f01b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731297, "uuid": "2d8a4df7-b62e-49bd-9259-2c4951aaa377", "comment": "Malware payload (Mirai)", "value": "a51b905a00b35f01fce9bf44adb438c2d329fc49dc3c3557a0bcb0a25b8418d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731297, "uuid": "91b56f15-6d1d-4cb8-8cfd-1a3940a0b040", "comment": "Malware payload (Mirai)", "value": "2dfc63ef08e441e54bb0fa8c646adf873c05e0f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731297, "uuid": "ef92c393-5738-44fa-ab11-fb5ec3aae942", "comment": "Malware payload (Mirai)", "value": "d3676129b7ae604d4203be039a5047eba1691601e0ad6e4262cb6deae9af3bda51fb5c815a05b17c0b11a72b40d801a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731297, "uuid": "8e449a21-a2f2-4d0f-a9ad-97ddb27773ef", "value": "T18DA3BF33E82A5D94C1850178F4E69E361B33F5C052571EF72AE6C6A6504BEE8F50ABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731297, "uuid": "66e5969a-dfe5-4543-bcff-9ae5dbb8f30e", "value": "1536:+/ux6FX2zJt000H/LzCAdsP67WKqr5u67wpLYlCmrbsgS8j:+mx6REIH/jWgpqg6YLYlpAT8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763731297, "uuid": "bb3bf8a1-527d-4e27-a486-15894d9fee26", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763731297, "uuid": "8241f40f-e09e-42e6-ae33-fe7d9a74a492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731297, "uuid": "bba59a5e-d89d-44c1-9681-084c0eaf4a26", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93751996-c72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764612, "uuid": "ca5cb74c-8161-410e-a309-f20752cbe9ec", "comment": "Malware payload (Mirai)", "value": "45c718d727dc59b366f38eb569473ec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764612, "uuid": "295ecccd-de8d-413c-8643-7eac6010835c", "comment": "Malware payload (Mirai)", "value": "a5635413e219239411f4992bff97dc6207c9ac5b1e3955e6d5c8c47c0aec7894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764612, "uuid": "689442ba-19fe-4e74-8655-d13edf059b47", "comment": "Malware payload (Mirai)", "value": "ca24bfa64365dd1840618e3281e745b41d010a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764612, "uuid": "bd9efc0d-a29d-4039-b007-0f8c0efd9ab7", "comment": "Malware payload (Mirai)", "value": "8324f597dbceca05f3e42e0b0203c1b6b5acb8677693bbd5f4853a3e38da340c407a2a9ef1ff91e4f2a86312f1d9a44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764612, "uuid": "4656c5bb-35e8-4351-a532-63c685b4da27", "value": "T130B37D21B4381E27C4E1987B22F74766F1F657D920A8CA1F7E720E8EFF152502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764612, "uuid": "a4b15207-9266-4d45-8d1f-ac8903f5eb37", "value": "1536:nlfh5LXDKjWRchdzwErYZkSaNMCW24xsrEJyIn+rcQr/tSTYm5B4chJRtfkz6k:PRjmMCWbn+JbQTYOaGlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764612, "uuid": "806189fe-f45f-432e-b08f-9568df2e8975", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764612, "uuid": "4734781b-2b85-4f04-9160-db9f755c2894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764612, "uuid": "6e95ed60-e79f-48f9-91b0-e1014bccb3f3", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bba09c4-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703825, "uuid": "637ef177-2826-4196-838b-e9ce0aa361b9", "comment": "Malware payload (Mirai)", "value": "ca96ded434c051acc40214ef7bcbebbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703825, "uuid": "e775d587-c490-4fc3-a8b6-4187ae1af662", "comment": "Malware payload (Mirai)", "value": "a592973b09ab65405555454254b83e5e14864a5134d528da3f0fe1011e48802f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703825, "uuid": "1fa80ab0-364a-4942-a833-c9abe3ae823b", "comment": "Malware payload (Mirai)", "value": "c5081b0578a4a0ec547f9fef7664e5aafacd921c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703825, "uuid": "f8e39cdd-1b8a-4855-b268-377203e3d99d", "comment": "Malware payload (Mirai)", "value": "052689e835dea41d87922fb274eaf94b5e5c6c39d8877e2e75a4ffc1c5caef7ec1a5041ea4c686893cec428010a75f39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703825, "uuid": "95033aa0-fc14-44ce-a4a9-159da8a942a4", "value": "T129343A33FB0C2422C8929FB05D3B2BF69375D4E25176A00964196B2D6A33BB46D8776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703825, "uuid": "a42e7039-8a1e-4e03-b311-15b4b3a4fff1", "value": "6144:YY1qTgK+BDinAFwHZJizoeJEkl0HGStrYK7f4:YcqbX5+cGSSK7f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703825, "uuid": "5ccb1aad-a7c0-421c-af69-14e4c2e58180", "value": 245280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703825, "uuid": "81c9da1f-b43e-4a30-8267-60a696bb2d18", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703825, "uuid": "22f37da3-f1c8-481c-abd7-3c79b5e9bcb5", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46b2f64-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694337, "uuid": "ddf87f44-dc63-46ea-a99c-bed7bd4c8ee9", "comment": "Malware payload (Mirai)", "value": "50f0f46929d1037492a2d297d0d22b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694337, "uuid": "138fe55c-d5ea-4fad-bc31-6d38c53e1e86", "comment": "Malware payload (Mirai)", "value": "a5f08da3dfb83e0b9195135254b981b2913c2bcee47dcf7068bb4e4d52edbdab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694337, "uuid": "41bbe9d1-a3c7-46e0-8197-5af46572eb58", "comment": "Malware payload (Mirai)", "value": "82857aa20ccb6a22b7c27112b7efc30c144f446f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694337, "uuid": "6fdded39-0f39-460b-aa20-db89803397f2", "comment": "Malware payload (Mirai)", "value": "71654111871fa027a8f12dbc460ab550a39387db3da19506744a0258aa4090e07ee09033d4e0fa3f8106b51e2658fbbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694337, "uuid": "f1057bd3-5b85-476c-ab26-c2ba33059a24", "value": "T138D35B85EB63D1B1EC570C31416BB3379732B43D402ADF47EBF8AD26AD60B029169A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694337, "uuid": "1ad05f45-a263-4fa0-93c9-8ec6d4354cd8", "value": "1536:kjh0WnMetciAnkZ8I0jgTxuQYLKHgJmLW3Rqoi6qNBTThB7cS5PHIcHpw75:k90WMetVOAygYX3CWEo/0BBVZs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694337, "uuid": "bb48cd28-daf0-44e0-a2a8-6294bcf08d88", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694337, "uuid": "26a2a5cd-f16c-41a7-95a6-ace62de38027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694337, "uuid": "5f7c4da6-a7d8-472e-b807-7e3d3a43505f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2d5c2b-c6ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763738352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738352, "uuid": "52e03e0e-b089-497c-94cc-3ef460c0065d", "comment": "Malware payload (Mirai)", "value": "7ae55b44c96068b0d6b0dd6dcbc712de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738352, "uuid": "29b99ac6-d09e-4e87-b9ae-63c5d1402fcb", "comment": "Malware payload (Mirai)", "value": "a6b62fa7086a6b05cf834364bfa90ab98e4d3a646bd6364a45dc6c3d97d8ccaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738352, "uuid": "5606d886-4ac3-4a75-ae18-d0507ed6c161", "comment": "Malware payload (Mirai)", "value": "660a158b2765f5a2a5d8482845225443b9a87e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738352, "uuid": "a1b2eaca-35cf-4c6f-af97-a6849b8c20bf", "comment": "Malware payload (Mirai)", "value": "cc55241ad666ee4889b1f0f9f1d14a87d67211e4b88ecd1acb265105efe6ea7c05dfdea9a42fe735011c3aa2827fa983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738352, "uuid": "253f1e30-7c15-4016-8eca-a0d7bc11d31f", "value": "T17223F1E2919827A0DDC942754EEFB6833996E00E934443B53ECCB6385FF66A092783D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738352, "uuid": "b78e9d46-e3f9-4fc5-8b39-52cd9315edef", "value": "768:UVSPM90ytrDqvDipkHt1JzRBH3r7feo7N8732PDRS+W3oYnbcuyD7UHQRjD:5s0Uu3tDtZI2PDRS+K1nouy8HyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738352, "uuid": "72b51402-db35-4958-a6aa-fc41d0ec0a7a", "value": 45576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738352, "uuid": "0c2352d2-2132-4ef2-87ce-dc40a39bebe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738352, "uuid": "8fc09979-2927-4b4b-ab8d-1779b991fe1c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26ec502-c6c4-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1763720882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763720882, "uuid": "622683cf-8ef4-459f-9dbb-ed74ba426a1a", "comment": "Malware payload (DCRat)", "value": "975d600d998f08fb9f00d95fee840d93", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763720882, "uuid": "bfe99e74-37de-435b-aba9-9bdb6c168a8b", "comment": "Malware payload (DCRat)", "value": "a84f8698f017e5e174836e4acf33b7112e4d3346822f3c32656c65537995fcf6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763720882, "uuid": "0dd5b82c-374a-48ac-b939-a230057022b0", "comment": "Malware payload (DCRat)", "value": "108065b54a094028a460ea1e81bdb7537aed7c41", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763720882, "uuid": "a37c65b5-89a2-476b-aeda-70a6c6fe7ed7", "comment": "Malware payload (DCRat)", "value": "a2b513a213f98259d11a66fd03406610ee17ee5198709d02d182877dcedc3faa3ba393af9fe71cea60f54804bff2ea29", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763720882, "uuid": "7a8a83cf-df27-41f2-a175-31cdcaf6f211", "value": "T17BA39C4E1BC90E79D2C25496E895EAC44290D776DD6003A4EBF8D7806BC37FB0E6918F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763720882, "uuid": "cd381d69-cdfe-4f36-bc9a-f3b902f57626", "value": "3072:xwnla3SlUMIM3hbQIx9Bgbkv2PmzWsStdNIcpdykRCJMGhnFkk:wla3SlUMIM3hbQIx9Bgbkv2PmzWsStdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763720882, "uuid": "6762402b-38c2-4188-ad73-a7c09a8c533b", "value": 102986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763720882, "uuid": "70505dd9-cd71-48e7-8052-63019c960d13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763720882, "uuid": "a834bf59-d670-4d5e-939e-5ef164a3f318", "value": "IMGS_291089.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2eb6137-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694281, "uuid": "11b9dfca-0231-4194-9c0f-1faee054f83a", "comment": "Malware payload (Mirai)", "value": "4b159845b483631c7bdd1611329f44b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694281, "uuid": "20965feb-5474-4fbe-a9f1-0d79c7d10470", "comment": "Malware payload (Mirai)", "value": "a8cf98b8e71e4800662e5fa1f73e8f730d51989379f7080e89eb439de1aee238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694281, "uuid": "0fb8cffb-981b-4713-a866-801144a4576b", "comment": "Malware payload (Mirai)", "value": "c4f3766cb5d8c0983d5e07cacc06dc4537e28d42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694281, "uuid": "13895faa-5591-4157-a6f6-891cb1215770", "comment": "Malware payload (Mirai)", "value": "ef84e97587d6dbd7d563141ff0879bb1cf56e15fb4e25de014540c381a5436af1541f3718321cb584db81683a4a5c95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694281, "uuid": "9134d9e8-601c-4afc-b57d-220c01d5e8aa", "value": "T166836B55BC929A03C9C252BAFB1F429D371613E9D2DA3203FD255F2D7B8796A0E3B140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694281, "uuid": "1e1e38e1-566c-42e6-a5b3-cde1af7ce0dc", "value": "1536:/nUEncQ9Pk/5XqnPRIMaSwISGfOgLTIrZmvtP+b+vBk0VO0:/ntcdqnZIkwISfrZmx1BlVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694281, "uuid": "16a7a10f-e529-4b0c-a0dc-e7c9acfdae9c", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694281, "uuid": "f7802ce8-b2ca-4002-a96d-bab5f2a16bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694281, "uuid": "28f85d5c-43e8-4bcd-b4c0-855ded14f6fd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356bda9a-c6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1763724511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724511, "uuid": "f6f3c76a-b0fe-4171-b3b6-5cc779d593d5", "comment": "Malware payload (Socks5Systemz)", "value": "9a5c3637dedd36acbc317f1fc832ff9f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724511, "uuid": "7b5ba2c5-ddab-4464-b218-1211d13a1554", "comment": "Malware payload (Socks5Systemz)", "value": "a9f5b2bc4a80cbef294f92fdea338737f16bcc5c84438c7b51b5c8b346789f3c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724511, "uuid": "a71b97e6-bcaf-4605-b73f-9f7178dbe3cb", "comment": "Malware payload (Socks5Systemz)", "value": "2aa49e5d61eb49ee0e0382bdca40f7bb0f6941cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724511, "uuid": "609864b9-205a-471a-a622-a533aad0432f", "comment": "Malware payload (Socks5Systemz)", "value": "87d3567e0c42c8b3bad1b5b060af8b6b65899cb597fdfb06b492ba1ec4b20846178424dc73163d63e1b5e3b8c8996592", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724511, "uuid": "9ec8b796-5c24-48f5-b1e9-f15d29de47b4", "value": "T1200633A067E91AF1F052EC323E857864211FB6A01C7B2421F5CE589EBF4D5F0A365E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724511, "uuid": "ecf9aacd-891c-4c30-b3d0-3e1615b7a1f0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724511, "uuid": "0d7d1723-d7de-4feb-8128-116fb5d41fdd", "value": "98304:MRza/D7sEPWH74ZPQxM6v0QX7z4+UyF7QtHkpuS:wzmD7hePrzZUyekYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724511, "uuid": "cb4eaefa-3a4c-40fc-b207-8694a0c84487", "value": 3842258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724511, "uuid": "7ee492e3-7d63-4f04-971e-3ac015b0180f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724511, "uuid": "41329dbf-bbf9-41fe-a9ad-f8ee0714a04b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8766d5-c6d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763729058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729058, "uuid": "26861c2c-7d24-42a0-b161-3fa60ce0a4ff", "comment": "Malware payload (Mirai)", "value": "3deebed28209605a0e6e5fe8332b18a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729058, "uuid": "0ed511d1-76d2-41a6-956c-095f5dfd1130", "comment": "Malware payload (Mirai)", "value": "a9fa402f83916906056b5d24e3b71c94161daf4561d36a89c34eca4fb5b61e94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729058, "uuid": "9722519b-a866-416b-9bfb-ee94a969f202", "comment": "Malware payload (Mirai)", "value": "246709ee9f30e793d70a772a67d1d25cced79176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763729058, "uuid": "b171735a-8855-4af8-a174-1932f99027ce", "comment": "Malware payload (Mirai)", "value": "5403f05149f03fc8b97457f0369ca74154d4adab8769441e64d176e83a4c3a9ab89e4394d0753ce530122a7cab047706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729058, "uuid": "1f9c64a5-24a6-40a8-b869-7ff6ac55958e", "value": "T19A33021C9DB4F592CEEE1ABEC4F912F1E65878D603C71B90438E06E1E7B7606246C25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729058, "uuid": "8d990aaf-69a7-4cce-8947-c95c5d6190fd", "value": "1536:BLrfd7bbRrPnfRyPyi66WTkd5eVaLbWYj5XAs2L+eC:JB7pfRACR8LZyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763729058, "uuid": "3c59fd8a-f400-4952-9d36-3b60580620af", "value": 50444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763729058, "uuid": "20df5b13-3ab4-456b-8431-23114c5f5ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763729058, "uuid": "b5c1a262-c6a2-4981-beb3-afe1330719bb", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d480fd0c-c67f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763691277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763691277, "uuid": "46041113-ab52-46f8-9e90-a979b395f8c5", "comment": "Malware payload", "value": "a72990a0542ebf48ac6d26df01108c50", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763691277, "uuid": "7d801876-1ae2-4630-b6c7-02b8e655822e", "comment": "Malware payload", "value": "aac1bea43bbe829626203ed48c91975796f9a64d1c0aa7a373bf5fa88c16a147", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763691277, "uuid": "1d75931e-adf3-4ed7-93f3-ef15c259a253", "comment": "Malware payload", "value": "694f543170c93cf6b10c19e04d8bad767064ba7e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763691277, "uuid": "815d2e41-de18-4ca0-8c94-493617edc1f2", "comment": "Malware payload", "value": "a85bb670eeb040461a764bd711f30b9647e5a53b58f05b2b740e769415a2ab3e60f4755cdb5ca7076d1bcb7c8dbdbc4a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763691277, "uuid": "23a72273-e573-44d7-aed4-6163d1780361", "value": "T1CEE6334DE1B029ABEDF2827D94B2C109D3307CDE1F32D69B9AE802522F535E16D35B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763691277, "uuid": "136e23d4-5689-4c9c-962c-98959478705f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763691277, "uuid": "8b4835e2-a103-4d5c-aed0-b99c8def8971", "value": "393216:cWSOHiVo/ECIIXMCHWUjMVg74wFKyBPNBGZ30aRhwEa0q:cWSO1XMb8kDwFKyBPNBGZxhwEa0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763691277, "uuid": "84459f57-855f-4e63-8f22-cbe16b9ffd56", "value": 14505194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763691277, "uuid": "ee46b383-f3fc-45e0-b04f-9a1fc212dbfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763691277, "uuid": "c7de4d9c-6b5c-43ff-b749-99a32af59847", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0322e2e7-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763742036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742036, "uuid": "caff0cb9-ab67-4518-92c9-24b9be5f32c6", "comment": "Malware payload (Mirai)", "value": "966e29ded5c2fabf9281d1ebea3dec85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742036, "uuid": "956402ef-a58d-4554-963e-2c9baf0974d8", "comment": "Malware payload (Mirai)", "value": "aae6a6a92b452250a0404fb8fcb9ee2bdc3aad3050c6c139cb70b1060a7bc971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742036, "uuid": "cc328e54-3604-4a07-957d-036214e27cee", "comment": "Malware payload (Mirai)", "value": "2ef0eb403db51e1709e48f99f0bf90ea2d950cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742036, "uuid": "23a9d949-c241-434b-bcb0-4f0ab123389b", "comment": "Malware payload (Mirai)", "value": "19e5b7ce5aede473fbf5b94a68aeed135c56fa8f6f114a5fe0afaa210545493a8f2dcb3088e5cfcc00637ceb7ec47a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742036, "uuid": "6bb2b76c-edda-4740-952d-470f17a655b3", "value": "T1E5A35BC0F98B82F6C447883011A6F63FDE32D5A95070DAAEEF9A9F36DE375419112648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742036, "uuid": "011eb68a-b400-4ffa-bd17-d8a79e43f83b", "value": "3072:4H13FNCrVxBEBblnH3Z+DVQLAsG/a4TQX:4LCrVxBi9HJefTQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742036, "uuid": "3ef89fac-b668-4365-a63f-c905b94c214e", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742036, "uuid": "a242dc86-e15b-4c58-a038-1b8d38a26d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742036, "uuid": "e87c03d6-479c-48f9-be53-c9e1c1b10965", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bbced0-c6b4-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1763713969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763713969, "uuid": "c26c2a5e-d621-4657-9de7-b5c4be64ff34", "comment": "Malware payload (Amadey)", "value": "65042ecc7e6827a14ed57ebe78f4834d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763713969, "uuid": "26ed6447-4617-4ff7-96e2-b7b9aa1634fa", "comment": "Malware payload (Amadey)", "value": "aae9d15623fe8b86fe9311fc9863540cf56fac3dcaa7784419898c4ea991bd64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763713969, "uuid": "28d610f0-ef52-43f1-a4c3-11b43b410d2a", "comment": "Malware payload (Amadey)", "value": "ec46c81b788ae6cd170b9ac1fb850a81e42ea79b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763713969, "uuid": "de769b06-b018-4eb2-9f8e-f3d1edcb633c", "comment": "Malware payload (Amadey)", "value": "43f78f4a8253bfe2314cc8c4ed7ed5af7a12f4bad8ddbf1a94425d48e713fcedc98e544a453ff90d507a5ad77a3e5aa7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763713969, "uuid": "3557e339-49f3-4c00-b114-a17d25344754", "value": "T1F5358E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763713969, "uuid": "2d85039c-f3e9-447c-957e-73e27d1fb952", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763713969, "uuid": "b044c628-6444-415c-b241-28970622b28a", "value": "24576:Lf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVI/Y:Lf5xVaU24WGmhkXzFU/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763713969, "uuid": "f46050bf-1ce9-4af1-9705-30bc3828dbe9", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763713969, "uuid": "b50532ca-ffde-481c-ac7f-361320c28902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763713969, "uuid": "59aeda87-1515-4382-858a-827e78795cf2", "value": "cred.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e083d0d-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763734404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734404, "uuid": "322b1605-950a-4cc4-af3b-3bc5b55e2cf2", "comment": "Malware payload (Mirai)", "value": "ab762446afc9c574d78836356c866ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734404, "uuid": "3c27b373-f872-4d69-85e0-63921e78ac83", "comment": "Malware payload (Mirai)", "value": "abd07a90f4b747a3b766b7b2b744bfdf485aeb6fbf1f5aa68e97f24289846367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734404, "uuid": "9b06bbbc-2854-4e37-a1ed-69d3b72fd351", "comment": "Malware payload (Mirai)", "value": "c03a684e62be560c58fbb3b81213560f6d4ebfc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734404, "uuid": "5bef65ba-43df-4276-b72b-2f3a3ccd90e6", "comment": "Malware payload (Mirai)", "value": "ef594bd7d2705293b55823c7462adfe2b6ecc387263abaedbfd439bd6f06793ced7ae5043fa6d075c4825d4213d372a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734404, "uuid": "f663a681-cab7-403f-b719-1ddbb9399b77", "value": "T116343A33FB0C2422C8929FB05D3B2BF69375D4E25176A00964196F2D6A33BB46D8776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734404, "uuid": "dc261d31-e6c9-48f1-a83e-11907ed2fce5", "value": "6144:MY1qTNK+BDinAFwHZJizoeJEkl0HGktrYK7f4:McqaX5+cGkSK7f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734404, "uuid": "c3d5f1c6-d884-4b0e-8fa8-80395af120eb", "value": 245280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734404, "uuid": "b6e63bd3-ee41-43e5-b244-2252d9dc0d3d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734404, "uuid": "dc787452-6395-430a-9f52-4731f5157af2", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921e9b9c-c68c-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763696749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696749, "uuid": "5253c459-aab1-496a-bf5e-9680df5676e8", "comment": "Malware payload (Joker)", "value": "605a2807dbfd2a51da0d98721421ae1e", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696749, "uuid": "fb4d137c-7b47-4d99-9974-80e43243f120", "comment": "Malware payload (Joker)", "value": "ac7c8e5e58eaf61c78428bbc56be68385d430c0c90e0728418f8ff69cf6242ac", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696749, "uuid": "ee11cba8-cdbc-46fd-88fe-bfd188184985", "comment": "Malware payload (Joker)", "value": "51ea7b57198d9e26d5aca264adc2e4a1906d1755", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763696749, "uuid": "1c152450-666b-4b48-ac6e-383b2f185757", "comment": "Malware payload (Joker)", "value": "596118c80570c1a14e6c719d519058311b37e03b034b05bdb4443354baa9b513c0f75032a89707635870541a16b880ca", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696749, "uuid": "556e8d9e-ecd8-4a79-9571-3fb14b642b5c", "value": "T1F2272287F70E692FC8F3F5798DAA136292061C89260183976915F21D7DB36D89F1AFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696749, "uuid": "c713223b-0017-46d0-9345-7d6ac715958c", "value": "393216:BM2C97p01YcYJ6VsGVZSc8KmzfM/3kJqRTCFBIpwo00bJdJB8Tkfxzk82:w9C2csG3HQzEU6HGD0br/kkfxwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763696749, "uuid": "46ff4488-65a8-4792-82eb-4bac20f4e958", "value": 21123542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763696749, "uuid": "0d778ec9-0e29-46ea-9698-d1ad07f5d93b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763696749, "uuid": "3c5accec-e89d-4946-a136-1b0fc778dd75", "value": "Cool+Text+Keyboard_1.2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40063fc2-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763715939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715939, "uuid": "8be6f53d-be6e-4641-b2e4-053ff18fcfc4", "comment": "Malware payload (Gafgyt)", "value": "5271b56d0a70f429343f632bc702143c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fourloko", "colour": "#FCF97A", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715939, "uuid": "a5f39c56-688e-44d5-a39f-6ae4a8c6fcc2", "comment": "Malware payload (Gafgyt)", "value": "ad362b3f00ad46d7d1473420d707c4f0b32f9f611a98fce5780b94ec51892e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fourloko", "colour": "#FCF97A", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715939, "uuid": "e19571ad-0713-470a-90ec-b3d66a36789a", "comment": "Malware payload (Gafgyt)", "value": "f1e89b48ee4b570e099bef2f9e3d28d34e2d3dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fourloko", "colour": "#FCF97A", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715939, "uuid": "d014f86c-2d68-4c16-9f3f-15551e6f55ba", "comment": "Malware payload (Gafgyt)", "value": "806eb1b187b209ef5b59d22f52c00d1263f02a8582b410ee8518a610c447ae9c6f1093d808ee151fc54847bd93b793f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "fourloko", "colour": "#FCF97A", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715939, "uuid": "5260cb7c-214d-4b45-89dc-5e68cbad8c26", "value": "T1B5E3742E7E22FBBEE268863107F35F70839521E237A19385E16CD6185E7128D4C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715939, "uuid": "fde43cc1-c6dd-4341-981b-477fe67502a9", "value": "1536:ep7j+1THFq+fK39Hin/32rK+h67EXwSwweuIbZMmvi4b77BloSg1DCUFxkCvU8nW:eUpuzXwSCMai4/7Bl7g1DCUFxkwU8nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715939, "uuid": "7f6ad2f9-5e0f-410e-8fe8-51698d50aa2a", "value": 144220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715939, "uuid": "4574b79e-4ecb-46bf-a0b4-7312cc1c70de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715939, "uuid": "9ed5febc-1c01-46f6-96de-93e6b1440fcd", "value": "m-i.p-s.Fourloko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277c85b4-c6e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763733078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733078, "uuid": "7b51bf39-7b19-4aec-ab3d-414da2b06632", "comment": "Malware payload (Mirai)", "value": "7de3280846c80765ea18f0d2989da2d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733078, "uuid": "434cd98d-0088-4022-8369-15dea873d12c", "comment": "Malware payload (Mirai)", "value": "adb37a7453e94ac5abe05a0cb8e0922acbd9fe75ab086ebe7d7ac8d48fdcbcdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733078, "uuid": "d5b60719-53b7-42e5-8969-2bb3f3c10c5f", "comment": "Malware payload (Mirai)", "value": "c3257fb3625994cf342f20729f883958f9fe73cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763733078, "uuid": "92135770-21e5-4953-a544-75c930d720d2", "comment": "Malware payload (Mirai)", "value": "5136979ae3848d4da6c63d523420a943281146cb7ad668f72e71420c023178d0d3a3df0733d7a34ab8af90982ef001ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733078, "uuid": "c3f1bf14-88de-4f70-bf45-9cfb420dc843", "value": "T156631295F948E9F0E93059FBFA481487C7442EBB09DF44632AB4842C5DD682F5AFCE21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733078, "uuid": "bbb9ca5a-113e-4ab9-afc0-46a27865cc37", "value": "1536:7ExWIQZDw2YllxU7QI62+6gQmcBhWgXc5wL1biGLDyJRZK9cdmGXu54p:vtZDZYlC3ZsPknXc5gLLDsX+Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763733078, "uuid": "e1fbee6f-506e-45b8-9435-c43ad2959a39", "value": 72972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763733078, "uuid": "0388d5c1-29c1-4e62-9d2a-599a7118f201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763733078, "uuid": "91158da7-c712-4cf1-850f-35311d8d1d9c", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa4ca58-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732949, "uuid": "2663389a-72a7-444e-be05-c14cab0e4074", "comment": "Malware payload (Mirai)", "value": "5321e4e2f4ab9e1c0aa11d094e2d51f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732949, "uuid": "6c1c1f7c-7518-4685-b91f-a8a3c2266a02", "comment": "Malware payload (Mirai)", "value": "adc3bf973cc9360e63b108df388f6a8e36b700ae842c7e180c232052ac110ee9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732949, "uuid": "598ca2c5-5dbd-49b3-b112-3274ce05c04c", "comment": "Malware payload (Mirai)", "value": "ea33e668d4a92aefcc113291322cf55649b12623", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732949, "uuid": "88b9b9d4-6171-41cd-9fb4-de8eeb72a1f7", "comment": "Malware payload (Mirai)", "value": "c85faf6e3cf7aa45d01f60716bbb4a8338f2ff987edf1f7ebe9ffaf0b95d140ba55ef722de431a0653013749142311ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732949, "uuid": "94896cd5-6548-47b4-962e-198b1717547f", "value": "T1EE6195BA014407716CE26BD7637D404C7092929748F6BF22A7ED28E88D8DFDCBC41667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732949, "uuid": "a60095e2-4d69-480d-aad0-3ff6c7f7ec61", "value": "48:/oldGVVkDw+oUUPFy+8nJh+JRmHQqL1/2uNN:/oldGVVkDw+oUUPFy+DJRmHQqL1DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732949, "uuid": "a58ef9c3-9229-4689-819e-e8eb84a55953", "value": 3182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732949, "uuid": "dd5f513e-cda5-41fa-a163-98f66e39ca3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732949, "uuid": "9ace56b3-d7b3-404e-a2cc-339cdd3ec91a", "value": "2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d3744e-c72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764611, "uuid": "704a6e10-b026-4d3b-a187-874e33a6fce7", "comment": "Malware payload (Mirai)", "value": "dfd44a546f8aae79121d1d91c0ff64d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764611, "uuid": "62afec9e-b6c7-43b9-bba7-767ebeed1190", "comment": "Malware payload (Mirai)", "value": "add45c08bd5973bbd5b4e75ef497a4b77f2dde9e7125f446b9bc9c92b8c37e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764611, "uuid": "ca9c36a7-ad83-4206-9fc5-a521920285c2", "comment": "Malware payload (Mirai)", "value": "164d217a46dc144b87b6f62a00db40f41bd7e56e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764611, "uuid": "854163fe-2f8d-4d99-b2db-db224ef12d35", "comment": "Malware payload (Mirai)", "value": "8476a49dda55471cfd4c1ac58a2f4d2deef411cb2f1ef3fe2938265a790d917e812b335dffde775e731211486b4a8af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764611, "uuid": "644c622e-169c-447f-b8e8-1dc778ffcee7", "value": "T15EA3BF32C82A5D98C18505B8B4EADE365B23E5C417932EF716E6C7B65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764611, "uuid": "a8956603-a81a-478b-b60a-7ec3cededde2", "value": "1536:H/I9A0n3bQK05LKGVwS0K2qcKDFVut7DAQmHICwE6SPXc5:Hw9AkrqLK/K9DDwAQmHIEvvc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764611, "uuid": "a598b3d2-1c04-4ad0-adf7-deb8fcdcf466", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764611, "uuid": "eda0a58b-9256-4119-a760-d799120f6898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764611, "uuid": "45d26165-4531-4a37-8fa2-b4b2c690677b", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e23da68-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739692, "uuid": "713248fc-bc9e-44e5-9fe1-2f3e43f04174", "comment": "Malware payload (Mirai)", "value": "1cdf1cfda6bed59b73c36a01a1808768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739692, "uuid": "87e54e6a-0142-47e4-bee7-9177e73f4f0b", "comment": "Malware payload (Mirai)", "value": "add766d3c4d941f0b57c58e131934b17bba93fe579c0c0010b6132bdf0407155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739692, "uuid": "79964a5a-57fc-4c5c-976d-e66bd86b82ea", "comment": "Malware payload (Mirai)", "value": "7bc3d1dbdb59f1d29153446bbbf2d31158365229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739692, "uuid": "aa4b00a1-dc20-49ef-b485-f67cf64cb971", "comment": "Malware payload (Mirai)", "value": "cc3e73e7363ada8e621a5851854fb2a75dc910a37e5a47a20a4511c86782ff6b4dfaa31943e56f75438229997c18bb4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739692, "uuid": "34e17766-1c79-4725-95da-69754ad495d9", "value": "T15393128C80A2D052E04A10F94E7799AD70D96A7DE85072D1FA5562C83BFD0DB1F9C6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739692, "uuid": "70f187df-634a-46ac-9879-01e3f6439e43", "value": "1536:/vZTjoz7tjiubR7+OJXNUCsAybuP/R4vMis8hkeu4/BGl1Rj0eV+50t10DcWR:/vZTwxmQ7+OkCT1OsFeumOJ7t2DcWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739692, "uuid": "e8e2713f-fc55-4a86-a3e6-af280615ff32", "value": 91236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739692, "uuid": "0543d934-9995-4b6e-968f-97a4b8fef74c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739692, "uuid": "514b6005-63be-44bc-8766-4533fe65dd1a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d939bd6-c6dd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763731450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731450, "uuid": "0eb7b95a-0a6e-4259-b2e7-8cebc04baa75", "comment": "Malware payload (Mirai)", "value": "555008b5ac29599914b91e68c5973fbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731450, "uuid": "a184f1e9-5250-44b4-83b4-c36bc39b4e5c", "comment": "Malware payload (Mirai)", "value": "ae36a70746bd8acf8f2a443856fd804bb607041079bdebc24de6bf1bf24f5daa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731450, "uuid": "c2c08e46-af3b-488f-9b3a-87d3e1eda882", "comment": "Malware payload (Mirai)", "value": "a836a554178c129a03b7d46341aad90ec6c532ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763731450, "uuid": "aec42641-1acd-4696-ab48-592d682748e8", "comment": "Malware payload (Mirai)", "value": "fb7bb2d324a3be69fa6764488eb7f70b6014a6423071b5f4092e8c815bf480b6d6f95c37ffd789156a07488a26b51887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731450, "uuid": "cff9cceb-aee6-4a85-8873-b4358a2cbb20", "value": "T16CC312A8F98F112AE20E8272CF524BCAF6BE316C1E6535572D40DC0E34E89B6C05DC83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731450, "uuid": "cb122a16-868a-41fd-a623-b2d4ca0d9ed3", "value": "3072:rHx9IB5TP+8nKlo3ogt1B4IjszCTKy1btlrRtGhZIH414h1Vk2:rHx4P+8nKCYdzo51RlrfGhZC414nVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763731450, "uuid": "99a83bae-b1c5-45a4-82af-d894296e61bf", "value": 129696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763731450, "uuid": "0607688b-82a2-47ad-b09f-1d99c7074b3f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763731450, "uuid": "8a2cf4b9-6b7c-4418-bb5b-87d832a85d47", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c188a82b-c695-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763700694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700694, "uuid": "17d9fdd2-be65-4b0e-abde-1b16e778c66b", "comment": "Malware payload (Mirai)", "value": "6eb3c3ee9cc00133ce38efb7d28985f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700694, "uuid": "e5cdb686-a43c-4696-afd8-4d14bb4ff0db", "comment": "Malware payload (Mirai)", "value": "af231c1dd37cb92586ec628a0470b92e123594ef6c152fa81ddfb23915dfcf0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700694, "uuid": "5d8916b7-ee24-42a8-98eb-f96d552a11af", "comment": "Malware payload (Mirai)", "value": "1f2082f34c60abeb6b5647c2aec49e965de97de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763700694, "uuid": "5c3e8e13-d4b7-4c12-a220-5975c75dbe94", "comment": "Malware payload (Mirai)", "value": "275774a42aeeb34f7075a53f975076db6ad0552c5525d72bef531f546682626a23c678994412b0efbb979453f31bc899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700694, "uuid": "237642b9-903a-42cd-9322-5046c9e3238b", "value": "T1162490E1A41559DBCE0048BAB3AC4F7437923C70825B1F7D4D528169A28F8DFF1D6BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700694, "uuid": "39281cf6-597c-4887-b488-2c1433899b10", "value": "3072:icUxR8w8lReBwwAkt2LGXewoQlWPR0Bm:icC6+BTAkt2L8YvPEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763700694, "uuid": "986950ee-7b88-469d-8504-67397025b97a", "value": 219568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763700694, "uuid": "ac8188e8-8185-451c-8d91-6076b9f21d2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763700694, "uuid": "8fa88f13-2b68-4de2-85ec-186a9b0f69c5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f37f24-c6ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725076, "uuid": "ab667813-05fb-4d69-a825-d06c82d2e58a", "comment": "Malware payload (Mirai)", "value": "c1acec98d2ec146a429cb2580ada2257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725076, "uuid": "c4c5fe6c-e846-48a7-8e3d-30002f9adbb5", "comment": "Malware payload (Mirai)", "value": "b0da7e543d15c872ad7e1c75b7a2a9b3740dda8e353a6cc3c48b8d8b11057ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725076, "uuid": "6b8a3e41-77e6-46be-b9d0-59a87820e96e", "comment": "Malware payload (Mirai)", "value": "3d45274f26766d532758148ecddb8e5e2c6ff378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725076, "uuid": "f5440273-110f-4b29-8243-6fcb0ca13090", "comment": "Malware payload (Mirai)", "value": "4ee4b4de607af2882270c5ef884429c5150157290e88a6cbfb9f66c6aff2849e038e8dd038b45b80a8ef8fdf6bf79fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725076, "uuid": "a88aa00e-b082-4380-9997-52a94988ed0b", "value": "T1DBB36C22B8391E27C4E0947B22F74766F1F517D924A8CA0E7E720E8EFF255503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725076, "uuid": "f8f41eca-9c3d-476c-8ac2-207fa1e6ecf4", "value": "1536:RDEE6oLRjgjAa/T3iA7PDNxo9iZhmCr4MnxobuCiG+rC+CHtrjYm5MAYMFJitKVq:9ScepoCr452G+94tjYOGAVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725076, "uuid": "546b7992-a56d-40ad-af58-55eb7a6574bb", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725076, "uuid": "0fdd71bd-cf2b-4078-8647-5f60cf70f7ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725076, "uuid": "0ee70254-f233-4b71-8e69-da6e460069ae", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5078a72d-c6ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763738730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738730, "uuid": "a788ff77-956a-4e2a-9734-88ea3266ea32", "comment": "Malware payload (Mirai)", "value": "3c3f9a5f3c1bdff64af03bb9182d9bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738730, "uuid": "31d67d53-c701-41b4-81ee-399e67c2210c", "comment": "Malware payload (Mirai)", "value": "b16a3c2883d928d00c55999e02604429df7699c4197e570163c773c5e7dbfa60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738730, "uuid": "f8f16e9d-bbe5-4b07-935b-2d8c071f5f6d", "comment": "Malware payload (Mirai)", "value": "f9c5944336996c23663c7ceb896fa36197909d96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738730, "uuid": "0710b08a-cb31-4ba8-ad1f-1e246b3b7ad0", "comment": "Malware payload (Mirai)", "value": "d5dc65686b241b8f44675e96641f111116fd3eedab7d3a00b84b0b074471ab05b72c8ea80020d24c25d5092c6afc2b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738730, "uuid": "68343a29-e5d8-4d5e-90e7-fa2440cd9fb1", "value": "T12C630224DA17637AEE5491F7D02942BF672AD724C5F23CE60B011795A36280763B534E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738730, "uuid": "da5d1c56-a0bb-4028-ac29-f8c087ac7798", "value": "1536:9IWGrjp/EG5G8HaXIH5MpWe4bXxdb1dVhPEo0xh8TkRTJLWUB4zy1:9PGrV/PG82YM0eMVdVhPEJ4iLZ40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738730, "uuid": "06da2c32-f197-4d50-8d68-e6d8b8e49ee4", "value": 70120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738730, "uuid": "0d2da7ff-3b43-408d-adf7-b427c5c6a624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738730, "uuid": "cb578bf8-62bb-4fe9-901a-e742388d0fdd", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432f787f-c709-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763750304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750304, "uuid": "629b3903-17dd-41b9-9597-c1d558464360", "comment": "Malware payload (Adware.Techsnab)", "value": "fb458b36cc771298602be0a1388dc371", "object_relation": "md5", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750304, "uuid": "a49f2dfd-6da2-41eb-951d-2ac4b36ce4ac", "comment": "Malware payload (Adware.Techsnab)", "value": "b228a454d0817d9902d965530c7a654e97067c8b2165ac02788249c422b57b27", "object_relation": "sha256", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750304, "uuid": "270ffc99-20aa-4646-8e16-fb32dac05cf0", "comment": "Malware payload (Adware.Techsnab)", "value": "28344a1bc50b7367cd870fa1d17275debeb147ba", "object_relation": "sha1", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750304, "uuid": "a9ca6b0e-34f6-4546-ab3e-0ec3ebaf6c45", "comment": "Malware payload (Adware.Techsnab)", "value": "5eff04432ab4fdda58dc491c729ce77916a45a55bb728bc183c237655c874343d7870b92ffc1e04aa38d648f243e05f6", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-243-109", "colour": "#D9B17A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750304, "uuid": "9debe50b-4ac9-4a09-92c0-1d80e48ae238", "value": "T15908239CF7C867846F765CBA9323672FA0778488CB763F564D01C6F126B412FAE46881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750304, "uuid": "e8033e17-b288-4ba6-87a0-10f965c84e7c", "value": "1572864:QGp5mivYD9j5IDn8i4UhIbNV/6zBTU8UoccaU5lDGRfvZxfWVG327764tyC1Mx:lpcKux6vWbOA8zcHU5lMZxuVGmv6c1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750304, "uuid": "56142b8c-9627-4ea2-a5d0-369fc3209789", "value": 82874527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750304, "uuid": "9f6c4968-279f-4bc4-9586-18f1b74f6dd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750304, "uuid": "3678244a-5782-423d-9d5a-be48289f7c8a", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd067889-c6da-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763730429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730429, "uuid": "6ea6324c-3b3a-483d-9c86-bd4958883996", "comment": "Malware payload (Formbook)", "value": "2b08b5ac33e33dca695e36acc14f82e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730429, "uuid": "0a113c9c-d608-4e24-9305-f78b912e3947", "comment": "Malware payload (Formbook)", "value": "b36a6dea23c15e5783122d763255c950ee1390c603c7f2c1f12ef3b3a0bf032a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730429, "uuid": "e3749c48-4a84-4a17-9258-f37e20fc69bb", "comment": "Malware payload (Formbook)", "value": "d798d89134f41d77b11415fd9a8c70fa9c27306e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763730429, "uuid": "d258545a-9ad2-4e33-97fb-322c5d000f90", "comment": "Malware payload (Formbook)", "value": "da71bbbe1ed056a0844b74f91b981982299701d2815f2c938085636d1a8c89eb91dcbcde21f409fcd0241aae96d3532e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730429, "uuid": "8e90905f-f9c8-4aa0-aad1-da52ab99fdb6", "value": "T132050215220ACE07D4E31FF51971E2B816B9AFDCE521D34A8FDA2CDFB5687805A503A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730429, "uuid": "605a9d15-aa59-4d31-8964-7be30f23cf0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730429, "uuid": "8263598a-d571-4764-8589-dccdbe3c0597", "value": "12288:+nd57PnTyhvcjikT4XjlMeZXrCxwzgLoMygPiK0jp7BRr6puqPyU:4d57PdWg4pXrOLLy6f0jZBRSVyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763730429, "uuid": "ffe3dcc6-f53c-4b1b-b7e6-60e0e7bb4a22", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763730429, "uuid": "ef3360f3-7ea4-4411-b6e3-bb219e21d59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763730429, "uuid": "fa816b7c-dd54-4161-9d01-5ce0dec6f27d", "value": "SecuriteInfo.com.Trojan.Packed2.50433.2440.18692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75484c56-c6e4-11f0-a129-42010a9c0007", "comment": "Malware payload (HijackLoader)", "timestamp": 1763734497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734497, "uuid": "5b938931-50eb-4b04-842b-8fa810b51814", "comment": "Malware payload (HijackLoader)", "value": "3d03c61c9b33a899a09ba10946177e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734497, "uuid": "8d178a0b-2285-4940-aa13-97e5934b50e1", "comment": "Malware payload (HijackLoader)", "value": "b3beb95220d37ff0b625f81464ed47db6772d9728583a8a66136439cf88065dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734497, "uuid": "3333e2e2-8c82-47a4-87f1-df2792d45147", "comment": "Malware payload (HijackLoader)", "value": "4e9bc024e9871890d6af21e722fb024db8d5f822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763734497, "uuid": "4d7eb1b2-b4ff-4e7e-a0a8-16eb3b483f20", "comment": "Malware payload (HijackLoader)", "value": "887bfe152c96e28af7a6da6445603ad85406362870c4b5bceb9a34107645179e79c468040ac8c66cdb84ceb84332e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734497, "uuid": "9f7f8425-a6ce-475b-8037-574836e8fc11", "value": "T1F9451B1AF7A551F5E0B9D274DA632127FD7138998334A6DB47C09A0A5F32BE0DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734497, "uuid": "5e560305-a1ea-44e8-a0c3-46293007dce0", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734497, "uuid": "43f186dd-48e6-4b9a-b345-506b4f8a396e", "value": "12288:SlzYjLwgJMPBFNKbI7M66tjRx8nqBZIXmD4Tt62iXh0QQhCfpyy8G+WRdK:Sl14kmU7itjngqa20t7QQcpyqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763734497, "uuid": "f473d35e-77bd-4ec8-a5ae-4b4eca6786b8", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763734497, "uuid": "bc315f36-ea32-472a-8d42-2b910488bbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763734497, "uuid": "1f63b502-92fd-43b0-ae5e-4466a2f8ff0c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.44825721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d003d355-c699-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763702437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702437, "uuid": "f56a7e7c-adbd-4383-99e6-420ff8bb721e", "comment": "Malware payload (Mirai)", "value": "bc97288446cb919c30f9c4e69048b01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702437, "uuid": "a2f203b2-249b-4bc3-981c-0aaa7fa7cf29", "comment": "Malware payload (Mirai)", "value": "b45d129d32f59be871f59e963d8cac3122a31f57c4491ba6519b0256d62f986d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702437, "uuid": "5284368f-c864-47af-a809-f680a2a9dde0", "comment": "Malware payload (Mirai)", "value": "80241424daf8d6cf2420f1a5655fee41f024f72e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763702437, "uuid": "33d14553-5d94-4335-91e7-3cea57eaac82", "comment": "Malware payload (Mirai)", "value": "0ac907bcd70fb75b8a0329ca49b46885f9764a00e9fac11e8bbab4913d1340d830513398a560e3cf79879c6c52143aa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702437, "uuid": "5df5bc19-cbe4-4586-98c6-0ac1dae271ad", "value": "T131041991BD516F22C5E623BBFB5E428D371513A8D2EF72078D226F203BC695B0E76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702437, "uuid": "a3bc0316-68d0-4b32-b939-229740f95b66", "value": "3072:GVZRkiSbGvnBybB7aNzOz/kmd1XarhILF8+nGf41zD8hvBYzML5Fn:GVZRar4ILDGf41zIhvmYL5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763702437, "uuid": "cd27cae2-e55f-475d-8460-354fc1d976e4", "value": 174476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763702437, "uuid": "3ab40e84-befd-4ff1-b131-d0fa14fd9013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763702437, "uuid": "438e2a57-c3c4-4865-b8ab-4b7e33bc4291", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe11407-c6f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741306, "uuid": "e02fdd9b-046e-4dec-958b-7f788baa883b", "comment": "Malware payload (Mirai)", "value": "725f2f0c7976bb7bfde7f1e6ff567829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741306, "uuid": "a748d739-ad6b-4979-a20e-c4f030f49bee", "comment": "Malware payload (Mirai)", "value": "b47823da70bb16a6cbb97909b93c2fea1ac03d9e11b16901ee43a9834b415f9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741306, "uuid": "b0585f3f-2806-4ed0-81ac-1e12819c359f", "comment": "Malware payload (Mirai)", "value": "2913ec7e7ea4bc89c7203b492c109ecedff7e37d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741306, "uuid": "8070744f-e4a9-4435-99eb-74dd2065a50b", "comment": "Malware payload (Mirai)", "value": "ab6b6d2c1d4b06bb4c961c272b6fb0ca032d22af1205734e2ed7b7150b3970a61d0839fa19547f234615f7243eb87e76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741306, "uuid": "4bb07ca5-a30e-4b3b-bf2e-2a10fd4c0c2e", "value": "T11D630646B8828B3BC7D0177AA66E668E376173E4A2CF312BCD205B6137C650F5D57E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741306, "uuid": "5ebb51d3-3f97-4d86-b01f-8758a61a0559", "value": "1536:tAO3JnNK820T8vWIT8Mtpf5SFyLTAn6jQzdvqY99nnn89nnn:tH3JnNK8tnTqYbnkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741306, "uuid": "fe4e8f61-2aa7-4a48-a2c2-9707b99ffe4c", "value": 71660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741306, "uuid": "08742468-ed3a-4af9-8947-755be5d36846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741306, "uuid": "e664ec2a-5d83-4d70-a217-3dde5fe5dee6", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7bedfc-c6f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741971, "uuid": "a261d6dc-e908-4651-9424-e11b88a6be34", "comment": "Malware payload (Mirai)", "value": "819db171f43a38dd9bb8b550f403d6c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741971, "uuid": "2c9c937c-0359-4cd1-a4ca-c6ddeab5800d", "comment": "Malware payload (Mirai)", "value": "b48241575a281a613f2658f81ef2282cdc1c9d97c2eb6c7dc9e04a81f1809873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741971, "uuid": "940985c0-4237-4863-9f2e-79526e8afce1", "comment": "Malware payload (Mirai)", "value": "b1376545d3fbf46e23b60eeef9cb17fbeea6087c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741971, "uuid": "344f5d78-d705-410c-b464-83e25162660c", "comment": "Malware payload (Mirai)", "value": "f73e7e19c9f8c0d6c423fd486987ee010a39c2fd6be888711e5781676ac0d74a674d088cc225172115f5c068988de518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741971, "uuid": "422e2201-a7a8-4bda-a388-b3c309cd8629", "value": "T1D613F13A54E3C3EFF0C65070D9AB64072B4792BA878196E2BAC0553C19E1B3929FC7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741971, "uuid": "e1548003-7edb-46b9-aa1f-332f01b0a355", "value": "768:LjSUM6JmnGl5YVaPunpclFKUS98A3baB0S2lzAFZ4IQG3kDrv/EMkcWmSvnbcuyi:LjSUM6Jx5YVqunp8Kt98A3bzhlsFehr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741971, "uuid": "80db0cde-48b5-4dd7-be8d-5fdc8174ee15", "value": 44244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741971, "uuid": "2ee7486d-daf6-435b-ae28-cfa28e67a303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741971, "uuid": "8308cce9-0f50-44e6-9a99-107ac2630b28", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fd0828-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715929, "uuid": "d9cf3a1c-0ba9-44ee-8bf0-a60778f3fca7", "comment": "Malware payload", "value": "3d459a9d7fea487634c78bd594fde0c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715929, "uuid": "3438bf69-eea5-40e8-a15a-bb3ea8374c78", "comment": "Malware payload", "value": "b65d879b93d39a373aa6045bc7a6487bb15b740743d576e29b3c64421594bc28", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715929, "uuid": "7f5af7c3-d02b-4836-9d4f-7d407036558e", "comment": "Malware payload", "value": "4171f749a537e45f76dd9bc4c4af971f751160a8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715929, "uuid": "616b7ece-d66e-47d8-ac9f-c13ed6601819", "comment": "Malware payload", "value": "885d84a7b5bd00503101fb41ea0c87f388f5b1a06f25ad105ed7ec52124405d3c6fa4f2850b4247a796c607ee681a7da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715929, "uuid": "3724da27-33f0-4998-8ea2-a42c91d192f5", "value": "T1CB16F086FB589A2FCC7704364EAA5231165B8CD68E83D7837954331C68B76D80F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715929, "uuid": "bf499542-3414-4bd3-9b93-e727ae996d05", "value": "98304:yaz6U1qGhb+VpBVAZLPG9HlPVrEjS4YhhrYmxa:Dz6q+7BVAZLuxlA8xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715929, "uuid": "275f2f80-3737-4cee-8143-4ca3edf99d03", "value": 4295502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715929, "uuid": "4106625f-a7b4-420d-a8b0-eced90a6a900", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715929, "uuid": "53158af5-8c33-4683-b862-a752661608e5", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4111bc5d-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739563, "uuid": "13f5a433-4b3d-4bc9-b552-6d5bdf6eb51e", "comment": "Malware payload (Mirai)", "value": "d39ce7f67caade27089186a3a4c0521a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739563, "uuid": "5ff9ad21-8d19-4a4c-bf74-1e2d1c42ef22", "comment": "Malware payload (Mirai)", "value": "b72e6af7a47bca2b6f0b8337a149302ada171590d1c961ef11f2d3ece29dc33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739563, "uuid": "70197ce6-1f09-4d30-ae1d-382b6b2f17bb", "comment": "Malware payload (Mirai)", "value": "2f7ccb5f8323d4a893ee8aef8a9a1278981d90fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739563, "uuid": "69cb7885-00b4-49a5-ad84-e488eb2f00cf", "comment": "Malware payload (Mirai)", "value": "132b5f26f09d039dd42249427046aaf7045f4d475ec38ab5e411d91f933805734139fb2c38c0c206e9190ea4d066d2ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739563, "uuid": "d22f8b24-a17e-4b23-9bae-59fd241c5400", "value": "T17C13F102C8679278DBF6D2383C9E34599F80A66ECEC149F9AED0F5F30412B352724AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739563, "uuid": "00ad7148-0b8f-4c43-94c0-77b4456e1518", "value": "768:C2nU7TyjAAvlvEbCNIZTBvlbihwR2FOT9qnEb7IPp//jndi/twdnbcuyD7UoQRjY:C2U7WjAAvlKdhbR29Eb7Srdilwdnouyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739563, "uuid": "b5a717af-9d67-433f-9698-7a943fe56719", "value": 42696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739563, "uuid": "540fa56f-4adf-4a98-825f-5f018400fa87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739563, "uuid": "1194cccd-1a5b-46f4-91eb-ab88636a534f", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d79c242-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739691, "uuid": "d1b627ac-dc34-4b77-bed2-d4a7bd1af683", "comment": "Malware payload (Mirai)", "value": "21f773671ebeba360c8506df7f5540d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739691, "uuid": "0b3e59b0-a6bf-4826-bddf-04a8f06ca073", "comment": "Malware payload (Mirai)", "value": "b77c9e8ef9ba868d7c755428f96e91d20a15a9ea939f95541fca56ac3e807a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739691, "uuid": "1e5fc8de-9194-4cc5-a0cd-cd0db19add93", "comment": "Malware payload (Mirai)", "value": "7b0ad56bab0148e7923c8eaa179718b86f7a8f05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739691, "uuid": "f081f2eb-1d5a-49c0-8b67-a922e9f20cb4", "comment": "Malware payload (Mirai)", "value": "8a7da8b7b0169a65819becf4ff25eb619ffaea14dc15d577ed02ac76965136e0d887aef80135686e00af2722c83c8047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739691, "uuid": "68b8a1dc-6df5-4173-86c9-a2267d0d82fe", "value": "T1F5B34A9AF401DD7CF80BC9BA44274E0EB930A39156C31F26636BFD97ADB21A47813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739691, "uuid": "69630dbd-fa12-4730-a571-ac352f772055", "value": "1536:ItLx7PeVAK3qThEa85FFv20arhd4aW3EV3w6WjQUiBAQUpmdp3mBB3l+Y2xuHHYp:IZWakxaUnIddwYnwlWRN6oJmhJWoaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739691, "uuid": "56c52f4f-701a-4a2a-9764-71022c51ab77", "value": 110636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739691, "uuid": "30bb6c2c-d367-4d76-ab8e-95c4a534dff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739691, "uuid": "22cd9e1c-f4ac-46a3-aced-e4f2e3a74aca", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0811cd1f-c697-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763701242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701242, "uuid": "d93da4bb-be8a-47e3-ad12-56373d90c041", "comment": "Malware payload (Mirai)", "value": "a7c47b202bdf4a3df097977eadf3e9b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701242, "uuid": "405f6560-e098-4617-9ff1-88e36d136ca8", "comment": "Malware payload (Mirai)", "value": "b996086e3bc5fa52f39a8e2d40e36c113f816399305321a0562febb1782066df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701242, "uuid": "588b4df5-494c-4731-a33c-d28ad950445b", "comment": "Malware payload (Mirai)", "value": "e36679cf76274340d440a8654690579829f5cadf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763701242, "uuid": "6c5e7485-2bbe-4574-ad98-d9eb1b09b1bb", "comment": "Malware payload (Mirai)", "value": "8387263a0d759265396fd659b5eb0e3ea594ff52dc11e834c31b0b42e8dcdb9f327cf9d902228788c21fb97533132a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701242, "uuid": "eb2cb734-3fbc-48f1-994e-416659af0130", "value": "T1C053F19FA64644D9C53C48BA62CA8FD12F045962FBB6F4DD3244C2E2FF016A990E2DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701242, "uuid": "128a5a3c-f339-40a7-9eec-5520c33bc1d0", "value": "1536:zjdjMnBO2QTpf0UBWtHufFCOWyWEt9kWNQHDCitLVSW:zj1G4V1f0UBUufFCdyWEtCWN4tLVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763701242, "uuid": "c4f40fa6-6744-4330-8828-7908704d02b4", "value": 62672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763701242, "uuid": "29f93f0d-a1c0-43e0-be1a-5ecde4ddc44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763701242, "uuid": "a4f3724c-9f68-44a6-8684-a428bd6c5a2d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b71399-c6b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763712303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712303, "uuid": "5ac55095-52e4-4b0f-ab2a-556ff2e5086b", "comment": "Malware payload (Formbook)", "value": "0134bcd750479925fadb0e089402e828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712303, "uuid": "da340111-9b22-472b-b234-4e0ebd9f053a", "comment": "Malware payload (Formbook)", "value": "b9b168088505eeb033b4bd3a66a82178bea69f61c4153d000a47d5ed867f3531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712303, "uuid": "053a2b04-7a38-44b4-b6cd-b8c9f5f3ec9e", "comment": "Malware payload (Formbook)", "value": "873c585849aa8942e6ec98ce62980ca0236a931d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763712303, "uuid": "df1dd17e-259f-43c8-8eb6-18527fdcc534", "comment": "Malware payload (Formbook)", "value": "8aa1be3d64afbb45b8e9cabcf4fb36583b3d2782c2053a0a05f3a7e4fbfc9dd9d0b9cdcade90013a719ec9276460e097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712303, "uuid": "3277b3ff-693e-40a4-8c54-91e67ff0a99d", "value": "T11645CF1363DEC361C3B25273BA25B701AEBF782506A5F56B2FD8093DE920122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712303, "uuid": "6eff4405-5f08-4d02-a823-1e7fa2799599", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712303, "uuid": "6bf60f2d-a3dd-49f3-ba70-d1ccf922ddcb", "value": "24576:ltb20pkaCqT5TBWgNQ7aCoXkH11jI6xJHxP6A:WVg5tQ7aC7V1c2Rx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763712303, "uuid": "ff77ae4d-86e5-473b-bdbc-431603a0d906", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763712303, "uuid": "2643f1ac-56c5-4c35-8a9f-660a965c9901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763712303, "uuid": "5f7d3656-7e35-461f-9535-077429fcfa38", "value": "Payment_Confirmation_071025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260bbded-c6c6-11f0-a129-42010a9c0007", "comment": "Malware payload (ArechClient2)", "timestamp": 1763721479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721479, "uuid": "9fefedba-2cf0-4fc3-a904-4b2727ec4a6d", "comment": "Malware payload (ArechClient2)", "value": "98195214640f8a2e35785928a06f07de", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721479, "uuid": "0a1dafde-ab16-4fbf-aeb0-acfddb992148", "comment": "Malware payload (ArechClient2)", "value": "bb0296d32de860b5a60046e01bdb66bdf8b26da27f7ea143f10fa6b7413364ef", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721479, "uuid": "dcc35582-26cb-4edc-b027-8e43f83ca711", "comment": "Malware payload (ArechClient2)", "value": "a0473fa7b509bae74e6fb11938e5016dfc70f32f", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763721479, "uuid": "551c5982-b739-43dd-ab00-22996c804467", "comment": "Malware payload (ArechClient2)", "value": "a7eb00a8a51d362c6d88ce52b26bca2e21c0011c6f4bbb8867148ef96a6c79c607fea21a953e3148bafb17eb123968c2", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721479, "uuid": "aa280d85-d721-44fc-8a49-e47ab59e3a0d", "value": "T1ABB63365EF702737F9DB8B123A2A8594A30F9123CDCAE61B285E91875BDD27510FEC10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721479, "uuid": "7eb15460-3d46-4ee3-b8ab-f214eff7a0d5", "value": "196608:kfrkKe0jszWCvs4IgKHAVBs+lk7gOHrHRkXE6DSTUE3/5U76IcRgenO:kDkK21vuTHAVBs37xHFoG/5arcRBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763721479, "uuid": "3aa6959d-7d68-411d-afc9-0abcc5802af1", "value": 10793701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763721479, "uuid": "8c030816-92a2-4e67-ae5b-7964d150e770", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763721479, "uuid": "64c4acc2-e8aa-46a1-89e8-9bd8e7657011", "value": "DockerDesktop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b755fc-c72c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765226, "uuid": "8e76a502-a735-44be-a49a-8fccc22fff16", "comment": "Malware payload (Mirai)", "value": "a5e72afdce25f3c044cfc9246534f226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765226, "uuid": "65eaed6e-cdf1-447f-a537-666548cf5e32", "comment": "Malware payload (Mirai)", "value": "bc4ad6f38f7322464d61ce98d3fb0c82a9ee8697ac245d54d191ea73025d285a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765226, "uuid": "c25b550e-15fa-4b09-b4c3-2d36718bc2d5", "comment": "Malware payload (Mirai)", "value": "cec3cac62827711e02f08e601f6ef67061df288e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765226, "uuid": "ac048f23-2ea3-4aba-8ce1-15c620df9b64", "comment": "Malware payload (Mirai)", "value": "dcef529327bc60d466d7bb6ecf60e52c66475a76cab295cb4567227ede1e79007356c3d85edbbe7ab18407da2bbafdd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765226, "uuid": "d41d2b23-8788-4d8a-8093-5b17f4a832f2", "value": "T18923E1876DDA0BD4547F00779C7B7A4E2D28E5088649F58B278801FEBE1EFCC6924386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765226, "uuid": "0ed97d40-53a0-45f7-b31d-31323dcbcdc7", "value": "768:LZ+A1ENhFI6vR8IxA5w777Flqqt05lf4vYZVFTxuhYRpyLxlC75a6EsVgnbcuyDc:N+A1OR8Ixbv7FlM5kaxmipMC9a6EZnoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765226, "uuid": "e6ad8322-b6d2-4d6c-869f-42f2ae262213", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765226, "uuid": "4c0fc795-907a-4933-9dc8-1b06e05f9b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765226, "uuid": "84af7b05-d8d3-4181-bf94-987ca88e2e6e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ffb127-c6bb-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763716786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716786, "uuid": "86a4ad05-ea1e-46c5-8142-a3194b0e4b74", "comment": "Malware payload (ConnectWise)", "value": "a08c5c62472189b769fdf5127b22e30f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716786, "uuid": "3d0aa449-5b41-482f-909c-74be8c4cffb3", "comment": "Malware payload (ConnectWise)", "value": "be22baf679b34a7ddbcbe6662ff42d70a667ce99b2792f2c715d91071309d069", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716786, "uuid": "a6503297-5aa9-4a0e-9b76-b46a686d430d", "comment": "Malware payload (ConnectWise)", "value": "33b02b1474ed038ff84218ae35f2f306af44b7b3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763716786, "uuid": "35c5fe3b-9cc8-4ff6-a6cd-6c27e3734a8a", "comment": "Malware payload (ConnectWise)", "value": "3313cdc41e233872a0445953e93e54bcd3191d39ec971f8b7de5a4c5815c569327bdc37e8c053d3a9f1e6494fac6f26c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716786, "uuid": "958db12d-f1a3-4fd3-9b15-0a8180da76d4", "value": "T1AC41742FF905E7399F42C27691E25C2D9F9102160400C4F4B6ED842CEB28A31EBB91D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716786, "uuid": "5dd18518-82d5-4978-9e0e-589c5eec78e6", "value": "48:e6NETob0vknIPOCcHyOz+BDzZOQgqWWAjUFP:DiobzIPSJNq1ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763716786, "uuid": "ea357925-068f-488d-9164-1ddd3ff5d2b2", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763716786, "uuid": "3aa06e07-fa1f-4264-83b9-89109269a4bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763716786, "uuid": "7f728448-38a7-4b88-aaf6-490d9525c9d3", "value": "ZoomWorkspace.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b245b4-c6f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1763742126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742126, "uuid": "5ef61114-a4a3-48d5-86e5-1641f12c1457", "comment": "Malware payload (Kamasers)", "value": "cdedd76616c33421bd485fc532bb464a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742126, "uuid": "328c19e1-3af5-473a-8149-db2653a3a471", "comment": "Malware payload (Kamasers)", "value": "bf3099dce6b26d2ce908fcf7e4ab957f1904181daa74715e6f18993996a2a1cd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742126, "uuid": "f3c7da43-8592-4fda-a855-f8bcee800169", "comment": "Malware payload (Kamasers)", "value": "6c6eec0a245d55f3f5d5cccd53c647322a885041", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742126, "uuid": "baf41300-73e0-4c68-b72d-1a91f8b2c1ef", "comment": "Malware payload (Kamasers)", "value": "a02c758bded4def7f8e1e4af588eb01f4907207a7ac53f8d558a6b4d862944923eb1619dcd61cdad8ab204535cf93581", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742126, "uuid": "db8bdd9e-ffc7-4eef-8c28-2960ad400fb5", "value": "T1EF65238667D42012D4A533F158F382574A31BC416BAAA2EF22B2F1295DB3ED3DC7074E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742126, "uuid": "b74cdbe2-02f7-49a2-b616-03c19259cc9d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742126, "uuid": "0353a343-1353-46e4-98c3-d475d85965c2", "value": "24576:Mj3yLZANQSAsAgL53q44sZ/E5gOywpOGozeo+kMW18sX1XDgKlH7gaaK8dS6V7oa:MjCNAeql4gxmwWw1XDggbgahLa5HP/y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742126, "uuid": "8a126771-6bae-4318-a995-fbfe6026a862", "value": 1540208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742126, "uuid": "778f9712-ce30-460c-bb86-9084147ae960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742126, "uuid": "12cf6d30-41e3-4f80-81e4-6b4eabefc97d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caae51c-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715906, "uuid": "4a19d08b-ec2b-4bce-a461-e7cd5e02da27", "comment": "Malware payload", "value": "67bbd31218078e475b4785aec4bb523f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715906, "uuid": "e176e2aa-5f26-4b33-ac30-3cee7b9b5fdb", "comment": "Malware payload", "value": "bf75d8babb8f1a50e24c7815606a8633336220b0eb7b4d025723869cd69ab4e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715906, "uuid": "45944b07-d918-4cbe-ae1f-be784bc75601", "comment": "Malware payload", "value": "e82edc95de5c45a8266ba704bdc55e6e6523e824", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715906, "uuid": "d8a926b5-970a-4b5b-8d3a-d63056db6b4c", "comment": "Malware payload", "value": "7a054e31f6a6dc92b7f8e9aeeb9dcb43ab6bde1f589e18976f86c58b772cabefd89eb31a9a0508b0ac0e4d6dd9d98bc6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715906, "uuid": "e13ca384-c4d0-456f-8a69-d797e5c652c8", "value": "T12918235A6AA5D847DD5F853884D5C1CB90882F584982F06F676C338426BBF983F13CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715906, "uuid": "2489b0e7-7967-4ab3-a72e-a701cd7d71ce", "value": "1572864:iiBWks//RZROR8RwLRrKvktuLuhDFTwrRRu8l+2jhhqWpDLxzlrto+nLbbdVgcfN:iuj0E1KvktuShhTyeI9NZNnLVVgciQtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715906, "uuid": "d7ffc190-6c24-42af-ad08-97b4b297db6c", "value": 91485480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715906, "uuid": "f986b191-cc82-47e9-b4fc-bbd21035b7bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715906, "uuid": "783ea133-b103-4e7b-b9fa-d3bcb134311c", "value": "DNMZONE60FPSZ.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0077573-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732421, "uuid": "6cbcb9c8-2b1d-457b-bbea-baaf8e5c818c", "comment": "Malware payload (Mirai)", "value": "1bdcee55cc642bb1dd5f3ba7886c74ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732421, "uuid": "4be25019-c443-44b6-b2d5-8497c2a6f58a", "comment": "Malware payload (Mirai)", "value": "bfb71d36eb179e2e7fe16888affac1844671402677d6a068ff495714a8181a0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732421, "uuid": "cf1b1381-c379-4c90-ae39-8b00e8433a6a", "comment": "Malware payload (Mirai)", "value": "f0a900d60603db30a28dde328c3ddd5db21d29b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732421, "uuid": "751ddd2a-1150-4809-a14d-b51ac3c056dc", "comment": "Malware payload (Mirai)", "value": "6e6756725710d15b03a3c051655e830f40fa48da0a49e03dce391b06cfe5223d1d950484682dd88d356d34a061758826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732421, "uuid": "7448ef47-32fc-4f39-b9d4-773c72b05655", "value": "T1EC83129DAEC74889C4937B34039941AC5F827FBB5A7792A4A30A0FDC70BB5C66191643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732421, "uuid": "eff59773-dddc-4ac2-b6eb-ceb02d29bc8e", "value": "1536:ORYYnVtzxhIIYaMSxX1WSsx4JRCAIYRO0l+uJiyYSmstKtWRhxhx:0z5fMSxFWSjJRC3YBl31YJstSWRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732421, "uuid": "9c20dc6c-c217-4145-bc01-3fa1e684cf36", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732421, "uuid": "093bf346-bd8f-497c-99de-1f987df2f609", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732421, "uuid": "2caf4919-b695-4120-af8c-54e653d36c4b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4c5574-c6cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763725437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725437, "uuid": "9e4ac3f3-64b7-458e-8c9e-4c30ff376952", "comment": "Malware payload (Mirai)", "value": "a28e30787ff94e82ea09d2eb8638f3e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725437, "uuid": "398ac233-ff92-4a48-bcd8-275c8a180edb", "comment": "Malware payload (Mirai)", "value": "c0168286fcd39abea1d7053817e97a567945677d0197d2cf3e26a821fcf84611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725437, "uuid": "a44f8f06-afe2-421c-b8ed-27eedb7a98f4", "comment": "Malware payload (Mirai)", "value": "f2be8d31740b511dcb545cb562ec9db3543b3f16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763725437, "uuid": "39e1d288-ccb4-4ffe-8b7a-fede451ce7aa", "comment": "Malware payload (Mirai)", "value": "2a58b448a04942c97aaa85775a8491d85ddba89de012199016ea15fcbe45224efbeba05fcabe89a169f9dedfbc660667", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725437, "uuid": "b0bcccbf-1a2f-446f-9944-6b13053fcbb3", "value": "T13F23F27DA4410DEFD169C5BD669043B33AE0DB827002F94A37A8DA07D7862AD78E36C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725437, "uuid": "bedfeb97-a442-4b21-97fc-3a6c4be435f0", "value": "768:XALqhKJwMX50IloFLQtAl/IOyNG+CfRNjw/M2C5h6KgmEc1Jvegwaj8kjJgGlzDe:XQBhXyISFEgwOyc+8KU76K3rHwAzVJuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763725437, "uuid": "59d41a83-1971-4428-88e8-fdcc8fe2cc22", "value": 48512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763725437, "uuid": "01ce164c-cd46-4ac6-b95e-a50a283dcf55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763725437, "uuid": "411bd33d-b17b-4434-97c0-1ee3170142cf", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a647c678-c6f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1763742739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742739, "uuid": "b0b28d5d-0db6-4de1-99ac-59fa8c554808", "comment": "Malware payload (Blackmoon)", "value": "32fb3b6283e7c7dfe7b5a7cb0ddf3b72", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742739, "uuid": "8040ba00-4e93-4bbc-8241-fd7511eaf641", "comment": "Malware payload (Blackmoon)", "value": "c0ce182f817764ed212bbccc03ce5dee13b5cb492748e0a0434b4b2db3ebfe1f", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742739, "uuid": "a975621f-17fe-4119-8f68-da5f7358080d", "comment": "Malware payload (Blackmoon)", "value": "c2c16d3bdc5d8630bc79a407dfced99188493a1e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763742739, "uuid": "0499f7b5-5309-4ca5-8627-950062a9f31f", "comment": "Malware payload (Blackmoon)", "value": "eaf1a55f1acdf644aafb97e8d53a59f70f5dc270d354f9aa61b8c452f82e95516f806d265ea702c047700ca6171f7b99", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742739, "uuid": "db36a9ac-c617-4e5b-8e22-fa7e597682cb", "value": "T1B52733578A9A0D7CF3EA983040EB05D6396FB3BB1F689C074ACD39C8DFA904964D1653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742739, "uuid": "059a3070-b123-4a41-9f16-16cdcb1c6e75", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742739, "uuid": "dacde571-173c-4aa6-a289-f088ab1d61c7", "value": "393216:TzB2Bngh/DMDErC9u5pW9x+tVIJVWeQXYWw1WXVQQnVfCrdy2/2CmH:Tzrhpb5p9tVIb3S16r12NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763742739, "uuid": "75144527-594f-4d19-b9a2-8729b27ae7c8", "value": 20585464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763742739, "uuid": "290dd177-ebb0-4118-a6b7-32cdb0a67297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763742739, "uuid": "7467d0de-6ad6-4168-a826-551b7a6350e8", "value": "c0ce182f817764ed212bbccc03ce5dee13b5cb492748e0a0434b4b2db3ebfe1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03afa131-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703812, "uuid": "f6bad2ad-4070-4500-aa99-57b372a0c25b", "comment": "Malware payload (Mirai)", "value": "2ab1dc2eee551c6b743ef3d693afcf8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703812, "uuid": "a6c1b3e7-bc80-4c43-9abf-766ad5fcdc30", "comment": "Malware payload (Mirai)", "value": "c1ff927bca70a2d9909aeed5547366f6644950fe9eda4fa7530072082b10860c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703812, "uuid": "dfde28f9-cb72-400e-8ea9-7e24257ed4b7", "comment": "Malware payload (Mirai)", "value": "dcdf206a189e79a09c44154deb80eec49f5e224e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703812, "uuid": "e3b252e5-470c-427e-a540-f7950cc2d2de", "comment": "Malware payload (Mirai)", "value": "1112bf14d75c4fd75649957a36f9b460947e8e6a68f9d2ca38cdaba621b5a342ad10609dd2e4f734a84311778a4520de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703812, "uuid": "c4109905-b285-4a1f-a53a-86c13ee5ead9", "value": "T1A324F81CF4508B7AC7C1217AFB55428933734F68EBEA730589396B387BDAA255D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703812, "uuid": "f065304e-3bd6-4b75-b725-3c1a58057923", "value": "6144:7892pG07ZIgM4akHibridGkk0KE6KZn7Gg:4kTD/HiPQAvIn7Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703812, "uuid": "fa4e7ad4-61d1-479a-9120-a1610af0e59b", "value": 216548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703812, "uuid": "6ab6e75f-2026-424b-99ab-22868c5da357", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703812, "uuid": "7584e9e2-4e34-45ca-805c-2682cf87adc9", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a0aea7-c6c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763719727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763719727, "uuid": "efeebfb1-6485-467d-bb64-0a1187b1ed87", "comment": "Malware payload (Formbook)", "value": "0fc13eac1adde3cb216fbc3b8d37e9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763719727, "uuid": "813d62dc-a41b-4419-8a65-ffb5a96d5255", "comment": "Malware payload (Formbook)", "value": "c226b60282dc9109c47e3aecce0b90449743f74f2a53d1cd72074a7b766ae2b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763719727, "uuid": "41144df7-4575-4c2a-9e5b-7f2e634e2512", "comment": "Malware payload (Formbook)", "value": "8f06efea8fcee7888b2edd18990a6d9c874b500e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763719727, "uuid": "95cd2a31-232f-4855-b40c-34111a421c04", "comment": "Malware payload (Formbook)", "value": "b1cdffbaad8b764b7a70c760d7af38a2c2eefdc4dab95aef8933183465bb3a97864c3e82e1fd402069196e0385d86f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763719727, "uuid": "095f0891-05b5-4562-866f-de2bfa68621e", "value": "T169E422A1A0B8CC22EEA13731627BDF9052667E31CE495F6F1785F25D687134318A363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763719727, "uuid": "c4e21c30-33eb-455f-b3c3-be00946faaff", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763719727, "uuid": "7ebfdae2-de9d-4a66-8df7-3509b54619d3", "value": "12288:BOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi1OdSLkHFIQtoaPrTfZ2PogmpqjimA:Bq5TfcdHj4fmbALMI6nngPvmUmIvqWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763719727, "uuid": "49bfe771-1adf-49b8-9c70-c0af2014d329", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763719727, "uuid": "cd581ccc-7bc5-4995-a4f9-84435c97216a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763719727, "uuid": "2f7b0b7a-c717-4ad6-9145-1a5d84000840", "value": "TT 100.574 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7d43e9-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763714185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714185, "uuid": "f133a905-1749-4e45-a95d-4ca152f97da4", "comment": "Malware payload", "value": "07fe6d719b20a9bc48f19dc668cbf545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714185, "uuid": "fd850e86-032e-4403-ae84-97aabf843b2e", "comment": "Malware payload", "value": "c29adf79264f40c9fb6acb1d9dac6b40d416918314460dfe1cddbfde705d2f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714185, "uuid": "ba4721f7-c8f8-4501-b32f-e3fd967edcd8", "comment": "Malware payload", "value": "615f2675b939f95ccee31a87666d73b3c2b9a666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714185, "uuid": "2a07e567-0960-4be9-9cfd-4ab48c8a3c19", "comment": "Malware payload", "value": "011834eb02a23815f174bc6213cf4ac9f24cafa9af664378624e2e5dcbe39cca4110053e215c97aa41e976895bd4d8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714185, "uuid": "9ad1f545-3e9b-46bf-85c6-75fd6be96486", "value": "T1BFC6BF56E2F900E8D9BBC0B8C6575517EBB1345517309BEB52A08A692F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714185, "uuid": "828465dc-9e23-4ef4-8bac-bfdb4d816735", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714185, "uuid": "7cf33773-b086-464d-aab9-e69b09cb62f9", "value": "196608:xKx5ZkerI1dc9irWBGFGJ+UII4kQ7tSwEG:xKxapWfkxI4kQ0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714185, "uuid": "28d47f1f-3a5b-4fcf-b2f4-e301e5b248df", "value": 11526138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714185, "uuid": "66a48e96-9708-4bd5-a12c-c86d1ca1450d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714185, "uuid": "0db4cdd6-5a4a-42d7-ac36-b67633c79100", "value": "SecuriteInfo.com.Trojan.GenericKD.77843383.29540.29424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90639cf4-c732-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763768043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768043, "uuid": "a7afe1ad-8a76-4572-9649-47c291d86b37", "comment": "Malware payload (Mirai)", "value": "df590411c533fad0872da7a213b7e271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768043, "uuid": "2bb73b66-58a6-4d0d-87d9-663c944e5b01", "comment": "Malware payload (Mirai)", "value": "c2ffe399cde2e546f3b54b616a9e59b664a2742612a519199f6246b1ee4a53cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768043, "uuid": "2d32486a-4803-48c7-ac4f-aedc0d33ff37", "comment": "Malware payload (Mirai)", "value": "f45c5deba516995bf56b38b78c06c4d6b44257e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763768043, "uuid": "acf3df54-2720-4578-bcd7-188d3dcb7193", "comment": "Malware payload (Mirai)", "value": "41486e577597d3f8d3bb567f77c905fb1146934b8012d47cb2ab023f42d9e490b2b09e39be2abf550aff95283fa4850e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768043, "uuid": "48055f7e-5a8e-446a-8181-bbad427e5acb", "value": "T1D7934B92BD81D613C6C15277FB1D428C7B2753F8D3EA32038E225F61638A96B0E7B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768043, "uuid": "97c692ce-0b10-45c3-8681-b6fd7f3b84ad", "value": "1536:XoCgRizKJIlFyx3AaduMemeyrKHQ14NovS6em1:XZgRyj7a0pmeWbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763768043, "uuid": "171fecb8-9156-4492-a7a9-765b3cb4f35d", "value": 91540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763768043, "uuid": "8fb94fb5-700f-4909-95cb-169e7a20c45c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763768043, "uuid": "d6a3862c-988d-48ed-a959-163be0473c41", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62caeb6a-c6f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763740049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740049, "uuid": "977475d0-e348-4e28-a959-03a24367039b", "comment": "Malware payload (Mirai)", "value": "dd9d78974c94b31c7b75b32b5b208523", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740049, "uuid": "82c37ef7-c429-4a24-bcff-feb86baa6445", "comment": "Malware payload (Mirai)", "value": "c533f5c224b031402b17f1aa88daef681d218b6e4e3270f90a57bb3f6d6730ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740049, "uuid": "aff44f8e-e766-4c24-97e7-663058cec315", "comment": "Malware payload (Mirai)", "value": "93e0f32b6c31c0feb7341cdb416171caa2a128d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740049, "uuid": "4066ba33-eab8-43c6-a11c-fedb83958276", "comment": "Malware payload (Mirai)", "value": "1bf6d2d3cba60eb3cfc1870fb383098ba219cc92ec6b54c59973c488a4d2dd75a610358a80a536707466cf7876f88710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740049, "uuid": "dcb0c219-8a74-4f6f-81cd-ba73feda5f0a", "value": "T1E2B31846F8824B22D5CB12BAFA2D518E331317E8E3DE72229E145F2173C766B0E77945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740049, "uuid": "adac804d-a349-4952-ab2d-b5005c23b0b6", "value": "3072:o0KcoQKFIp6TAZGSxzpa4dpZ+zqEwtd0Hn:XKcoJFIpgSx9aEvDEwUHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740049, "uuid": "66685d95-8336-42cb-88f6-11a691c9f518", "value": 116192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740049, "uuid": "89e251f4-68d7-4ba8-a978-53d0993dd033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740049, "uuid": "1b7131a9-fd6c-4d0d-851e-a15026f45461", "value": "SecuriteInfo.com.Linux.Siggen.9999.7193.11734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ab7d4d-c712-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1763754063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754063, "uuid": "7c7cfc7a-ebb2-4814-8bc0-466eb229ff2c", "comment": "Malware payload (Gh0stRAT)", "value": "1687226ec6bc6647062c91a4bc09b7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754063, "uuid": "1fe24551-c07f-45a8-a6dc-4284367038dd", "comment": "Malware payload (Gh0stRAT)", "value": "c60f79c9fd9432f493256c8c5aa794dd141f9480c3d4fe187e4c48ceaf79088f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754063, "uuid": "20c3c8b9-8f19-491f-8537-8295f8958ad2", "comment": "Malware payload (Gh0stRAT)", "value": "c36be149f2a8ca9c947c0e72964870bcdb176241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763754063, "uuid": "5df4557c-d053-45db-99f1-5c4f47093e67", "comment": "Malware payload (Gh0stRAT)", "value": "fe756a340b0afe27775e26e77ccf059537f00e11ac3a6ecc536c79a6cb9354197dcbc0a399ba2b1d300f0703d9d70bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754063, "uuid": "932f8a5a-2d2f-4144-9f6a-b9fe48ec13dc", "value": "T175D7331BE2CB603FE9AD47358927C2528937BB5068558C13AAEC781DDF711E01E2F61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754063, "uuid": "949bc77c-8c2a-4274-8038-d119933810b6", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754063, "uuid": "e50676fe-11f1-4f50-b7f9-1777efd117d0", "value": "1572864:9zMBWsDKHe06UlcD9L0ZNAoJZyZOGsb8rqzkw8l:58l26Uly9eZyZONb8rAkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763754063, "uuid": "b3d39a36-b8af-4953-9730-fb3638a432f7", "value": 60986872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763754063, "uuid": "943942b3-5885-4399-a942-d8393503ede0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763754063, "uuid": "a18f4c10-7d7b-41a3-a9ce-b18a4d5f7e49", "value": "PrimalVerse Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b655aba7-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765100, "uuid": "c623aa41-ef16-4a6e-ad34-0bba351cc03e", "comment": "Malware payload (Mirai)", "value": "a5b635f92b63c38537ce56f9a5d1bf71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765100, "uuid": "479bd94f-0d08-47e4-86e9-a3a133eccb20", "comment": "Malware payload (Mirai)", "value": "c7a6426b567cd168d6e1aa42e294100e1cc7a504354318bc29be46d5cb005e69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765100, "uuid": "1885387c-e89e-4bc6-a411-beb00cdbbf42", "comment": "Malware payload (Mirai)", "value": "f56fdd2c8386db45b095d645fe09375de2d75c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765100, "uuid": "f167266a-06df-4936-9cd7-a45d06bbf656", "comment": "Malware payload (Mirai)", "value": "d83ad781f84647d09bd3ea732ac69650edb9422c76d6de4422e947a6881ad5e9734405b48a65bcc3feb3de4dcd850145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765100, "uuid": "24967920-5ec3-453c-9c8e-c6fa255406fc", "value": "T11104881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765100, "uuid": "9e7c0bc3-c496-451b-9f4f-4b2625332809", "value": "3072:jg57Rj7LHZwbq1YSBan1yvbysxr1uGSpI:jglRj7LHZ0Bqyy1BSpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765100, "uuid": "b5315410-9b65-4920-92ac-552eb28e6ff7", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765100, "uuid": "93343a12-a136-4876-b0f2-14ea0b981b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765100, "uuid": "6e09cd8c-6860-4e46-8d2c-1f8d3d75c52e", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819d8031-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732799, "uuid": "32e796d2-5f53-4ac2-8a1f-9c8959b25027", "comment": "Malware payload (Mirai)", "value": "2ee839fbb1146230fe0d581ced2f4fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732799, "uuid": "545cfd05-2784-43d8-b646-d2968d0d6b8d", "comment": "Malware payload (Mirai)", "value": "c7d5e336a0f5ec4380b61d161446f39e6796322b8cf91f454cc24f9324453af8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732799, "uuid": "145bfa1b-24ed-49b2-9f8c-c15981027ebd", "comment": "Malware payload (Mirai)", "value": "f5a41211a522ab6c292cd36dcadd7a4118f457bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732799, "uuid": "53f39361-95c0-4b78-a25a-993e5c79f8b7", "comment": "Malware payload (Mirai)", "value": "ca22d5e589f78a5e4455e6ba440f2c508d43f525e720e2562a504a796e51cff2ef435595d67ce6888946378e0c21c0b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732799, "uuid": "6ffd0fa4-1417-4905-a470-8f83298ee753", "value": "T1ECC3120AE1531B95D083CF3DFF11B77A92092AA790DB424CB9D46646B3938C9C8ED0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732799, "uuid": "cd809f0d-a17a-4ab8-a4ad-93872bd04f1b", "value": "3072:5AXMiE0fVoryJf+zWm00VI5U1uxa7OhURpmJl:md9fVormfU9jW+Yxa7OhU4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732799, "uuid": "2ad4965c-9f48-4e92-bd53-fae250607549", "value": 121204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732799, "uuid": "ab253e43-6624-47a2-a6fe-8cfd052d4cb0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732799, "uuid": "2ce758d3-8c13-448a-8eec-20833236ea4e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b141d28-c6c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763718883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763718883, "uuid": "020f56c0-8ca6-4bd3-887f-c79dd9ed9154", "comment": "Malware payload (Formbook)", "value": "1b129eba4bef24231fef0fd48cd55c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763718883, "uuid": "a1f23876-918d-4b5f-8404-1aa1379bd3a8", "comment": "Malware payload (Formbook)", "value": "c7ec184357047289d78a998bb3b8d00a4e22b2caf69d546cd0e62ae2a5addcde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763718883, "uuid": "20a62981-e866-484d-bd28-1261169b5a1b", "comment": "Malware payload (Formbook)", "value": "21e37c1f122b8910b34b057ab45198f3048fe88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763718883, "uuid": "53e7160f-4f95-478f-a5d0-2011a9e625c7", "comment": "Malware payload (Formbook)", "value": "be19a999cd441ccedc6e3e44b23a80201ded4cead10fd33ad5abc90b4a5a7362fdc12e2ff16b7df9453f1d74d31f4a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763718883, "uuid": "ea793290-251f-4b15-9f14-27e1d1b97022", "value": "T18E45CF1373DE8361C3B25273BA25B741AE7F782506A1F56B2FD8093DF920162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763718883, "uuid": "37a5d84d-a19f-4e00-8b27-74258a47b703", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763718883, "uuid": "c08a9b02-0577-49cd-847f-fb25a03a0d0d", "value": "24576:Wtb20pkaCqT5TBWgNQ7aULo7u9RcBk7LkQ6A:DVg5tQ7aUM0RcBk3p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763718883, "uuid": "c5a95edd-12c4-4aba-b665-f184dd876cca", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763718883, "uuid": "58a3dba0-ac87-4c6c-a0f6-5cc8b60dc18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763718883, "uuid": "2b8bbcbd-a8ed-425f-a621-0da93558905e", "value": "New Order 8125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9e88f9-c6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763727239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727239, "uuid": "81c3e7fb-c638-43e7-836d-0357ac4166f6", "comment": "Malware payload (Mirai)", "value": "42c112e69e256e0626ae8f890acf74a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727239, "uuid": "a638ad84-3a29-4e94-bb8d-88c75f5d3b8d", "comment": "Malware payload (Mirai)", "value": "c84fc1cce021b6b728f885a955cef307fcd2de6022d51f87bd7ef6b9775e07b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727239, "uuid": "47c3c151-1ad6-4f6f-b7cf-d6a71b0de84f", "comment": "Malware payload (Mirai)", "value": "5c766c22f4f3e2627f7028640df59303f10f53b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727239, "uuid": "cf49bea7-667f-495a-881f-e2653c762a14", "comment": "Malware payload (Mirai)", "value": "1c1edb9797747ea2faa661551d5685e70156a23eb46f2036862eb40191590dfb57081ecacee675af8c002baa028f06f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727239, "uuid": "2b57bd1b-abfc-4964-962b-2f1a62ef5586", "value": "T10313E066ECA50AB1CFDF1E689E06C098BAB6099DF781CC4670C5CB42C75791B7B15CE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727239, "uuid": "ffa2b070-a095-4937-ba14-d88f0897676c", "value": "768:MHjvUw1Pv12iR39ieCs9iFOKDqKoTebcDOc9JtNnNZCQ4uVcqgw09g:ajvUkPx39ifs9m2o2TtNNQQ4u+qgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763727239, "uuid": "4957a32d-62dd-4044-bcaf-f370882ea30b", "value": 45252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763727239, "uuid": "c4586ff3-ec6b-49aa-811b-c235127b835d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727239, "uuid": "d114e7ac-01ce-4b74-974d-4b8e529b7012", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e469f0d3-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703759, "uuid": "67b55026-38a2-467a-a35c-a747aef68f5c", "comment": "Malware payload (Mirai)", "value": "68342df728bdf68e5c26c7df8b14ad3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703759, "uuid": "41a1c874-0dd4-47e7-aa6e-c14bfc2a9e40", "comment": "Malware payload (Mirai)", "value": "c8b144a3be62d5d8926b62ddde7d28fb8ae32b418a46f400f1f9e392520cf5e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703759, "uuid": "7acdd206-d682-4bc8-a4d4-c0394b25e4cf", "comment": "Malware payload (Mirai)", "value": "4988ee063ff49b50652ab0d854cbf5a030f22b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703759, "uuid": "bb2079a6-3329-4ac5-ac24-5459986983ff", "comment": "Malware payload (Mirai)", "value": "effa646398b98567a2a2b01ee45699232a24ba6766a93e4fef8e710906340b78fa8b6c5f407d53512c0dacf515188947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703759, "uuid": "12920f41-7467-4a96-bdd0-13f631421d95", "value": "T1207302EB89CDC176D067FF348C5883D5EA10328B209D24742D4849AFE7D0996ABE4D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703759, "uuid": "8b3dc5e2-c237-4de1-b0ee-8b551b2637dc", "value": "1536:EoC0v4FvUKPwHvBDEMOkLSCjUNXZa1gIy4eXRX1i/X7NMzI71lR:dgFvUKPwHJD7rjZgIleXx1SDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703759, "uuid": "376ad077-a0af-48cb-8ae6-ddc5795977cf", "value": 77776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703759, "uuid": "4db17f28-fe12-4ea9-96f8-cc4230abc0a4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703759, "uuid": "1dccad15-4697-437a-858f-7b5f7543e340", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758841d0-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765850, "uuid": "747c96cd-5b92-42a5-bce1-e41ec31bc13c", "comment": "Malware payload (Mirai)", "value": "e23bcf710ac1bf5390e3de018aa9ec92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765850, "uuid": "f3b2bf32-623b-4fca-8e1b-26927814ba88", "comment": "Malware payload (Mirai)", "value": "c8b2489169a78d3fd3b2e2031f9abad0b88cb55a8bb53f1bd8f100c167278620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765850, "uuid": "70945323-e09f-4807-a6b7-73130691bf35", "comment": "Malware payload (Mirai)", "value": "98c0d63168e8fe60b611e49dd2b33f18f8a8acc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765850, "uuid": "ac2e88ec-208d-4336-9875-73cc6acbb65e", "comment": "Malware payload (Mirai)", "value": "b3841ef4bfbf01f69f366a984f4cd46d2a0e203cb964e7473597b903a4c2774db9a876430c767c78410ad751d95b95a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765850, "uuid": "4e691bb0-7703-4e36-b0bb-1ec13da5b383", "value": "T182E3F809BF610FF7E89FCC3705E91B0528CD556732A93B36B634D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765850, "uuid": "98e1b4f9-36a8-4dbf-8267-1a215a287d4c", "value": "3072:q/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSncBoyJi6ts1uYa0:q/IWWosd4Bi3u7KGzJtcMae10lJicBbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765850, "uuid": "8fcc78cc-59c8-4684-9e7c-27396af6eebc", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765850, "uuid": "85653ff2-0ba2-4c02-8753-f0ee6eba9040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765850, "uuid": "dd61994c-ad27-4cdd-afc0-0c322b71b072", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c28f02-c731-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763767775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767775, "uuid": "ff7b2e67-0ade-4141-9613-32db1c2e585c", "comment": "Malware payload", "value": "c7aaa50a3062f2a1eae694da56f8d219", "object_relation": "md5", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767775, "uuid": "97ff3073-09ca-47f5-b9e7-88a4d34a3bfe", "comment": "Malware payload", "value": "c8babcbe1d8e441c1bea941187b18dadf39b4d98dad389af66629c29cb626688", "object_relation": "sha256", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767775, "uuid": "5c542a28-0e02-48be-afd4-642f4b17a79c", "comment": "Malware payload", "value": "73fa749178310d10d403bcb5db595a4c1ac02217", "object_relation": "sha1", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767775, "uuid": "ef878213-5fbc-4136-87ea-a33c1ff714a3", "comment": "Malware payload", "value": "efb674c2ea805bbc5e9d6afb32b669b66945aa87b4a6a81f183a224d5b56121dbf4ea52311e0296f5706d998827e2c17", "object_relation": "sha3-384", "Tag": [ { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767775, "uuid": "9bdcb1d5-ac7a-4672-bffa-a420d0bb9db5", "value": "T1FE566D0A7C9146BEC06A93368AA3DD917732B8440B3393D71A51A67FEF76EC8C935314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767775, "uuid": "3c7be033-6fc2-45eb-88c4-3b75555480b9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767775, "uuid": "698fb9c0-adfc-409a-9a67-0e3c088fab76", "value": "24576:OmceqgQwhivXjXsjKbqBJQZsEUYj/CPvLyzfMXjVvqZ0TGEzbku:OmtqgQG2zakj/ObBvq2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763767775, "uuid": "e53da0f8-26e2-4855-879c-32f816f72381", "value": 6384784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763767775, "uuid": "c9f28341-e9df-45ae-b35c-6551f62184a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767775, "uuid": "284a36df-b58e-4391-8c55-967557c324c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589789a1-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763732301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732301, "uuid": "3e236dab-e4da-471a-9384-3c6a476390f4", "comment": "Malware payload", "value": "f9be4d6f77f12af170099777706f03b2", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732301, "uuid": "d24e0773-e651-4b6d-a0b7-289f031b6ce3", "comment": "Malware payload", "value": "c8eee9e4537d7695ca60723f92647d182e842f91e78eefcf0bb156dac4145915", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732301, "uuid": "d1f19722-8a56-4908-b97b-f643dff5b9c8", "comment": "Malware payload", "value": "bf6e8a58d949251421c1d2d1fbf35b33dc5f9551", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732301, "uuid": "d5eca5e9-807e-4c44-86c1-b140b15a8271", "comment": "Malware payload", "value": "c60b2dff6d812f264f84cc5fda89c3eeaa14da9ffa6a6f0ba0c113b3c60acf79c8b9f79afb6343572536c9a7cbc85d56", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732301, "uuid": "1330c155-2d06-48d0-ae84-017aae6fa423", "value": "T1CD014E6CD1EC9F5008F5C6C6B1F84248C491808751F467D5F34E09166F28EDD7C9320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732301, "uuid": "429e0af1-ef8b-4b63-9e58-f17b9d0dfbec", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+rDjInkC01lkC0F70/GrZhG+E6:FH8j/wWi2jz3XIkT1STR0/GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732301, "uuid": "5693a004-2562-4809-9564-1c1aeb264860", "value": 720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732301, "uuid": "271af28f-9a61-4af5-b0e6-592b579d896f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732301, "uuid": "433c7046-5573-40f1-ac11-bc83e67755b6", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e510353c-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703760, "uuid": "a3d4a952-c0dd-4377-a4a3-9ba5b1c009eb", "comment": "Malware payload (Mirai)", "value": "8f091de24df287063c81104fe6747cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703760, "uuid": "264c9d40-1a96-4c80-8a79-a72e69796a9c", "comment": "Malware payload (Mirai)", "value": "c9e46cbc51056a78044f4dd808e7c7d47fd176897f2ca82d6cb04b80c35fed43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703760, "uuid": "fa59f812-2296-4bc6-a6a7-804e7285156c", "comment": "Malware payload (Mirai)", "value": "ffcd2fc31c82e42d5afbe25c8d53725930e1ea7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703760, "uuid": "81c69856-838c-4ee4-8471-debda16d6866", "comment": "Malware payload (Mirai)", "value": "74a4e82ced21117b6aad029fd464fbcc7709f8511ade380d6ed7da730977b20ebe5f937c7494524fd6035f8d6632d52a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703760, "uuid": "c20debc8-c9c6-4e2e-a5d3-005dc9b22254", "value": "T1419312506A35BB00C26169F4D09BCA7A574F4EE11A23DA0ED8EC7589D80F6F2C61636F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703760, "uuid": "f38b21fc-0875-4ed5-9a63-a045d121720a", "value": "1536:vmU1Zh24xcfqnkC4VVIxYE6FQP0FtsKZwYu6PbAie3feg21FyGRHaytF+DBlbbXm:vmcVC2kC4HIxYLaP8tsKZwYuWUNveH1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703760, "uuid": "2d7a67ac-5f34-4f31-a6a9-8cc080e8ad06", "value": 95680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703760, "uuid": "481fc932-542b-416a-ace0-37929ca95120", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703760, "uuid": "7df016ec-bb86-4d4b-be67-946d064797e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc78c899-c6e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763736441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763736441, "uuid": "f5487370-2f0b-4d06-b331-e7d88d7ef9b8", "comment": "Malware payload (Mirai)", "value": "616f65d63cdf42ce689baaa1394870c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763736441, "uuid": "eed774a5-b609-4974-8c9e-fbc7f421b59e", "comment": "Malware payload (Mirai)", "value": "ca2c8b3baeca6f0f7802440a483e6c67a8f40a5d3d8d80199feff7149fca5891", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763736441, "uuid": "7c0753f9-e8a7-4e46-b882-57cc295dc0e3", "comment": "Malware payload (Mirai)", "value": "a7d197596d86afe9b5f76df1d90470acd3422f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763736441, "uuid": "0621841e-5247-48e2-846e-58f403fbc1a7", "comment": "Malware payload (Mirai)", "value": "b192110d7f9d48e8200df62c9d960059b2a1a917bffbc2648b8dc7a1da91bed30510ce16835df5359d25a07983c3ec0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763736441, "uuid": "7c33407e-bd12-44b9-8392-cd74cd7a3f38", "value": "T19F146C92BA6E3D7AD7630F3FC54347547F3CAF424A012527A0AE628719BB6914F17309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763736441, "uuid": "01b73515-4a32-4c81-8cd2-3a0d03cf16d3", "value": "3072:X+7ZNXht0xgtBCLVB35CUYnvUas4/Weo+xgS5vAeLfSt:uXhqxgeLzpCPvUaP/W/6gStAe7St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763736441, "uuid": "8f0e0fb6-2144-487a-a404-f46a47243d5d", "value": 200884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763736441, "uuid": "be7dcc57-f3b8-4b2f-bfa2-68a3a13e8946", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763736441, "uuid": "39e1739e-2f9c-4f4f-903f-14a44a004305", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ad7502-c67b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763689400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689400, "uuid": "66ab80c9-93cb-4abd-ad83-c23fe485d862", "comment": "Malware payload (Mirai)", "value": "f3a63ed0cb9b03543ac1b317cafd9f2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689400, "uuid": "78637f29-7f4e-4546-be4f-923bbb2274dd", "comment": "Malware payload (Mirai)", "value": "cb5cb45cdc5501f9b0c19f89bf048ee10066e901265ba61ff449323c89ec5a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689400, "uuid": "f9d8abc9-d38e-4dc5-89cb-53008d6cbbab", "comment": "Malware payload (Mirai)", "value": "6ba5f9fd2da427f4d3f47fb5f7551396ace8b1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763689400, "uuid": "11160275-01e4-4cbf-8cb0-e5a3b258cb6f", "comment": "Malware payload (Mirai)", "value": "11b7c7fc5f5d57fd6872f249b4514eec109cd482c404d9833b34cec91775e9289985428db00ba805bb3dc1e8b3424111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689400, "uuid": "c59f813d-06fa-4dd4-9b39-647e0a3b169a", "value": "T1DE63B60AEF654EBBDC6FCD3745A9070534CCA51B11A93B393974C828F65B50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689400, "uuid": "dbcf245c-b191-4890-8ac3-01cec6fc89f6", "value": "1536:I4EpeVpbximOnxrUcfiV4sZ1kbSB+PEOl4+jAD:I4EpeVpoocfhsOPl4+ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763689400, "uuid": "023686b1-8ab6-4fcb-a71f-76ad0a30d6eb", "value": 72492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763689400, "uuid": "fa467544-8ec4-4c9d-9de4-3529e735a212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763689400, "uuid": "54cda138-f02f-47ad-a88b-4d9276896edf", "value": "apeshitcrazy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0baac3-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714481, "uuid": "9a6ecfae-6829-4938-bfa4-5c0bf379371d", "comment": "Malware payload (Mirai)", "value": "6c19bca67293e86b38a2e3fdbb37f5e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714481, "uuid": "411f5ee4-fc0f-4b72-bfd3-c1685481bd0b", "comment": "Malware payload (Mirai)", "value": "cbe882628455e98b007d8c33ac513a3253ab876f1a2ae81403ce471fef0e0690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714481, "uuid": "e3fdb617-74be-44f3-9970-e61bd56d413c", "comment": "Malware payload (Mirai)", "value": "555309e0fa6f9cc6c75d1ee682412a9eebf2a27d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714481, "uuid": "1eec460a-19be-4e85-804b-e7c9922cda8c", "comment": "Malware payload (Mirai)", "value": "a8b7a06564a52adcfedeec994e5534cccc8fb4fff47688156d719d2dba335cfcb2557ec0be9c6a15c57c845dfa6b2adc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714481, "uuid": "f749220a-4db9-478e-947f-50618fba4ae1", "value": "T15A53024B238168299E67CAB2032161FF7F9BA34651296DC183E39F05E058809FFAC775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714481, "uuid": "3660619f-bad0-4168-8153-f66ee4484486", "value": "1536:SejcBUO6mUO15gdpV+2cHzsKnxA7VLkg4azH4r:JcYO15gHVbcTjy7VLGazHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714481, "uuid": "7874d728-8e06-41c4-a7e5-ab34483e81d0", "value": 64524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714481, "uuid": "112ef80b-26fd-4a55-a609-2105504a1b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714481, "uuid": "67484904-8673-4ff6-82ff-7033351d397f", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbc8277-c6ef-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763739047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739047, "uuid": "0b2807a7-028c-4a52-b06f-3c2f38acef67", "comment": "Malware payload (SalatStealer)", "value": "dd4806c82d0bfb822718bfcb15afe27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "Trojan.PWS.Salat", "colour": "#A82713", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739047, "uuid": "efdfaca3-1576-42a7-9d11-10d44072f21d", "comment": "Malware payload (SalatStealer)", "value": "cca4352a19245a6c93d62dcf35ed55d180c315a42ac48a3c9bb43860093335f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "Trojan.PWS.Salat", "colour": "#A82713", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739047, "uuid": "51e0c16d-9e1f-4c39-b58b-50ba10b1181f", "comment": "Malware payload (SalatStealer)", "value": "44fcf9eeb9512e55b343abfe4884dbb286830611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "Trojan.PWS.Salat", "colour": "#A82713", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739047, "uuid": "416d4fd2-b0ad-4693-b31b-11c9e2a68f85", "comment": "Malware payload (SalatStealer)", "value": "75c96df6dd3981104f8ad2790623334d9f58c5335ba6ae191b4b73ab86f2615d3ca934b493d464c2cf97ca358870fa7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "Trojan.PWS.Salat", "colour": "#A82713", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739047, "uuid": "4ffc7ec1-0422-4017-8837-2957afd417a8", "value": "T106E5335503DF1C8AC84F30B17F9E7FAE166E6818144407BFFA225445CD1AEBD209B69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739047, "uuid": "8c01011e-3395-46ef-8bed-a63fd6a87451", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739047, "uuid": "411755b9-e62d-4716-82e8-135324275a03", "value": "49152:F0JoBperVpQ5qrgZ4rjjFnvxTNlaDFV9H6TA4+ffu8YLiwSvVzTg/7sAVa:F0CJqy4rPFnpZlaH9H6ODwStnPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739047, "uuid": "edda225c-4b44-446d-89a0-da8d10fd6e9d", "value": 3292672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739047, "uuid": "980ef949-36ab-489c-877c-dca0e5d77a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739047, "uuid": "767ba960-369d-4cd3-86c0-cf5c4151e777", "value": "botchat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed1731b-c6f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763743103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743103, "uuid": "972a5b00-bcba-4bdb-85c5-054179d45189", "comment": "Malware payload (Mirai)", "value": "7bb3cdfe30d6029aaacea27736926f03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743103, "uuid": "92095b19-fcac-43a3-8b3b-7ecaec2b86ff", "comment": "Malware payload (Mirai)", "value": "cd6065cdba26f2bdeaeb5fb9e6304ca75fdf31675edfd39e453799f749427b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743103, "uuid": "2eb24778-290f-401f-afc3-f482391f417e", "comment": "Malware payload (Mirai)", "value": "5f17b72e3bb4d12830b4ca358c843288207814f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743103, "uuid": "c1ac6226-287c-40e5-9518-76d0ae967772", "comment": "Malware payload (Mirai)", "value": "2cc4f480a0035d273c29a175ad23ceecefd02cdd6a8447988b56ce151f678bc8ced27344b4e1884f5f79355b2a1814d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743103, "uuid": "c3524b8b-3357-40d0-aa55-58e6d5b5efcb", "value": "T13FD3E509BB621FF7D89FCC3B06E9170129CD549A21B93B767634D818F64B24B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743103, "uuid": "e37ce7cc-f5aa-4c71-8026-9d893fd4fcfc", "value": "3072:TM+dmT6faDa/f//GYF6qHyfvoRbAlFwT5T:TM+dmT6faDaf/tF5HyfvoGFw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743103, "uuid": "dfaa3c44-96ed-424c-b485-b3ef5ffed073", "value": 136508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743103, "uuid": "c89ce23e-769b-4cd4-a813-7d663bb11364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743103, "uuid": "acb3b21a-6c4a-47f6-a6b9-2d1339e8ab87", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d215aaa-c721-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763760521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760521, "uuid": "571ec643-b2dc-40b8-bf4a-01112a8d6aa0", "comment": "Malware payload (Mirai)", "value": "a9bce448194dd04964e22009977c8922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760521, "uuid": "6bf81162-7a83-456e-9caf-b37b4a748428", "comment": "Malware payload (Mirai)", "value": "ce21f83e3dfcb6285e3d448c4b2d13b17baccd72b59c197f4943f354a7f57081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760521, "uuid": "e274c6b4-788a-49d0-a201-a54233b61b97", "comment": "Malware payload (Mirai)", "value": "8abe51c6327ccda3651c8ecf5c373fec3c2866da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760521, "uuid": "f792c278-c38c-4708-9581-e988ed588812", "comment": "Malware payload (Mirai)", "value": "3282b023f614866d03249a6b682d73a8ae5b34ebde475f45e3d28a16ea88792a3efcdd7c4dac4e48985a2618d0f3cd5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760521, "uuid": "048367dc-b758-4a01-b1cb-fc906f6c67c0", "value": "T1F3D39EA7B3471591C86342F40BCB4BDD2AA322826F6B98E3BC2F753758760DB4506B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760521, "uuid": "2f90ccb9-e55e-4e91-b6ea-986842cdbff7", "value": "1536:ieLFxeg/54VHJmQvMblhaYeSsETlrM5tFlcQVuZxZJHtgS+N/LWl:ieLFkOmNvMblhR9syw5JhVuvtgS+Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760521, "uuid": "d0676f7c-ec27-4796-8d57-c093ffca3196", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760521, "uuid": "e8476808-48b4-46fc-88ee-663b47f4aec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760521, "uuid": "0339cc7f-6120-4e1b-9c83-83f47c6b33ef", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b324aa-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711227, "uuid": "93cb1342-804d-462e-9351-2384a6ca1f9f", "comment": "Malware payload (Mirai)", "value": "60b4c0421f11287d77498a4f2216bb7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711227, "uuid": "f87b4a45-698e-4ce2-a463-b1dbe99466c6", "comment": "Malware payload (Mirai)", "value": "ce92514c9762ef035eb725d9948059ef181482a287369cbd24821d7c6b2d358f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711227, "uuid": "fb3dfd3b-1c1f-4f93-a373-13cfa6d83e7f", "comment": "Malware payload (Mirai)", "value": "8de1f82f7ec2faa667f4a5ae25b68c1c2b6ef51f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711227, "uuid": "9e86ce72-8584-4c95-86f4-4be87b2188df", "comment": "Malware payload (Mirai)", "value": "512185eb5d39de6bcf0cc5e30e57a3b8760807b3d45ce0b6ae3ebdff64b3c0e9bb0dea9915dab3ff6b0f3eabff9a5e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711227, "uuid": "8faf71b9-5471-436a-9010-b449148e9cbf", "value": "T109732882F98781F1E407887199ABB33F9770D9145131DA29FF55ABBEE923B01661338C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711227, "uuid": "d15418a7-d2be-4c10-911f-a29bdbfa6b7c", "value": "1536:2Iz+Zjh/rFOSydt4xH9CsyUsOtBlW9VAyP3Ayk0WxVD:2ISTFx829CsyUsyK9ayoyl+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711227, "uuid": "934321c4-1eea-4315-9439-5be99ae9d5fa", "value": 79072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711227, "uuid": "d8a15119-6ce5-4512-9b13-b85bb3b906c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711227, "uuid": "4d4bc11f-1cf3-4572-bd4c-56fc62ef1439", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b819908-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715931, "uuid": "bcce92aa-66b7-41b7-bf33-c613861a3495", "comment": "Malware payload", "value": "17f1c6492e785f64f1a8ed2f4055677d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715931, "uuid": "c20d2cc0-7181-4f88-b451-f5c359f2c41a", "comment": "Malware payload", "value": "ced78925e9812c49be0a29bca1f03bcc4a6d7360faa965343737ce681c91003b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715931, "uuid": "50c89363-b880-47db-8ac8-c8972a4a8b56", "comment": "Malware payload", "value": "9743d463ea11c117bafcf3d99d983b0fb9e2e08e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715931, "uuid": "784bfd5f-c1fe-4abc-b030-186a1fcf38fd", "comment": "Malware payload", "value": "687daafe4a5d4796c771753c07fced71a244df92c53f7486be534d4bdd84a87cef52545cf09bd48962dfbffd4a48194f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715931, "uuid": "af95a212-d43a-49c7-aad9-4879a07474ae", "value": "T19236F14EFB5CBA2FC87F40321A5AD231225A4D158B82D7476944376CF8776E80F99BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715931, "uuid": "e3a4d8db-3d4e-414a-9ef7-717e2051b6b7", "value": "98304:T1mwe3T9V7Orwfdj6UA7p0ppOIrziweWppwStpD55ITYpsOySpLEVM3WpD53j/R:T1IVOrSdj6UA7p06IrfHbwSj93uxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715931, "uuid": "d404968e-2bd1-4e43-bfaa-2d5d2ec23124", "value": 5046426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715931, "uuid": "69f8cd15-a3c0-47df-bb61-16eba5216d2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715931, "uuid": "c0f12d01-9bb3-4ef9-9085-be1c8b46d10f", "value": "autenticacao-cartoes.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b99066-c688-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763694910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694910, "uuid": "7278cf16-0c2e-4265-8149-2d3d91901480", "comment": "Malware payload", "value": "62a3a075160d76d5b2bd4f5e8a4b7c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Supper", "colour": "#50FF0B", "exportable": true, "hide_tag": false }, { "name": "Vanilla Tempest", "colour": "#7B6CB8", "exportable": true, "hide_tag": false }, { "name": "Vice Society", "colour": "#6E4B1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694910, "uuid": "3beb610c-45a8-4155-8483-00ef7b85426b", "comment": "Malware payload", "value": "cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Supper", "colour": "#50FF0B", "exportable": true, "hide_tag": false }, { "name": "Vanilla Tempest", "colour": "#7B6CB8", "exportable": true, "hide_tag": false }, { "name": "Vice Society", "colour": "#6E4B1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694910, "uuid": "5c57114f-c692-49da-80d1-cf7fc7955122", "comment": "Malware payload", "value": "68cab971930753b21344cce0c2dffe8dbdc99102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Supper", "colour": "#50FF0B", "exportable": true, "hide_tag": false }, { "name": "Vanilla Tempest", "colour": "#7B6CB8", "exportable": true, "hide_tag": false }, { "name": "Vice Society", "colour": "#6E4B1A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694910, "uuid": "7d4c9258-2a96-48ba-bdec-cc689ed0e640", "comment": "Malware payload", "value": "d412952d357a61e8bed94f2cf9e9f471e456f576a0e4731cb403d4344a5e23a1574adb84049f24fa2bcef5d1ed75c864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Supper", "colour": "#50FF0B", "exportable": true, "hide_tag": false }, { "name": "Vanilla Tempest", "colour": "#7B6CB8", "exportable": true, "hide_tag": false }, { "name": "Vice Society", "colour": "#6E4B1A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694910, "uuid": "19c5a462-455c-4737-849b-a449f59f2ccf", "value": "T1FA543A2267B59041E277C07C5667EA13E273388A17DCF2AB5AECC74B3361547B68CB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694910, "uuid": "f18bb2f1-51ae-43d1-99eb-c2aaa62c221d", "value": "d1c007e42fe245e43f7b5bc298bf7b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694910, "uuid": "48b6a54e-af2a-4576-bb82-ea1d7b4b76f4", "value": "6144:0htV+rF1Ws/Nhj+IJAf8VMIMa+nOmSyT26YFKykJ:63+rFFFAf4MNa+notC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694910, "uuid": "c3fb63f5-8923-4dd7-b25a-f686e7f855d6", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694910, "uuid": "d7c7861a-4bc2-41fa-a4a6-b79b791a4b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694910, "uuid": "ec156c62-7ee1-447e-b71d-e040fb888134", "value": "supper.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7860cf-c69c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703508, "uuid": "0c6771cd-e25f-4cbc-8e48-8cbbe35a3ec5", "comment": "Malware payload (Mirai)", "value": "8c8bcc31238d3dd399044836a54a8d60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703508, "uuid": "7efbf59d-67fe-455c-bb3b-455f92aa6d07", "comment": "Malware payload (Mirai)", "value": "cf51986d1870bd8be8c81ca3abdf0ae8c8ea0a00456f7a590d7ac2807f0f4b7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703508, "uuid": "7b2d2b91-6e5d-4611-a3f8-b3f7437573c2", "comment": "Malware payload (Mirai)", "value": "2c33dfe011bf1c1b31b967af43c820e92c8a6ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703508, "uuid": "6cf6b8e9-7788-4caa-9618-dbe5c5f1f514", "comment": "Malware payload (Mirai)", "value": "d5d97754133e466e93f9032b6158394892ebb5e188f5aeb8ea33fdf4f4fd18bbe1986632f96daa32bf2476f032aee628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703508, "uuid": "ceb6d7e4-0c71-43f5-8d64-1425bcce8253", "value": "T11A040946B8418B11D5C423BAFA1E028D33172B3CE2DFB2169D146F257BCAD6B0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703508, "uuid": "00069fee-62d4-4a68-bbc4-99fc48e0d237", "value": "3072:6G1Lrfs1iXeRs2UlpP3BX3Qh1gFa75zd1NQ8zPxqmtw9Bkt+11:XXeNGtBXgzka75pw8zJHw9BY+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703508, "uuid": "ae38d8d6-59a6-4f86-88cf-ca4e96fc648a", "value": 181584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703508, "uuid": "725b9d87-7588-44cb-8796-2a2a78c11535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703508, "uuid": "49182c01-d764-4369-92c6-cc7145a35c57", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51010815-c6fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763745603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745603, "uuid": "ead4997d-fc31-49d8-b1c6-a7026a1c7906", "comment": "Malware payload", "value": "c27c6a7ca133633c984861e35b02c2e6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745603, "uuid": "db098345-faf5-425c-8683-0bc6888e202e", "comment": "Malware payload", "value": "cfc4dbf114fcff13e205b390675ff799e34789124bf0190c9b7f31d9c472cf12", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745603, "uuid": "c1508e2d-357a-4203-82aa-b7fc7326a087", "comment": "Malware payload", "value": "d2a9ff41134a5cd70ddc0490b0e40135789aedad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745603, "uuid": "d63e9ad8-f6f0-4ebd-b6de-907b774d78bb", "comment": "Malware payload", "value": "3fa238760e629499dd907bfcff62454717911da480cf97b9379fc59fd96e85b6878b6a42a3d3b5a41c8a5f74833f155c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745603, "uuid": "3da56757-2713-44a3-a76e-a2bbfd4aceef", "value": "T18021B681EE08F672C927A2F1458DDF1C71A61F14230D7DAB890C9081A9AD2F03D61BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745603, "uuid": "12edd83b-20c8-4721-b6a7-c30ba4c2ca0a", "value": "24:9uW6rYM0ZQgH2v0djNiT4hHVDVZlTzgy0ixXc1/:9MgHNCstdXlQwe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763745603, "uuid": "cce8f425-41b0-4ed7-aed6-0d60357e84aa", "value": 1113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763745603, "uuid": "a9d002b5-a304-4b11-ab49-46ab60a5fb34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745603, "uuid": "31b592ea-d01b-401e-b68f-7791f75ed89d", "value": "39115644349814967482.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa37776-c6bc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763717200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717200, "uuid": "df91b737-3976-43f1-8aed-28f0208cdab9", "comment": "Malware payload (ConnectWise)", "value": "2c1daa985470393c2ee737e9ea028574", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717200, "uuid": "25220843-4076-4872-b0e6-1ca054647c7f", "comment": "Malware payload (ConnectWise)", "value": "d09a41581c732f175b4017608a74afd636cc32bde5f56e3d9bd1ca53ef6ec29c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717200, "uuid": "ed10b3a9-01a0-45dd-9a6f-8273103893d7", "comment": "Malware payload (ConnectWise)", "value": "d08f68204921d890e6f6b434adf18e30382306e8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763717200, "uuid": "e608ac7c-c3f6-4e89-af22-aafafa60e16c", "comment": "Malware payload (ConnectWise)", "value": "c2c90dfc2e5ce8de28558a7bfd4c4f2d6cd8919dd1209dcae2c3378d89b432ecf6aab6a657c7be814bec36bff6194320", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717200, "uuid": "075876c7-df79-4824-8311-873311de3892", "value": "T16BD6232523FD441AF8F74B79FD3682A45D72BE64CF21C11E9228B90D2A74D4096727B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717200, "uuid": "659e93a2-dde2-42de-aa1c-8fafd582520b", "value": "196608:oWh0cGwnWh0cGHWh0cGTWh0cGSWh0cGfWh0cGHWh0cGU:oWacNWacmWackWac1WacqWacAWac1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763717200, "uuid": "14ccfe8c-8fb9-48cd-a279-d51c183fc59e", "value": 13398016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763717200, "uuid": "6c053939-e92c-4710-9d30-9be34defa1aa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763717200, "uuid": "630b1183-9f11-4303-aadf-4e46058ecaf1", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e3b90e-c687-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763694425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694425, "uuid": "852b3660-86db-4996-a99f-6b4e0635e5c7", "comment": "Malware payload (Joker)", "value": "aae6fc6718e14f9c18a7ad133eee5d40", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694425, "uuid": "87a72cfa-14ca-47af-b9b5-40334f9fc095", "comment": "Malware payload (Joker)", "value": "d3c9c4214a61d6c9f88e36f319515667d48d69057798cfda5e1d34de2be5a066", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694425, "uuid": "458bf863-1d6a-438c-832e-f13f729c8f31", "comment": "Malware payload (Joker)", "value": "9f6f5980437a717e1f0aec2977e5f3f6fdaa512e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694425, "uuid": "c46bbbfb-0550-49c5-afc3-f7ad1955c1df", "comment": "Malware payload (Joker)", "value": "5196f8c2a567a91fbc7235a529da2883fc7a4ed41c0875065ae62c58ba85bc086753b672fde318869a5a67b2bc7f5701", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694425, "uuid": "13fdfc6d-c0d1-4fb8-9c5e-f63816aefc3e", "value": "T1A6F6125BE71DA82FC877B5738EBA122001251C855682FB63B956B21D29F39C49F4EFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694425, "uuid": "461b9ee8-b0d1-456b-a31a-c66882ca6c04", "value": "393216:2rdMusND+oq4+ZACZg5/fWTSPCbrwqcIuHwxfTYH:8qXNDaLZHm5XTPw/RTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694425, "uuid": "4c875fb1-5ca1-4229-9c9b-44ed54cfc435", "value": 16723820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694425, "uuid": "c33a06c3-8ccf-43a4-bc8a-bc7ed7c176a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694425, "uuid": "05f4e3f0-f903-4de9-807d-67a0e0cfa446", "value": "Junk Removal Clean_30.1.01.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d185fdfc-c686-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763694279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694279, "uuid": "02e6404f-6261-45e0-ac0d-fd9e2ea61f5a", "comment": "Malware payload (Mirai)", "value": "4e1da1b0ab895c4f72414730e0a272e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694279, "uuid": "eb853639-5c9e-4b02-8c90-f329fb9ccf9e", "comment": "Malware payload (Mirai)", "value": "d49fbb6cea6eb2060a0913da0e170b5b0b5d963105838bad3925505ada804337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694279, "uuid": "d424af34-466d-4fe9-b732-3ec0873e2165", "comment": "Malware payload (Mirai)", "value": "f9afa8ec83668eb122aa0a2dcb60e9c7a2237db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694279, "uuid": "41a0f433-c154-4183-a135-d78542b14d21", "comment": "Malware payload (Mirai)", "value": "bea0e39ae1e6d4ba54a404f26cda1c0427da5d8c592c43079a45a4af33f7c5ed503abf9f20c2dfd6ee05c95cbf54ac4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694279, "uuid": "c6ba9ddd-b4a1-4d98-a999-cb88a752c694", "value": "T10B930257DE340542DF8DDF6307249B5EA5B22BAACE2FC0979BA61E9451800C37D3DA32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694279, "uuid": "3a1928e8-9796-47ac-b103-8b47c591acc0", "value": "1536:IAfGw/geyVkdUt9iTr4t59W1X6iCeLG4YCHz9k2Rz9gTlNgHECocc6GjEhjM7ac+:ZekgeqEA9igKKiCeacz9k2RZ6NgHLoKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694279, "uuid": "1702d811-cc5a-4c7d-96d0-7faae658ec02", "value": 96668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694279, "uuid": "f1ad4800-28ab-40fe-b656-80b471ab6739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694279, "uuid": "f0e646d1-42de-4832-b8d4-a885819a2c88", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92b0abd-c6f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763741107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741107, "uuid": "d873e1e3-fc9d-4393-b427-021406868e5d", "comment": "Malware payload (Mirai)", "value": "cf6f07596664b87578110e3dc0b7a0fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741107, "uuid": "b84a8015-c96a-4a8a-a9f1-e9bea97d8a59", "comment": "Malware payload (Mirai)", "value": "d4b39a2508d321d19451fec03c2ab58c605901fe2af2f2314171303d49d13e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741107, "uuid": "d3178ce7-adaa-433f-8e37-3cd3fdac8b7b", "comment": "Malware payload (Mirai)", "value": "ef5b3a92ceb8c687e6237627b05041571009f4d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763741107, "uuid": "3821d7c2-064e-40a3-a35c-8d5b1a107e07", "comment": "Malware payload (Mirai)", "value": "9508d0b25f03a7e3c5a6c19167accc9c9cbd5e3436b4b22daff397da2281e7431f44b7264daff3e594d89ebf0cf81e3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741107, "uuid": "0d9e8901-0b25-4b5c-9edc-d7fc26f28588", "value": "T19A637DD4F2067E7DC89B293DD48D2B4ABF1C5FE05A439511A0B2BE471AB31531D22DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741107, "uuid": "40b1b5b0-30c5-4f1f-9902-c56b37892002", "value": "768:0/4bvzQoJs8R7PvsV7KaXG658b++SyaFvxYG1OM7QHKp1IzM7MvVvC6MEYa9GPZk:007Qk7naXVBsa1x+EQ3zK+vC6Sa4PZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763741107, "uuid": "c572a510-7adf-444b-9c7f-cd7ef4ed6de9", "value": 66956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763741107, "uuid": "54192fc2-88eb-4712-bfb9-c9a73781bf3b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763741107, "uuid": "3725a3dd-d1f5-444a-833a-1275ce031cfc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6facb969-c6ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763738782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738782, "uuid": "487cd81e-d3d8-491d-89bb-163ab1cb9a62", "comment": "Malware payload (Mirai)", "value": "4391b6d4183f2f40a1f430de8fe24b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738782, "uuid": "9d4e7696-7024-4168-8c05-c8990b5c2e31", "comment": "Malware payload (Mirai)", "value": "d57dbfb20e6559e0a6b9052fe11f4a96701083bc9a15e1da2cb03215e22a971e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738782, "uuid": "b5c6989e-f315-4d19-b4bd-8c46130c8fa3", "comment": "Malware payload (Mirai)", "value": "2ab0f3e512ab006267f0583fd8919af474c4c913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738782, "uuid": "4aa789e8-762b-49d8-b680-d7a85e3b5096", "comment": "Malware payload (Mirai)", "value": "fbbb814be80d237a5566a0a9098420f18520af9b64331e3246bddee565fb308eeceb486a1881bac681caa1713e2ed349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738782, "uuid": "6353718a-56ad-465b-a4eb-775664cb2354", "value": "T183144C46EA414A13C0D7277ABA9F428633339BE493DB730699186FB43F8379E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738782, "uuid": "888e3607-8b17-47b4-861c-868e02401329", "value": "3072:7lnbOSwtZchxybAaaO0kHupJ3vxFyjvCSavsaFy38d5M/9UurD:7lbOVtZcOUaaO0kHuptvxFoCvvzFy38I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738782, "uuid": "deb2aa53-92d8-4ed8-9267-070a4d3ff435", "value": 191898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738782, "uuid": "e1aea908-97e0-4a39-bc56-790531bc6fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738782, "uuid": "8d0a8641-6cbb-4068-a809-a19900eb0517", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efe451f-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703992, "uuid": "fc64a024-0212-4408-827d-fefdf1a7b944", "comment": "Malware payload (Mirai)", "value": "0ac4c70b726a744f42e3cba54c987d04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703992, "uuid": "d1bb807c-aa52-42b3-a0d3-a050d3ab3767", "comment": "Malware payload (Mirai)", "value": "d57dc7f48af2a21bda0a5de5924e65bed64aa59a5951ffc521f0cf10ee2df9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703992, "uuid": "74832bfe-aa35-4d47-bc3b-3814ac8cba6c", "comment": "Malware payload (Mirai)", "value": "364f235fbc06e3949b1b0a620f0bfb4d6418ed22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703992, "uuid": "8159b6ee-85a2-4716-9267-ca4b50c037cf", "comment": "Malware payload (Mirai)", "value": "f2dda051125a6eb4357f1c5760280426f99e4861cb9cca9697e0fd1be9d6eee283d98b90703f2a0fa4b3f6616ea63a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703992, "uuid": "7cb641cb-0ca8-4215-bbe7-615fb04ab9fe", "value": "T15664B5BA77107FAAC368C23805F343E996B3235116A39105E12DCA3D2DA534C5DDFEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703992, "uuid": "9c6edc93-45ab-4322-86e4-9bf6f00035c7", "value": "6144:Yktw54MqpZHx5j5Ytdx7yDF08ga5QREab+r3S+tybN2:Yk/axygRBbm3tybN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703992, "uuid": "a92ec47c-46db-4d0a-8ccf-daff5ab21c85", "value": 310620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703992, "uuid": "9d09cbba-f5f1-4eef-8260-8da499cd5e7c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703992, "uuid": "e7ebe53b-0584-4aab-b767-6b96cec7f134", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbfaad-c68e-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763697425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697425, "uuid": "9e8b6b23-14d8-4d5e-8a36-c61ea0ab1c6b", "comment": "Malware payload (Joker)", "value": "42a15b908dfd48c199f4835f6f2af43a", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697425, "uuid": "f2f1f72f-0b24-4393-9fcb-ec7b2e69d97f", "comment": "Malware payload (Joker)", "value": "d5b609393c18cd3d6d0654e270f3d250ab5fe3adb5e4a7453dd6b7e26971ed31", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697425, "uuid": "fe66b1fe-674e-4ef7-9cdf-704d0a326965", "comment": "Malware payload (Joker)", "value": "d99251748d6ea87fc90bb4453291c09b58b843ff", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763697425, "uuid": "afdbaedb-d711-4e47-bced-efb9cbe61424", "comment": "Malware payload (Joker)", "value": "d53efdc9014bc52119b5530ea366f99b2d0b669393dbecafdc7b296ec58af78df0770b31423fa5cd688e4c01ca451e84", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697425, "uuid": "6f99f35a-3e27-481a-b0a6-2d92484c678a", "value": "T11177234BE71DA85ECCE6A2794E79026252635C604393E3E33811B23DADB76C59F49FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697425, "uuid": "350b5179-c45d-4d51-8c55-52aaedadb949", "value": "393216:p0M2a/A/sSc/SixcdAhok3HZYR4b3pW8j7jCwJzUF2PWL6xlq6mhYgZExfOcdNgE:D/AEjxzyI7sANup6cE9uQiT2uc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763697425, "uuid": "39e68246-2855-406d-ae6c-e6bff7484b15", "value": 33692845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763697425, "uuid": "a759743f-50f5-4097-ada3-d3fa74215807", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763697425, "uuid": "88afc97a-6c3c-400a-b0b9-fc4b9cb9e91c", "value": "Trend+Storage+Cleaner_1.0.14.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd848e50-c6ed-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763738483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738483, "uuid": "453f3bc8-8b5d-4c1c-beeb-0980f50e60fb", "comment": "Malware payload (SalatStealer)", "value": "b0e7eeab1ae33708b25e7e3c34f3b85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738483, "uuid": "a8d1a552-81b5-40d4-b353-e2e607da67cb", "comment": "Malware payload (SalatStealer)", "value": "d7899d1bfe5b51a7d6dee0871cd17f6ad993c28fe3bf2709d11aaeb47d6007a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738483, "uuid": "56194ba1-bf34-4137-911d-c8d92f9b34b6", "comment": "Malware payload (SalatStealer)", "value": "2176e9afea2ccf45f8b31122848cf424ec9e4183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738483, "uuid": "ef32cc98-e48e-4415-bed4-63e078638726", "comment": "Malware payload (SalatStealer)", "value": "9ab3845949454e7053655eceae4673104721bf851035f7ac09b2130df6d7722fc29995c8b00d3da4cc63b5065621f79a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738483, "uuid": "8aa72ccf-5c49-4344-b243-78d5b1224b08", "value": "T114C65B51FA8B94F6E9031831415BB23F23345E048B28CBDBFB547B6EFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738483, "uuid": "b5034a47-722d-4ff1-9eca-da978eb0b5ad", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738483, "uuid": "67caf66a-6802-4e41-92de-9792808ba871", "value": "49152:3m+AOd0Nna1Frh8YboQkToG5E4rfjKwgJ1wwnD7NghNoKpR+x8d3kIPGm0DnaxHo:2pOWZ48/zT/2udcHfpqQSPWQu+pU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738483, "uuid": "9e6f7691-5e49-4c42-b9cb-adeda64e5a04", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738483, "uuid": "b2e50b0c-b72b-4a65-9949-034f656d2bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738483, "uuid": "55204969-5ddb-4fa3-b45b-a85d5db5cb05", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b3688b-c70d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763752296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752296, "uuid": "0fb0acaf-e983-4eb3-bbe1-b769a3f1cb67", "comment": "Malware payload", "value": "24384b9a8e05487a3f7d52de4dcd8128", "object_relation": "md5", "Tag": [ { "name": "194-55-137-65", "colour": "#CD1F7E", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752296, "uuid": "9a90af68-2d5d-4be6-9912-d4eb262667b9", "comment": "Malware payload", "value": "d9ca878417879125a0aff7c605c423ff6db0332df74e0935a26fa02a041e3d7e", "object_relation": "sha256", "Tag": [ { "name": "194-55-137-65", "colour": "#CD1F7E", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752296, "uuid": "baad949b-db53-4f61-9d5b-316a7ccacd52", "comment": "Malware payload", "value": "235f2a6a4d2ad6f7ea5e61f830a664c237e14c56", "object_relation": "sha1", "Tag": [ { "name": "194-55-137-65", "colour": "#CD1F7E", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752296, "uuid": "64b28bae-1033-41d8-b0fc-90d0ac906793", "comment": "Malware payload", "value": "86193ac753acc35abca6f571698c7dfd32e562cc15238cb23c61fb4adb25ccb40f8e7e1eb288941aeef569b5a447134d", "object_relation": "sha3-384", "Tag": [ { "name": "194-55-137-65", "colour": "#CD1F7E", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752296, "uuid": "ac240898-01da-4323-b0e5-786d09f81dcd", "value": "T15A07AF6AE1B800D9D07BC078CA579616E7B2741913F047EB26A45AE91F23BE03E7F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752296, "uuid": "e9e5745d-c8a0-4619-947d-2876e6e2920d", "value": "d76ed98b00ad8c99f25c7d513dbec6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752296, "uuid": "962d07ee-d985-414f-9439-426a97ab5b31", "value": "393216:Fk7eI5B76EkawiuNyjIQ7V1DuExSaxbosWg:JExbig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752296, "uuid": "e2417719-c5b4-4dc5-85de-c2c5e67bf8da", "value": 16820088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752296, "uuid": "8f6b115d-a133-48aa-9887-9a7783a2f758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752296, "uuid": "ae995879-d084-4152-9f28-70258ce5f4b0", "value": "build3_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba219f8-c708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750023, "uuid": "756e39da-5a55-4c8c-8b17-68fd83fcac9c", "comment": "Malware payload", "value": "9e6a5c30f564e564b337386dad75b205", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "health-smooth-eu3-com", "colour": "#5D774E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750023, "uuid": "e5a8d9c6-adb6-4555-9964-7cb72750b09e", "comment": "Malware payload", "value": "da0df8fd246a20bcb9d9cb6364f6018e6da4e8ac61c72311bf3d0db9e7ba0b5d", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "health-smooth-eu3-com", "colour": "#5D774E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750023, "uuid": "bc2d571b-161b-4fc7-ac4c-8975457238ee", "comment": "Malware payload", "value": "c9af5b68896df6c1cc10c9acc7b05055d6df4e5b", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "health-smooth-eu3-com", "colour": "#5D774E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750023, "uuid": "e9c5c389-1a5b-4d45-bdc4-c23f4c578e7d", "comment": "Malware payload", "value": "8ffd7d8e15d820ddc9e58af10365b3a0f416fc054a2f0cb3477b9a05b20a21cc7aded53444f4052f16d12c7761999abd", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "health-smooth-eu3-com", "colour": "#5D774E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750023, "uuid": "79647c29-eb71-409f-98f2-e47ba7bed491", "value": "T174639BD717DC0AED9B9089D68159760768F7C27B2C1E528DF9E28643B03ED20B71AB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750023, "uuid": "33f72043-7d6e-404c-b7dd-a8eec341151c", "value": "1536:KgOe4RTZas1upYo8pVvnGMFrux2FDbLHryQ6YV:Kb6YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750023, "uuid": "2d0b4b89-6e5f-41df-925a-321a6eb797ba", "value": 73110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750023, "uuid": "04a90c64-38ca-489f-91ed-279c5357ab12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750023, "uuid": "c8511bd3-fec6-4749-84de-fec7811b8c64", "value": "t1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a6fe2e-c6d3-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763727013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727013, "uuid": "fa3c896b-3091-4b2f-87d5-4d371e8e6998", "comment": "Malware payload (RemcosRAT)", "value": "45be8311406aef16d321fba80ae33a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727013, "uuid": "88719a39-2f05-442b-b76d-c80ae0140da5", "comment": "Malware payload (RemcosRAT)", "value": "da667f87b118e222887a612d5f45bb74d329872e1042b21af36555fb75b7288c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727013, "uuid": "d7b6b554-0a97-4b8a-a853-06d61c0217c1", "comment": "Malware payload (RemcosRAT)", "value": "8d42e36f4a97ac1d5f7aed7d0d44ff911a62f0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763727013, "uuid": "3e100c8f-eadc-48ad-86d8-1658957b1dab", "comment": "Malware payload (RemcosRAT)", "value": "760e25414fe117f6b456a6c94eeee8c4c2c3bd4d2e08e289cb61ad1370cd017458d040c48654f27b8a37e99f32f1419f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727013, "uuid": "8202ae53-7555-4833-972b-1f238f188f64", "value": "T152559C66512CF50EC6F1EA7CE690913602EB9D8D1C1CA16D48A47F6EB1B5F8C0A03F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727013, "uuid": "5cff6bea-9489-48cb-a66c-f7306b5768ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727013, "uuid": "1292e429-02b2-4697-9911-f1dd03481ae6", "value": "24576:npP7XEe+5x5fS6xy7i8OLv2HOEhqajzWLTETVyP1Bn6AD:pPTEjlSI+hODpEhnzYTETSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763727013, "uuid": "c962aec9-4f72-42cf-8c2b-257946cbdd86", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763727013, "uuid": "832f5496-d554-4204-bf88-07749bc1b2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763727013, "uuid": "b068cc4a-9d56-4304-a280-9b6de068ebe1", "value": "6J0u2mZX0m0TqUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d72e5a5-c731-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763767582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767582, "uuid": "54d955e1-6f5f-44d3-bde1-352e386a555a", "comment": "Malware payload (Mirai)", "value": "4e6890b541715cb4bed1493d60fffbf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767582, "uuid": "b13d1bff-009a-49af-98e9-a50c9ca23d2e", "comment": "Malware payload (Mirai)", "value": "da9da62575080a96f1d6dcded16dea6904aa98546b47a9d8ad99a42c6d672c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767582, "uuid": "0c28683b-dc50-4514-bbd9-54bfa5d25013", "comment": "Malware payload (Mirai)", "value": "1171fb8ada3af4bd30e26e22486ed17789f5f1c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767582, "uuid": "f10a49ab-4e1c-48b1-b028-2822f3bbc593", "comment": "Malware payload (Mirai)", "value": "3625fa71b23750cb7e0dfb3d6b5c80720c184c269b640d56ce80cef2f6bee3f60631bad6f2eb049685acb40429e42c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767582, "uuid": "4123c587-eed1-4b5f-ab91-3066523a480d", "value": "T117B329C0F98B81F6C40B8C306166F63FDA31D9A95171CAADFF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767582, "uuid": "fa06e4a3-5abd-4026-8bf5-a4c21cec6b6d", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJxQXireDHGKgpuzFlo1OUg:q/ij6i8CsMTMXmyhcQ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763767582, "uuid": "8b8a0b2f-a409-4175-86cf-bc0f7f179bb1", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763767582, "uuid": "4fcfda60-f074-47ae-8268-55d5b73cebec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767582, "uuid": "1ea99dbe-f9b8-412c-924d-8fd2a040ba1f", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab6b951-c709-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1763750209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750209, "uuid": "6d1fa1db-17b9-41a6-ac85-edd4586b4d0c", "comment": "Malware payload (Efimer)", "value": "2f57fe25e58b5a299427ffe54df8ea0a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750209, "uuid": "05856095-04fb-4693-b967-c902589c06ef", "comment": "Malware payload (Efimer)", "value": "dba7831ae5ae0ac62b22866dbacdc3e44746e202f0be0c0820ebc1338216a026", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750209, "uuid": "9f84f2cd-52f8-49fd-bcc1-aab5d5dc7a57", "comment": "Malware payload (Efimer)", "value": "dc9db4bd7debe1115b9fe82fd8f7b26b01e0c98f", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750209, "uuid": "78cb84c5-fd34-4559-b6ab-1197ecc896c7", "comment": "Malware payload (Efimer)", "value": "87ccce5ac0eea4723828627ef6e75959f40f1843fb3f109c1e644097bbb97d0bddc8dc10a8f87e49688dd24b7840b29d", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750209, "uuid": "1eb3f652-23c4-45d5-9001-1ce433c1278a", "value": "T1F4D633889BE452FDFA73903CEDE325F5E261B4214731CADB47A442A26E136E0593DB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750209, "uuid": "c87aa84a-a629-4304-b2bb-32c3e47b3426", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750209, "uuid": "41f43ccf-6d6b-4e20-94a6-d52c3026cba5", "value": "393216:lMn5ZyTOLE31V5dD4roXMCHWUjzNcuI3/PjuUw4:6n5ab3vWoXMb8z6H/rA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750209, "uuid": "7aaca180-f68e-4dea-8cc6-f107916c3be2", "value": 12618894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750209, "uuid": "e2430301-a91a-4443-91e8-9bebc1ece23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750209, "uuid": "6669d9f5-48bc-4a38-baae-0d3bc24e0569", "value": "a\ud835\udc53\ud835\udc2der_\ud835\udc1ef\ud835\udc1fe\ud835\udc1c\ud835\udc61\ud835\udc2c_v\ud835\udfdd\ud835\udfde51_\ud835\udc2a\ud835\udc1e\ud835\udc30_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464cdea8-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711225, "uuid": "fafcc698-1fc4-4323-bd6e-98f1be048aa3", "comment": "Malware payload (Mirai)", "value": "67faf59d73c8cb77783522d26c199f40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711225, "uuid": "f9272476-2bf0-4e22-b58e-25b8db578322", "comment": "Malware payload (Mirai)", "value": "dc23d84d24c04b0481c02bbb671384655256ba1c7c37700ecac298224b69aee4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711225, "uuid": "a2a32d1d-b903-4ea5-b095-2bb912122dd5", "comment": "Malware payload (Mirai)", "value": "61963cfac01d365c045a6eacedabaf94494bfb28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711225, "uuid": "27a4d400-bdf0-490b-84c8-7f1976128be4", "comment": "Malware payload (Mirai)", "value": "724c2a30fd209fd6ca084d9d907ae7458a6fb23d28920082bbcf6997b070eca73e42da2882e2dd36580552562c6d6179", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711225, "uuid": "2f5c2040-3ed4-4ab5-a86c-440a75bd909c", "value": "T1DB0186C76252BFB108ACAD157DA24899408442CF2A7E8F9CBC9F4A3C4C92B567194E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711225, "uuid": "34077e40-ca6f-47ed-a178-519a531f166b", "value": "12:wTKwwNo9o4XkFUAyEkQUW+9TCU6+EQp3G1RmtEOXIWu:vi3kzpkQq9TCirdGjmrXru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711225, "uuid": "e39e3fa3-8980-497c-8778-f725be11954f", "value": 796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711225, "uuid": "f00ecc38-f3f2-4ea7-a6c6-dcc9b8a475fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711225, "uuid": "74961c21-91fe-4706-bfd4-aefcfde57aba", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5d8a67-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766075, "uuid": "5d065a38-64f4-4a4a-bada-b2bf9c5ddea1", "comment": "Malware payload (Mirai)", "value": "50a24c2e32d35ee5f229e385abcdeec4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766075, "uuid": "076df1d4-09bb-4377-92b7-2c4d74278684", "comment": "Malware payload (Mirai)", "value": "dcd3cb7c5a2d04459f219d03cca7c257de55647fe5d407769e55be8c0c3e177f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766075, "uuid": "f597012a-020d-4153-adab-8d3832f85fdc", "comment": "Malware payload (Mirai)", "value": "2a40b86086633f821f16f672047e85e64c78d3a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766075, "uuid": "01937e9d-4c42-42e5-9c67-e42311d3d553", "comment": "Malware payload (Mirai)", "value": "15f53128153c9e8054edd084433f4021ff665e0ec9ea6777f2af79b02c4b77243e6305a8d102a5566876e3f9366218f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766075, "uuid": "71c4b07b-b577-4493-8672-aee94ca6e4f5", "value": "T1DA357C56F2B370BDC057C030839FDB626935F46901322E7B65C4DA382EA6EA41B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766075, "uuid": "10a934af-5fea-4418-adeb-092322745dbb", "value": "24576:QzKHk8cGu32/xnF9d9Aq2vYaWFDS+dMvjn2GTG:vH7cGu32/dnjAq2vlsvd0jnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766075, "uuid": "a4da74d2-fb76-4c84-93ef-d04340bcddf5", "value": 1155328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766075, "uuid": "1f334be3-32dc-479f-b275-d5bd9164d073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766075, "uuid": "a4457a5d-1d26-4304-837d-2af153d25dea", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d532a6-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703814, "uuid": "6fdeb9a1-8005-447e-848e-c452bac8f9a0", "comment": "Malware payload (Mirai)", "value": "42d974fe967096ca0b83c2833bb5572e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703814, "uuid": "87bb25bf-0989-48e5-a16d-0accccfa9ed0", "comment": "Malware payload (Mirai)", "value": "dcd8998be613a15d40dee197bf662dfadfd8686ade621e2d87348b27acdae9f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703814, "uuid": "2fb21347-1b4d-407f-9800-52df922202e9", "comment": "Malware payload (Mirai)", "value": "de99548ffb95595666bcd022bb9a024b14df7f6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703814, "uuid": "e8fb38d7-58fe-4ae5-8e01-f9bdb98cc8a8", "comment": "Malware payload (Mirai)", "value": "3bed921591f0dd424434d74f73ad5779a540ea77c60299f8f9fd6544b84eb2d7d25cce932fec879c2b155a73f29d360a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703814, "uuid": "c5cd3b5b-dce0-4526-a9ac-9b8c399658c0", "value": "T190640892EB412EBBC00EDE30411F87D911AD849953FB572BB278C51EBB8EA0D69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703814, "uuid": "c8901108-5da8-4530-a3af-ec31cd707674", "value": "6144:unkhNOObxMlw/SM/SRzgV6br6eo9+ro5jamZQWl434UYGi//Xwgef1XdvdqOyWcn:unkmVf3vdqOyWPfybN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703814, "uuid": "45687926-ce66-454e-823d-1bd75dd3443a", "value": 310648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703814, "uuid": "a0ebfd38-128d-41e8-97c1-b0716e2e2bf4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703814, "uuid": "17faa5ad-c058-49f7-bee2-ffb4672d1785", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075b7766-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703818, "uuid": "7a50dea2-3b25-4008-b9dc-745d88314bee", "comment": "Malware payload (Mirai)", "value": "44e4ce09b973966e9d22fa62b2897353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703818, "uuid": "ca939f8a-ee18-4419-94e8-16d18e7daa9b", "comment": "Malware payload (Mirai)", "value": "dcffc3c7055a7414eda9434de9ef5b29c158e9d7c337c64d389a9677ffe3509d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703818, "uuid": "a9144dda-654e-473c-95ac-1a19df0c1f62", "comment": "Malware payload (Mirai)", "value": "1497a00ebfb03946e4708c5b7905209ec0202232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703818, "uuid": "a8570ebe-c124-439b-8baf-390c8d08f234", "comment": "Malware payload (Mirai)", "value": "a115134c78df5442d0a85b331e9b1aa3200cd0eb8252377699afe5a2f585fe872602133ee164cdc0e40e6b1fec0d9a75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703818, "uuid": "e14bc71e-4f89-4b6f-873e-eb9e652a9ec2", "value": "T166047B06F642C1F2D18301B26057C7665B30D932032ACE07FB996E757E726099E9B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703818, "uuid": "fd98fdc7-e1ff-4253-8b49-c6d74389c944", "value": "3072:Vw8+ErxDBAp74QcnRmllaSOaaPd/5VeIz4wTL0K6ynhTmjvqKmXx:Vw8+bZ4Qc8gnVeI106nsTbmXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703818, "uuid": "8582081e-5e42-4a91-8cf9-c8cea1c75857", "value": 183560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703818, "uuid": "1ee3c35a-e56e-4211-8580-689e677e029a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703818, "uuid": "4e5911c1-7160-4c94-ac88-543954ad87eb", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16c256c-c6e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763735483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735483, "uuid": "85a1c036-bce8-4d5b-aa5c-a62f706491a3", "comment": "Malware payload (Mirai)", "value": "c4727e79f22a113ccfd40c1965ad301f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735483, "uuid": "a841d73b-f2be-49a3-816a-8b26365fcaa8", "comment": "Malware payload (Mirai)", "value": "dd96438bd3d2f457ae11b9f3e699743796dab8183914079b73d33acba9a5d253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735483, "uuid": "6bfb8bbf-f2dd-4589-8a2a-9b301e103d95", "comment": "Malware payload (Mirai)", "value": "20f30badbbce6403d484e1ea4e119d3f355bf6c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735483, "uuid": "2cc951ad-eabe-47ee-8105-0cda9bd07d90", "comment": "Malware payload (Mirai)", "value": "27d42b673862e4ab3b10f2b006125041c31d46d40a282b530887dba42935dede3a7865fafe9609176a1def514937108b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735483, "uuid": "3998a11e-77f5-4727-8b29-72fa72ae9989", "value": "T1C5C33CCAB402DD7DF90FD5B644730D0AB935A3A156830F26639BFD93AD321A4BC12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735483, "uuid": "af7bbc03-4595-4139-87a7-80f95c8b8cf4", "value": "3072:HtnTmbI2gQ+qD1Axn0OT/xXNNsJ0H1FyJ:RmbI2gQ+zZbx9Nr1FyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763735483, "uuid": "6ba3af31-d3bc-48ff-b78f-607c45ccc7c3", "value": 118736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763735483, "uuid": "217f3e4f-8a78-4a37-ac90-e9c3cc3691ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735483, "uuid": "5df19fcc-ae58-4d66-92c5-9cb61546600f", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbf4555-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714482, "uuid": "32eaecc9-3cb3-41ff-aeaa-ad6bdc0140d2", "comment": "Malware payload (Mirai)", "value": "fc4cc610a9bb179e5608f79e35ed9dbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714482, "uuid": "dfc9f37b-f88a-4949-898a-df23ef6ed0ce", "comment": "Malware payload (Mirai)", "value": "dda759e0254f8fe4943252fa5e73a66b729de0e018ff22a9e57e7f973fa9b967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714482, "uuid": "ec683f9c-3bb0-4565-81e7-cc3140c7a026", "comment": "Malware payload (Mirai)", "value": "3b9898bffdf50960c9a693ca97acf5958e6eccbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714482, "uuid": "7102120b-7dc3-4b49-b7d9-2eb201ef25fe", "comment": "Malware payload (Mirai)", "value": "c449e9d343ba84a0cf446a5c11cb4924a335783524967131f4512150a37ba183a2672c8d7b338897442b9d0047c33323", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714482, "uuid": "6bc289fb-93d7-47fa-b8a1-c20afbf6ad6d", "value": "T113C3BF475411BDEEE4659D3FC4138F25AF26DFB08AC32B1A60B9F9D0593925073A7E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714482, "uuid": "998147ab-00cb-4ab1-baed-bf57ccf52040", "value": "1536:gTAku8aLbusfWPMdITeYomzXp81rSCwJImYNaDcRBoHcy2haotj+GOhCv0ELloGK:gTg8IvjY81dwJImYcBcaoGCv0RGMUS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714482, "uuid": "5b0e09a6-76de-426b-bec3-da3da64c3b90", "value": 123616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714482, "uuid": "f7618a36-a52c-48e0-b139-df1fd7b77a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714482, "uuid": "095250fd-4cf0-4d46-8b33-36439617413a", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41495ae0-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763732691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732691, "uuid": "5fff642a-1037-4e4f-afd2-f022cb6c8e66", "comment": "Malware payload (QuasarRAT)", "value": "1380ea6d83266e156d826fadc9aeeb76", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732691, "uuid": "fa7fa29c-8688-420d-9c11-25b846ea676c", "comment": "Malware payload (QuasarRAT)", "value": "ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732691, "uuid": "65cfb1c8-6547-4bcb-9f7d-a572c9cc8b24", "comment": "Malware payload (QuasarRAT)", "value": "f2e5fd035e9e3aa566ca70945b079291b7b668b6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732691, "uuid": "0c1719f7-69cb-49a5-8ff4-811bbb8e661e", "comment": "Malware payload (QuasarRAT)", "value": "1f6028ffc123c1a7878806179f07db8461f39280a68fc456a1a6996152ae2628b122b5652e100cddb58c6c5ed10bacaa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732691, "uuid": "f83fc729-aebd-40df-aa15-3c1d948d9e74", "value": "T175448D55B7E50CF9ED67853DCD824905EA72BC4647A0E7CF03A04AA61F236E09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732691, "uuid": "7f4af0bd-614d-4bfd-b256-e308e548b768", "value": "a5763d1f6dd0dbac191659bd8af41b8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732691, "uuid": "9ee7d12f-c044-41f9-be70-3dcb30333b1f", "value": "3072:aTnlxYtAj1/oDWtwn7w+uIjh2LkLIPZMEi2c+IqDXDy54GCM6H5CYmvCEwmyS5k8:yKWtUHBoLsI7rXj4sQryS5k8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732691, "uuid": "5045cac2-3bde-4b40-a529-12acfba0cf71", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732691, "uuid": "7e1e30dd-de4e-421f-ada0-f02f4276a6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732691, "uuid": "bc0f796b-0909-4fd3-b1a3-fc2691bdba2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39af135-c72d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763765928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765928, "uuid": "4b7486d9-fa9e-412d-927e-221a886a3afa", "comment": "Malware payload", "value": "a8082a80cef9ccee9d7a35f5366e3afb", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765928, "uuid": "f623ef0b-ac6e-49c7-9724-8afc57aad445", "comment": "Malware payload", "value": "e036e2ba402d808adbb7982ec8d7a207849ff40456633b2b372bc7916d9dc22f", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765928, "uuid": "8437537b-95b6-4c4c-82d8-cbb0fae8cbd7", "comment": "Malware payload", "value": "1612f489f8a6b28cbc727b9489d5e972f3bce5de", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765928, "uuid": "f0a30445-518c-4563-878b-1406a0afc601", "comment": "Malware payload", "value": "f22b24a54dc4b6ea0ac9f83a5462cd971b8b063630d1972d1cd7ec7e7cf52d0d9b3050859b38d19cfec9df130c6da5dc", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765928, "uuid": "9a500a66-d57b-4423-835b-287854f39e76", "value": "T12E9533919E4FBBB2C474E2B0CC92960659B29D10D991906987AC7A360E3C3F83FDF754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765928, "uuid": "c7329ba3-c10e-4d8a-a0f5-9110c8a9e34c", "value": "49152:cU/n+xrnGqorqh76fDFxMnwL/1hgCxJ3k1t9g7D:N/QbMDFGnOgCxpkj9wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765928, "uuid": "c8212056-7d1a-4035-98c6-62423fb6ed53", "value": 1973301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765928, "uuid": "7d209fdd-fc46-49a5-9b8f-0ddc6e502ba2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765928, "uuid": "44430bcf-a7ee-46b2-8224-6bfb2631f8c5", "value": "ATTD-ASIA-2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e39fda-c6f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763740828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740828, "uuid": "4c8b8557-ff42-4d23-bf12-d571f9907e6a", "comment": "Malware payload", "value": "1911d38e12ed40aa1df89c6aac4dc580", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dropper", "colour": "#3DB640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740828, "uuid": "eb39634b-d86f-4309-9b7e-d6c10c1727df", "comment": "Malware payload", "value": "e04cc11b575025f8ab13ff6bb2028a7be33f2d27a3d2ac7f65862cb19108a4f1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dropper", "colour": "#3DB640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740828, "uuid": "7c5573b8-7b79-4ef1-bfb3-874f6c64c3c0", "comment": "Malware payload", "value": "078067df91f3f566f5ed1c36fbeb0ba55434d20e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dropper", "colour": "#3DB640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740828, "uuid": "3a62268f-4069-492f-ad45-a0085d443a6a", "comment": "Malware payload", "value": "b3974b41fe64a24a0e69c8962accc5366eeb1a12b5389505e0193f2f5d9d1104ecc514b1080e7ecfb98b8060db7b14df", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "trojan.dropper", "colour": "#3DB640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740828, "uuid": "e645d75b-66f2-45c8-b634-8bd13ba75f8a", "value": "T1AF41C6A26B8981D3C7C302F3490BB5D8E2DC0098D8F26D60E4F2FA10A76D10D4ACB87D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740828, "uuid": "e658728e-58b9-49e3-8f73-b089ce15bc50", "value": "48:EAfZHzQeDxz0wyoYB3Rw1mpCjs9AQm1KVQFjL7VCS0pm9+DG3qUEXpw3WIIYVRWX:hz9DZ0TrBh2jtviQFf7V30a+IZjteZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740828, "uuid": "529ba278-ee71-4c88-b734-7649634669f8", "value": 1912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740828, "uuid": "7793e1d4-c35d-44db-b9e4-6fb247963277", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740828, "uuid": "2f37eb2a-b888-40a0-b29f-21d16a5cbe50", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1195602-c708-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750166, "uuid": "8c5764e7-e3c0-4476-bde7-03595816a860", "comment": "Malware payload", "value": "81f70588205f3294644293ea2ba04823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750166, "uuid": "df8e43e8-5156-4029-87ac-f0a4fb96089a", "comment": "Malware payload", "value": "e23da146770e8fbe4a0a7e2949d33c52196e3581d2d697bf994e2e84a2d0207d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750166, "uuid": "ada2c005-55d1-4607-a95b-77b1001653df", "comment": "Malware payload", "value": "d19be4ea84686b1143745044ed048c56967f6c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750166, "uuid": "b000ed99-1d32-4eed-8717-dc9cf59e8700", "comment": "Malware payload", "value": "eafb60ec63fbf29f2a75418d2209ef550e4f4b3fb01a65c0865741ea782da75edfb3c7cbe2d873ee8223dde06713788f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750166, "uuid": "608aeb49-353a-4eb9-a5f0-9d4b054c76e6", "value": "T1ABA633DA1D285294E6217331730F188B4D44AAE3F45C61A9ACFF33EE5DBA257C57B022", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750166, "uuid": "99338f4b-bc58-4674-a851-282384127fa0", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750166, "uuid": "d8a7457f-3ca5-42d7-94eb-fb894e32f164", "value": "196608:8hIC8l3yf08/xuk1THfRhCvSfJb2Of/XVR7wsZ0uDDL9W5ReNks:8KC8lt8/soHJh4yFLfr1ZRDV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750166, "uuid": "b9f6ffcf-75bd-4e6d-9187-6d653ed962b5", "value": 10339328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750166, "uuid": "d217fbe1-465c-4a1f-a9a3-696ed3b3386b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750166, "uuid": "a51a562c-7c9d-4579-a50b-e0c7b5aea538", "value": "Installer_v54903_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7196e693-c6f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763740933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740933, "uuid": "b8cf3256-0c3d-4ab3-afb8-71ec69a7bfc4", "comment": "Malware payload", "value": "88417922ba6fe6385c86aa866290663b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740933, "uuid": "81e1ff3e-ba9d-4deb-87fd-3e6ded4fedc7", "comment": "Malware payload", "value": "e27288fcd6c3ccbadf90d37481ff6b407e31eeb33f775e5110be3e75401879b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740933, "uuid": "438d02f2-f6a7-4268-bd29-0ef0d720855d", "comment": "Malware payload", "value": "6f5dbeaee0b4bee68f2772774b14c44b61e7b21d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763740933, "uuid": "19c4576d-e0e0-420a-ae8a-c7222c745ea3", "comment": "Malware payload", "value": "9c119946f097dc1315abd97c345f1f9b994b498d16fb6c7bdb2b220cd74e63088e326248d2aa1fe5e2cd41ef00ddf6a2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740933, "uuid": "399e85be-aaf0-4616-9556-272f8740a17a", "value": "T1EB253371F8B0AD98C44D62F147B9B73378B4ECA41579C0F8A87523CE5A169BF3D92881", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740933, "uuid": "457f9149-c9f6-4f33-8953-47edc0133fa7", "value": "052cdca8d4bafb20a5561f8e1a832cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740933, "uuid": "b3635392-1f74-4aae-b147-fb083e569a9e", "value": "24576:bFidHS2VWm0VIr8uPmU+0NkLtRUE4Elerv:Jidy3m0il+lIeyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763740933, "uuid": "8454859f-6347-4b47-82e0-1d5b0b11ba10", "value": 1019200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763740933, "uuid": "b999e745-f4e6-4ffd-929d-bec2089cadd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763740933, "uuid": "35e8e9c4-9bc6-4c5b-8644-f7e15204ea74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d640c8-c6ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763724864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724864, "uuid": "dab92290-3932-43b4-b04b-fdac6df2321a", "comment": "Malware payload (Mirai)", "value": "ec2aeb6a89ada5ce97687361d468f0ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724864, "uuid": "b5e3b20c-4bdc-4cb1-a308-cd0bcadf3fe2", "comment": "Malware payload (Mirai)", "value": "e2e1ae7ef45eefdfeb5a73d250a451c3f1b2169a02c78c1deb938596de2ca031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724864, "uuid": "e3980a96-6621-4962-99f5-8e84160a6bc4", "comment": "Malware payload (Mirai)", "value": "99b0302ef6389df7edd80b2ad13ce8866f5feb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724864, "uuid": "4b9d9234-8fc5-40a0-87bd-e26d84fc6fad", "comment": "Malware payload (Mirai)", "value": "89377c925c78723ae3b82393150dc0aa96676d25a6f05fcadc57ec75ecb1f8a31ebf086a14dd05d8e9c8a71524f3b329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724864, "uuid": "c2d3b2f9-d2da-4904-b0ac-9fe92c23b531", "value": "T1AA144B46EA414E13C4D7137AB6AF424A333297A4D3DB73069D286FB43BC279E0E27645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724864, "uuid": "fabf2a3c-3ab7-4a9a-83ba-d0e827b5e838", "value": "6144:zlHBf8hqxrNGYIaLLB7lcNUFB2E0ocB3b5M/9ND:zlhf8hq9NGYIaLLB7lcNUzpe9u/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724864, "uuid": "0923a043-11c5-4217-a562-f3012de0db6d", "value": 201645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724864, "uuid": "f8c30586-2d6b-418c-ba98-bc02597d7b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724864, "uuid": "c9f99139-16c2-4ac3-b9f9-2262ae8b5177", "value": "SecuriteInfo.com.Linux.Siggen.9999.21934.23929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d38e308-c6f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763739637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739637, "uuid": "8320c9d2-0654-435b-a56b-33a4faa69bf7", "comment": "Malware payload (Mirai)", "value": "9e4b92d9da1d34e585bd456bac45427f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739637, "uuid": "24ba7490-d16d-450c-8463-afdc0ed91bb6", "comment": "Malware payload (Mirai)", "value": "e335f0eb15447981c93163c97360ec62691d52bb02323c367d58229a6cf57e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739637, "uuid": "0a8665d2-f742-4ddf-99c3-5eb010a185ed", "comment": "Malware payload (Mirai)", "value": "f281d8dde458c5f5bbf6749b19811ed990682e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763739637, "uuid": "33dbe251-138c-4603-83cc-264346ef8754", "comment": "Malware payload (Mirai)", "value": "2cf8ecaac46df31edf1a535e0355fe3a1fcef10f0c7a1416d0c1cdc130856f8f2463a2bc06fe5217c54b779650f85c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739637, "uuid": "2770df50-dac7-45e2-8de2-f995e8b91cab", "value": "T11C934BC4EA43D8F5ECC701322037FB375A72D5FA2128DA43D7A89B76E86A501E417A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739637, "uuid": "ef825035-083c-4687-8e05-28e2c69a2eee", "value": "1536:8E2JWrdlMe6MTsBMZiK77kqW4l1duVWUEFnQxRyZkZ2i6W9ycI:8EdYMTgMZiKn9Wk1wWUq4Rii6W9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763739637, "uuid": "1a9b32ee-442a-421e-a432-c2be70851e1a", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763739637, "uuid": "f3ac1e71-16ca-477d-9dee-acfbe144b987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763739637, "uuid": "86d6e1ff-8324-4904-9e2d-50c9660f25e1", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9fcf73-c6df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732445, "uuid": "635b7a72-f595-48c3-b070-1d2af9ea06ce", "comment": "Malware payload (Mirai)", "value": "77a610ad0ed8e92e26fb3c4ad8f4a495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732445, "uuid": "31566819-c943-4086-9cd5-f31070aff3f0", "comment": "Malware payload (Mirai)", "value": "e3c1e228e9570a1db2b534defc17fbe2dec6b3e62940ae8eb98f29f76f331454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732445, "uuid": "94cab4fc-2eb9-4020-be1b-49f4ffaae0e2", "comment": "Malware payload (Mirai)", "value": "5ea040bdaa09379a7b1e80b563693d76f629712c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732445, "uuid": "4109541d-73ef-4c3a-8f4e-64cba23c4e36", "comment": "Malware payload (Mirai)", "value": "5192b810057f43db64a0d0305e91baed899e55ebade1f364ebb668c3b5e2ecb2194d940dff8fd1fa9925fb537fdc5f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732445, "uuid": "91997289-9702-4e01-9de6-5970e3b968ec", "value": "T114B34AC0F98B81F6C40B8C306166F63FCE71D5A94271CA6DFF969F36DA77A019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732445, "uuid": "8fe6e303-b189-48a7-a7a6-c6b9f7aab8d3", "value": "3072:bqyLpO5iL2SNPNmIrAzRzBz935rzKqgptWsRCPr:f9OgL2mPNPA1BBpDPPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732445, "uuid": "9b50d1b1-7a9e-45f0-a15f-fb599e0b4e50", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732445, "uuid": "4b32fc40-4a72-40bd-a207-332369a9e2b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732445, "uuid": "d20a9baa-5910-4ea7-bfc8-7ab58f344db1", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a76a01-c70e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763752402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752402, "uuid": "0a3fe36a-57b2-410e-a2c4-d5e0aca8bef7", "comment": "Malware payload", "value": "0c7edc6d19a8ae63770955944ab9ba6e", "object_relation": "md5", "Tag": [ { "name": "5-253-30-24", "colour": "#A31501", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#AAD0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752402, "uuid": "16fc0fe9-ea94-43bc-9466-40afa9b7d904", "comment": "Malware payload", "value": "e3d0782bdc635b7c1f875f6df3002af830a8d94d15ad26d2f9d18dbe65b45b53", "object_relation": "sha256", "Tag": [ { "name": "5-253-30-24", "colour": "#A31501", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#AAD0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752402, "uuid": "78aee216-319c-493e-ae4a-5bf14ba90497", "comment": "Malware payload", "value": "202fceeceb55790689073e2159f6848c5ca634da", "object_relation": "sha1", "Tag": [ { "name": "5-253-30-24", "colour": "#A31501", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#AAD0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763752402, "uuid": "d0911d1b-4268-48a2-ad4c-206c56f3c8f9", "comment": "Malware payload", "value": "918e52bc1967bdd8e9349cf1773e7fa87105a1b6b9bb256c9b7a66e2a6713cad09b200e29339bb8a75590e98777abcb5", "object_relation": "sha3-384", "Tag": [ { "name": "5-253-30-24", "colour": "#A31501", "exportable": true, "hide_tag": false }, { "name": "dropmefiles-space", "colour": "#8D1AFB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MonsterV2", "colour": "#4BD60E", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#AAD0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752402, "uuid": "03667868-a47e-4cd4-9430-4b603e0f522f", "value": "T10C07BF6AE2B800D9D07BC078CA579616E7B1741913F047EB26A45AE91F23BE03E7F741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752402, "uuid": "fdf69387-1a01-4e0d-8c0c-34a27e70c359", "value": "d76ed98b00ad8c99f25c7d513dbec6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752402, "uuid": "727cc292-e5f3-40ad-91c1-5a1ddd079255", "value": "393216:6k7eI5B76EkawiuNyjIQ7V1DuExSaJbvRW:wEJb5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763752402, "uuid": "20b85cca-ec50-446c-b80c-d1c461b202cc", "value": 16903320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763752402, "uuid": "11947046-cb83-4957-ba14-2b05c882e9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763752402, "uuid": "50652a64-16b5-45a2-a019-458698ef815d", "value": "build5_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69b3c37-c721-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763760805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760805, "uuid": "9f0d6ad8-16d6-466e-b5db-f6257368453d", "comment": "Malware payload (Mirai)", "value": "8f592560ea09a01a0a3787c22a1f8b17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760805, "uuid": "51524463-d007-4c19-91fc-97f60b319b7e", "comment": "Malware payload (Mirai)", "value": "e4386057bb0efdfdc54fed65798c1095c4be80f5391fa665d6ba07fc2cfa25ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760805, "uuid": "8d7fef2f-c609-4cd2-82d6-07e68a2500a9", "comment": "Malware payload (Mirai)", "value": "0c7ae0a6d60720f89eb323232d1f68ca942fd5e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763760805, "uuid": "d3108e9b-02a4-4daf-859c-137f7716728f", "comment": "Malware payload (Mirai)", "value": "ab58b18f575b672153c860486767e0345eba8c0c96927bb0bc7619cacec5c58495d5806cd2dd0c4ddf58703b0d353983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760805, "uuid": "fb4a6f1a-7bb1-4001-8d98-4dab027c8183", "value": "T105B34A4273180F57C1970AB02E3F17F687BFE5E021E4BA89650E9B5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760805, "uuid": "d5f26c97-bede-4710-ad22-f47e96168ef4", "value": "1536:SXXfJWeuWomtxzUZN/fyWpA+8pLnKlIpYwl5KD19j+JuM1+463tQcU:SXXfJ1uGHwzpbGn5y92ukZcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763760805, "uuid": "30c97a3f-c581-4990-a6e2-a260612b9bb8", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763760805, "uuid": "b34b7864-3442-441a-9254-9dc177027f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763760805, "uuid": "a4d6abe9-b95f-43a2-bac1-bf4231615472", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0b3fd5-c708-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763749807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749807, "uuid": "0ea4eee8-d685-4077-a29d-eaa5d4c15d28", "comment": "Malware payload (Formbook)", "value": "f94deb673214449fd29f19278e4b3331", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749807, "uuid": "91e090ea-1cea-49ed-95d2-d22d451fb167", "comment": "Malware payload (Formbook)", "value": "e529f9d6fd649953e6bdf1ce2483b9bc9c79a6166454cdf594a0792c9257f5f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749807, "uuid": "8240291e-d4c1-4af7-9adf-7d91ba0e52b1", "comment": "Malware payload (Formbook)", "value": "6513cfd279924fb4942cd3ccec372ae84fc8fb77", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763749807, "uuid": "c68d47ea-1f93-475f-aabb-044e51f8a3dd", "comment": "Malware payload (Formbook)", "value": "a34264e5c2aecb58f45b85e8ad1ecfade0e69ef825e6e1df49e1032c8464027efddf08b2e764d1f08b45cd16cfdb359c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749807, "uuid": "f13b26b4-f4a5-42e7-885a-afea17ad81e4", "value": "T19D750201F340EEA8ED6B0271F4B29B2842E67E4665B6441FB99E33142B73346356F94F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749807, "uuid": "c7e1e655-b6ff-48e1-94f6-257507314981", "value": "49152:eMpbVuCn84C96y+STOk1pfnpz7wHNIC6ABMi8+rm2I5nKpQ5j4Jtox:eMpJuCn84C96y+STp1Bpz7OIC6A+JQmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763749807, "uuid": "4a40c7f3-db90-4b19-89c5-4049846c609f", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763749807, "uuid": "88fbb25b-6bff-4a95-b4c9-0775aa4ea020", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763749807, "uuid": "9b2d61b4-5072-4f7f-928d-db718718cbbc", "value": "nPO379025_PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7e501a-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764042, "uuid": "44d2074c-4201-4380-a309-b89ab90bcd9f", "comment": "Malware payload (Mirai)", "value": "3118011555bdf31a030b1a5f06d38c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764042, "uuid": "15bcab4c-872e-4fc2-9864-66056e3ab355", "comment": "Malware payload (Mirai)", "value": "e652296277f80e1340d7ec3d22332d3dd142efc4769b74b860afa8831318e790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764042, "uuid": "9cd97028-f55d-4328-ab75-9a0a29260e0c", "comment": "Malware payload (Mirai)", "value": "b7f9f57acb41e938259261a7d754899a2b6f6e7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764042, "uuid": "25ee86d1-8ca9-4edb-8c0d-bb58fc1c8dfb", "comment": "Malware payload (Mirai)", "value": "cda75141693e4516169e5439d2a45bbd3e6fd5d549d6bb2d4f46ac77437b0ab7b0b0e3964ed12a59cdbc5722ff627c55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764042, "uuid": "790aed16-7a48-4076-b987-f193b268f0ae", "value": "T10CB3394273180F57C19709B02E3F17F687BEE5E121E0BA89650EDB5A8675E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764042, "uuid": "07aa508d-4031-4779-be61-82c8a2e2ba85", "value": "1536:gHXylSpMEscMYse9k1ai8ptKLvYnAXVKDY9r+JuUqtBxHV/TE:8Xygpusk1J0lW9+uVTTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764042, "uuid": "aa236019-4dc4-42d3-b2bb-86b0a96b952e", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764042, "uuid": "3c3b7a91-a49b-4fa3-bfea-548cad0e835b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764042, "uuid": "bd41305d-5b54-4090-9ca8-5d2f8a556d25", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a4cf24-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765104, "uuid": "2709076d-2b05-453c-a0a1-0ecb6c6a0631", "comment": "Malware payload (Mirai)", "value": "5b8338c89a205fc95f16a7c5e5acb5c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765104, "uuid": "ab179641-de77-4134-914b-4b5db055bec7", "comment": "Malware payload (Mirai)", "value": "e72811a5507aee56ba5df45b763e273b3aed876daef643f6fcc87718e88fb122", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765104, "uuid": "8a986843-397f-4dd1-a713-7b02d794c510", "comment": "Malware payload (Mirai)", "value": "8a0b117a45a2bc82ed01ac33b145c5525d1081b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765104, "uuid": "51d8f067-4557-494c-9b91-794abb9b7ca7", "comment": "Malware payload (Mirai)", "value": "dbb6b17905833068ab2729473b4358549370f0bf9ed6202cdd34be5e971b568a5a4ca6d67ca2a4556c3a0aff6805ae4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765104, "uuid": "54e9354d-061d-446c-8f6a-5a842428104f", "value": "T1F1D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765104, "uuid": "15212cf7-ed60-472b-a9d0-58df740fcee1", "value": "1536:UFKdzElm18uZJNb4AdFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTt:UFKp50yU8e947Lb71izSftBdRalKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765104, "uuid": "6cf7cac5-e31e-47c6-91ba-7f9635c8b884", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765104, "uuid": "15b7d982-ca1a-41da-9c2f-a9f1ddc8b649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765104, "uuid": "4e2a6da0-bfcd-459c-8f36-e8a7faddf086", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21808185-c6ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763745952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745952, "uuid": "35ec2d5f-2f93-41ae-b5c8-f37693307ffc", "comment": "Malware payload (Mirai)", "value": "c5ddcb93982e18fc594e8da47d9ecad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745952, "uuid": "99265519-8643-4a7a-9095-ed7e5fffb1a2", "comment": "Malware payload (Mirai)", "value": "e75a35e43afb0024663d480a83100d728a0329a0ad81f1b807f0bdb12aee043e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745952, "uuid": "e372dacf-9dcd-41e0-89ba-d1e1690832e7", "comment": "Malware payload (Mirai)", "value": "937b7e6fd5a84afb9d90543bc28bdedfdcddf19d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763745952, "uuid": "10c61491-1c5d-4026-be57-a2991929e531", "comment": "Malware payload (Mirai)", "value": "9736bfef85cc48b019113012b8cf02775c30907efe025c2eb199a1d00520b713699b83579e8047a1bcb2d939d1f96276", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745952, "uuid": "ca1ca8c2-ef28-4eb6-8913-9e68a7e6c335", "value": "T19F13F28653FA4A7ED648737520629B9066E6810B443293DB0CF3F9DD4DFF90E2A09AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745952, "uuid": "fb839cac-7c58-4094-b1fa-0c9ffd7938bf", "value": "768:ouSjY6gkcfOU9BHG+Ab8u2tX3urrpglygoAn9A4y9p4uaEodOx02Y:LSGkyOYGp8ROpglQAnHK4uDDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763745952, "uuid": "f07513e5-4f4f-4d1f-939f-a5ccc33ccd73", "value": 45008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763745952, "uuid": "f860299f-e8e7-4b4b-b00c-aaa12e7a077a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763745952, "uuid": "0753a39f-17b2-4b40-a642-cced1c224287", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a326cb-c729-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764124, "uuid": "f4968dc0-386d-45e7-9624-569ba54c096f", "comment": "Malware payload (Mirai)", "value": "31f09a29503dc37d9ebe438d90693626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764124, "uuid": "8585d4b9-8f46-4693-a038-48238260edc6", "comment": "Malware payload (Mirai)", "value": "e959eb9d18affec46e67ef850897a15ee7ab25f54456261317bfff1044007c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764124, "uuid": "b46114ff-c94a-46d6-998f-f2b99cba5c29", "comment": "Malware payload (Mirai)", "value": "138b5a631d6637ae41aba987984e8c25015aa053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764124, "uuid": "96f6294f-a542-4b87-bf0a-88efb9b814ee", "comment": "Malware payload (Mirai)", "value": "21fca446dde17e91436972f7aeb9419c638eb68c04ddf402350e4b23a82e700bea79d847df57b2c08370aae8036f23d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764124, "uuid": "e55cf1e7-1bf0-4fcc-a01e-f95f7d6e6754", "value": "T1AB33F1AC86D6BED0C92A4D7D11FB69F59744D0C172DD5B9C0B8884849F3C8193E2D0F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764124, "uuid": "e2ea1b2c-9ba6-468c-a876-7a99b58bcaca", "value": "768:tzzEd+Vv/VJ6HAzHfnRaBkrAE50n40zKWSTfafk4eJhEeNXqzziAbW7:t/EdWX6aHpaBWKnvvRzzi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764124, "uuid": "19339542-516a-45c5-99d4-2a11bba79ddb", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764124, "uuid": "dc131c76-cb9a-41f0-a6bd-b5c68190995e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764124, "uuid": "1fe7d464-8b35-4c5a-9aa0-b5be06a5ff5e", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804eb330-c6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763724637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724637, "uuid": "4139e552-8e74-486f-b9c3-9f00c7809f80", "comment": "Malware payload (Mirai)", "value": "9e856373c1ff272775a8aa31312a1039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724637, "uuid": "0a51123e-d69f-4d02-8a80-cbb2f1b701dd", "comment": "Malware payload (Mirai)", "value": "e9901369d41880b3a2878258d62e959c15022513cf833d7ace305de5b1fe9972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724637, "uuid": "a2e15955-f992-47b0-9da3-db5f99de3c51", "comment": "Malware payload (Mirai)", "value": "e0e7e87cb302551c1256faf934603707dd0fcb1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724637, "uuid": "a9a175ba-68ad-4228-8e9a-edacfa0b22b6", "comment": "Malware payload (Mirai)", "value": "727dc8e76a601198fbf64daf6d6418b5598a9c7901bc51f1b0ed47e4db8f56f289399416c348f7ade0c03eaea152a22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724637, "uuid": "c20d6148-b39f-4690-9812-f64d9e2d4c34", "value": "T1D2831881F8C28B2AC6D013BAE6AE698E3361A3E5D2CF7527DD244B11378111F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724637, "uuid": "f1b50d35-3ab7-4d17-95ab-d529654f0770", "value": "1536:ufNxCoqyx2lTaH80n1JbvgSX9jopOVAAWR5pFZJ5KQEnph:ufNUoqyx29aNzh2tZJyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724637, "uuid": "9eb6ef69-516e-4d28-bbd4-7210e7d637c6", "value": 83468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724637, "uuid": "874df374-a03c-4078-9584-1c07a33a9c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724637, "uuid": "63c82409-6b68-4a06-a511-a00853a4915b", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee2ba83-c687-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763694757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694757, "uuid": "bf48c306-742b-48b9-9458-9ae4cff54b67", "comment": "Malware payload", "value": "e2fcd16f04edb6f6f83921985887b79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false }, { "name": "UNC2465", "colour": "#79A139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694757, "uuid": "71315b69-b276-418e-bcfd-5e7803cec3af", "comment": "Malware payload", "value": "e9b15ced5ae1cc9f93b91f7e23beff15f2801a475cced0ef826653f3b3a89dcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false }, { "name": "UNC2465", "colour": "#79A139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694757, "uuid": "7c918d62-233a-4d27-976a-5f785f98f838", "comment": "Malware payload", "value": "8dc1036dc4a169c53b6b6787187b64a99075e497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false }, { "name": "UNC2465", "colour": "#79A139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763694757, "uuid": "40727404-352b-4760-bbb5-7c69c5822b64", "comment": "Malware payload", "value": "04429b6969789cbc520b40af05573cc6e74871d77745798797ba0bb5d270405e9a63c13dbaf43dbfef87e3862009e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false }, { "name": "UNC2465", "colour": "#79A139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694757, "uuid": "de96bc43-7d90-4d33-9d14-ce4aae08d354", "value": "T120B7337C7252BB18CAA638BC9CB1B060CA827D9D39D9C0559B3DBD804DB78C3EC97255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694757, "uuid": "ff50c712-2be0-47d3-8874-7846dc74ac0f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694757, "uuid": "6a880b49-4fa4-471f-b908-ce3f022bdc1f", "value": "1572864:JxcH5/1bUEwmOL+8fzKNDX200XdkBeo3Zo0l+BGP:JxcH5/1bqmOL+8f+m0IYZay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763694757, "uuid": "bf573808-776c-4d1a-a57e-08b73169de3d", "value": 51393528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763694757, "uuid": "f69b6926-2b20-4e06-bcbe-09030f1b618a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763694757, "uuid": "236be052-99c6-4fe1-a57f-f241694f6ae6", "value": "ScanCore.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4f9196-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1763715956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715956, "uuid": "dec41400-9350-4ed1-8e78-9de8627ed0f3", "comment": "Malware payload (Adware.Generic)", "value": "5f350add374984d4036db47adb59185d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715956, "uuid": "79972fad-f20d-4fb9-92ee-838259f7dd12", "comment": "Malware payload (Adware.Generic)", "value": "ea8c2ac345fce0d08ac7f3f6cd804ddb3f3a519a1913af1d542f1514da328fb5", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715956, "uuid": "5b6a99ce-7f64-457f-a1a7-c3d57291d4c4", "comment": "Malware payload (Adware.Generic)", "value": "0a2a810227965f8057d537cd9908ee8d9ce7c78a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715956, "uuid": "9d50994a-4280-4d45-aeae-9508b166c728", "comment": "Malware payload (Adware.Generic)", "value": "1522a23b7cda423074499ec95b656713e9a41ce1f0fbaf9a746715013820b6da6899187c363a99af35125a58dba5e04f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715956, "uuid": "9dd3706d-cf05-4a4a-8984-91e2f6951466", "value": "T180A6233FB268713ED9AA0B7245B3D220997B7BA1791B8C0E53F0454DCF364B02E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715956, "uuid": "ce688e03-ebd6-48c3-bb44-295e22e5e983", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715956, "uuid": "905932e1-f435-415a-8e19-76fb2ce88a56", "value": "196608:wBvir7o7Op+b+n/tfq7vsHi3PjkvsHcQt2AmD5LCjxv7Y:siWb+n/Jq7vs8jSsHDNmEFv7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715956, "uuid": "ec6138a7-3e5c-4eb2-888c-3033b4a801f0", "value": 9566214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715956, "uuid": "73f035df-84f9-41ec-887c-0f88ed37851e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715956, "uuid": "7d91b756-6d63-453c-9f5b-abf2ef9e37dd", "value": "sa-mp-0.3.7-install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b52aab-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714479, "uuid": "6543be05-bd3c-4ba3-9608-ae82d94550c5", "comment": "Malware payload (Mirai)", "value": "c7e228676ccbe7cd86bd5c773c05da2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714479, "uuid": "81fafe66-3559-48ec-9c6d-077521f72467", "comment": "Malware payload (Mirai)", "value": "ebd0b6965def259a3ad014e5e04747ea861b7945f8dd0f49f679926fa419715d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714479, "uuid": "ea1b325a-c25a-46f5-be91-e042985e3b8d", "comment": "Malware payload (Mirai)", "value": "c381ab5db1c89ac9712dee01889ac893eba6b141", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714479, "uuid": "65c3a265-9293-4064-8363-3b732ab2eb4a", "comment": "Malware payload (Mirai)", "value": "5e3786b2dcaaa82b0f12d781df80fcd996070169fbcddaaeb997e05e5b83734559863887f825a001f561ed70388528c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714479, "uuid": "3adc6ad6-08f9-476a-be5b-c31fbbb3f92e", "value": "T14D7302784608BD3ED29D90B315C959F8A091A863D1463973FE4A0E25A6E38C5017FEFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714479, "uuid": "8a7b2e9d-ff52-4fe6-9a5b-541137bfe2f9", "value": "1536:n7EzJuHEFN+0N/TG+4LCPiATe4LK5nUAw08aKLQA1rP+:n7EVJfD1j4L2zG5nUz9QA1rP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714479, "uuid": "a4070bfe-715e-4ba7-8474-ca8da7785563", "value": 74596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714479, "uuid": "8bae4fbb-762a-44c0-9e8f-33cb8f84e503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714479, "uuid": "1cf8aaf5-31f6-4e61-8a32-2e6f029aff46", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc4db7e-c6f9-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763743534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743534, "uuid": "23935571-e726-4354-9b54-b5c8008508c3", "comment": "Malware payload (ConnectWise)", "value": "c277ded48706627b63623db7f200460d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743534, "uuid": "21d57222-37de-415f-a662-215d42cf9cf7", "comment": "Malware payload (ConnectWise)", "value": "ec10a4cd0ef5a679b9b1373061a97f9dc00199494706302079ac9a5f58012511", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743534, "uuid": "241001c2-0b5c-44d0-848d-13838bd00c0c", "comment": "Malware payload (ConnectWise)", "value": "a91d473c3e47033e5ec1cdaea4d0b007814c421c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763743534, "uuid": "69e2c9f2-9615-4a83-b3fc-d31fa4855c00", "comment": "Malware payload (ConnectWise)", "value": "ecbab8cf1e2b9501cdec582e98750afab63c251adf908a03e9e15f3a676eaa56c35866b0d812fd283b991687263f5f99", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743534, "uuid": "9e51486b-08b8-4c02-bfb3-4a030082cb56", "value": "T109E5E021A3E4C136C0BF0639D8B95561A7B4BC099366C75F57A47D6D3E73B808A223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743534, "uuid": "f87c4fbb-1e9c-4b10-be9b-270b4ac00033", "value": "5e4c14112c0f4c3c784dd28246e56fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743534, "uuid": "ef8a354d-f1aa-4e6a-b2be-89de97b39951", "value": "49152:iZwPTPFIST0+TL3Z0Mi963PSugQeccp6EsToWTn1Yt+fLbXGundZRT4T1g7:iZkyZ16MAEsToWT18+vGWkTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763743534, "uuid": "7d66dac3-ad75-468c-8921-1ea7e223f95d", "value": 3282064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763743534, "uuid": "84ec2d0b-8969-4756-9971-57bc6e09878c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763743534, "uuid": "693ccef2-bcd4-491d-9f5f-c59bcc3b5479", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac7973a-c6e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763735070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735070, "uuid": "835f269d-30d2-432f-8dac-414b18ea2017", "comment": "Malware payload (Mirai)", "value": "455b62582461382376bb9ac49262eef4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735070, "uuid": "ab2586e5-e1c4-448a-862a-6255ec16e0ee", "comment": "Malware payload (Mirai)", "value": "ec22eb905f9f8836ef1c36cd3afe5ac4f43fd48389a5045cbbf3e1361a7d5bea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735070, "uuid": "9892faf2-f81e-461e-b2c0-dead404a764d", "comment": "Malware payload (Mirai)", "value": "69383fb1001a2dee1bae6f2d7085b061dfcf984b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763735070, "uuid": "7aa90ef3-55a5-4133-91d5-7b33664d025a", "comment": "Malware payload (Mirai)", "value": "00854d98e775e03d08eab348c38bbdc605b9d2f165d94bbf6417aab431cd84b98090f5e2f7614f9d01bc77b44a68dfc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735070, "uuid": "0cde9ba3-b3b2-48cf-ab49-5bf7b7ffdefb", "value": "T19CB36C22B8391E27C4E0947B22F74766F1F517D924A8CA0E7E720E8EFF255503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735070, "uuid": "3022ab31-1edf-4e37-a779-0f563bb2f86b", "value": "1536:RDEE6oLRjgjAa/T3iA7PDNxo9iZhmCr4MnxobuCiG+rC+CHtrjYm5MAYMFJitKdq:9ScepoCr452G+94tjYOGAdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763735070, "uuid": "0ab824d2-4628-4337-8619-c4ac373dda93", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763735070, "uuid": "8ebcb83e-3bc1-4e3a-8a0c-5d21a17f7da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763735070, "uuid": "6394279b-8888-433e-a09a-93e8a6b6ec9c", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f7edf3-c72c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763765529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765529, "uuid": "69afc38f-0cc5-4915-971c-612fc9653000", "comment": "Malware payload", "value": "bfc91f029550ae117028621869d5c1da", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765529, "uuid": "267ef4d4-dddd-4463-af86-be7494cdafc4", "comment": "Malware payload", "value": "ec5d14ca011ba8c12f4d51b0d463cf51051feaf1655c7f709dce3ffa625dfcf6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765529, "uuid": "2f42865e-34b5-4b4e-817c-2fc464b0e398", "comment": "Malware payload", "value": "df2f4d8311840488facab07a3ce54cfb86a84041", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765529, "uuid": "55ddefce-baab-4ec7-833c-d8392c41d0a3", "comment": "Malware payload", "value": "b2882b6b2c24936cba0b30dc442de8564e58f31a063e6338f238e8c018ece4f042fa0ea6a73b507c2e81b9b64bd24b72", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765529, "uuid": "afa648bc-86bb-472a-841d-2de1cf734dbc", "value": "T1B3B67B9271955EB8D252FB3CD94242AFF21DFC085B9143C7829A6D702E723D91839FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765529, "uuid": "24e52d78-db66-4be2-9376-8807e4ab71f1", "value": "e1833d8c9cab446ba71f57dbfec6896d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765529, "uuid": "23e809a9-8113-4b2d-ab4b-9e0f32605756", "value": "196608:KS7jl1N8wCA7muMROBLg8hgpNZQy0GvJ4Z08RBCxXB7q3oWqCiCBXBv:Pjl1N8wCA7muMROBcDp7Qy0Z08RBCxXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765529, "uuid": "d382bcbd-7f5f-407d-a335-5fbfbd13c6a7", "value": 11413504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765529, "uuid": "cae5f86f-1678-42f4-b65b-2aeefb8776fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765529, "uuid": "f25a9490-e554-4818-98b4-91e3ea1f7f7c", "value": "libmupdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c955e5-c6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763724830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724830, "uuid": "55c75cae-bf28-4c1f-990a-9b1fd4a77146", "comment": "Malware payload (Mirai)", "value": "9c278fe8414c4e664dce0406e6993e90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724830, "uuid": "fcbf8a47-9010-4f61-bf3c-45e6a34f9b0c", "comment": "Malware payload (Mirai)", "value": "ec5e903bc067d016975e7cef06fc8f7f0a58ebdc75049c80ef4869f7c575d8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724830, "uuid": "f9ea2596-b4b1-487f-9408-64b763d9b47a", "comment": "Malware payload (Mirai)", "value": "f8abc3b572a14356115fb13e593895803b6a1278", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724830, "uuid": "fe9fae9d-a161-4695-8d82-3d0e3ab20cfd", "comment": "Malware payload (Mirai)", "value": "bbccbb1aab8c376537b1d58a84752d26ab4d14cd6a1d971ec95e06ce8c0fc659073f480e3364aad9f8324cec18787d4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724830, "uuid": "432127a7-b757-4e17-8c1d-574ed39b94d0", "value": "T1386312BB49365862C6F0D156B30058DBEC181FE991E7B4DB6C684DB0A7F40632A1E84F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724830, "uuid": "71015448-a58f-4d0e-bd13-2be839c19747", "value": "1536:YsHufd2KEyAcDKZAPj+3y1zTru4+gLzctLDyJRZK5MIbIL2c:YGk/52Z4j+ilTru4HLAtLDsUMNLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724830, "uuid": "34bd6051-e550-4d27-bb15-e007d685a401", "value": 72952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724830, "uuid": "424ef2bb-d3df-45a2-8224-9f14f94ebc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724830, "uuid": "0f3b5f9b-0011-480a-bb87-901b2ef023e3", "value": "SecuriteInfo.com.Linux.Siggen.9999.21934.23929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c1b67f-c69f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763705022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705022, "uuid": "97d4f0cf-8af8-49e3-b245-6c0d3b81bb11", "comment": "Malware payload (Mirai)", "value": "1bf45a7a60dc1f3587eed8219bafb24e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705022, "uuid": "3db3577e-f6da-42e7-88ac-d2a3b7a637e6", "comment": "Malware payload (Mirai)", "value": "ed7002fb514deb13339171d982be492e6ef1c097978fd4bfcb396eab0b2d8488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705022, "uuid": "9583baba-bea7-4561-be9b-5d7eea796851", "comment": "Malware payload (Mirai)", "value": "7dbcf617fa9e2d0cd029834b3133211522f948d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705022, "uuid": "f443f076-398c-4419-822e-f6087aacff87", "comment": "Malware payload (Mirai)", "value": "d1b1259980e26229ce8acc020d883623155ffb780816654bfbea453cb0d17aa1e578648acb0953188ccce6c007d7e865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705022, "uuid": "4c2ebff4-7467-49b6-8f6e-7301f901b4f4", "value": "T19E43F256D3629BB0D4B78C31CC4F99C6FA650B4E3712ADC281A4BB25E54C3837E31D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705022, "uuid": "a17ab7dd-1c61-4b28-8a2b-250b48794641", "value": "1536:X001jdrPKUWkBAxe7dNIDUbklu3+UQKS9V4u+qgw0Vu8:j1dhWkCxUdNIobBrs4u+qgw2u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763705022, "uuid": "11e50eac-0a19-4721-bc21-d4d04323ca24", "value": 57232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763705022, "uuid": "9afa97fa-ca3c-4d75-b2ba-554a2c08ed33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705022, "uuid": "08d36b1e-2ee0-486a-b7ba-16966fd7fd63", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b2fce3-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711219, "uuid": "b82686b7-1740-4e32-bcc4-c76e9b45eefd", "comment": "Malware payload (Mirai)", "value": "6dce11da73c1d6c2fe0159fa3ecb66a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711219, "uuid": "209de8a0-5f01-4027-8473-2a242996d32f", "comment": "Malware payload (Mirai)", "value": "ee48ac5a66211a2a28b18cada35b4678ae28a3a111f69ebfa6c346500b0ac063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711219, "uuid": "946e6cb2-d138-41a4-88d7-2889947ab057", "comment": "Malware payload (Mirai)", "value": "b96d6e9ebee78d395069fbac83e38f5c7aba841c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711219, "uuid": "8a689bd6-dda4-4c91-9839-265d3dd61ec8", "comment": "Malware payload (Mirai)", "value": "ec520573da3cf07e1f0ce04a77d65fac9d9ee9e66a2327717b97843f07a2153975b64168aafb9d2b839947afb93d4f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711219, "uuid": "6931c2c2-34e1-4ab7-9b18-cc9d921327b7", "value": "T1BAA3D81E7E124FADF768C2345BB74E30975833922AE1C684F16CE7095E6434EA41FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711219, "uuid": "da32b19a-17f0-4684-9f86-d992d8441628", "value": "3072:QGAYuogdsEgOO+ACA95/1wwEf6K6QPsCSU1kZnhAaH:QGAYuoX3OlACM5/1wwEf6K62SDOaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711219, "uuid": "beafcf89-b3e8-4ff1-b827-6daba3d9abc7", "value": 104716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711219, "uuid": "1e48e922-7c6a-4a76-8dda-ab5057c960a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711219, "uuid": "2629e70c-c1f2-46f9-b04d-978e52886a0f", "value": "umips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cac9e57-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763764976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764976, "uuid": "cd5cd4d6-1ea9-4b00-99f5-424fc052c312", "comment": "Malware payload", "value": "ebf1da4a81a7aed1461fbd8d624a864b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764976, "uuid": "1dbd4958-37f7-4cb1-ab89-cf18b9821903", "comment": "Malware payload", "value": "ef16ba8122617c85e38482c7376144032df948eff0dc73dfae8215faafc849b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764976, "uuid": "d116f78e-488d-46a4-9fbe-548b09a5ce49", "comment": "Malware payload", "value": "0bff255efe28358865c32053590887c05f35af07", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764976, "uuid": "a744d5f8-7fcc-44e2-85b3-0b20da5f565e", "comment": "Malware payload", "value": "891e34fcddfc9f4ee6cfa2baebe82ce9b7648af114e74af59159c0e13dde607a5c07f7e066a3df77e3e0527e407f2485", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764976, "uuid": "d75c84fc-d1f9-4832-a7c3-6d494e1978f4", "value": "T15911ACCE096564699DE8EF4C70BDC508BDF9E3C97AB1C7989CA468A341965312C00F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764976, "uuid": "3f167f83-456d-404f-9fd4-a06140068d24", "value": "24:rf8FfYB2fYNII+fCKSDfSIfel9Bfu9YfQVfITVf8Uf8/A:YqBnzx2n9w9zqTWv/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764976, "uuid": "117d7617-2fd5-4079-8fd3-97246bbd21f8", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764976, "uuid": "785621a6-5beb-4389-ad69-32f44bfaba8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764976, "uuid": "ad77f34b-1561-4124-a9c6-d365a46cb447", "value": "abc2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc6947f-c6ed-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763738433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738433, "uuid": "5d2d73fe-e787-4c23-9915-81c4f87fda83", "comment": "Malware payload (SalatStealer)", "value": "d541f95d78f86dbba7779b656e2a1867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738433, "uuid": "a9f4389e-8d66-4b02-ab66-622031ec6b80", "comment": "Malware payload (SalatStealer)", "value": "ef7cb253973a7258bdcc68ee04b7555e64f69d9143efc222deea4e2bea8fc06b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738433, "uuid": "6fed1800-053c-4ffd-aba8-76cd37fa8051", "comment": "Malware payload (SalatStealer)", "value": "eae51453cc6edb1e1829f4de40f5f9cf2cb406e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763738433, "uuid": "6bde16c9-e544-4b68-8a3d-562e23065e7e", "comment": "Malware payload (SalatStealer)", "value": "89f3c90b294bb24d7d777ef94d1b651cae1abef2339fed5eebe42f77df6735454d4f81dc933ac53729f187a0b41d47c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan-PSW.Win64.Salat", "colour": "#BE8CD1", "exportable": true, "hide_tag": false }, { "name": "trojan.dump/salat", "colour": "#68A802", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738433, "uuid": "56b63089-f975-4b40-b4ee-e55f22dbbbeb", "value": "T142E5333FC69980B3EAE0733689D95C505CD87A9934693C862EFBB942807550327B7D7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738433, "uuid": "fd3ecd35-85bf-478d-9bc3-c3c991589176", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738433, "uuid": "e97d47a7-dc60-4745-a4d3-8a3a9e0561eb", "value": "98304:4KhxcmyuULiita/sQFE1SokOjuPPMN1xG:x/pBULZU/REk/XM7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763738433, "uuid": "72fe1785-5461-4e94-8513-5ecf46575a22", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763738433, "uuid": "45a92cf6-6920-4777-8154-f6418c454d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763738433, "uuid": "eb933215-3e97-4114-b37c-abcb017be36a", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edca89fd-c69f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763705064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705064, "uuid": "2774878e-f5d1-4c07-87dd-39f780261b23", "comment": "Malware payload (Mirai)", "value": "21d314d6cb512628cc42d3bfec70c2bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705064, "uuid": "8fcfa4d1-abae-4be0-845c-1fcdbdc335eb", "comment": "Malware payload (Mirai)", "value": "f1715fda1c51ebbb0c75271cc71ebae5c5a683e2753a84a2c7760da77a093389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705064, "uuid": "f6cb388e-8282-4c6b-98db-48e81f283b8c", "comment": "Malware payload (Mirai)", "value": "c211ee4a940188f2670dce8c17fef24d25d5023d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763705064, "uuid": "ecd938c4-0146-498b-a729-765f13b86293", "comment": "Malware payload (Mirai)", "value": "7edb2880dce2d1757de171229bf2f9c67aa72114e8c2fc733c821f3788a955ad5eaaa31a613117b517d02e954b202771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705064, "uuid": "4737a5c4-40b0-4e4d-bd82-ead711d1c077", "value": "T17BF33A02731C0947D1A37EF4363B27E0D3AFE56125F4BA44291F9B8A9271E325586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705064, "uuid": "685943b4-df5b-439e-9bb7-2eb2004febeb", "value": "3072:GQcVNlign7u6BYsiqa1xGoUtOJQUBf778:GQq3zn9oqa1xGoUtOuUZn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763705064, "uuid": "37ff4df9-790d-4efc-b211-d550e526403f", "value": 166404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763705064, "uuid": "d7755101-aa92-4c1d-8f87-8f748a0d3444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763705064, "uuid": "7dd8c9d7-1c53-41bc-991c-2196e03e00c7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18cdabe-c6d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763726464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726464, "uuid": "66797881-09a3-468a-acb0-1853e89d7708", "comment": "Malware payload (Mirai)", "value": "3726bbbe97493536d58aea8838ed862b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726464, "uuid": "f4f6306d-f1ae-45ba-a3f0-d084619504bd", "comment": "Malware payload (Mirai)", "value": "f1c39d40875edea37c49bcc9b8a070627fff65c7bc67eda0302cfa826622be39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726464, "uuid": "c1605aee-a871-4805-9503-a48e9ebe93be", "comment": "Malware payload (Mirai)", "value": "456c21e976cad6f68b39d73cadab58ec33c4b8e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763726464, "uuid": "40309979-b6f4-4463-8c26-e94d7e1dcd9d", "comment": "Malware payload (Mirai)", "value": "f36b29768493a21e2031f384312cebd57e9301975a6a499c41ee4b608ddce6b070069c90b0382bbe3f619e58dcd59832", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726464, "uuid": "e386b269-9f4c-4c17-8be6-28cb8afa8a30", "value": "T1FF63024148C25F61E5F140FAE12889018E56F7F8E53E7AA3D3749BF178B00C7AB429D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726464, "uuid": "5482f100-a1ff-4ef9-83ad-710a5ff9a581", "value": "1536:cfQIKtTGsT/k+cmrHz2mJefarv1T7wjJrFnWkLEyJRZKy8Qb+2p:c4IHsLk+cCT2Yefarv1TUJFWkLEskQy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763726464, "uuid": "7be7e464-9fee-4265-994f-d1b17ede7e3a", "value": 72992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763726464, "uuid": "27505bd9-688c-457b-a758-9bb8c389affa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763726464, "uuid": "e3827251-7644-4218-9083-8fa86ceb406a", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fddf5e-c72b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763765101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765101, "uuid": "a4ba5c20-f69b-42ee-9b19-f8e9524b4a76", "comment": "Malware payload (Mirai)", "value": "a3caffcd8f8a4c0f3124afad5a2668d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765101, "uuid": "73dc4797-5056-45bc-944d-f8c52acadd7a", "comment": "Malware payload (Mirai)", "value": "f2dba4a7f3537df00b6c19eafa672fa0432888b002d7d03cce54f8a52cd99395", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765101, "uuid": "7d16d92d-f84b-4d76-bfa9-8d49fd96ef97", "comment": "Malware payload (Mirai)", "value": "677e8f354a9740eaa7b4694553fce3cc0a711cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763765101, "uuid": "b9d2203e-b286-433d-8ffd-78e1af0eb1c7", "comment": "Malware payload (Mirai)", "value": "e3a81903e8c151ed6e26390cafa8384b633c5f543702705cd83473ed5fc1d1ae78a26ccdf26dea248abd1403703f051a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765101, "uuid": "73e06dc9-43fa-4a7b-92d9-fb5be3b60a81", "value": "T1ACE30B46F8414B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765101, "uuid": "3b97ac13-2f5d-4829-97c3-445885d41d7e", "value": "3072:DHea4CTDUjnwJIXMb6kzz5aTHACdYV8P4eLH:zePCTDQ6IXu7zdaM38P4eLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763765101, "uuid": "a22503cf-6242-47f4-9ac4-256a0cacb1cb", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763765101, "uuid": "9b64a02c-b93a-4b74-bf5f-7837ad795c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763765101, "uuid": "076a0106-7745-410a-bbd0-ff88f21aebf6", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a92fa0-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763732670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732670, "uuid": "8bff20e7-a705-4ff3-9a36-d92ab5773cc2", "comment": "Malware payload (Mirai)", "value": "9d50426d2e2fb31422363bab67c54b92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732670, "uuid": "3c4960ff-280b-4005-8189-052e1a9a0ce6", "comment": "Malware payload (Mirai)", "value": "f3e777d9eec7675386832fe869f870ae0c0227f16f1268a133d4a9d27d391719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732670, "uuid": "f2acd937-35c9-4fda-8f17-718c22b6bc12", "comment": "Malware payload (Mirai)", "value": "3aae7d7d917d65a27e814998d59c34f580261dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732670, "uuid": "a64b3e4d-9c59-4d7b-8ed5-d0c046fd91b9", "comment": "Malware payload (Mirai)", "value": "944ac8ad4ad9825b5252a9c45604d9e08c9a5e4066e484ce2144473c8652ef2bef08f592ad3becc73975625871cf9979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732670, "uuid": "6a4f9b1e-7091-4a39-bf73-84a28e282d84", "value": "T16723F2AC921761EECD0256BB674C4B873E9C3FA1E133D54A993CECB39D884A1B0525C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732670, "uuid": "d6177e53-8335-4567-85b6-2444b1b1c3fb", "value": "768:qu4POh+nKiTMJAsjjyRUudoPRDX009jjFivyGbyIzyxEAS+is7y/XRoPK8mY4OEH:R2Oh+KiTM7jjxB009jJivyGbyek0GPKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732670, "uuid": "c7fc381e-4fdd-436d-bd19-33c3fc6ce0e7", "value": 48496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732670, "uuid": "6783d84f-e0aa-4b4e-9034-309b91e4ad9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732670, "uuid": "d913f98e-fe75-4b99-98e0-3905f5477cdb", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b5ab81-c6ae-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763711216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711216, "uuid": "21785ae9-4d43-471c-9565-3bfec2f32f54", "comment": "Malware payload (Mirai)", "value": "4e85df97a71547fd7d2415b0f9b0bded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711216, "uuid": "69f2b060-5ac1-4e05-9e04-cbd36fdf070d", "comment": "Malware payload (Mirai)", "value": "f44edcb263bb63f0dcc6790a6d0b34aef41fa010e84ffd57876dc43132c91e3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711216, "uuid": "aeb82b5e-fb24-437f-91c9-206688c48a8f", "comment": "Malware payload (Mirai)", "value": "e1d2a8dfe50d41045cb9f1adb5f7bdd378c3fcf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763711216, "uuid": "47abda0c-549e-4cda-9b7e-3463c0fb2fea", "comment": "Malware payload (Mirai)", "value": "7dd2f05e863de54be8abad879dfa80fd1ad141b99513e67bfdb020b1472f166495bf327f0371e269d6ae9668104d71ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711216, "uuid": "c3295412-cadf-48ef-a457-1e0d4b280e8c", "value": "T181A3E80ABB614EF7D86FCD3745F9070235CCA94622A83BB57574E61CB78B14B0AD3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711216, "uuid": "a566ee51-6b80-4e4f-bb61-ad880e169c4f", "value": "3072:iXW7Z4Hs/vHorRDw8BPrrObpmoHHuEJY1lzY2:ivHs3ob6bpmouEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763711216, "uuid": "7cec8e85-7071-4cab-9428-36ff16799774", "value": 105660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763711216, "uuid": "7a63c259-9357-46a4-be20-bb25309cbc25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763711216, "uuid": "196b865b-fe5a-4bb0-ade7-ec694000dc58", "value": "umpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94079f0-c72e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763766447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766447, "uuid": "0512d7c7-3c3e-49e8-9301-64a8efc93c92", "comment": "Malware payload (Mirai)", "value": "54b1acb66579a737efeb9c4a0ca74c7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766447, "uuid": "58bdc743-525b-4dc3-90e4-46af942cfad7", "comment": "Malware payload (Mirai)", "value": "f53885904b77ddd59a07f421d63dbd7c6d367cc3da74f8fd9d7c23986d461fcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766447, "uuid": "4d1260af-69bc-45b3-b968-917aa8ad6dc3", "comment": "Malware payload (Mirai)", "value": "b6d2e9734e76ecfdeb92a6e4c6279af9384312d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763766447, "uuid": "05d2fa81-e9dd-4c5b-8281-ab60c633befe", "comment": "Malware payload (Mirai)", "value": "93cbf92e160a27a05b88c621cf7c1e86112f1da6b7ea21c496f4df30b4be9c6342d5a19037136f242e26d296543f2748", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766447, "uuid": "e325b7c9-bc62-43e5-9462-34f538fd7018", "value": "T1AB630233702F68A847301837BCBDCF5AFC9E8DA5C6986135A8249974280BDD7873A757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766447, "uuid": "467c0cbe-ce5a-446d-8113-33c25ae45fcc", "value": "1536:8YWnPpMi9HTxWL+KBmcO2agF9x0Q970eHwLJ6qxXXDvNdI9AEqRV+p:8YWBMUTwK8sgLx0Q9709LJ6qxxdI9AJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763766447, "uuid": "fc94dcef-a810-4acb-b5d8-e61514545934", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763766447, "uuid": "05ec8eba-add3-4a07-86dc-b385a7fa9bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763766447, "uuid": "70e64ada-5c6c-4774-82c1-f6232ae5abc0", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede07b0e-c6b6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763714942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714942, "uuid": "de1da281-a580-4a62-ae18-0a84bae1c80d", "comment": "Malware payload (AgentTesla)", "value": "70dc7355c51d1e47b205b414c3e07293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714942, "uuid": "5f5e4319-a669-48a8-8095-73bb60220fb0", "comment": "Malware payload (AgentTesla)", "value": "f56c676f25a2426f68a035dbf6a6047dce88440253d44c8eca47acfbd432d350", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714942, "uuid": "95b866a8-0edc-4d51-ae88-d9e028dd7c4a", "comment": "Malware payload (AgentTesla)", "value": "bb6afb27b5f4c51fd54cb61f207f31c594c15a3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714942, "uuid": "a23f3e62-da23-4967-ae13-ef0b2bf8c929", "comment": "Malware payload (AgentTesla)", "value": "67740221638bfed2ef2d55f4cc4fabef3c422a9b00838aaf5934f21a3e1275006e58a79e6b1330d1f99bc7048d71a139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8051634824", "colour": "#5C029C", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714942, "uuid": "f082508e-e724-4f7b-88e4-70508e08bfa3", "value": "T1FFD5333FE8E78BFC102C9AEF454718DFF9CB1204460FEA7902F49A542856463DDB58A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714942, "uuid": "50644549-e505-4955-bbc1-e6922529e5a5", "value": "49152:a+2UopS/GqPhLNMxgcjR33JE5/gOwDS4dFiTI1Hg1Q56rDW+cvU8rVPy9EKD:aoopGGe0bZMMS47iTkHg6ou+cvnr0uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714942, "uuid": "14308d85-66f2-492c-a587-b077623d28fd", "value": 2769294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714942, "uuid": "cd1d3a91-9bcb-4db1-8cfb-bcb033376980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714942, "uuid": "df1440e4-bcb0-457e-bc3f-5caf6f722187", "value": "Arrival Information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfde0e3d-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714489, "uuid": "4d74a153-2b12-4a37-a3b3-938c0755c8a3", "comment": "Malware payload (Mirai)", "value": "fe354cc223d23348cd34d32cb5778259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714489, "uuid": "99129cc7-b404-487f-943d-39854e177e74", "comment": "Malware payload (Mirai)", "value": "f5a8ba6abd8eb44d12c1e262d6e4b9af14699b1be4cc3c2560ded39fb930e86c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714489, "uuid": "a76a6415-3046-40c4-84b5-f7fc56a4ef56", "comment": "Malware payload (Mirai)", "value": "f5a205cfdffa7bb55d763bcbe33c4eefce246b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714489, "uuid": "fa5bbd3b-5dfe-4ec7-a170-df300e2ad7bf", "comment": "Malware payload (Mirai)", "value": "9fdbba24932df5b5ab7507a6279fb68d36ceee59de76ed6a00efee020ec71650b3a441e8c30fdc2958972a76e48c49cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714489, "uuid": "f978d073-1deb-40fb-8302-94b404634228", "value": "T1A204392F3585D2F0FA411B74ABCBD3976D690BBF1099909F6B412329B6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714489, "uuid": "0c14e2b0-e08f-4642-a795-5eac82b09f23", "value": "3072:8jciHfdQPr/MownR7gvdp3q8VJmXsk2P6RDZya6dCOGNhEcdN1uKynv558PGjUXf:8AKQPr/MogezbiRaVYhf12nv52zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714489, "uuid": "055bf7d5-77c3-43d2-a1c1-d9b022e76d3d", "value": 189308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714489, "uuid": "2f5602a1-7bcd-4b01-b764-d2edf01677a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714489, "uuid": "a271e3aa-becf-4ce7-a8b6-583d1891afd8", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a3400b-c6e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763732593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732593, "uuid": "c76c7a67-11b2-4175-b679-27f0418515f5", "comment": "Malware payload", "value": "bc9b4805e663ce28d4c8a8c8ade259dd", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "evosas-live", "colour": "#EE3E2A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732593, "uuid": "450a9960-4ec0-41fd-86ed-dccc738fa207", "comment": "Malware payload", "value": "f6921257957d560cc95d91007fd53baddabd4a4627ac0ff92e48a96fd683a048", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "evosas-live", "colour": "#EE3E2A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732593, "uuid": "8beca85a-806c-48f6-a4a4-2efd92e8be3b", "comment": "Malware payload", "value": "f8d002e7e864bdb1bf11b3ff26676957e53da58c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "evosas-live", "colour": "#EE3E2A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763732593, "uuid": "2fafd37e-ec9e-4767-a911-50fec97b0083", "comment": "Malware payload", "value": "01111e30866cfae49e4d9e065c6988458ade6f6794f5555f92d8b2557ca5ccc37653321e454008b36e137fa9ae9c8be8", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "evosas-live", "colour": "#EE3E2A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732593, "uuid": "509751f1-5f30-43cb-9c18-1a2c0be6c579", "value": "T101060122338AC53BD9AE02706429965F55AABDA30B3140D7E3C82D3EADF54C16736F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732593, "uuid": "5942f6ea-4d19-447d-9fed-d843b1ad5411", "value": "49152:C2JY0ZKumZr4AfTreUuyZD6lvVz97fMaRhK36RJ7MoTNTdhel0+x5jIoHWuO+HAo:jYeKsAfTgvVVS3WjdhelfIo2b+MjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763732593, "uuid": "82dc0a65-a3dc-4c03-8d8a-4180842e31c2", "value": 3713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763732593, "uuid": "4ba24aff-0ef9-4522-9d38-f171ce411813", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763732593, "uuid": "1775914c-88ca-4b1f-ad45-3f7949622686", "value": "f6921257957d560cc95d91007fd53baddabd4a4627ac0ff92e48a96fd683a048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d40bd3-c709-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763750384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750384, "uuid": "ea6f5457-a48f-49a8-af72-ebec1b909cdd", "comment": "Malware payload", "value": "765176a643ed6d58c6a04b4fe80f7ca5", "object_relation": "md5", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750384, "uuid": "03464649-134d-48ce-93b6-b28e4adeb4b6", "comment": "Malware payload", "value": "f739db503502d60d0526e590b657fc56c07fe3ef97aad73beb3ca02193681b95", "object_relation": "sha256", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750384, "uuid": "45dfc78f-be77-493d-b269-216ecbc97797", "comment": "Malware payload", "value": "d336ce42aff86e7f22e3b567c186925f2aee94e1", "object_relation": "sha1", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763750384, "uuid": "8118b010-8621-4471-a02f-7fd1711f2651", "comment": "Malware payload", "value": "6f6d58769a24ce18d088cd004b953b44a70a6960a71594482e298970d0e30de45d40b9fa09da8548a4cf7cde9f27563d", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750384, "uuid": "e04bf14e-a751-4794-95d4-e8238c7477ad", "value": "T1AAE633F5CA14B9B798626F6C481006C77C9981DEE70E432CEFA019A371DEF3BE5A4548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750384, "uuid": "603f2e7e-9133-465a-9a37-dc5067e0e339", "value": "393216:X2ia6lnFR2E6w+/6SLnE0IXBC+qpPabXId2kHb:X2QRL0/rnlIwVyDIQk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763750384, "uuid": "e2c4386f-911d-4281-9c5c-f6ef78961681", "value": 15232532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763750384, "uuid": "d9f6fd1a-a8bf-49f6-bb49-ac6fa4c5d76c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763750384, "uuid": "fd028710-125f-4add-93b6-8ea985d532ac", "value": "Set_up.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a308be-c705-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763748516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748516, "uuid": "076d9ccf-cddc-4259-aa70-e241fb32daa2", "comment": "Malware payload (Mirai)", "value": "3fdc064301129b6cd44ecb92925d6f16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748516, "uuid": "1affa4c8-c4b3-4e77-8fc2-0a69ae1527a3", "comment": "Malware payload (Mirai)", "value": "f95c9af2e7be1e2edc8d123e38a25fcbdd4eb1f159f918e1dc4bc55eaf0676f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748516, "uuid": "71a98d2d-031c-4c99-b8df-065fec7e9c14", "comment": "Malware payload (Mirai)", "value": "58f20f842cb59ec51a04e9dfac7c1b999d7e5214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763748516, "uuid": "5b562eed-9199-4d08-98bb-d4e66d758ce9", "comment": "Malware payload (Mirai)", "value": "6831f59fb853fca830bf91e5804aee37a9b451dfc9407c042df886e567cb6fb911138a824c13f84f45b7286b9c769f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748516, "uuid": "c5f33b22-3e88-4e65-8999-87c271ac206b", "value": "T10A83F707B711CF10E75ADA3046F78B562AAE16C227D29546F32CDD603E6434C682FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748516, "uuid": "89eb0c88-0b0d-448e-ae7b-20103e859a9d", "value": "1536:z3yEAdcTzmAMgsUj733yZeAOul966JuC230Y/+jr03nkhYKTSJ4E:DVTyD8/yZRg30YWcVKTSJ4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763748516, "uuid": "bf8d33aa-dc7e-4eba-902f-043605dbf837", "value": 84204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763748516, "uuid": "68932572-2d21-4906-8bbb-ea9009bef8a5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763748516, "uuid": "5b3838cc-d54c-4167-ad0b-84d6fb4d6ada", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b55741-c6b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763715947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715947, "uuid": "df97ae10-809b-4776-a162-42fbd86df135", "comment": "Malware payload", "value": "143ec6b2e5868ff7eb3ae6a1cbf603ac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715947, "uuid": "a8521d94-5d15-43cd-a6b0-9e42e914b28a", "comment": "Malware payload", "value": "f9ac55ae787eca2c6a1dc1e5057cd1806d69d5f7b557ef5b1a6bfea397865ebf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715947, "uuid": "73d76598-5a8f-4996-a3c6-ccc9e478405b", "comment": "Malware payload", "value": "07d3581ff0e64226784ba79683c7ce0c865659d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763715947, "uuid": "de50240f-d984-465e-902b-28f6cf9bf3af", "comment": "Malware payload", "value": "69dd78b738b38008364df921d68160af5267021b1d326a437703aa5b7c4a2efd4bc19e56c895feadca519f963833d233", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715947, "uuid": "d1340090-a075-484c-bb50-9541d9b940a1", "value": "T1C595F146F3E5BC2FCDB780364FBA077A41868D56C646D3174466B12C9DBBAC48E82BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715947, "uuid": "c4c7aa2e-b823-42d4-b8b9-5d89ded17cbc", "value": "49152:EIzQec+aeb2dFyK7xlvJ0vxxbhuadYmB+3jPfFFDuu1C+bg2Ai:EIskaebsPHNCcjPHuyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763715947, "uuid": "d1dd69f5-b1e1-47b6-b703-ccf3e754e4df", "value": 1933105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763715947, "uuid": "0213dbbf-dccf-4082-979e-a94c8d961843", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763715947, "uuid": "a2ebb801-8ba6-43fe-95db-dfaeb4a45e36", "value": "download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6320156-c6c8-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1763722687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722687, "uuid": "4bf9098d-86fc-433d-a525-9d39b9afa145", "comment": "Malware payload (VIPKeylogger)", "value": "d96df749ebbe7630ece077a29005a49d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722687, "uuid": "72aeaea5-9e43-4751-8bff-cb4e38728838", "comment": "Malware payload (VIPKeylogger)", "value": "f9d6984241d27a0d169da35729aa5352435c550331b7479452e7b022204a26e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722687, "uuid": "40108a10-81aa-44df-a062-f9f4a3b76268", "comment": "Malware payload (VIPKeylogger)", "value": "79ae434ec1ea078641f497006eebfec601aa0b89", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763722687, "uuid": "4eeb38dd-4ec1-440c-8ca0-6b92ad712cdc", "comment": "Malware payload (VIPKeylogger)", "value": "3cf38c3b08eec14940aada070a71712cc5cc4089ef7a3a666f0f81c481201a26d2188b59107251b0b9faea4559a5f41c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722687, "uuid": "ebd4fc22-6570-4e6c-abc8-7305139c95f0", "value": "T109661203447F08C1E5A760654EAB859DAE3510DFB8A6EC983DBF0BE44F4ED205D39B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722687, "uuid": "d9abb2bc-56b0-4057-a9ca-7f6c27817f6d", "value": "768:/KDacKz+06o2OAYqtenyfVOZ53vMf6rNEDroO+XxHeoyfVsoz3zks31Nf6oNyaNC:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763722687, "uuid": "1ba0303f-2177-4da6-9c6a-469731a0adb4", "value": 6655359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763722687, "uuid": "fdb2a403-1267-4e28-899d-b2c56f08b175", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763722687, "uuid": "43031cc1-9f6e-4d4f-89d0-35c02b08d7ae", "value": "dvswiftsend_25047474211125_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea9fad-c72a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763764369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764369, "uuid": "d77a0834-bc45-4faf-a886-b102345eb70d", "comment": "Malware payload (Mirai)", "value": "20bc2bbfd2a549bef426a6b0e311636c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764369, "uuid": "1b90ec0e-b380-4ffe-916b-d81fe1f69e56", "comment": "Malware payload (Mirai)", "value": "fa0d2b62161505e85714ab89afcaf7e418030f8427dc3257801a355752b3e2c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764369, "uuid": "be70c3a9-8b89-46b1-84bd-c7465e4baf0d", "comment": "Malware payload (Mirai)", "value": "9c73aebfef3d54e57ef42bda1d875bb0d5f2b392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763764369, "uuid": "e3b09121-7382-41e6-b50b-a07564b016a3", "comment": "Malware payload (Mirai)", "value": "549e15f2356219ba680f1227c223513b5a92695146578cfe0c409bf1af05343ad9e7d49bb90b1c164385073148513102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764369, "uuid": "faca6cdd-8536-4390-b502-1d606057122d", "value": "T1B0C33BDAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764369, "uuid": "05347c3a-c062-4b8f-a351-a7afdc002940", "value": "1536:OVI1MQBlUwbswLQ657zSwISXqZdkZRxJsdtHWYpL3fPu8lgxFkGOEVK5Kx5vjLvo:O7wLf5ESckXE2sL3XunXVhxNAp47Zt6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763764369, "uuid": "320604ec-8bb3-4661-9924-ed1b0f440508", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763764369, "uuid": "ecc94b4c-4b61-48d3-8f2f-1109dc12223a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763764369, "uuid": "8c4253fb-b615-42fd-a6ec-d0dc16941eac", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc43b87-c736-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763769599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769599, "uuid": "91565c6e-a272-48b5-983b-dc627197fc08", "comment": "Malware payload", "value": "4d8290b01c2692dfe6ae9515b53b1bdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769599, "uuid": "a74c293a-97aa-4768-9dcd-3f5a6c4ff917", "comment": "Malware payload", "value": "fa89310a2f3f35350b2b464a3427f635ce3539d73007532d0c3ad1f52973a935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769599, "uuid": "fe204f1c-f597-4d37-bafd-3d1a834c89c4", "comment": "Malware payload", "value": "f8a53ea01686b24ffaba6aea1794f784d5e17730", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769599, "uuid": "18862e5f-5186-466d-9c66-bacd6d63157a", "comment": "Malware payload", "value": "bada27cbfdbbd1c6a2b02857999c3498a05ec9ddad5308bb17a3a21479397b1ed99faa860cb53708c747d5dd54563968", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769599, "uuid": "02319ec1-1f8b-4c25-a67b-d9298e2d2579", "value": "T1A233F121AC6247B389E12C7585DCC4465D3D8BB6F2E7351620DCC99C2DD138C6BEAAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769599, "uuid": "c4970479-dfba-40e0-a2de-b3ac0bf0e263", "value": "768:QElkr8F6sdFPaW5T7wkihER4oTYGtEYbfqfI4Xv93Ie0P2Vs5vtrubqizJreCNJn:dO26s+W5T7wkv4Oj2r+5Wqi8Wv2Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763769599, "uuid": "f2646cd6-2657-489f-9856-c051b160a21b", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763769599, "uuid": "61cb1415-6948-45ad-afdc-e7b3dbeb9e18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769599, "uuid": "7656bd8c-9be2-4e67-8908-80c5e5c18f51", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd7818b-c6b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763714486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714486, "uuid": "308cae7b-ce5d-4fc9-a8c9-12802ba367bb", "comment": "Malware payload (Mirai)", "value": "a934705bc2fe193b595297c2cbb3c928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714486, "uuid": "78238ebd-7056-49c8-bdf3-61216a17c797", "comment": "Malware payload (Mirai)", "value": "fb1b595f89a787fe3a2ea67326e0a3f246f98edf659d65c44a1949aa7f69afb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714486, "uuid": "62d23627-d21e-47c5-b5a2-248a42866814", "comment": "Malware payload (Mirai)", "value": "68dab14e32cf68cd45296c8c3c8ecf16dab5a71d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763714486, "uuid": "17740342-bc06-4740-96db-6537049050a9", "comment": "Malware payload (Mirai)", "value": "92c6b1543938feb947ba79c79f77186de81dd4b0797ddb15a2b9957822bae24d1c2549cd463f6870b092b3427088e7d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714486, "uuid": "42fe608c-273d-47c6-aebb-a34c8ec1eb28", "value": "T12AD3C032E5546CE2CC100A7938B9DABC07149E7417C621C2FEFDF9AE587BD94346E2A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714486, "uuid": "9024e07a-8765-4721-a00d-78cda31f9dd6", "value": "3072:BKssxRS+VCGlerXkLNdHqAjnSMQTELWhM4OQEC:BKRllQkLNdKUrLWhMcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763714486, "uuid": "46bec7db-22fe-4c0a-a4b3-92f1a196bd7b", "value": 131972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763714486, "uuid": "f324e784-7607-4678-b71c-ebbb8e68e7c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763714486, "uuid": "4f0e0dec-0c97-48e1-b245-0cd864c8255d", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e45424-c731-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763767461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767461, "uuid": "e60fc91a-f39e-4e59-add9-9a5393083943", "comment": "Malware payload (Mirai)", "value": "fa5fd3901dde05ef4b8feb83b6f8516a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767461, "uuid": "afb7100f-32c7-4fe9-9071-cbab20a83b3a", "comment": "Malware payload (Mirai)", "value": "fb2fa8af3b66f4485adc5aa15bc9158b32cbad9495aeb0b766a5856b77859268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767461, "uuid": "72a19220-ccca-42fd-a040-0854780740b3", "comment": "Malware payload (Mirai)", "value": "06e53fa742b5f6d5e6e58b5a0fa7d3bf0df75c22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763767461, "uuid": "bcfd93ee-8918-4b7c-a9e9-dabceb3e5f59", "comment": "Malware payload (Mirai)", "value": "24bcf3d3eecbd4145d88cc9389821e4ca9f6a5a0d903e42b2498d52a78afa47115de0cfacb5c60e310080674458ef0d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767461, "uuid": "40bb0d2d-ace4-47dd-9ba5-e6fd2080c272", "value": "T144830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767461, "uuid": "05fa9e7f-33ef-4997-85fa-975fa0bce0e9", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFOPOCHYmKgAHCe:EPmBcPJUqiBlV34OPOC43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763767461, "uuid": "ce588bb9-c84e-4792-aacb-1611646d6aa2", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763767461, "uuid": "7c2c9de3-fddb-49ad-9a35-128c5087fca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763767461, "uuid": "6334c969-a617-43c6-b6ce-7cd82c994896", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e231dd5-c69d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763703937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703937, "uuid": "c1c4cfec-4f7e-4783-867c-fae0b9ccc35f", "comment": "Malware payload (Mirai)", "value": "1ddb88bdf6bc4c169cadd778e158a795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703937, "uuid": "6bf2e735-4ca1-48c6-bfce-c7033d409c0b", "comment": "Malware payload (Mirai)", "value": "fc30e0c33e48a683a931198881d5e05ac764ff6e9fd6a9c975764b1e37adf87e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703937, "uuid": "73f6d48e-ed32-4902-be44-87e964cda652", "comment": "Malware payload (Mirai)", "value": "ed02b30ca17402b80c133fa889279c33202bbf1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763703937, "uuid": "6d6b71ee-3a7c-4681-8758-f18c5c59af41", "comment": "Malware payload (Mirai)", "value": "513ca821b433f5640dbc8ab0f27352fe15d4fe5d03b6d1aa0935a45cde7e44021ef552eb9d69466033c267c4ff4c6ff7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703937, "uuid": "19ab9e11-926a-4223-9a0e-a5d930047bf3", "value": "T16DC312B7AD2B8A41E04416A9938986F8E1A131E2E6004F37405FFFF4771CA5344D9BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703937, "uuid": "909836ec-e80f-4a84-8591-cdc99c8873fe", "value": "3072:TtXsNcXTGhQEE6jCXeNS0+L05xzjW1mHYcUR2maccqp:TJskGhUR0+L0H8EYF2mk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763703937, "uuid": "ed5c5fbe-5de1-463f-afdb-5b76edf8824f", "value": 122416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763703937, "uuid": "f2ecae81-4857-49ef-aa68-67c7da94c11b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763703937, "uuid": "a5ebe871-c72c-4482-8f78-fc6c10400a31", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48d05f5-c6cd-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763724832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724832, "uuid": "f6a2f7e2-1dff-4557-ae3d-db6013d84087", "comment": "Malware payload (AsyncRAT)", "value": "cb8025d3f84a526c4746b4445366e20c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724832, "uuid": "de539905-273a-45c6-bccd-fa07d5216366", "comment": "Malware payload (AsyncRAT)", "value": "ff6d69cb519de3d4d0fda0f19e45ccb5fa5a7a4e18246fe59c1f58fdf1a298ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724832, "uuid": "1c1caf3a-9a2d-4625-9db0-e89ce2876b8d", "comment": "Malware payload (AsyncRAT)", "value": "b22a8360b1adf92aaa824b44f8c255a605a50c7d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763724832, "uuid": "e1e65e40-34dd-4f19-8c25-2f2b9e461ff6", "comment": "Malware payload (AsyncRAT)", "value": "cf579cf71f6f68839112e06a24a7b230fb59bd3b98a144678e39e5797ec56924df2bace2b264c084284e369ee93659f3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724832, "uuid": "3dbce511-8e39-46a1-94d5-392ede37a4f1", "value": "T131C40164225BDE03E4A31FF41631E2B463B86E8D9822E3175FC63DEFB926B545901783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724832, "uuid": "3757569f-296f-418c-9c84-1f50f3e6254d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724832, "uuid": "8ac84ecf-49c3-40ba-beb1-77c80988b3c6", "value": "12288:4QBA4V42GFqYuyvZ7DPT8g6CgdwskrlzhyKFnuqPyPbJBbz6G:4OHV42+nuKtpULcnVyP1Bn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763724832, "uuid": "27f3f595-beaf-4b91-b917-200893318795", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763724832, "uuid": "d4b52b57-2897-47e4-8f28-294079852125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763724832, "uuid": "2bfd782d-a0b0-4cf4-8754-463a30e0e0d8", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.MTS.gen.Eldorado.30530.24300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }