{ "Event": { "published": true, "date": "2026-08-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-12", "timestamp": 1786579382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9bf5b276-d178-41e9-be23-5744345e4b9a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1941bd-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786514823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514823, "uuid": "f461c2b5-66a0-44b1-b8f2-8146205b8ce0", "comment": "Malware payload (Formbook)", "value": "c25b9ae749222f0df7b468fcfd1e3122", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514823, "uuid": "119e9bf9-c81d-45c3-bf9f-16c7f654265b", "comment": "Malware payload (Formbook)", "value": "00027cd3ed57fe8dce74c50beb4179e430ce731cfccd6ec61d98d8e92806e219", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514823, "uuid": "8ed71f37-8790-41f4-868b-febad3c145d5", "comment": "Malware payload (Formbook)", "value": "94b4476a28c7b5deef64e189119af3d2a26f95fc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514823, "uuid": "64544cd0-a60c-4eb8-978c-f33441057cb0", "comment": "Malware payload (Formbook)", "value": "bb454a676f66e5e201dfbe1f0962ce17a6281a7ff19a9eed11c59e825ab29c482bda7cd98f83e12c95008d905e7ead0f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514823, "uuid": "b68861bb-8188-46ad-8a62-0e42eeae8080", "value": "T15D730C4448C376802337A77FB63AA8D8F736476B01804907B97CB554AFF1D19E9E18BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514823, "uuid": "2b25d340-a000-44a0-8176-728afa7e9c98", "value": "768:PTfX4rHPv9PXeafhvsosnjUTx1PY9t25qft8B26VanhOo/C58j+2Bvv9JEGyj+BY:bf+0uLB27mvCDdVapXRvqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514823, "uuid": "0dceda09-3501-498f-8628-065b6e75a8c5", "value": 73383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514823, "uuid": "ad4b4ba3-d552-42d9-befd-b8afb1261e31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514823, "uuid": "e6518811-69c3-46e6-a0bf-49206f0673c2", "value": "(E9010450102) - PENGEMUKAAN DOKUMEN MAJIKAN BAGI TAHUN SARAAN 0050-E-MD-0013-00 -26--08-12.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4daec57-95fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786504856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504856, "uuid": "2d2e17e1-78cf-4b1f-93d0-374628021aa0", "comment": "Malware payload (Mirai)", "value": "7d93060dbe7a8b62d29f2a69774b638d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504856, "uuid": "113b38a4-b8ca-4b60-a83a-d191990c64ed", "comment": "Malware payload (Mirai)", "value": "002220d936b03bcceb0767a3e8357a45d6a7495c476cc8b89dcfe3a3259ee03a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504856, "uuid": "8255d17b-8432-4b45-9838-bfbb919cae02", "comment": "Malware payload (Mirai)", "value": "b43c4caa037aa2f34c27f0afe877f95669ad384d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504856, "uuid": "bdc76495-1892-4bb5-8072-60a597335d2d", "comment": "Malware payload (Mirai)", "value": "83d370494821b9b0370781ca116981bd26750f8e447def853f55ede011785e2c7c03bc705d20f25a47c5fcc58d00078a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504856, "uuid": "6be69cda-cc1e-4bbe-8d24-adf401e9dd5a", "value": "T17C63A451F8929A6FC1D1137AF68EAB8E372173D4D3CE7223CC654721378A28B0956F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504856, "uuid": "844bc8b3-68dc-4e52-a1de-2d798863f212", "value": "1536:4D0yReYZtjACgiXgkT0peEly8DitTM2TxVTSi:ZyUwFAYQkT0peEfmtTM2Tai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504856, "uuid": "7423120d-ed55-446d-b55e-a1cf7eed9be4", "value": 69324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504856, "uuid": "9019f2f9-98e5-41d0-8bd8-db17decb98a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504856, "uuid": "c1238ec6-f289-45a0-a461-1207b3c8fa35", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed3402a-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512925, "uuid": "b2295983-2bcd-46fd-98f7-66ae37531b14", "comment": "Malware payload (Vidar)", "value": "7103319d61b7335a60755933e264c40f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512925, "uuid": "c30e117c-25ca-4eb9-8fd7-4b765873a56d", "comment": "Malware payload (Vidar)", "value": "01770ee7687312bb30ca56990769c8dd527acc9e61956ab40ab5c75216f831dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512925, "uuid": "525b7acd-d3b6-40e5-9f82-297b140cc6b7", "comment": "Malware payload (Vidar)", "value": "a9fadc699c289be44bb10bacc96e00ccc1fd93f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512925, "uuid": "5c40540e-aa93-4221-b55a-a411b6fadfc4", "comment": "Malware payload (Vidar)", "value": "159a08953209131d37905f34d01bdd34f09cad4d340c02acdc3edeae2cc462b03f7d328611cb6799a8799986e7740ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512925, "uuid": "f5472682-c30a-45a9-b98f-cfd754bd3757", "value": "T160D5AD0BACD044EAD8AA5375897611927B34FC454F3263E72E90B7382F72BE09D39794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512925, "uuid": "89231b41-dc6c-4068-906f-9c6bfdf41347", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512925, "uuid": "42c3986c-8425-430f-9a39-edc437284977", "value": "49152:qYvOFO4syL9f1rqRknd/zOBL0YM5KJN4r6N:qYPmtuRknpzmL0YM5KJNdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512925, "uuid": "78a1e00a-9c37-44de-b642-7a6928fc96fc", "value": 2940272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512925, "uuid": "1d1dac66-9ad6-43ae-ab71-4c06b26ff9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512925, "uuid": "dc7f9dc8-c8c3-4745-a67d-5a5171bd06d8", "value": "01770ee7687312bb30ca56990769c8dd527acc9e61956ab40ab5c75216f831dc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5f2e81-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511336, "uuid": "0d1094df-e69f-42ac-bcaa-d89cc644d838", "comment": "Malware payload (Mirai)", "value": "2776e16931cfbacf203034971e6fb136", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511336, "uuid": "babf5d8f-c1a4-45a2-acd2-bd2212f5ddd0", "comment": "Malware payload (Mirai)", "value": "01804de69a8f45a6379fb5b276a89318cbda04a2f1c375cb1c247292c53d087c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511336, "uuid": "062ffe72-67ec-4804-83ac-ebab64e9faaa", "comment": "Malware payload (Mirai)", "value": "fe13a860a0244eb8c2166a9268e69e384d1a4f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511336, "uuid": "dd657b75-ad3e-44d7-b33a-a3fad1dc2e0d", "comment": "Malware payload (Mirai)", "value": "68b4f085626c8235fa541790cb2934d69df7f651025c613b457770446de4311b9ca6ed04fc1273ce044eb9872439df24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511336, "uuid": "f92a91d2-7fa6-48de-b42d-2eb1e707c553", "value": "T1D051787A6B90DE6DD940903EBC1713043725DB64E0C671737328D6E17D1E938872E849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511336, "uuid": "40330b40-dd97-4eeb-ad5e-da8db66452f8", "value": "48:cbKGETYjaaBN8hhiKFxLZLE6ojBuK1aAg4Wd5VDdNmjRiDPKNG5SLYZLlwGsekIs:+K+BdKnlE6W5Zg4svpUj4mwhZx4ekpZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511336, "uuid": "44c75d23-c448-4e4a-905c-f22d97bc4a3f", "value": 2828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511336, "uuid": "a3a29c1a-923b-4dfd-90a9-8692a1bae406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511336, "uuid": "03fe210b-27b0-4e5a-8a02-5fd04d217755", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be5bb0d-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786575063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575063, "uuid": "7a583335-dd88-4af4-8fb1-70210fe49f26", "comment": "Malware payload", "value": "5ffac7731469e5a5269cdae564208b3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575063, "uuid": "42ddb300-449f-45f7-90bf-eaeba4fb3175", "comment": "Malware payload", "value": "01c70849ed30aa1cc4e08cb7529b62c2e3a9044ad0ab000ad84a343444a8dd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575063, "uuid": "23012a8c-1adc-4df8-8090-4d4c8f34c972", "comment": "Malware payload", "value": "20919124a409125dd6093ab6a8b866886d5af98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575063, "uuid": "bd5ab8a1-7b9a-4da1-8158-1c18875fc869", "comment": "Malware payload", "value": "9dc1d1b52bb753045e90ef28ff46d6beee64acf62b5504a385ab1c72a361fffa46746e286b35db950b89626ecc116ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575063, "uuid": "848a484d-b89c-49a8-a6fd-28b2aa8b1480", "value": "T1CE640765BD418BA6C6C15ABBFF5E838C732B17ADD2EE3103DD155F21379A84A0E3A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575063, "uuid": "7d070077-1e47-4e8a-a21f-2869a91687bf", "value": "6144:aZHYotUWejARUS73O7pttpaJyiziVQI+Iy/2JrQA/fTMJ4/MOcqCCFp1R3X:aZHYotUWejAP7UpttEJ1iVQI+ILQJ4EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786575063, "uuid": "234f169a-213b-4c96-8045-49b352e583f6", "value": 322336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786575063, "uuid": "6eebd134-301e-41fa-8fa6-47d0aa754831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575063, "uuid": "b600c156-85f4-449d-87b3-7e43e0c86f08", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950ff044-966a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786551993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551993, "uuid": "46406e5a-2b1a-41c8-b4e1-7f2fc8238bf0", "comment": "Malware payload (Vidar)", "value": "8e2d5262eccde15f44d6fb2058d47304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551993, "uuid": "45f45989-6919-4529-81bc-a8e160643439", "comment": "Malware payload (Vidar)", "value": "01d001ab09aec1ba43dd6d6a5f32c3df1104c4d9ade3812d9cee46f1298e31fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551993, "uuid": "91e34628-6343-4ea6-872b-1ce5df0efefd", "comment": "Malware payload (Vidar)", "value": "ec3cdbbebc36c9e56aecc8b983bb1f0e28658826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551993, "uuid": "bdd16fe5-7b40-407b-bd08-191c290bbe88", "comment": "Malware payload (Vidar)", "value": "b679a173febdd51e4b311bc7015e0e8b555a0f6a949c0cbc090d67f1df854a68868413f49ac7c98f2e516abc2b9d5b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551993, "uuid": "07d8531e-2804-438c-b66c-00d603ad03f8", "value": "T131567B17ECA158E9C19AA231C9A79253BB70BC884B3227D72F90B7782F727D06D74750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551993, "uuid": "1bca8e1f-41f8-4db7-88f9-4e914c437e16", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551993, "uuid": "14f07e2b-4257-4222-8cfe-9a85a27bcecc", "value": "49152:EWN3iJpeIaRHsQs66Ny5zEyZe5YbSeysbL7mPLSvRA0DxjCTme25B2rkFkBefKcP:EgiySNKESeqX/WLSvRA0DxjCTUe4koEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786551993, "uuid": "aad995a1-cdab-4045-9171-031b17a80b7f", "value": 6264176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786551993, "uuid": "d4f6c516-23b2-401a-a960-cdb0724d8871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551993, "uuid": "7ee28d5c-967e-4ffe-b582-b84806713a58", "value": "01d001ab09aec1ba43dd6d6a5f32c3df1104c4d9ade3812d9cee46f1298e31fc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bb2bb4-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511622, "uuid": "a515373e-d856-4213-a111-f143a2517140", "comment": "Malware payload (Mirai)", "value": "f18c89e59478fdfd9ecde5b7b58bd9a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511622, "uuid": "da622640-26c5-4a51-bf32-0ba4f24c01e6", "comment": "Malware payload (Mirai)", "value": "02198bbfbede316cf98163f94625f578fc121a4a27969937d326a5e65eef829d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511622, "uuid": "26d10ecc-f9e3-4070-8d68-5963a0700a7e", "comment": "Malware payload (Mirai)", "value": "126a12e4bf1b6164762c5ddaa8d50e87f89e6127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511622, "uuid": "a87037bb-23e4-4e90-80cd-ac584739fc2b", "comment": "Malware payload (Mirai)", "value": "bb10630b12b710fc99ec5bebcecab372c1a4ae36549784737443fdd57ec9b9ea23e914ba19580d40535e429769c27685", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511622, "uuid": "70ea5088-67bc-4208-90cd-0c49bd9e125d", "value": "T142C318C1BAC18B91CBC0C17BEA0B218F6732D3B1D1DBB3C76ED15F467A969260E56601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511622, "uuid": "08e96742-e197-49c0-ba35-0eea8dcbc408", "value": "1536:JYXjld7bXXUhP0nMaOL0JOgIAFJtSJqYXBDteF:JYzHnUZ0rOgIAVSkYXptS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511622, "uuid": "9a7e2e24-b387-4db8-8f02-dfaf2307925d", "value": 119208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511622, "uuid": "ccf135ee-328d-4338-af71-469c9a429e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511622, "uuid": "29af9ae3-cf82-476c-98da-b2b6dbccbeaf", "value": "02198bbfbede316cf98163f94625f578fc121a4a27969937d326a5e65eef829d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c31dee-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509533, "uuid": "2a418641-4429-4f86-b753-3bf9609139d6", "comment": "Malware payload (Vidar)", "value": "c35237f4e5e0b03127dc0024ea6c8dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509533, "uuid": "9223d472-669b-4968-be74-99411236fe0e", "comment": "Malware payload (Vidar)", "value": "0261a9267c0c14bc8b0d0a65cd98431d7129887340458ec434764d59db8e4aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509533, "uuid": "48dc1a14-7276-48a1-822f-f96ed657a528", "comment": "Malware payload (Vidar)", "value": "c7596c0f6aa7a2f695cef5125986f333df29d02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509533, "uuid": "51de359e-51df-4037-bd1e-d9dd74a7c578", "comment": "Malware payload (Vidar)", "value": "39964f8971387d7f3cadb0bb072f54e21cfa78b9ca14a12dec21fcdccb99f7ae8244b6ba7266e54f51bc7d02c20303cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509533, "uuid": "1965628f-b2a9-43c4-8174-b43bf8e337db", "value": "T191E57B06BCE149E9C4AEA23289B711927B71BC080F3667D76E50B7382FB2BD15D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509533, "uuid": "d8c8ca45-17f4-4e28-86e8-ee8302525a50", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509533, "uuid": "41b7a25a-b6d0-409e-85c1-3c51deddbeab", "value": "49152:ywzYf97N5HLsartFZUiF21yX1xXtdcM6pYn0yKPP7gk:yws1gcxXbcHY0yMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509533, "uuid": "210dc02f-7a2e-4cce-a0d5-111a339034b7", "value": 3085664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509533, "uuid": "44538f53-29f0-49e3-860b-6e3d5bdd0b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509533, "uuid": "ec2a8116-2fca-4cb6-9971-93a141e1939d", "value": "0261a9267c0c14bc8b0d0a65cd98431d7129887340458ec434764d59db8e4aff.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32a3c77-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512637, "uuid": "7eba8c83-0315-4bd9-acce-466d924f4619", "comment": "Malware payload", "value": "4d0116364fcf51c7a48f850c1ec304b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512637, "uuid": "b2f01375-9a9d-42fa-b47b-cb6dbc026619", "comment": "Malware payload", "value": "02a25190d5372cbcfca6001bbaf15f5eb746a341239abcd8aed226a91e6a33d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512637, "uuid": "898334d4-65c5-4d96-b05e-8a1eecd6e866", "comment": "Malware payload", "value": "8c7d873043f8e7ae7925c553690341136f6d2713", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512637, "uuid": "e79255ef-d6ec-474c-ad3d-9b1e9b91e145", "comment": "Malware payload", "value": "a6296411e421f3e42924fafc6abf32d0dc70c5fb4f5cd43c1c8e386b38069a80c73b9d6edef67f331c796039f2eaa28f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512637, "uuid": "c67e7edf-22a2-42f7-850e-f6bd29a2ce7e", "value": "T1DB1189512923F033E187173EDB2EF62CB07671131D30CD48B58F51A4CF9184D6764264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512637, "uuid": "d2555e05-eab4-4fa4-8467-bfa112d3bb61", "value": "24:ghaRIvaAcMeMMiNzzMimhMTqMw3MnIMWNCs/MeubQz1uYkS4+KJqA:RsaAczM1zuhaq/3IIhcs/DDz1Xj4RJqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512637, "uuid": "36ecfa4c-7a2c-4251-ae24-fe1ab0ac561b", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512637, "uuid": "2eaf37f1-3022-4d00-9e50-4e8a6d3251c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512637, "uuid": "843dbdc8-46ab-4eca-b3d6-032ca85eb0ba", "value": "02a25190d5372cbcfca6001bbaf15f5eb746a341239abcd8aed226a91e6a33d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cac840-968e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786567540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567540, "uuid": "6c1e34b0-ff3c-4f67-8365-ba9d5bebc037", "comment": "Malware payload (Mirai)", "value": "ac028e0c0fa55813fe39d41511eeeeb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567540, "uuid": "6d22ceb6-4ade-439c-a06a-abbf3960760f", "comment": "Malware payload (Mirai)", "value": "0352a0814d2244b9568cf2b051222f2034760cf228618529371fa7d3b86050da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567540, "uuid": "7d0c9a3a-bd20-4302-8ad9-65e3ae2d0a21", "comment": "Malware payload (Mirai)", "value": "a3e5749a618cd52084dc5a7de48ac5b990631a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567540, "uuid": "09641ba9-5087-48de-8153-e2db2bc8e68d", "comment": "Malware payload (Mirai)", "value": "bc3d1cac959d843edd14df3cbeef31b000aa8f538e5f7c1e578cb494ebb955c978cbb72d562ed98e839c61d6b115cc93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567540, "uuid": "13d5db41-e069-43ab-ad7f-3acf0c0687ee", "value": "T108E33A05B30D0A47D2672EF03F3B27E1D3DF9A8124E4F684291FAA899271D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567540, "uuid": "1b550795-cf89-4e1e-9bf6-d744a86e8a83", "value": "1536:VOUknEYbTExHBYxozRilSOWeoGKrIkSFFuMSRz4fodPBiZOgsU0q3vAXtxetjj+M:gUAE3BYxgAhI8uPMZXmXVoGBH2ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786567540, "uuid": "92336fbe-88c1-4779-bc56-f38c504a4bf1", "value": 151900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786567540, "uuid": "3543f206-56a0-4a67-a4cc-837d9f177516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567540, "uuid": "e9cffb65-cfcb-444e-95f5-d30aa191cff0", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff100c-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517333, "uuid": "03cf6ff6-a6d9-425f-ab2a-7870d7072037", "comment": "Malware payload (Mirai)", "value": "74b6c7114aaf98ada7721c58456fe318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517333, "uuid": "7bdff37f-17c3-4960-82b1-0726fb75a32b", "comment": "Malware payload (Mirai)", "value": "03e2f013429e8d6e5a7ec62d6a7f421c5cd5cc770b051fdaccc11f453e58a7ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517333, "uuid": "ad6b3db6-238f-410a-a3c0-54e6f96fbdd5", "comment": "Malware payload (Mirai)", "value": "fa6f43855ca58fe5bcc82203ba7158c39b155791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517333, "uuid": "97af1bd4-ae02-4e32-b61d-b59cf65db777", "comment": "Malware payload (Mirai)", "value": "270f83866d5a98afad5a3d5aab54f5b92430f7b0e2c84ad100ef8eab9c5825f05c812de4e91a6f255ca3e09f3ca2c894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517333, "uuid": "3a5adaca-96cc-4f1a-a95f-d9ab66b0a791", "value": "T1CC044AC7F800DDBEF80AE73648530909B530B7E519921A376253787BED3A1D90977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517333, "uuid": "fa031e98-7704-4d9f-9924-256ff71e6e5e", "value": "3072:DSjppcIY8Lgzb/pt4JU+UAN1lumK6zhkDZszWVejbieL6H9j1yxDR8a:dBz8bjl/KRdszLL+byxt8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517333, "uuid": "a9762ba0-0b37-4618-8062-b2514f0e13f8", "value": 184032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517333, "uuid": "40270806-1fac-4cbd-96f2-2d9d03f3458b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517333, "uuid": "12213a0a-f518-4f33-9ce9-fb6c9f64b81f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2a08a-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786514976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "7100fc68-4779-4abe-b936-b0f82833d772", "comment": "Malware payload (AsyncRAT)", "value": "40f05ada092f03402cba730a26daafd6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "e08b5051-51d6-4c8d-92ab-f9928f6bc7c7", "comment": "Malware payload (AsyncRAT)", "value": "03f994167591b065af5e50026ff4f89cc85966025ec8c92037ac2855d27e0978", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "e46c833d-c47a-4241-a55b-58207f848842", "comment": "Malware payload (AsyncRAT)", "value": "b310950b6ba3223145930b45d783841c59c5acaf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "b888ddc4-eeee-4370-9cd4-ebe7e00d37f5", "comment": "Malware payload (AsyncRAT)", "value": "7fe5ca4ca59c464f612e3c9b4355f3d67abcdb572d2d87483bf0f43aee7a1fd1f1642d8993f3749234085fdfbfd79dc0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "fa9738b3-1cdd-4b69-9708-454c4a3c64cf", "value": "T1AC451AE717CEB90A2E297338E04C9C888B5A80164F45BBC9B0EF46C4571F45A79D8DB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "2aef316c-5741-473e-aa7d-6423889424ae", "value": "24576:+oZ9hnvgWA1J7erVNZFQ/8g5XaPMoZ9hnvgWA1J7erVNZFQ/8g5Xai:N9tLA1J7eBN7Q/d5Xy9tLA1J7eBN7Q/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514976, "uuid": "9d193f3c-ae7a-4935-b138-ac97df08bff8", "value": 1254041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514976, "uuid": "e37a6d96-3cd9-4972-ad84-8c15fc267853", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "41489fc0-f5c6-4501-8a89-239b1cae641a", "value": "LOA-AD-169919-169930.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78142dea-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507706, "uuid": "d03250a5-d922-47c7-93fa-e62f46d05228", "comment": "Malware payload (Vidar)", "value": "18758ab8f3baf84b20fe9cfff999afae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507706, "uuid": "7c94064a-c471-44e8-8d3e-d5946350163b", "comment": "Malware payload (Vidar)", "value": "0418670d867ae2d6481d618a1cd049c43649b834a1c501a817e5c06b3df9601c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507706, "uuid": "7aca3926-3928-41da-8db6-5d3087086642", "comment": "Malware payload (Vidar)", "value": "6e6e1b7b834b3c76f4f80a62b9c9579daeac2b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507706, "uuid": "9d9842ca-6dd1-49af-ae16-814f7ad21b58", "comment": "Malware payload (Vidar)", "value": "f1e8e92b49230377b7f62d95168fd0ffba9e84ef51976a83b0e573d7c78d1d1720f636c4d84f816bf51ee13527796867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507706, "uuid": "dc781218-56f1-4499-b9b1-29dbbb176dce", "value": "T124566C13B95286BAC0B4E730C5B64242B6257C4D873937D71E71AE7C2F22BD29E36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507706, "uuid": "c517bd95-b364-4e12-91b1-a12884c7849b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507706, "uuid": "4d36a3aa-3622-4b23-9187-1f2291bc592e", "value": "49152:8b1ZX7/kdQkieZU8DgrdDkpIm8x0OsW2Jn6m38r876/JeWSs9PuPwj5ONzRtTFCL:8nvwvLURo1CWPwdkzR+S51y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507706, "uuid": "8d8e25c3-3960-4d46-bf46-821c705986ef", "value": 5915008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507706, "uuid": "de28fb14-c550-4909-b3aa-170616365514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507706, "uuid": "52e4a6a3-e9d9-4ef6-be92-9fedb0ae7fda", "value": "0418670d867ae2d6481d618a1cd049c43649b834a1c501a817e5c06b3df9601c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63126e4-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511354, "uuid": "247f37a5-eb9d-4640-a904-139d9e9de9d6", "comment": "Malware payload (Mirai)", "value": "71ada7cb82cadaf0ddb350f054d0818e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511354, "uuid": "1657efc2-fc66-40ee-ac97-c3c134eb22a8", "comment": "Malware payload (Mirai)", "value": "045b0d41d1def1bbc0a71301d447417d76239a20d7ba4ddea43459e934c7cf14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511354, "uuid": "dfb500cc-fee9-4bb1-8494-248c8521a109", "comment": "Malware payload (Mirai)", "value": "b8f9e7d8feaabbe978354ffd42b9a2b1d74a508e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511354, "uuid": "107c9a56-01f5-4985-ba25-937c1e93a61c", "comment": "Malware payload (Mirai)", "value": "e3fcb88cdcace75f5b568686f41fdb18e94cfa1c6cd60e68ffa88acc4376033e596beef094a83fa62f1e824a5e9cae69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511354, "uuid": "258696c0-a28c-450d-9eb2-fbf38dd13c79", "value": "T182419809A8201D28D724C47D06221A757B19DEBBC847CFBA042BD8DC681B57C77543FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511354, "uuid": "dddbd9ab-2210-4bd8-818b-f2168e587f81", "value": "48:KdEUpPLxWp+w4YRUgsoeR72ioEsT1j7oJBgPgyIsMYNV:K7PLmwYyxAEsTSBQIsMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511354, "uuid": "2c785949-b6e7-47d1-ae95-14468754da28", "value": 2284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511354, "uuid": "1731dbd9-8bbb-4fb2-811d-cfab53198cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511354, "uuid": "ccba5088-369f-4ff4-a445-ae5c19358baa", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d773e8-9616-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515836, "uuid": "aa1cc062-d07c-4c03-942a-2449cd3d4371", "comment": "Malware payload (Mirai)", "value": "def852e3363678baafc77cb4d8da9d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515836, "uuid": "d44c72cb-f41c-413b-a330-65c78d411373", "comment": "Malware payload (Mirai)", "value": "04e86124e3d180d9c7b3a68994f2398f4ebb49fd393e5240d59969d71f255193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515836, "uuid": "3b99fe36-91fc-4d1c-bf76-ab71dadca0e4", "comment": "Malware payload (Mirai)", "value": "f1d29c48992615662e5609c0cdcae082cbc61da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515836, "uuid": "52d6eeb1-3213-443a-88e9-32d3e7bbc196", "comment": "Malware payload (Mirai)", "value": "641f20d1fb4de53c7c0a8608c8b15c214f9b6db2276d05323e09294db6f2bbfc375fe0825379ef900bceb267aeeac459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515836, "uuid": "66a2cdc2-11bf-46cb-a2e2-e3199a817225", "value": "T131E43916F8808F62C5D12576F65F8268732347B9D3EB720699189B343BE792F4F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515836, "uuid": "678abd77-5ca9-4192-be93-d11d978b04ea", "value": "12288:+NrMLXhLAuHImPrvKBLm/AyBIFiBaJKHLMrrw8pdubPjnO4z2imWKG:uMLX/IqvuLIAOIYaJXqvnO4CimWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515836, "uuid": "8c3e060a-d814-47e8-a96d-5230a9a9b978", "value": 676652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515836, "uuid": "7ae2c7cb-e052-4474-900a-dda9e835a571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515836, "uuid": "ff87b98a-5355-48d9-a800-743cb09d2df5", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b93400-966e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786553602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553602, "uuid": "91d0c762-6095-482b-8015-8762d4a39f1f", "comment": "Malware payload (Mirai)", "value": "b634716100d05a00973e8e68d8d05732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553602, "uuid": "f8fcea84-3fb8-4844-abdf-32373d635cc6", "comment": "Malware payload (Mirai)", "value": "0585ac1996c03e4fc9a711e5f75df010514b058ddefdd0c6628da6a956c55273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553602, "uuid": "8dd532a0-6d4a-4f6f-9239-43e63d6403db", "comment": "Malware payload (Mirai)", "value": "2b96beb92a77eef44aa21a2396da0a3363c37aab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553602, "uuid": "4ba65847-1f08-4831-8bc1-79b9145a97f4", "comment": "Malware payload (Mirai)", "value": "3ad9d133f03f16e5a90af342a637a1a31eb41afd960135bbb5909cc6ec065e7da82a1b43ea8bbac8b20d6d0da865f028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553602, "uuid": "0aefd8d6-433c-41eb-a594-6dee2d96cb08", "value": "T11883125B08D01B97EE41C8BE8B539C612BE87F6A0FE98513469841935B42CCCD70DBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553602, "uuid": "6c008cd3-8523-42fa-9f74-22da6f01007c", "value": "1536:E5l7oZnsG2x8pNo3pquTGIa987CcLsSGw4hzHiBsJVawvpMr/FW+4Jj0G7:E51SnsG2eoQuTvi8OOGw4hjlzaw6DFWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786553602, "uuid": "da8fe1e9-eee0-4bf1-ab02-2374727a51fe", "value": 83148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786553602, "uuid": "f059e939-a6a3-45dc-bf17-c55b860fd1b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553602, "uuid": "16f0abce-d526-43eb-b7b1-7b14aa770e33", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ba5858-9622-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520834, "uuid": "e1301d75-367b-41c3-a0ea-1d3217e2ee94", "comment": "Malware payload", "value": "5a6f42b98991168c263f9a3181259320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520834, "uuid": "f5277436-1b78-4d7c-83cf-c1089a7c6057", "comment": "Malware payload", "value": "05ea2c8c8023b899976a271b825c2ef5cb3861101d167bf37949e6ffb2ee9b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520834, "uuid": "d712318b-8440-4b97-97a7-fc13d711e3a2", "comment": "Malware payload", "value": "71d9794c74a7eba6a47d271de8864cd5ddabb946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520834, "uuid": "51b1eb09-e5fa-4c5c-af25-c562d7fe2e05", "comment": "Malware payload", "value": "3ba679debe75a8e5a5de5b30633ead05c49b2b3c0b857efcae0e88ddeee86a0c21fac069a2f6219b1c13e21b2648bf60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520834, "uuid": "38e15775-e5e2-4ad8-aed3-687b548109f6", "value": "T125F3D6247AE55259F1B76FB2CBD570CE46BDE2732E03631A549103431E23A81FDE392A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520834, "uuid": "ddcec5f3-b635-4cc3-b9fb-fbf9c81245ff", "value": "3072:JXjdYg8aMvUdORGKE2gzXfv9bpJYWKvmjeDR+sSPuiO3HgOVJ88iDg8EUoOHmh:NjQvO9b/avvwsUO3HgK8E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520834, "uuid": "f28a176a-0cd2-4ea3-a580-a37d9ac6fe31", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520834, "uuid": "157dd53f-983c-4e22-bfdc-abbfd7b74600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520834, "uuid": "b67501f4-54d4-4da0-85d0-4b844c39beca", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a4dbe5-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493024, "uuid": "0ebea8da-e438-4911-ad56-08091549a23e", "comment": "Malware payload (Vidar)", "value": "f4cbe67959ddf02d74a27c5347a15ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493024, "uuid": "d6a0afe8-0a86-46fa-9146-c9b2c49ece2e", "comment": "Malware payload (Vidar)", "value": "060ca418d6df8abb2aedded94b6280c5b548ac76c0ceb91b28b68fa63a3e04dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493024, "uuid": "8c78b175-6f69-4236-a187-3bfa21fde150", "comment": "Malware payload (Vidar)", "value": "84c74a940e13f2df2654c859d3eda4ee5d2334b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493024, "uuid": "1d4f2282-ffe3-417d-8594-ccf6015dcf62", "comment": "Malware payload (Vidar)", "value": "7cf8c2843dee3f9505ad1e5fc9c3d9158bbde19ec01981dbccf92b04536e3d79b43f90627da0b9735c236204991bc926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493024, "uuid": "7b4ad6c9-aebc-4c3a-8fcd-d523c5050097", "value": "T11C665C47FB512EB9C095EB70893A82667624BC5C873477F72E22ADB07F2A3D11935B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493024, "uuid": "c3b30a67-5adb-41dd-9f3a-e04fb6feefb3", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493024, "uuid": "79f8a9cb-7bdb-4f86-8f8f-7dd7cbe78a58", "value": "49152:XVh9cjgCppPWadn1CUCJ6tEUJjkFkvS4bzd1w0Uds/nhdOcjWKIEFGzL3P0+rdjS:Xpu1CUCJkN5fhdOlN730+jg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493024, "uuid": "03ce285e-5a48-4486-aaf4-b2c6f0ce4f72", "value": 7021680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493024, "uuid": "df13ae6c-61d2-4d6d-921c-503da0dc10db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493024, "uuid": "67087a15-047d-4101-a7d7-2f83661a02b0", "value": "060ca418d6df8abb2aedded94b6280c5b548ac76c0ceb91b28b68fa63a3e04dc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cc2928-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498490, "uuid": "1bee0faf-a887-4d53-8f03-3c35bdb4f860", "comment": "Malware payload (Vidar)", "value": "4a6b61d32f19e1e2e8c85b38e65167bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498490, "uuid": "d703f03c-ec74-482b-8000-b873b1f392ce", "comment": "Malware payload (Vidar)", "value": "06c9957d333dcc91e5a13fd7feb79d18aeaa5cd929df0cdf82085f98481afa66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498490, "uuid": "adeaca94-c5f3-4cab-b586-a20c5f12b821", "comment": "Malware payload (Vidar)", "value": "f3e8b6e96bdf7ce360c97f89983588b9d0866bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498490, "uuid": "19779ddc-8d72-4ec9-881b-58f63a4a17bb", "comment": "Malware payload (Vidar)", "value": "d8bce03deea68645e50ca22bfa525bf58db536e06f5b0f9b8fedf8805095c4a26334c5ff595c32c2d5940f106f72f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498490, "uuid": "9cdf0055-71b1-49f1-9b4a-5cfb79ac8b81", "value": "T1D4164A037EA448F5C099E73588AB5252B674BC4D8B3133E72E90AE782F763D16D79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498490, "uuid": "ae35c3ef-3d2d-49a6-a0ff-f54e828a827e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498490, "uuid": "d6d4b6db-2e08-4651-895e-b901a6732d84", "value": "49152:T52ee7ZG0XbW1yk5q0kIfdJS6RaCpMcwOJBgDu4xKa5qX:Tfmyykst0Oen0Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498490, "uuid": "451ff39d-ae00-4261-9ce7-7f7690a0d3ab", "value": 4411256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498490, "uuid": "21229cd8-4faa-4e9d-b637-6a2e37196796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498490, "uuid": "6aa06f49-02c9-488b-aa35-ade184353c64", "value": "06c9957d333dcc91e5a13fd7feb79d18aeaa5cd929df0cdf82085f98481afa66.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd55b473-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786539283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539283, "uuid": "47367715-0a14-4b9a-a608-e1005a926433", "comment": "Malware payload (Mirai)", "value": "7e26abe706beebfa5801658c8d41bb01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539283, "uuid": "032196a2-27ca-4f30-b3a8-af6781c9986f", "comment": "Malware payload (Mirai)", "value": "06edcffe1074d0082f278b8cc6de07334649a5dbe135d16fbb40c980576f093d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539283, "uuid": "febb96b7-9486-4356-b92c-b96478015c80", "comment": "Malware payload (Mirai)", "value": "8b45b93c7e75476959149f8a5d8562fed55c3027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539283, "uuid": "3183412b-797b-4dba-b85b-c7989f09b743", "comment": "Malware payload (Mirai)", "value": "548b38b3eb58c96937cd78273c72acba38ca5e6027a32372bc313f368ffd4b6a6a0860caaf6fd30ef4e7a5eb2d80d120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539283, "uuid": "cb584cbc-5686-4a72-ab9f-a2ec99e31c2e", "value": "T102233A48EB57E5F0D9030AB02267F73BA6326C366260DDB7CBD8F963ACB1651D087158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539283, "uuid": "91d9c24e-a911-42ba-b0aa-a77396ad9db0", "value": "768:CuCxHfoDlXIfwfynyucXO5FtvWc/0ngK1ehCiVKJTi56mFVLf:MhflfwfyKO5FtvN0ngK1ehCiXDVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539283, "uuid": "ccb967ad-72b2-458e-b8a4-a23cab9c1c71", "value": 45652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539283, "uuid": "edbdc1c8-fc3e-4864-9efd-3e80db1da00e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539283, "uuid": "24ac7467-34b1-42bf-8f47-6523199c0c61", "value": "miron.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1862869-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511346, "uuid": "6b6fda1c-050e-42d5-8321-0d8ed4dc2d37", "comment": "Malware payload (Mirai)", "value": "027a293a7c6a26d3b3fd89cf55fcda28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511346, "uuid": "1e138fd7-7c62-4bda-9a44-23466f78f48a", "comment": "Malware payload (Mirai)", "value": "086e64a08e4ec5c4cc6c5545604e025ff54234207be64661af31327d7dca5aac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511346, "uuid": "34611c07-d0cc-480f-a26f-a9b463cebbfc", "comment": "Malware payload (Mirai)", "value": "9717602765158d515fdcf5fdd3dbd5477e44afc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511346, "uuid": "d8f54398-0efb-4505-a76b-1f869d12119b", "comment": "Malware payload (Mirai)", "value": "00fa1f42baf17c8c0d47f7ec055314e55649959fdd87ee0741713de0326ee1ec471fba21b1bce118cc37e642cd4f22d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511346, "uuid": "ed940e34-a05e-48c5-8c02-8978717256fc", "value": "T1F4D3A70E7E215F7DFFBC823487BB8B259258279A2AE1C5C4D29CE9011E7024E742FB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511346, "uuid": "94e0fb58-4869-4bb3-897b-8ddb8261dddf", "value": "3072:clobb91nEzaYlWcf+h2Xx9qXvVHxwHPDZ1da8VnNLNcJ+E:L39FiaYlDxciDZ1dauNZO+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511346, "uuid": "eea4aac3-b740-40a8-850c-a91a1da3867d", "value": 132912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511346, "uuid": "7d2f97e1-cfbe-44b3-ac7a-30b5363b14b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511346, "uuid": "d8449cb6-9276-446d-8432-fffb5afd8bd0", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1191e02b-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786521708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521708, "uuid": "dfa17445-1639-4b2b-b1cc-7bd4ffcd3ff2", "comment": "Malware payload (VIPKeylogger)", "value": "9102bbd4a94547b40de1d9d2b0971e70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521708, "uuid": "0de8eb6b-d62e-450a-8a8d-5dee9024cfd4", "comment": "Malware payload (VIPKeylogger)", "value": "08a0aad9162f511bb2593151bfe61a21cbbc890b0dd7f89f904695a3b7549d77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521708, "uuid": "91d292fc-27c5-4a1e-84aa-1998bd2865c7", "comment": "Malware payload (VIPKeylogger)", "value": "70e530e68077d9548a1b02026682e80a2160c377", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521708, "uuid": "528589f4-f970-4c87-b7cc-b0d915d688fb", "comment": "Malware payload (VIPKeylogger)", "value": "a475c3abb057921d308f6994b0c08a71aa5fe6fc97d8b14817c79058189ab24d9dcd4a579c3f90e13868d530ab5c3816", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521708, "uuid": "302a42ad-b41f-48a2-8035-63fb4a013b91", "value": "T1B8F5C8C0178094B6B334B7CC613ACAEA95195AE3E5C9CB153A6EE10A373CD07535CADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521708, "uuid": "be397e16-d4ef-460b-a298-7a6ef0c826aa", "value": "98304:ScUy+Nd8ufs/5Jh3K2S47OWwkwPXWWK2zjiAZX:qz8u85j/S1Rkw/y+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521708, "uuid": "806ed0ae-bfe0-45f3-a6c2-5fa00056cb8f", "value": 3451854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521708, "uuid": "6fbe367f-4386-488a-b8a9-4a20162abc84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521708, "uuid": "a899afdd-a359-4b9c-ba4f-d4a1ca7376f7", "value": "wcbtdwln.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1551adc-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539236, "uuid": "82dadee5-26e0-486f-928a-e9159721f7a7", "comment": "Malware payload", "value": "6c0ff68b20c6919fb5cf97cb73b1d688", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539236, "uuid": "a7b38edd-b25c-4208-939f-40164b6005c8", "comment": "Malware payload", "value": "09768b33697871b52d87d6422395568155e6bd39950785adf4d7dcd603c88470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539236, "uuid": "0d59571d-c9da-4cdf-b5b5-4adea8a5514b", "comment": "Malware payload", "value": "4b550fa076d422d9c08ab104b8ff8c5ae10b2794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539236, "uuid": "bb40b63a-9919-47dc-b16f-05556052cb57", "comment": "Malware payload", "value": "d21881113af197da09b8befcadd8fb5702e5bb0483cb5827c778da084e8662db1e1581bd973855fb76de74d174d68d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539236, "uuid": "cedb90d0-a13b-4207-b88b-082f1198abeb", "value": "T129E32AC7F801DDFDF80AE33B48134909B230B7A615925F376257796BEC3A1990963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539236, "uuid": "0ed6cbde-c55e-433e-a985-8c6df368f74e", "value": "3072:zNucizNp93cfild/33GVZjbiDLI4QHq5IODOu9ajyt+KHV:Av93cfilt33DLI5ax2ytfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539236, "uuid": "3f0911f4-c943-4d2d-871f-d83c1b422448", "value": 148768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539236, "uuid": "7b3bcf70-e670-415f-830c-d3af39e19d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539236, "uuid": "0e77313d-c11f-4203-95ff-0646bdf0c468", "value": "miron.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf20fd51-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496659, "uuid": "a5fc0653-cb49-46b3-ae0c-34a466f77b1b", "comment": "Malware payload (Vidar)", "value": "07ebd45100f063d7fa9beb67b6a762b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496659, "uuid": "44c1946e-ffa5-4eae-bb30-691a248e4c58", "comment": "Malware payload (Vidar)", "value": "0b3ce056d3aa8ec05069acc49ae887e2b2b4d210d4219221778abdbda9f4c458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496659, "uuid": "52b9a986-901e-4b67-a41d-86d63749c801", "comment": "Malware payload (Vidar)", "value": "1b762addb20e43d13c7f426688a81341f3fcdeb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496659, "uuid": "2169cf0d-4721-429e-b180-703b469ab877", "comment": "Malware payload (Vidar)", "value": "232fdbe13d9db71fa5f30c9106e4ea6e352909eeb7fb68942d36d028374a25bee5efd47b3c7eefce4f46fb0e36f30489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496659, "uuid": "e19e1ab6-93b7-404d-ac2b-73e1187bdeb0", "value": "T1E5366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496659, "uuid": "d971c830-fc40-41b8-9717-7c3675f9174c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496659, "uuid": "63194c7a-b974-4353-bfcf-2b9f95f8cd09", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaY:uc3XND1aJrCOkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496659, "uuid": "037331be-2830-4715-a1d0-0279ecc6469c", "value": 5002845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496659, "uuid": "786b46ee-08b7-4733-854d-d6cfc264d563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496659, "uuid": "22135a83-05d4-41c0-91e6-810927a3b157", "value": "0b3ce056d3aa8ec05069acc49ae887e2b2b4d210d4219221778abdbda9f4c458.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a444937d-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512934, "uuid": "4e95ee70-3673-46ea-8818-6a523c3d7ece", "comment": "Malware payload (Vidar)", "value": "83c5950a60b559579b88052b0072868f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512934, "uuid": "14fedc41-0078-4eeb-a55d-c21d67ffcdc1", "comment": "Malware payload (Vidar)", "value": "0c727b71e15797ea16dc3ff98641b67d5dea0b101965711276a72bc03d2ebec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512934, "uuid": "45ac45fc-d6ab-4b27-84ef-d3a4f58ef12e", "comment": "Malware payload (Vidar)", "value": "b7cc6e2011a2ed201c231ffd31f7def2fcbda2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512934, "uuid": "fa10b774-6687-453e-b171-7f16ec7b1b6c", "comment": "Malware payload (Vidar)", "value": "65c4ba2543073325ae870cb684182b7f4f0d19bbd1b0c1ae9a48abda22f3641fe1e179ea282516daa12150ec37f6523c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512934, "uuid": "c40976af-3531-40ef-80b1-90aa35f5947b", "value": "T1B8067B47EDE11CBAC0AAA33189B712957B2DB8051B3263D72B50B73A2F727D09D35B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512934, "uuid": "a2077692-2298-4886-9022-69577136038a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512934, "uuid": "c9197e25-aecc-444e-9b06-05c814695a69", "value": "49152:CAglNr+PetPpztXJ5RugoQ9AucEWujbMvFTLsbaaN6HUOXRrMvjw:CAarXYgoOdbzYdTQuaqmjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512934, "uuid": "9379b897-9093-444a-bf13-fc7130c77ab6", "value": 4000840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512934, "uuid": "5f4e84f1-44e3-483a-bda2-6603529a0ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512934, "uuid": "31fd07d6-a5c7-4d39-a6ec-a1317621a0ff", "value": "0c727b71e15797ea16dc3ff98641b67d5dea0b101965711276a72bc03d2ebec3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8621e59-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499332, "uuid": "46d17487-b471-4970-ad41-8e052f5e8d44", "comment": "Malware payload (Mirai)", "value": "3bda04843d18b8cb644a0ff1e955cc22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499332, "uuid": "edc0a4a4-488f-4666-ad55-5d8a7822d62c", "comment": "Malware payload (Mirai)", "value": "0c798c8d0b07bc618204c6f2fc9365d2efb023816e13af33a7a4d4ed86c8cb82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499332, "uuid": "cd30d0db-8433-4ac9-a766-d614ffc460ec", "comment": "Malware payload (Mirai)", "value": "422929c0a3171ad32cb15e200882c39640013b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499332, "uuid": "748b7861-5a57-47df-ba57-dfaa0f7e75f5", "comment": "Malware payload (Mirai)", "value": "ef0b73d20ca15b66abc8a56fbbbca1a71ab355dd4415dc98b30ce522f34ae9974f1dbfb10b94ff152afe4caa8984d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499332, "uuid": "58e178dd-e05e-442f-a775-4fb297155227", "value": "T1A5A34AC5FA8BD0F6E4170475402BB33FC732952A9022C69BDBA99F67DE23782561620D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499332, "uuid": "bd5995bb-302e-4d62-b756-bc9204a0d699", "value": "1536:qNnPLnehr33ludh3WM7n6xKWNa5OBzZFmQ+VmAgIxb:qRPA8dh3WOnI05OBzZFwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499332, "uuid": "4ac7ab5e-d2da-4200-be2b-2c767852c120", "value": 100688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499332, "uuid": "264efe39-d2c2-487d-ab82-906711f1d665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499332, "uuid": "f83c65c2-1dc2-4cf1-a268-c82edce47dd0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b899a-95f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499563, "uuid": "22839ed8-2718-4d5e-b2db-a2f3081e5fed", "comment": "Malware payload (Mirai)", "value": "154c4d2eb9fc3df8b9342f363bcd6d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499563, "uuid": "bd3eacc0-af66-4398-8fd5-23d44541c33b", "comment": "Malware payload (Mirai)", "value": "0cdb6ae2118a96d618839532a4cd1166f0f1c9d83c6e020a19cbc5e7e5e0b30a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499563, "uuid": "6c8dce7f-c9f1-41d9-a9d1-61af2b550f72", "comment": "Malware payload (Mirai)", "value": "d4d9cd1e551720f6f1a46445489e8711c7323391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499563, "uuid": "55f19edc-1893-4217-97b3-488125c2e5db", "comment": "Malware payload (Mirai)", "value": "54df47d33a5b454635afba90bc78d47b7f5188bde66d6c053d1dd530a3f0a4b29e8c55b05a9183d3bb7c1657301415a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499563, "uuid": "53c18fb9-d4ab-4cb9-bc95-a5888296775b", "value": "T113D31945FD419F26CAD225BBFB4E428D772A1768D3EE3203D9255F20379A8670E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499563, "uuid": "38b995b1-5f7f-459e-b2a7-c4214a341081", "value": "1536:0OHInTgVvqtCpOTbd0sffGAUfllKADvgITxfv6iWCZ0OWOMsEsjwUzl3DwywTemk:0bT+ZGfGDPKAsItX6i3DBEssexGX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499563, "uuid": "89fbc2a1-9480-4cb7-8a85-fe3afa127cfd", "value": 142192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499563, "uuid": "f3cd0ff8-304e-4d0d-a803-2732348519b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499563, "uuid": "3394ca70-8396-4047-8e43-10dbe9a532f6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3433a14-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786522811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522811, "uuid": "6320bb94-2bc3-43e2-be09-ccc22e5efb1b", "comment": "Malware payload (PhantomStealer)", "value": "769d47bffc692029346b697a1eaac442", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522811, "uuid": "9526d978-32ca-4006-8134-e65bf6b32927", "comment": "Malware payload (PhantomStealer)", "value": "0d3736d9100efb706e9dc200b87f1834a9c2196c4c1ef625700d8946b123ee26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522811, "uuid": "f0278cc0-37bf-429e-8449-d3488c43db32", "comment": "Malware payload (PhantomStealer)", "value": "90d30345fdcb3ac3681e1c65ceabe6d38306c05a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522811, "uuid": "0c82cb15-2c97-475c-98ba-181a3dce0b9f", "comment": "Malware payload (PhantomStealer)", "value": "d794b6f059f98d9d09e586bc575046c4228352f8adc31385a39ae3687c64e36e09422392fd5b58e35663aa1a44f72164", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522811, "uuid": "262ebd79-3512-44b2-8bbc-06ecb52fa44f", "value": "T17006A3412344F5327326D76CA276AD7C940A6BC336C5CB59B06CD2183B2ED275B4CAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522811, "uuid": "62eff4df-da18-4bf5-ab87-d1cd5328a786", "value": "98304:7T5o5QvFXGr2IPClqVGZfCLYAMuvN/IaMt8K2HxXGLZSZWZ1GK71t0tc:bFXGSgClqkJuYkpMO4ZoWZjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522811, "uuid": "655d543d-b5aa-4549-9897-aa6fffd65c78", "value": 3972500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522811, "uuid": "e78d1254-b02a-40a2-9b43-8b8b551825bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522811, "uuid": "6fab7864-798d-48ab-b382-67b833fb8660", "value": "Quotation-TOH47206.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824a8ad3-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494839, "uuid": "f74c70d0-2ccf-448f-96c8-e97c84ff0de4", "comment": "Malware payload (Vidar)", "value": "98428e4fc4d8ed78e4419812d4da7546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494839, "uuid": "34cfe2da-056d-4746-a55e-4f9fc183abb1", "comment": "Malware payload (Vidar)", "value": "0d4226624f512bcf20ffa542dea6d1e3d5883c654dc9b5d9dce941d4ede9b1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494839, "uuid": "273f6d8a-3e8a-4b31-97da-90f7c7d2f742", "comment": "Malware payload (Vidar)", "value": "61a09af4bec6ca12e482684cb052701cfe380905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494839, "uuid": "082fd78c-0417-4ba7-848c-0ca016dc2add", "comment": "Malware payload (Vidar)", "value": "77a54a60561b08e65a74d1fe8fa7adae72fcc071daf729cef8e9b453858b455d76f9ea89c72b5485cccbea03e79a4c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494839, "uuid": "bb7761c6-1597-495f-960c-98c03779017c", "value": "T127467C13EEA149E6C1A9E735C8BB8205BA74780D473123D32EA17E782F727D16E35B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494839, "uuid": "e6382bce-30e2-4bf0-b130-f8a71bec7dc8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494839, "uuid": "00fd0148-fa03-4ff4-8ff8-9c24d22160e7", "value": "49152:YFF6jyn/ITBiyZGoxIByNlNuQ9CCeywFZAEqS6YQdbN:YOMevbwc/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494839, "uuid": "24a6266c-4e42-4c52-ae11-5f9df5cf2992", "value": 5481320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494839, "uuid": "995c805e-60da-4f67-8b22-9ff94f0093fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494839, "uuid": "e3f1a957-41e3-419f-8e9f-fc424ca29739", "value": "0d4226624f512bcf20ffa542dea6d1e3d5883c654dc9b5d9dce941d4ede9b1d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c909c57-9605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508385, "uuid": "7a3dac4b-239d-45ed-8c97-081316ecff84", "comment": "Malware payload (Mirai)", "value": "ec4592ae47dd936acb37170fee9c27e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508385, "uuid": "3399548a-34a3-4100-9600-579247f311cc", "comment": "Malware payload (Mirai)", "value": "0de62503164dbcdc68a0a2b8ee85194cd934087a625de94fb30208bf43a24167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508385, "uuid": "405bc814-796a-4c46-9fb0-8c4699000ab0", "comment": "Malware payload (Mirai)", "value": "b2f0cc5a904718d223598d8d544a1271837c81c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508385, "uuid": "c6b1ac6e-eca6-49eb-be4b-837d2c854b0a", "comment": "Malware payload (Mirai)", "value": "a67f81f63d8b11d9b9501bee56c4752b5edd070e08e5936d4dbd8fbc03ce8fdfe9325f67f529a27d78c9ac123972491b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508385, "uuid": "d5699903-d128-4088-a62b-603b539b8c13", "value": "T1A5F30745F8919A27C6C612BBFB4E428D3B2627E8E3DE7103CD255F21378B55B0D3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508385, "uuid": "3a81270d-a643-4066-a732-c230e1ee04d9", "value": "3072:T0QdkvYp6aWWSakAfirrLwbyH74FkOij0RgHgoHm:pdkvy6P4k2izMc74OOijvAoHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508385, "uuid": "1583d4a4-4fd8-4cd3-b707-762cba80c365", "value": 170784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508385, "uuid": "2e8ce4c6-74ee-4a6c-a831-0673f568f324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508385, "uuid": "13ad5492-f698-4674-98db-ee390a16447e", "value": "7835d27f42fec19a8eb3104e74f6ee17da47f653131444f4874ff9b96190d563.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa04005e-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504059, "uuid": "ceab73d7-eabd-4dca-849e-82a1c2067285", "comment": "Malware payload (Vidar)", "value": "174c1d82b9ff23ca30263cf754a7060e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504059, "uuid": "0848e48b-e034-49aa-b01d-9f0244cf2097", "comment": "Malware payload (Vidar)", "value": "0deafba18b5008912fe7f3f7e267f4cd76c91f5e02948ff2ad49afe1b4f0a17f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504059, "uuid": "37c991cd-d4ca-4add-90a5-873d41f99137", "comment": "Malware payload (Vidar)", "value": "b866e743e3fcfc8b7e92473636bf7cb9219b671c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504059, "uuid": "6852ab3e-a17d-47a4-9082-7f5d3e0cb079", "comment": "Malware payload (Vidar)", "value": "1f5c0deb2b62476362dc8bb333f2b250dc51fc9d0d37c0b9bcddc989d139c51d55c300db0809f701f92ebde38a238aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504059, "uuid": "db6f4e78-e1ff-47e6-9555-d1692be5f574", "value": "T115068C0BBE9058A5C0AA973268A703557B3EBC5A4F3333E72D50A6761E727C18D39F44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504059, "uuid": "3f8335ac-77ea-4311-a466-2894f0a9abb6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504059, "uuid": "cc6bfa43-be9d-428f-914d-47f384d1a1d8", "value": "49152:J7gCtZrDd3U51kAsImB8tZC5PDLRifTh72sKdqxL:J7T3+3FffTh72oxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504059, "uuid": "909269b5-ce1e-4dca-ae33-8a1a7595d36e", "value": 3797264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504059, "uuid": "ca360995-2b99-4a92-9c9d-5af4902f04a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504059, "uuid": "d7529ce9-42f6-4bf2-9fa4-fa137b7baa85", "value": "0deafba18b5008912fe7f3f7e267f4cd76c91f5e02948ff2ad49afe1b4f0a17f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54809918-966e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786553603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553603, "uuid": "ec6463fe-efc0-49ca-baf2-822f056061b6", "comment": "Malware payload (Mirai)", "value": "026ecad0a5fd492012e2899b9ee9eb48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553603, "uuid": "0e2ca5ec-1cb2-46c2-9175-e433c933cf53", "comment": "Malware payload (Mirai)", "value": "0e30a1984cd4782a536abdfa12ff29def05a43a2fed7239b6ebf0f6912a13063", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553603, "uuid": "4468b527-6fe7-4130-9db4-b9b8c94f2708", "comment": "Malware payload (Mirai)", "value": "de12a3c464de647ac1e271f3c05f1d7d6dbda624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553603, "uuid": "05cc7609-16e1-41e4-9620-7c11e5cd8c36", "comment": "Malware payload (Mirai)", "value": "669060345fda1be8eff8fdbf74c191c5efaa2f7005c73ea0767c1db2ac7e6b07474305b50c43dc6def35a547ac28d146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553603, "uuid": "4a9297dd-f3e0-481f-9778-a502adff9058", "value": "T139530235A0A35690836B9532A1FBFD5B5808E9FB8221C4C6DC753AAD5012B75E38CF07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553603, "uuid": "970448ed-5242-4856-9e4b-1ef98b8f4367", "value": "1536:WFr86iaUkR+V0WfW9yWpVlP5ol2tiv12ACPaSnouy8DMX:W183aU+8ShpfP5ol222A0outDMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786553603, "uuid": "9d10e427-0bbf-4c6d-912d-7e019850ddfc", "value": 62412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786553603, "uuid": "214ebb4d-604c-441a-a9c7-7fad47460c2b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553603, "uuid": "a9e60c26-157d-4b42-83f2-f2979e3e5df3", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ec4713-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786564695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564695, "uuid": "e981d8d2-17d7-48de-8832-f508dc0ee19a", "comment": "Malware payload", "value": "2141681f3e79a7e19cb10dd678175303", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564695, "uuid": "91f7f1f5-82d3-4a2e-88e4-b23ee8b85080", "comment": "Malware payload", "value": "0ecd299c0ac62ec3974ce2e9aca4764cd6911bbf7d81dd9a35b373d51ae6385d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564695, "uuid": "1d3aa1b9-e6c6-4d3d-93ab-5dfdb228483f", "comment": "Malware payload", "value": "1459173d029d6fc73c3233f29dd2ff650c60267a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564695, "uuid": "4981a988-544d-4c46-962e-fb793ab6b622", "comment": "Malware payload", "value": "cad0e4e5e28894fa17a19e502b743aa0c56050aae7edc6d728119f2d6889da20092331b00c17b4926601cc93991fdb68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564695, "uuid": "3fad4ac5-227c-4ecd-b5b8-8b35a5069cf7", "value": "T114236C6616857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564695, "uuid": "0db494ef-c13b-4b7b-8fd3-76d6caef3d22", "value": "768:kXRWNGxVb9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ylxmcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564695, "uuid": "37fe0875-2ec4-4e65-a391-b9f39875d3ae", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564695, "uuid": "63b9511a-12c6-43b6-b870-5b3a7f2974b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564695, "uuid": "91718d4d-f7cc-40ef-92ac-18df6a81e303", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5b5549-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521702, "uuid": "6625044b-7c02-4610-a7ab-28845301f261", "comment": "Malware payload", "value": "bedb6bdcd03c0ffeba234af862888152", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521702, "uuid": "1fdbdaea-afbb-4f4e-af4d-bec90495b70a", "comment": "Malware payload", "value": "0ecdafec38b93aa0c433ec9c764c3773b7c02bc94c5b178b0ac8f6e17beaa632", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521702, "uuid": "b131d79e-8253-4d24-acc0-e070ecc2ab4f", "comment": "Malware payload", "value": "488d36ff4d72f9e16b71155799e718a6b8bdcb69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521702, "uuid": "bf587007-2311-4d5e-b338-3a7bdeb81238", "comment": "Malware payload", "value": "f95b0dec760758eacdf0fb85cf975f3413e079a6c3e9aeb53fbedaa13b7d0da74430eb85a9fbd7b68e167219e201242f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521702, "uuid": "748532ad-5ab4-4d6a-ab8f-fec3a6626883", "value": "T1C9357BF7575C0424BDA126230F632B98E714321AB62BB4543C9D9FC71617EAE08BCB76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521702, "uuid": "5e539f74-7b39-49bb-9589-553828bb4e74", "value": "192:rq3nbQ3xJbkqXq1wwQ1CqNbQ/L9q1kqXqNbkq91w8b4YpNbQ33xXhb8bqlqxlq16:pEo9/HK6kQIoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521702, "uuid": "7ab05069-f20d-426f-8933-3c5599a99dab", "value": 1060030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521702, "uuid": "ee631269-aa63-4e2f-bb8a-7e71742f1662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521702, "uuid": "5dbf14f7-c30f-4026-97e8-44427987a7ed", "value": "Details to Tender Bid.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf77082-968a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786565881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565881, "uuid": "c70698ae-6975-48a3-89ba-9a75cc2ef888", "comment": "Malware payload (Mirai)", "value": "cf6b2cf59c312f6251bbec40cf52d769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565881, "uuid": "d8750c7f-9c8b-4eab-b271-5046f6f79365", "comment": "Malware payload (Mirai)", "value": "0ee582d0460ecb4088c37d41e4c3c3743c5a842aaef2f8adf1f036b74005b2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565881, "uuid": "b56af91b-97db-4fa7-b280-790ae57fff04", "comment": "Malware payload (Mirai)", "value": "81a91a86c29052f93fec8f1740dbf81fdc5bdf76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565881, "uuid": "b779d64c-8742-446e-a6b2-6a808ccd5f66", "comment": "Malware payload (Mirai)", "value": "ba8c19d966f0613b5ff2ba99ac3619070546d9d61505d59cab7d7c7599b12bfeb95e828971b150171de52e09b4016250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565881, "uuid": "24710748-3150-4c0a-875e-55fc9f0872af", "value": "T13753F1A362B78A68C4225B7C4C3941E4EAA3B9603313DE6E04C890FDD4777859F34F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565881, "uuid": "1561ecc9-94a1-4fe1-9c17-482a0065829f", "value": "1536:rJruMQ2vycSu4Dbau3zVZOO7NOa+YzeJ7LgIR/EA:9MOSue3zV7NOrYza5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786565881, "uuid": "6a2167bc-40ea-43ab-bf37-0ec2f68821ae", "value": 61300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786565881, "uuid": "438733bf-5224-4dac-a029-af3fc8edd04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565881, "uuid": "4a932960-ee3e-47ec-af68-a85f2cd57cfa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e5ac4b-968f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786567826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567826, "uuid": "d53b09c2-3cc6-488d-bae2-0b5b21f85a99", "comment": "Malware payload (AsyncRAT)", "value": "fd179f38399080ca33cb55fa0342afaf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567826, "uuid": "6b82508a-5ac8-45c8-a6ad-1be29356a5db", "comment": "Malware payload (AsyncRAT)", "value": "0ef3bf87332779d4b37885eaa23e12fe0e7bf597da7356718eed8691377eb999", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567826, "uuid": "12f77a2a-a2d1-4402-889f-b3fd247e20bf", "comment": "Malware payload (AsyncRAT)", "value": "7de9de3ae394116af7915b9f8d5ffa3d8bbcc7e4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567826, "uuid": "9db2bf56-6226-4de9-9b2b-19e818500c8a", "comment": "Malware payload (AsyncRAT)", "value": "d0507a6ae3c0dba5f7048ca5ff6a9f1900322e3bd68bfbb746cfe53d4c9676c513c5964ff523d841bb6a60843df68693", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567826, "uuid": "8e11a117-8913-4a78-8aa4-2e1183a807e0", "value": "T106C23C0833E4C676D1FE4ABAC83385009779D55B9923D75A5FC490AE2933BCD8A18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567826, "uuid": "9a6496af-bf47-498f-8626-f330c6ba8dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567826, "uuid": "d557f79a-c284-414f-9ea9-03adbf8b0ef8", "value": "384:tjG3urUZ2egznZWEGOsVa/KFHbZaH9qbuUsibQxnCJfJBndnjJEKj:tjG3XZ2/i1VDHdIIboBiBntj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786567826, "uuid": "85e61600-7108-4e61-b0cf-34889ee7b784", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786567826, "uuid": "050f56b6-1cdb-4a5d-af43-cdcc3cbd0553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567826, "uuid": "86b20dbb-3ec4-4bc8-8208-e2b83222e5e2", "value": "QH88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237bb95b-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786498116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498116, "uuid": "aba1848b-6191-4f5b-be84-49534a5856d9", "comment": "Malware payload", "value": "82c0494217d805cf83b8cfef02b3b1d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498116, "uuid": "caf6d215-a314-4a06-8c5b-93983a67c1d9", "comment": "Malware payload", "value": "0f0111f70ed0f619d5a47744dd319ba00312bee71f545e51e1c5e754df837d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498116, "uuid": "348af715-8008-43c7-a0a5-1a6a85802e52", "comment": "Malware payload", "value": "f4d8e72b54315be6c2e4ab85bcedb5df41d297d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498116, "uuid": "0de02744-14b6-4074-81fe-804b095ef2d7", "comment": "Malware payload", "value": "878251d246c62ea0732cc550dd7b7012a84f0ad7a568876ddc851fd829b2d405eabb8e8b91abc8607fa7b60c1d7e3af3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498116, "uuid": "de6910f9-b5ae-4da3-929b-8c46d24f1c90", "value": "T156C31295460346B2D988AA34E155DBFB618AA13B397AEFB42C2CCD71FF411381D83D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498116, "uuid": "b5923c86-91f8-4946-9255-42293764ab82", "value": "3072:kzIxxpr8SbvwxHctOfwkhT3HjKE8xRWgdC/A6H/RV/GeuJZ:k6ySo/wkhT3DKPvaf/RV/GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498116, "uuid": "cf330a33-7f73-42c6-ae92-10807bf9e36c", "value": 128252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498116, "uuid": "402a3f05-ae3a-43d2-a893-1760d93560ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498116, "uuid": "6723a03f-bc8f-4fe9-aa54-701ec426d389", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986f682f-9679-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786558441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558441, "uuid": "20c89e76-bf33-43de-9e95-35eb3b441946", "comment": "Malware payload", "value": "c00317bc309b92bb2865b005e363e381", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558441, "uuid": "77970f7a-8ef3-4c00-b0df-eda6727d1e0d", "comment": "Malware payload", "value": "0f808ec0e7d9fb413f44331ba5fc6a23ca282363f244062f0acaa418e55b2ec8", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558441, "uuid": "593f12c9-8646-476c-93ff-2171f437ab71", "comment": "Malware payload", "value": "2c60a57e3b3689675b3858321bd938eb3c2f8044", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558441, "uuid": "a040238a-eb1f-41b2-aa4d-25392a0809b7", "comment": "Malware payload", "value": "ae6743881fcb797a950fac0f1cef8a8736b56de17ab16658dac2d90ab484ba067b9bfc7d46882cc317fd2923379929dc", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558441, "uuid": "35e46470-177f-4abb-8749-9bf9910709ad", "value": "T1F4F42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558441, "uuid": "7ee76df9-4e64-484f-be9f-53828ce86b9c", "value": "12288:tU7wAcpxXAIIETE1UWLwJrr1nuwy/PUcyvmByHaRR1L+:tU7RyAOTtfvPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786558441, "uuid": "9404f9b0-3ffe-4373-833c-f8ba71f50e19", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786558441, "uuid": "d0ff6164-ec89-4495-8ca7-1c66d64c45f3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558441, "uuid": "d490587b-70fc-4645-8a31-047fdcac6ba9", "value": "0f808ec0e7d9fb413f44331ba5fc6a23ca282363f244062f0acaa418e55b2ec8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87957385-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494847, "uuid": "3ba7b3ad-1e33-46fb-a7fc-ece8119b933d", "comment": "Malware payload (Vidar)", "value": "36d7c723f4bff69f10b9dfac9a326e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494847, "uuid": "b8634daf-80c5-493c-bd9c-4f9f04d9b10a", "comment": "Malware payload (Vidar)", "value": "101a3bfb62b015b49bbe08f3f53c5174c94f4d9633ac982e295274f661b35466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494847, "uuid": "b5244811-15f5-4561-90db-58a5525746f1", "comment": "Malware payload (Vidar)", "value": "f6ac839cb4466498d740c5782eb400890303da97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494847, "uuid": "37920fc1-5743-4260-a80d-f7b4e1f42d80", "comment": "Malware payload (Vidar)", "value": "a1138fe32080f0789f4a7d79ecce5c1cf16f3f19b88fa2c458b2fedbf1c2675f6d300af3c35899468f8ffc08632eb9df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494847, "uuid": "b5edeb38-1b1b-4a0a-adae-3cd6cb8998e7", "value": "T19F564A17AB5548FAC0A9D735C4B74615BA70B84E8B3233D31E52BE782E317D06E35BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494847, "uuid": "2fef9a00-8b6c-4f67-91ef-5c16ef9e2d4c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494847, "uuid": "db18ffe3-1065-42a2-9fb1-9a9d36f52d9a", "value": "49152:8NCM4HOw7Ge1Avfj66/thorZwv8/OZMNc1Wv3u9oRRx4WjGx8+NsKb:8BdLNEbu9oJ4SUnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494847, "uuid": "c966baf8-91c0-479d-8017-784f593849de", "value": 6281064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494847, "uuid": "9b2c89f7-4ded-4c12-9267-3fb5a699c459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494847, "uuid": "304e870b-a278-4598-9f60-6335e6646878", "value": "101a3bfb62b015b49bbe08f3f53c5174c94f4d9633ac982e295274f661b35466.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80cc2bf-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516457, "uuid": "e5660358-2a9e-4cc5-aed4-f8c671334293", "comment": "Malware payload (Mirai)", "value": "fc66e8d9738bf2e06ae2402d3e3058f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516457, "uuid": "ed15f077-1452-4b94-a8d7-2f408807a937", "comment": "Malware payload (Mirai)", "value": "11c465a3cc6a9f7a895b9c5c48e4c733ce6cad202ca77a0a5b11aa5ef44db602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516457, "uuid": "eeb30811-fb2d-4318-900c-93118a281793", "comment": "Malware payload (Mirai)", "value": "2266d1fe33ae86406cde0745fdceb02a58238703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516457, "uuid": "03d5f73c-41f5-4579-affc-f36170d9f4f2", "comment": "Malware payload (Mirai)", "value": "d30eca56cd94e2fa4eed5f28fc8ab9b62b4e7f8ac2b6ddeb68741ccca9d0abdc1b8580d054e57faf079e63be7dea4a00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516457, "uuid": "263682ec-6dad-4052-9535-dd7a441e91e6", "value": "T1A153126EA18AD87AC9B14EF66E94E0C13C9D1FF9C7ABA432CFA04184737543366E7011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516457, "uuid": "7fed881f-f103-4187-a2f9-ba36358f03ab", "value": "1536:5Vw4m7HMGyCKSg836X6qxuA/k3vOD42I9KAWLE:5Vw37uvAqYA/kII9KAWLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516457, "uuid": "b4e8ea99-90e2-4539-865a-7bfad6476464", "value": 64884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516457, "uuid": "ad1197b0-a69d-4eaa-9c55-56b193dcd35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516457, "uuid": "fe9afb44-3ec4-47ea-aec5-d14ccd56bdac", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979e4c52-9664-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786549420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786549420, "uuid": "16fd2de8-b1ff-4b25-badd-5516ab587d17", "comment": "Malware payload (Mirai)", "value": "820b02943292958750f7ebb99bc72b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786549420, "uuid": "b90af63f-0935-403c-99c3-b3e4c9f11bfb", "comment": "Malware payload (Mirai)", "value": "11fc1bbfeeddff818ca8c6044852c52d6619e7900142d084dce2e7f73e4695c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786549420, "uuid": "7c5dbbd8-cd9c-4745-a0b6-583f36b65aff", "comment": "Malware payload (Mirai)", "value": "c73d6e49036abf4e4aef41d1d4078532db29020d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786549420, "uuid": "323237fc-1a23-4387-ab21-e31815d4bb8b", "comment": "Malware payload (Mirai)", "value": "d011d150095a33ef113a53663444eccdc95c59463b439d77d1d2fa86afac13105b065e1a8b348747092a19029c69aff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786549420, "uuid": "3b446ff5-6751-4c9e-8e4a-4a571c2c92da", "value": "T1B1F31956F8819F15D5C211BAFF0E128E73131B78E3DE72129D286B707B8A87B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786549420, "uuid": "43d6410b-6ab1-43c6-a069-6218e68ebe40", "value": "3072:h2BFr5CQ0vyg4Qdrn0zt+YLRaocNmPHyQKT/4A8F5Kd6oAfH4t:h2BFr5CpvQSrot+Y9aPNMFKTQA8yd6Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786549420, "uuid": "322611a2-cc6b-44cf-8743-a033d92b212f", "value": 159828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786549420, "uuid": "6e631bbf-f96e-49e1-b3dd-fbcbddde2b79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786549420, "uuid": "bb1f913b-dfd0-4477-90c3-8b42b16a2d20", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4842bdc-9690-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786568394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568394, "uuid": "b89dc6ca-0bb6-43a4-91ae-4968565b4394", "comment": "Malware payload (Vidar)", "value": "4e24641b93f8f73a01bf6946c0b44448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568394, "uuid": "6634cab4-bf73-40e5-992a-6b32969737e6", "comment": "Malware payload (Vidar)", "value": "124c9272f072151529a74124a04fb27b1890a37c2149242eeab006d6244d61bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568394, "uuid": "ea454cef-6367-48a2-8489-b6639232bd64", "comment": "Malware payload (Vidar)", "value": "3f518413fd15acccf819a9f19888d4ec898315bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568394, "uuid": "2c4169c5-c711-498d-a902-c5ba9193c4f3", "comment": "Malware payload (Vidar)", "value": "22b4d38db19de10909502f824bdb383ab38769eb8526a657b8f8b032843c3afe252b5f52f09f0d6709032f7a43d625e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568394, "uuid": "7accf6d9-3a82-40db-b82c-a274acafe152", "value": "T14B56590BBB610578C495EB74C8B682557A787C8C873173E31D90AA782F663E19D3EB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568394, "uuid": "eb82921d-5696-4fbe-a7a9-958e50c4b0c5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568394, "uuid": "33e6e349-6429-4460-8890-e6da79f0401e", "value": "49152:AaA1keR1q9yw+LShQsdaqt9ln6NR0/bsZ2pH0UquQxzoXd30ab5QoT/s0iWSfZxQ:AqBhOBe02rkvBNqtocIPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786568394, "uuid": "3d0b181d-6a99-4faf-9c21-4ec0919f844f", "value": 5981624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786568394, "uuid": "e95f3268-2fe9-4f48-a983-029a7f3a0097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568394, "uuid": "176b94b4-2204-4d4b-b5b8-cdb8863bb290", "value": "124c9272f072151529a74124a04fb27b1890a37c2149242eeab006d6244d61bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652279bc-9659-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786544611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544611, "uuid": "758111be-703e-47c2-b028-703404e35d12", "comment": "Malware payload", "value": "174ec6443307b8e46ecbe1be4c0ed76c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544611, "uuid": "6f43aeda-1e35-43eb-b11e-981f8b544802", "comment": "Malware payload", "value": "126265be46af5162821707337e43b9abf86edbb5cd9be8aa66e6fa777c50c687", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544611, "uuid": "253fa595-87d8-40eb-9d78-d3de0e4d2c36", "comment": "Malware payload", "value": "f5a771103b6b974903b57ed9a67cf4e2269eb9b2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544611, "uuid": "cc6624bb-7930-4cf9-a38a-05be91909c50", "comment": "Malware payload", "value": "d74265b270502b7dcafe075503b3050d5d59b8db7286dfc89d72b3108a79d4baeaa9423f4f9704688302d4cb582e814f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544611, "uuid": "4ebb96a3-ff54-42c6-8de2-c4691c320529", "value": "T18C236D6126857C14AA99C8371D7E2F0CBDAD43E6320452EE7FCB3CF68C4A69DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544611, "uuid": "793ecd84-64cf-47b6-9ef5-a041b94ca910", "value": "768:L6rDTPjH49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Or3pcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786544611, "uuid": "183926db-d17b-45c6-932c-91ab37aff779", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786544611, "uuid": "f1fa68e0-dc2c-4768-8aee-33a6d7edc6ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544611, "uuid": "c933087a-5ea6-469a-a820-8cce8c33ce48", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7cbafa-9684-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563144, "uuid": "0c2b3be9-4297-4e2e-a484-2d2ca92749e6", "comment": "Malware payload (Mirai)", "value": "60a3788cbb06916a760e70c5bad3543e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563144, "uuid": "defa0cac-942b-4b1e-8089-c2bf4ae08450", "comment": "Malware payload (Mirai)", "value": "12c914914a7e28cd56721888fc6ba4fea9b3b1e5b173ac064eb904788cf74f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563144, "uuid": "85263286-94a7-47b0-a654-84251ad671bf", "comment": "Malware payload (Mirai)", "value": "1195809dbbbe6f7da415640d1772a16ac47a2531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563144, "uuid": "aad774ef-4b91-4279-abf2-55518c43cbc0", "comment": "Malware payload (Mirai)", "value": "0d618e58a25cbbe8d95143c158ed948f97abdd0731baaed563ad4ae2648b3154051b0b0bc6088f725285c92cbaaf070f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563144, "uuid": "6bd67c47-7f1b-44f8-addd-ee093d7e7587", "value": "T1E253F1C3D225E9BCD0E25BF21E6306D07B71ED8519966DBB9FCEB1B90462CC81368D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563144, "uuid": "25701a65-123e-4021-ae71-3a25d389127c", "value": "1536:hGH2R+RM+HdTAWPD1JAzX4Mxhv6JLOnXRQlWe7KbUB123:hGWRl+9UW70X4MDoKhQQe7B/23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563144, "uuid": "99cf0ab6-4c95-4cac-a250-0c9ff3253fb3", "value": 60960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563144, "uuid": "30b620e2-28b9-47fd-a464-e0e4e31774e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563144, "uuid": "7355d003-e36c-48a7-b792-d61133f778cf", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b64796-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534977, "uuid": "9f75bf75-1922-4d89-9a39-ac418ef1f427", "comment": "Malware payload (Mirai)", "value": "b8cc15b25a88c2721f17452a6cfa944c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534977, "uuid": "f987217b-0a81-449b-b9be-7d7d4e2e3ca0", "comment": "Malware payload (Mirai)", "value": "1311c2f8cc6176c6aac03d055d30656039717b1e96f719b7cfe329ca52cd02ed", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534977, "uuid": "ea452c4f-4642-4885-8128-62c29c629e03", "comment": "Malware payload (Mirai)", "value": "2b27d40c044e7ba572c26b8b5f12c0043aa88e58", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534977, "uuid": "df668f98-ff78-457e-ba14-8e2bf3b97608", "comment": "Malware payload (Mirai)", "value": "db4dfbdb8427669a36ee8cab0dd083b722a7f57c90b036c434bc32a4f02c2e0020b2f69d9a7d6c42452fdb82f73eb180", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534977, "uuid": "c652cd11-45e4-48f4-980f-6e734c9afecc", "value": "T1B923017285E45582C2F46B3D8AF58E836A010379FAFD39A425A0E8BD37D3D0415F6F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534977, "uuid": "2a46d544-0f4f-4118-9f04-ca87aa77b659", "value": "768:xxEkYd5s50ZN/SobPR94t8IGiTDWMAbLj7p/mx1ygoSxbtnis3Uozd:xxEkWCa6g6D0NmvoSptnfzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534977, "uuid": "41419644-affd-49bd-972a-3c20e3a9069d", "value": 47716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534977, "uuid": "b03d3860-5e2a-46a7-b5cc-1d42ec62d860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534977, "uuid": "1c508fe7-f001-41be-b6ae-f77c15aaff74", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912b43d6-9654-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786542538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542538, "uuid": "95672f70-562b-4d78-84c0-bcb3466060f5", "comment": "Malware payload", "value": "eb2a905357fffde797927b45da2f4012", "object_relation": "md5", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542538, "uuid": "19c27ffa-234a-4a5e-9e3d-a808548abce4", "comment": "Malware payload", "value": "131ef9dcfd4fd0eb043c96aec544bbafe05916bf29105e679bc884c8d9a6baa3", "object_relation": "sha256", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542538, "uuid": "ad6af3f2-08df-4f49-844b-39e79a635d8a", "comment": "Malware payload", "value": "cdd97ff11040b963afdfa147d6006f016474ad28", "object_relation": "sha1", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542538, "uuid": "c428b87b-e6b5-4378-81d5-f00881bbf6c1", "comment": "Malware payload", "value": "0266d86ae2300ead946326b1c3b133e84d373df0fee210992dfc58cd2294f907b1f85ff03e6ffe8e517ee091065dee40", "object_relation": "sha3-384", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542538, "uuid": "862abba6-948f-4155-9d90-6267d9b4d8e8", "value": "T1E00612B63B819971C40BFB70C9A9D3FC3329FF459A624B0736D6AE176D4A5C21E31A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542538, "uuid": "e5aa8f86-c7c0-400c-bbdd-bb4c670a90d1", "value": "5565c4036a7e88eaf2a6959339e75413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542538, "uuid": "a11ffcc0-ac52-42c3-ad63-0a1f4088c580", "value": "98304:NcX7DgdnkmvtZ11t8XIEskrbomGqRSr3uLPbNmfV:q7EdFvtXk805ZLPbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542538, "uuid": "24e24812-2331-4e1c-81aa-efde1f7a21c5", "value": 3668144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542538, "uuid": "532a2a53-4d8c-4522-8f27-290c0a93a7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542538, "uuid": "0c90f62a-a1c2-4f7d-ba93-a120477a17e9", "value": "131ef9dcfd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ef2807-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786522814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522814, "uuid": "315c2e3a-a713-4e71-9411-e9b1f229e5ea", "comment": "Malware payload (Formbook)", "value": "d06d6121c2eb0430ccd331f68dd1194c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522814, "uuid": "81b32a7a-ca38-4f58-a1f8-a7430a9fdd50", "comment": "Malware payload (Formbook)", "value": "13ac73f4d4f28b8ed030ed83ac64a9d3fb59a7b54588c3f91d1a61806e88caaa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522814, "uuid": "10e0e78c-cbf6-4fb6-8200-b51d0e089287", "comment": "Malware payload (Formbook)", "value": "9d477de3e7064cc72a0cfe7e5faa810fd17dda79", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522814, "uuid": "673063dd-c181-4f1b-ad1a-bfc94651f161", "comment": "Malware payload (Formbook)", "value": "6a051ab696502b1287564fb17a3deb6685fe4fc764a03156c4d8c1b8a54aec2c0c7712564c7b4a676249853c5c531a41", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522814, "uuid": "800a84b3-e537-4c38-92f8-104a28eccf3d", "value": "T14C258DBC5362BB450CA8A7EA12039DD814F1A9D51580B77CDF09B9ADB522844CBF48FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522814, "uuid": "b394a47f-856e-4735-bb93-eb0e7d583804", "value": "24576:QkKfhbopIO2wlOFaQu8fl9euaT/Gj6eNmjXn1JH5mNP:SK21uwHohkM1JyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522814, "uuid": "aba66dca-38cc-43db-839b-6eb303e5493d", "value": 980086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522814, "uuid": "9d3c19ca-451c-4bbe-8255-bd3f0b92f7d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522814, "uuid": "8bfd7b49-e4c6-4764-b461-59eb9aa9e9da", "value": "SW_2752369.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eb78a5-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786522849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522849, "uuid": "5746e5d5-29bb-47aa-9370-8f3b3e7eaecd", "comment": "Malware payload (XWorm)", "value": "a639958fd3a3265d77f346a95dab6530", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522849, "uuid": "dfb8c6cb-7b1a-4a0c-9679-7843041fabf2", "comment": "Malware payload (XWorm)", "value": "14a6ae1bdc8e2989a1d22f0d866866abba4ef6a89075c66e0b5d38881516c7fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522849, "uuid": "0555bcb5-afee-4636-888f-45e9e7938db4", "comment": "Malware payload (XWorm)", "value": "ef124f963fd58b95c6fd1f4784230f12f4209c67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522849, "uuid": "ce668d3a-efcc-4957-a3dd-e9b431ac45a5", "comment": "Malware payload (XWorm)", "value": "418ab1925033310e67944fcf12b87fe5062e8a51cbe7c8dfb7ea398b21c2faafef799d7597498060bcfe9507190077fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522849, "uuid": "f7d7c6b7-bdc1-4b4c-94a5-ef192167bdd4", "value": "T12D252FA3F28F82DAD3018E1F7DBF4D4265ED5A4E06A972FAB81795FEE2244044D07934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522849, "uuid": "11f513da-69d4-4b05-a6b7-c6501d74d33c", "value": "1536:o+BCX4c0e9sgfCFJvMugkdwGHAqCUMaM9xFK5abFjTRDvhADYwD9mp8fND:8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522849, "uuid": "8521c132-005f-4b3b-aa9c-2e5088d329aa", "value": 1003800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522849, "uuid": "fa741e8d-26cb-4036-afd4-b29d7ffc3ad3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522849, "uuid": "4bb20d06-f923-4908-b6d7-4c1b9d9fe292", "value": "SF-00092801-0182.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7f4135-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493007, "uuid": "1ec8ad2c-b796-49a5-b563-f06e837e2c41", "comment": "Malware payload (Vidar)", "value": "25c6c706dc9ac68b449dc26fd0ad1b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493007, "uuid": "85367ba6-a8bd-4555-8993-e47a6f1720c0", "comment": "Malware payload (Vidar)", "value": "1599c9ae2761b8d42073c8c1992560276b3814fd808845d7935a6256fac926ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493007, "uuid": "dfaffd36-a01c-4f08-a697-70bcd529536a", "comment": "Malware payload (Vidar)", "value": "af966744dd56a556be5782e8215d75e68f7fe368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493007, "uuid": "cf85a1c3-5973-43c5-996f-4a59cc616279", "comment": "Malware payload (Vidar)", "value": "7f64492b44e9489f2c3411e8150b4b055a35c4711053e5091011594b2b9e794182d203769df146f6b0da0ae7b39ad98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493007, "uuid": "04870f11-626a-44f7-8b33-3a4b5191a1da", "value": "T10F664943FB526EB8C096EB75893A425266647C5DC73437F72E51AEB03F2A3E11A35B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493007, "uuid": "6a615287-d616-4a2c-aa99-5e4acbc47be4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493007, "uuid": "aa063279-8906-4414-b60d-0444f2f233f3", "value": "49152:BVXw8KMPRNg38HWAjnN00tMOa5TbSb/0MPQIELn7mRBONkZSYSPXr+xdQ4x:B5920tM9iPQIELnyR0kSPXrUQ4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493007, "uuid": "28923637-3d07-41d1-baf3-38f2600b9ec4", "value": 7024712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493007, "uuid": "9a7fb1d2-c7ff-4bed-87df-e109b5bfbae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493007, "uuid": "0ea018aa-3387-40a6-9772-ac6ed2c7c0d5", "value": "1599c9ae2761b8d42073c8c1992560276b3814fd808845d7935a6256fac926ec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151f9536-967d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786559939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559939, "uuid": "f5ed3687-8d31-4464-9a76-04b83bb6f259", "comment": "Malware payload (Mirai)", "value": "f4ba6134996dfebb62d545a1f748378d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559939, "uuid": "eb21ef87-6ea6-4a49-801c-0cf7ff71dc83", "comment": "Malware payload (Mirai)", "value": "15b63033ff22fae18a6fec5e1c5744b84c0f59dd204520b37bd899c887d6b8aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559939, "uuid": "adddb9a7-252f-4f93-a6b4-fc82556c4bc7", "comment": "Malware payload (Mirai)", "value": "cc2f4c82a13f1aaa655657b77173911781d5f168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559939, "uuid": "deb9c8f5-048d-4ba4-9ffa-4e4f606caeff", "comment": "Malware payload (Mirai)", "value": "1b39010c1cb411d0b3628d4666bbd316732290c5317186e63d536e28ee4e1ea776f0de95122293fa856e09221da789c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559939, "uuid": "af8cc013-b2af-40f3-8cb0-4a10993acb66", "value": "T1CE431276891C6D24E32518BDF2BC4447AB6A16D8F2D7761BE360AC4CB5B271290F0BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559939, "uuid": "743c9444-aa75-492a-afe0-9fd42d993394", "value": "1536:7oW9VbGnmWQtRfHmqCSnn32CnMp3rc+rkcI/fR:7oW9VamWQtRfHv3juIcI/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786559939, "uuid": "eb2d6a63-b6b5-4eee-ad01-3372ae164991", "value": 56412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786559939, "uuid": "29d5e3ea-7ff0-4f18-ae06-1a66fa0ef78a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559939, "uuid": "f10edaa9-6522-4d18-ae9b-245a23938473", "value": "15b63033ff22fae18a6fec5e1c5744b84c0f59dd204520b37bd899c887d6b8aa.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4902a310-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502473, "uuid": "29990c6f-905d-43cd-9dcc-63dc9c53e7b1", "comment": "Malware payload (Mirai)", "value": "1ee92f0edb63283ea03a1b1405861e26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502473, "uuid": "bd2737c0-584f-41a0-a010-caf2cea692fa", "comment": "Malware payload (Mirai)", "value": "15d44f49786a0e06bb026e05ee4c6f6245fc24d9b002e2f6ca4f847693fcf321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502473, "uuid": "4ddba376-9f9b-4ee1-b278-23d166ceeb60", "comment": "Malware payload (Mirai)", "value": "a7637a6a897d53392b97c3abe681af0513f3e766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502473, "uuid": "9e51aa4f-3a4d-413b-b17e-a10e523f6988", "comment": "Malware payload (Mirai)", "value": "7395b47d1596130dd5cbbe1d8141bc2841cb72b9e3d4a4807e64907f0cbcb6cd4eccf7d1eef9546d961adb5ec73ef324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502473, "uuid": "d3a64d97-4676-4c5c-9968-cf2bbf04c4aa", "value": "T148342B46F6418F13C0D617BAFACF56463333A794D3DB730699286BB03F8679A4E12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502473, "uuid": "a00346af-18c7-417d-9290-6330eafe558f", "value": "6144:RFhO/D8P8Q90BANWxDFjaxZkXD81FTPEFsSyAa0r6pTM/RipbN3:+80e0q+DFjaxZkXD81FjisyaNpI/w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502473, "uuid": "f2ca7fa5-711f-44ae-946c-c2a44a127fc1", "value": 233312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502473, "uuid": "1f55c157-5fd3-4f14-b9a5-bdaacfa09bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502473, "uuid": "86aa8b9d-a506-422a-8293-267e84633465", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42973dc-9661-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786548260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548260, "uuid": "a75dc123-53e9-4805-8d85-17ec4d3d3e37", "comment": "Malware payload (Mirai)", "value": "af1113f84cb5281e05aae2675a5d4d48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548260, "uuid": "472e2929-34e7-48c3-9d95-c6e1a8a0f512", "comment": "Malware payload (Mirai)", "value": "16c7a7b9ce245e15fcd37331760706f13481091502fcdb63b4baca8b9d99f7a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548260, "uuid": "ac064be2-51c7-4756-99ee-1c08d3c841f9", "comment": "Malware payload (Mirai)", "value": "c894d9773dabcf217533b107936152421e269307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548260, "uuid": "8b024410-32cc-4c2a-ba5a-7ed5993a83a5", "comment": "Malware payload (Mirai)", "value": "2ef5defead0d86ec1b13d2015c0be0d8a41cef57c9391c10da5d00944b9e12bb98fe783560e01b0a2b946154943c3929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548260, "uuid": "fb60b8b5-44f8-420e-b3e6-3d6b893257fc", "value": "T11914A61A6E229F7EF6A8C73447F74A34976D23D627E1D684D1ACC1101F2035E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548260, "uuid": "2d22d794-d7bd-4a4c-9a81-d041b30e5f18", "value": "3072:NoaPqWNWjfRw1Bi0CPWCzYwrWg6zbjU1FCkceX0Y3k35aUvOO1HI7Glsm:NoaPqWNWjafi0CbyD0xX+34UvXC7Glsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786548260, "uuid": "6cb529e4-1d9d-4a80-bdc8-17a7432331e6", "value": 200200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786548260, "uuid": "a80d6c2d-e6e6-4be3-83a7-bb492a18abfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548260, "uuid": "4a2d3a31-fd74-4c14-89f5-2a2b98f2554a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076313a9-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498498, "uuid": "1be5a680-82d7-4fcf-89a1-f3b30cc2e519", "comment": "Malware payload (Vidar)", "value": "1b257ab18e4161d4d5ed5efd535f798d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498498, "uuid": "7958cef0-995a-4dda-8fb9-e36e7cbc9735", "comment": "Malware payload (Vidar)", "value": "16d66eebf8d2ec738234449ec480e0a9eb98a140347671f4650fead082c01f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498498, "uuid": "26154d46-bda1-4a62-98bc-7715206c81aa", "comment": "Malware payload (Vidar)", "value": "bb5ad008bb1d5b796a00c734e8a2cb728b15f5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498498, "uuid": "66b5675b-0cf7-483d-a30e-144afe578b56", "comment": "Malware payload (Vidar)", "value": "46dd4a8aa9bf4655d13c9ac45359924314ef8d11bfd5ac527d87341c03ee2233cc83637240f2b49782b449c52acbf534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498498, "uuid": "b6ca6857-8d0f-41f0-afdc-ead6a1ad2c9e", "value": "T1CC667E13BDA25568C0B5E73089BB8351B728B84C873133E32E21EE786F267D55E36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498498, "uuid": "746b11a8-ef9d-446d-bcc4-9dd671b5ab13", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498498, "uuid": "ff489e71-84ed-44d8-9c82-7fde425bdea3", "value": "49152:4R+4lw4v3mu7hBAlzxiCWkYC/E3wGsGuMcborjquNpdNEYH8/1XuT6maEZ4X+:m57AlzsnxsjUj5p7EUAppX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498498, "uuid": "583cc3f9-bce7-4b37-82da-2fa368be0ca8", "value": 6562888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498498, "uuid": "521f81e2-123c-4440-a256-b97231d47fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498498, "uuid": "5690a201-92b2-4ed7-84f2-3d757525f32c", "value": "16d66eebf8d2ec738234449ec480e0a9eb98a140347671f4650fead082c01f4f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fd9c01-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522755, "uuid": "b115ebe8-3db2-46e5-b130-f56c3254908b", "comment": "Malware payload (AgentTesla)", "value": "081ebb2eada4299186af760aefaeb75e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522755, "uuid": "fdae2a70-67f5-4760-9424-b7c2a53455f8", "comment": "Malware payload (AgentTesla)", "value": "170a3b6c18e1e7974f7030929ceec8a2aab1e509fc80e0fad75f48b3ef868baf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522755, "uuid": "e9640de2-95bb-49b8-89b1-5b2b84371367", "comment": "Malware payload (AgentTesla)", "value": "b0fbf376d3c50a292fe9750049e4adf9dc05e1b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522755, "uuid": "1c34eb8f-0a5f-4130-8523-63a3bced5bbc", "comment": "Malware payload (AgentTesla)", "value": "e608151f63ceed614649c79cc566fd635a069b7c610c57ab93895a04978a7d80e34863e5f8e35827fdb942bd21447eac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522755, "uuid": "362d4e17-c1ee-4a2c-8a07-a107b7f5d888", "value": "T19AF5A45A9388A1337B20676CA3B6DE389809B2C734D5CB95396CD2093B7CD07535CADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522755, "uuid": "a07bac98-57aa-4213-bb4d-7f5f7d208695", "value": "98304:d281xI8Okj9MfxKzYg91JnteEzPP4qFXBVgjAeuh8XL48I31015+GZ4:d281dOSFteEzPN1iYeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522755, "uuid": "d1805eb8-3609-47a0-ae4b-b91a9a4e3d33", "value": 3328070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522755, "uuid": "d0510bd6-14ca-434c-8a56-be13aa6e3d8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522755, "uuid": "79eebf76-673f-4f4d-85de-f1902733acbe", "value": "INV 83467_12899.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed58add-964e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786540037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540037, "uuid": "7aff94e8-273f-4dff-9bf4-6df31a74dec2", "comment": "Malware payload (ValleyRAT)", "value": "dcd9cb7ae29a43c8901d9b98397ede8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540037, "uuid": "420ecd1d-baf1-4f2d-a6ac-48c712c1b291", "comment": "Malware payload (ValleyRAT)", "value": "17a820edbf5361d0d738f8763c6e4e10030abdf3c89a4a1b7a3b496f67f3a139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540037, "uuid": "81aab395-0ae0-49a7-9e36-7024e0ca7b10", "comment": "Malware payload (ValleyRAT)", "value": "437cd60d11df2b7fdf21b5a40038c49f57e2c2b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540037, "uuid": "0d1d825f-7acc-4cae-a3c8-8c23c237cfa7", "comment": "Malware payload (ValleyRAT)", "value": "183f847286d8d85bcf8fde2df9508f8d330457e152f09838bb1947c85ea58bde00aee4a898810aac643752cae123498a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540037, "uuid": "b918643d-9478-4a63-a296-d7b025ff22aa", "value": "T1BC773356852EC406E6B005BCEE56FBF80E540F52E86AE73BD4E27D7AF0F59021C5A843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540037, "uuid": "beb83e3a-f794-4056-8037-cf674e75e9fc", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540037, "uuid": "57dd7c97-5b88-4dc8-a574-4426452d366a", "value": "786432:tZ+BvixMf1TIYpZwuNxyJTjmG6ndKaczGillgGGBmijKnXg0jC:tZWvixMfRXNxHddKtGeijeg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786540037, "uuid": "4faed280-a192-45f0-82f4-f0692abe74f5", "value": 35485744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786540037, "uuid": "9b86e95e-ef14-499d-8ee1-7a05d8ab6e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540037, "uuid": "85d986b5-f209-4f88-a4c2-289000c87476", "value": "Anti Muted.sp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cef8adb-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556087, "uuid": "d74f8ebf-f3ba-44e8-a498-73e256fedfc4", "comment": "Malware payload (Mirai)", "value": "8e798110eacbd6fe3f97c25b4a7f1d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556087, "uuid": "bbacbbc2-3ab3-4411-8bf5-a55ffbdbfa13", "comment": "Malware payload (Mirai)", "value": "17ba33e3ca7ae5a7e128ffe2c96ad73ecf4dbd96419a6b101dfd120b1334125b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556087, "uuid": "892a562d-477d-4bf5-9fe3-7ceae5c8cefa", "comment": "Malware payload (Mirai)", "value": "80e4a67cb8791959058e25a11e9904dae23a7f72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556087, "uuid": "1d5c2769-2371-45e5-ad0f-8650c8f5b80e", "comment": "Malware payload (Mirai)", "value": "621aa4bc8108582f04f837dad4428f22556b95f41edc7100ae954c18c12b4e2fc9baa2adefb2add5b2bfaf3282046ab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556087, "uuid": "32aea07b-749e-443b-9320-8a9df6a33faa", "value": "T107142A83B905DEF6F40EAB7204D34B257231BB660A531A32B31779799E3A2C4346BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556087, "uuid": "892b3b79-9b23-49a4-966a-5e739b6480ec", "value": "3072:Sv2P47RMQwkXyZ4O6nnge8zG+ofaJBwxL/rNhFFrzv6BG7oxXkm2CLf5QwD:c44weyZ16nngxG++LTFFrzv6BG7oxXkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556087, "uuid": "8a831551-b3f9-4bd4-af5b-cffeb1b4ebd4", "value": 191618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556087, "uuid": "2273645e-b869-4187-852d-5d9af611aa3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556087, "uuid": "d4ca13e3-5b38-414a-bb3b-3497c2760a9b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031f995f-968b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786565922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565922, "uuid": "1e69cba4-d388-4ad3-b1e0-cafb63b50fa5", "comment": "Malware payload (Mirai)", "value": "f07dfcd88dc8b9ba8e2b30ae96787888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565922, "uuid": "5610d820-c63f-4b7c-a9c1-9616cb26408f", "comment": "Malware payload (Mirai)", "value": "1814a5238c648088ddb3a7d82c2408bd815be81ecafbff11f43c84fe5be5f4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565922, "uuid": "97690efd-fea1-41c4-bf94-251131e73f6b", "comment": "Malware payload (Mirai)", "value": "9a3f0a79e8573701dac83063900d84b0e8ba5950", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565922, "uuid": "2b54eb99-853e-4be3-ae1e-061b0bd11e5b", "comment": "Malware payload (Mirai)", "value": "5a41116b1bf2248cd348897ac2943c19cb00b7849ce6abbecadb1ec8be7f2619f3aabb7ede3338b9ed3dbaf3f708e54e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565922, "uuid": "4e484c8d-90c2-4b3b-b9f7-60d8b760c67b", "value": "T15FE36B17B5C0D8FDC8DAC1B84BAEE226D972F4195174B25F23C4AF262E4DF206B6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565922, "uuid": "95040f69-680e-411b-b83a-dfc44d53956d", "value": "3072:oZxYuwH0i5vqKX+LTbr1Mv4l71/eGDcSQfO9Inoy4UdYVZR8:s9JVMSeGgNwJR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786565922, "uuid": "bc6f6c39-dd0e-4313-b1fb-abb66e00f2fa", "value": 155592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786565922, "uuid": "18e8f2a3-dfd1-4f71-b803-dc7550238593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565922, "uuid": "51afc6de-5750-4892-8925-b0e35211a861", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64305050-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786523135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523135, "uuid": "be4f22d9-4adb-4516-a1c1-897a77701d0a", "comment": "Malware payload (AgentTesla)", "value": "a7f834e1edc61076aae2766a3f06f14b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523135, "uuid": "365f3307-e302-498d-a230-9ff8d5076bbf", "comment": "Malware payload (AgentTesla)", "value": "187cccb9071b2cc230dfafec4447de5ac348953a23006756fd4a66ce5e55d19b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523135, "uuid": "ed8a702e-2a26-471d-978b-79e08e082ad2", "comment": "Malware payload (AgentTesla)", "value": "c218df119cbb5f298a20c524ad1895b9620e72a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523135, "uuid": "2293acbb-679f-4f0b-b8ce-370957e1c322", "comment": "Malware payload (AgentTesla)", "value": "f6ef19fe8c366ec5591f9a67388e3786511c76b771e9a0ede269597ec1d88ab8884419443d42e2787cab51192c11b1b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523135, "uuid": "3354b8a0-efdf-4599-b320-40933aaddae7", "value": "T1E5821A6B0C722960454B37AF58F71271C431157AEF537AF02EAEF2515C0AB4936ECA27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523135, "uuid": "2e781863-ce4f-457b-83a7-5da10d99a130", "value": "384:DmH+7N8obdmWmgJp6DgN3ZFIFilTWz8Z5c8XFBjxHEo/9wxa:U+DmWzJQ+ZFIFi1Wz8ZS8XFBjt/9ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523135, "uuid": "94fda423-5ab2-491f-a6ce-84d2e94cb1db", "value": 18407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523135, "uuid": "68a732dc-52cd-4e6a-aab4-f92698e967fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523135, "uuid": "b6f8b703-389e-4d71-9688-22ad9e234a41", "value": "PO 01404 August-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9f9e0e-962b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786524760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524760, "uuid": "07cf33c2-e039-43b0-bb71-f87e38dba17e", "comment": "Malware payload (RemusStealer)", "value": "21b04f8aa0e5863a37d0ed62f4a62211", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524760, "uuid": "bf1c1d8c-03fa-4ea9-939f-b05b1215962c", "comment": "Malware payload (RemusStealer)", "value": "197cee5dc3836a5c7eefd646e8b86ff40112a81fd5673e2fd03575706851344e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524760, "uuid": "81acdeae-9cfe-4f78-b786-34d5df1e7d81", "comment": "Malware payload (RemusStealer)", "value": "9415def91a9ac8bab08cc11bb2de417d90b67c44", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524760, "uuid": "148e471b-03b5-4b9d-a9e0-29d00fba7251", "comment": "Malware payload (RemusStealer)", "value": "31eec43a759fd94937c31a46aa647b5e7f52ff75a055d12de33c8a42efca26eff9b1d772a66254d05acef46c3bdc21b0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524760, "uuid": "b645628c-66d3-49fd-ba93-4c4861bc42e3", "value": "T164163807BAA504E9C2D9D735C8AB42227B74BC4C4B3133E32E90AA782F767D05E75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524760, "uuid": "288c2bdc-d941-440c-a104-78b593d018e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524760, "uuid": "4265b897-107d-424e-a3c4-0f07d6c2fc40", "value": "49152:uIXSFDDvaErZMs/fRwGlxoqKqDosiNSwpRqfj1cFs5e03PtATU6pePcZ:uRPplgsimteUVAT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524760, "uuid": "83cea333-1b0d-4c43-bc7c-011fa36c69e0", "value": 4389720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524760, "uuid": "39209ff9-25c6-43d7-92a0-5700552768ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524760, "uuid": "4e6df6ce-e41e-4aac-9072-ad1041635ee4", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6dd6cc-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534905, "uuid": "ce6e701a-385e-4e4f-a538-ae4afc811515", "comment": "Malware payload (Mirai)", "value": "73a92d19903747de6ee29e792b37b26b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534905, "uuid": "70f230fb-812c-4c37-b8c5-62c07fb9a634", "comment": "Malware payload (Mirai)", "value": "1a0b68aaa68362b41b3f24346d51f187e8a61fea0bbb978c672f2548b08b4afb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534905, "uuid": "fdfc76fc-7907-4352-be7d-d248b32fc3a5", "comment": "Malware payload (Mirai)", "value": "1661a82bf6b39da25427f855b31eb2f2eb3b5d69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534905, "uuid": "5a69e932-56bc-41cf-8857-5a1889aa12e9", "comment": "Malware payload (Mirai)", "value": "b255a4c29b5606ede1713348c0d5dbb28ad57fcae1a1a9b78c0dfcd7f9caa7e559c92e1bcf70e952cdb88b620329b2dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534905, "uuid": "f547fad4-f4da-42da-ab58-5c509e763710", "value": "T169D194D2F931C530749D187A9B89B260BEC7542F0A147C14748F7D786F2C66CA2BCA76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534905, "uuid": "a45ce6b5-e505-4463-9ef2-d50aaf445d81", "value": "96:FuDx7R/wlHPRei19pmxLImzpWCDgQ19JZNxh9WqYX+Bxt8LejU4LJvE:YYNZnqca9xX9WqHtrj9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534905, "uuid": "ae8be3aa-0fca-4bce-8bad-781a6231352d", "value": 6542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534905, "uuid": "87ff34bc-5ded-4a9f-9840-c413d962bfaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534905, "uuid": "97b64cf8-6e13-4033-bd55-ba1e7be0cd76", "value": "chunk.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eae856e-9697-11f1-bd95-42010a9c0009", "comment": "Malware payload (Havoc)", "timestamp": 1786571337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571337, "uuid": "b50c6ae8-d9a1-4ade-9203-638aba196ad8", "comment": "Malware payload (Havoc)", "value": "aab85d7018c9401dca0b45a0cc8e30e1", "object_relation": "md5", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571337, "uuid": "9bfee476-42f6-400d-9a4b-14d9d3af087b", "comment": "Malware payload (Havoc)", "value": "1b151dd1b1ca636550029602ee88eae182a4143fef630a608647f4b027051a9a", "object_relation": "sha256", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571337, "uuid": "9d0df0ff-0827-4f33-863a-fdba730a2f60", "comment": "Malware payload (Havoc)", "value": "bd17b9e101a0a7b813cd068f08b0a1a422de36b7", "object_relation": "sha1", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571337, "uuid": "031d9a18-f898-4939-ac42-0b509aa1c23c", "comment": "Malware payload (Havoc)", "value": "b41cd769b3870ebdaf1216b0b77959c8475a2704a7e69c060a41a73b7420f294c7c10fa4f4bede07c47b4b7d5aebeb86", "object_relation": "sha3-384", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571337, "uuid": "cda3ef5e-ab81-4ae7-adfb-0a38dfb9e7e7", "value": "T1D921D72333088E6803168191717C38E3DEB4C2FAB8B00814A5D179C825BEFE2305C78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571337, "uuid": "3bae7e64-0e49-4911-940e-e6ebf2e801c4", "value": "24:PSmb7FFj1K2cYEHp2Owxs4H3WdyuSp2p8xs4H3vV3E0suep2nSC+Gh6/xCMpXR0X:P7r1KHHlmIPSG6SwvkNpheX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786571337, "uuid": "9749b537-dd22-4c56-bd5f-94a6da183f2a", "value": 1170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786571337, "uuid": "6a580a99-37d5-47ec-88e8-038809b33544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571337, "uuid": "3d70a556-c929-4580-b360-225db57777d3", "value": "view.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c087d7-95eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786497312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497312, "uuid": "0420fe7b-dc43-4f15-bb00-66b4441ed5fa", "comment": "Malware payload (WannaCry)", "value": "84d768495ad6bd0e2ca596ee551e32d0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497312, "uuid": "30eff020-92db-45e1-af6e-189e2da24cf3", "comment": "Malware payload (WannaCry)", "value": "1b2db3fb7efde4444b041844049425c2106f53393305ee8ee528990cb9d64d91", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497312, "uuid": "c5424f9c-5a6f-4251-a6ef-61ee085df6f4", "comment": "Malware payload (WannaCry)", "value": "ad9a5047004a34f50dd796e4987a19a7c070b15a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497312, "uuid": "3e10ef92-b6ba-4d38-8ff3-4b55d5390d84", "comment": "Malware payload (WannaCry)", "value": "63dcc1f5c08401473c6f2fc2ad8873d0758c18b61eadf6f80eb6ccce8adbec319f1db37bab948d7e6e190d5e4a4457b1", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497312, "uuid": "7fc24dc5-0bb2-4560-b5b7-71244014f213", "value": "T174363358726C81FCD1060D7488E7CA27A7B73C6556FEA60F8B9082771E53B5A7B24702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497312, "uuid": "5c2c3696-10d1-4462-9f32-b99eb657c239", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497312, "uuid": "8eae91f3-3fb9-409c-8046-3da69ae6d37a", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9mbdW:DI8qPe1Cxcxk3ZAEUacbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786497312, "uuid": "86efedb8-36da-40a2-80ed-8808789845ec", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786497312, "uuid": "f4bf39ee-a53f-4a01-8ac4-b2ae01c6edb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497312, "uuid": "8cfe8295-adfd-4fd8-9373-c1e30f758864", "value": "1b2db3fb7efde4444b041844049425c2106f53393305ee8ee528990cb9d64d91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d885a095-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512593, "uuid": "89b2c340-6fbc-457d-b8f3-cb6c745fa6db", "comment": "Malware payload (Mirai)", "value": "2e4f558461e8f62b779323a2ac9dbc74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512593, "uuid": "2935f4f9-7454-4f04-aac0-d1ffee5f17ae", "comment": "Malware payload (Mirai)", "value": "1b4f3ad084416ce4bdcd3323122586c947cff3bf98ca81866b357ad8e3ae5c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512593, "uuid": "27f3e850-5bfb-47f8-88c1-79fa4dca2356", "comment": "Malware payload (Mirai)", "value": "cac125d9ce7b3defe5ef381849749658c7858f5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512593, "uuid": "647d6dab-2311-49ef-b7ad-b4055a3c2a66", "comment": "Malware payload (Mirai)", "value": "84a213737b0cebebbe085da522ae4c2b0bfdfa3259c71bc7cb1b3fb5f7c0c04792c604d964f86df4bb8cd8bba8a7d7a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512593, "uuid": "04b643d1-f1d2-40e0-867b-22650c607974", "value": "T106E32C46E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512593, "uuid": "a2350763-02ff-4f36-8c6b-f7287e793e7f", "value": "3072:U+UgNWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UbIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512593, "uuid": "0a28e30c-a69c-4a2b-ae65-b31e0f3f4ffa", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512593, "uuid": "914195f8-bfd3-4c56-95b4-feb339b21502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512593, "uuid": "3d1adf07-998b-4017-b7b9-b05d946840e7", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16d25e0-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512527, "uuid": "c4e0b2ba-9e1b-4d0f-a054-7acf0dd33e60", "comment": "Malware payload (Mirai)", "value": "545865165ce3dec77942b18b10b41b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512527, "uuid": "f9978f0a-9cdd-42fc-8c43-cbfbcc076848", "comment": "Malware payload (Mirai)", "value": "1c3521b4351341697d7a4d09d08fb06a0834d11cb176a2d08b159bfb7dbdbdaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512527, "uuid": "9d3fd601-212d-4d02-a377-7182f90185b7", "comment": "Malware payload (Mirai)", "value": "0611847cfe255b6ae17d14d7b8d9543430488b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512527, "uuid": "b0bb7f82-c93c-4a36-83cb-b73f7db567b1", "comment": "Malware payload (Mirai)", "value": "976318249bb0ce058196e26ddb8828af9118ef77ecec2b51bb4c0d7721dbf8e2de43ed7e5336e5696d4698dfb3ff7827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512527, "uuid": "733cd187-d204-4806-adb9-bc23ba6b7cff", "value": "T135832A97F400EDBDF80AD77B4453090AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512527, "uuid": "a2edd77f-dec4-4a82-9320-181e1f48f615", "value": "1536:quKG91i4XgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTHxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512527, "uuid": "02cc8e3d-e392-446d-bea0-086cf46b3940", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512527, "uuid": "d2ae9182-7f77-4677-89ad-38f3d8f79a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512527, "uuid": "2ebf13b5-ade7-4f88-bb81-513f75e3bd35", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0106adb5-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786509225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509225, "uuid": "76ac9bdb-d002-4c24-8fcc-3819c8670fa8", "comment": "Malware payload (Mirai)", "value": "8358c579ee43aae737ffba7a14889a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509225, "uuid": "77b267e5-4130-4944-92d7-916886200abf", "comment": "Malware payload (Mirai)", "value": "1d316bbb9849e930792df647a701e7897519b278764f2efdfe2a9e6496e457f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509225, "uuid": "e60b1790-719b-43ca-981f-1c609aa90b5e", "comment": "Malware payload (Mirai)", "value": "fd8081e3ce27793dbf51b26e64d5b84dd71594a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509225, "uuid": "502547a1-d585-445f-b80d-096b2d6e83b1", "comment": "Malware payload (Mirai)", "value": "e35b3f8ad020b50e7509b9ad82c5350bdd098cdc900db8830934cec1b021380b015151fa6102de861eec29ab19f62b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509225, "uuid": "efb631ff-dc84-405c-bf50-e7eb575b3637", "value": "T1C953022DD5F5C44BCE9C6D3D842C2FF299AA16E1251A0B0543C1ED8AAF1E06DF08F0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509225, "uuid": "8b1c1840-1094-43de-984b-ccf952763eb5", "value": "1536:4Pk8JMwqusOhwo4OE6PGNqz1/rKD8NrHsrGkYctscn4ie:kkaMwxw/OE6+wJjPTs0cnn4ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509225, "uuid": "c7a138a5-bdec-49bf-86a3-9243426cc7be", "value": 66420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509225, "uuid": "94c98189-df1f-4800-8943-bba80c196c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509225, "uuid": "0fe9f025-8459-4d68-9488-c50614073efe", "value": "1d316bbb9849e930792df647a701e7897519b278764f2efdfe2a9e6496e457f6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95940ae-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786498474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498474, "uuid": "98686d1d-75f7-4adb-8601-6d986e7d27c2", "comment": "Malware payload (Mirai)", "value": "4f697d972257de63e691e47363e2ba96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498474, "uuid": "2ac90d5a-7ab9-432b-b3e1-74f01c14766d", "comment": "Malware payload (Mirai)", "value": "1d5c206d5d27fc95aa51c40e5428ab1bc0468c994e5b6b20f6b861521deac226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498474, "uuid": "e5ce419c-a440-4d17-8db1-8a86cbbfc766", "comment": "Malware payload (Mirai)", "value": "bcdb4f6b11cd1310cb7e0dfea6ff70105b64617c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498474, "uuid": "57ecb880-5495-4252-b6e1-4843e0abfe8a", "comment": "Malware payload (Mirai)", "value": "b00ab59d25772af1ab716bbd8f0257fb8dd6fa5dd68b9748e45710814a1a1be80a0e80a711568d4ab4599683bbb8bce6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498474, "uuid": "159e6419-0c88-46fe-a189-fc88bd93e94d", "value": "T172C30849BD419B10D9DA36BEFF4E028973575B6CE3FE7202D9204B2127CAA5B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498474, "uuid": "12f789f1-fbe1-4dc2-acdf-7f01f2557959", "value": "3072:G/hiIsmbBkHaqzdcj7OaCQ50CZHU77SmvkPHn:WiIyaqZc7OaCQ50CZ0SmsPHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498474, "uuid": "271f1dcf-bd0f-4b2a-bcbc-02c6698f7748", "value": 118372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498474, "uuid": "c92b6279-f029-406e-a7e3-3fe674ef9886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498474, "uuid": "ebbf9dcf-94b4-4df4-9648-eceac1001c92", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238230ef-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517013, "uuid": "092406cf-ac4e-49b9-939e-cca8414eedce", "comment": "Malware payload (Mirai)", "value": "2675ae09790ef653f08ca585c80ac995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517013, "uuid": "1c69c118-cb46-4849-8d9e-dce568c2aa8a", "comment": "Malware payload (Mirai)", "value": "1db0a58329f7f218d1370a0113a5099c6ed1757f4854155a4747a6afd2b8e2a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517013, "uuid": "857d0be2-b888-4b8b-93d7-f742f412fc6e", "comment": "Malware payload (Mirai)", "value": "b65efb118e4ef2bba21752fbd93f0531aef35053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517013, "uuid": "a42aa459-7665-41a7-862e-807c1e775cb2", "comment": "Malware payload (Mirai)", "value": "754db43ee7d17aaa32107e40fbfe231d027c6901a08fd15e0b64b6e571202fdf57540f254958e124356e90640e55cd4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517013, "uuid": "e844524a-0f4d-46aa-a850-ffc721d3eed1", "value": "T13B4301FCAD22CD29ED152EBFE2B915713A51647C14BE35B20530D3B9B3E558089B88CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517013, "uuid": "a5963307-de9d-4a90-a81a-7a61544f5147", "value": "1536:AyCPoJzVYeYkLaQEwQBo08BEm8JPMH/uFa7eoY10zQ:NCPu1EVBMBx/gBqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517013, "uuid": "a75dc06d-dedf-43b5-87de-804549add3a7", "value": 59448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517013, "uuid": "a2bc3fe0-b7af-45ec-9e15-95fbd3e41a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517013, "uuid": "61e87f78-051e-4996-98b4-a56ad123db2c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf33e22-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786522049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522049, "uuid": "d8a5f4d9-2917-4610-9d3d-ab23569fd82a", "comment": "Malware payload (Formbook)", "value": "7461243747fe47eb08938ab2a06fba37", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522049, "uuid": "4890fb37-5320-4a95-bbcf-c884face1a2a", "comment": "Malware payload (Formbook)", "value": "1e17f7e1abf637c27d60b22a90e597c56ec460f9a335b93f70e74cf9c9ad3554", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522049, "uuid": "f0abaf75-14fd-4ab4-b13f-e546a986ea74", "comment": "Malware payload (Formbook)", "value": "0a992d82f980504533c775ddc9b410b3d5026f58", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522049, "uuid": "a45358a8-bd8c-4820-98c3-ecf4eea5b8fb", "comment": "Malware payload (Formbook)", "value": "d61ca4673ba81717eae5759e8cb68225e23f08aca946583eab612e8eafd0a8706d1ab940f494f9f551af533bc591337e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522049, "uuid": "a7f4d73d-e714-4aa4-ba63-908250461944", "value": "T127E5089367EDAB8A590C77EC104E2A4F0FBD90990D9682ECB2CF03F0270B55965D991F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522049, "uuid": "73780f4a-f682-48b8-9402-ad0931de08b1", "value": "49152:P1NS+5jNHbOqfBLe5QzprsTEZXkTx/T2kOLxM7J9sNpn522aJ7bvqaKLT:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522049, "uuid": "c80d507d-55ee-42bf-9a9d-488d98d2233a", "value": 3105771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522049, "uuid": "9e14358d-d9ef-4518-b77a-767a522c72a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522049, "uuid": "2405ac9c-3c39-4cd1-bf46-7ffa0c512a55", "value": "SCANNED_DOCUMENT_HSBC CUSTOMER_PAYMENT_COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d4fa52-9604-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508031, "uuid": "07f6cb5f-63c9-4ba0-81e8-2f3f2f2e5efd", "comment": "Malware payload (Mirai)", "value": "b791339b62ead2b71bf03e41b18b0b47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508031, "uuid": "84a97097-5768-4367-b3db-14da8cec936c", "comment": "Malware payload (Mirai)", "value": "1e9fe6fde5bf86fbbd6804987fa426c4c626af664360ce02a799224e6bcc4b38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508031, "uuid": "b4fe6938-3925-49e9-b932-5444996cf8e9", "comment": "Malware payload (Mirai)", "value": "e17108e17a47d1a55267b2d8f1da89d09862b60d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508031, "uuid": "f3c83e8a-485e-4899-9bc3-0e6c0a9a463d", "comment": "Malware payload (Mirai)", "value": "5a0c43441dca3babad6e039b9df9238f046a13cd84016eb342db304864084c3f963640fce5f30f04bf15540b8c8d757f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508031, "uuid": "10971f04-94c7-4b0a-9459-c5a242c063c8", "value": "T1B8E38DBBB30F1051C42206F417CBAF9D2E2312C25E6BD5E76C69263A2A765DB1C05FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508031, "uuid": "11f29d34-cca1-4925-9440-2d6523ace4a1", "value": "3072:oDd5u8l95miKatIgR25jMkOIl1WsTSeHPugeCkpX5XR6S6q:4tXi5H1PGwPmCkpX536q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508031, "uuid": "a9b8028a-5de4-45c8-9dbc-327d7029e49f", "value": 149020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508031, "uuid": "afca34db-a740-4d22-b0b0-d7be35c896f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508031, "uuid": "6c15cce0-4e42-4da7-b64b-c331010c4a38", "value": "1e9fe6fde5bf86fbbd6804987fa426c4c626af664360ce02a799224e6bcc4b38.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78a88ff-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516483, "uuid": "33e46d04-084c-42ba-b49d-a0aa0d510ff2", "comment": "Malware payload (Mirai)", "value": "7c6c71a2dc2e340120aa2964a309aeb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516483, "uuid": "6937c951-e380-4c05-af72-a64f3c4b3fe5", "comment": "Malware payload (Mirai)", "value": "1ea86fbd3ef6aeb01e94033343d5f50823ca8be96bf12538cb2c0f3fb7a24595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516483, "uuid": "c5539af9-7125-463c-9d69-fb56e47c5055", "comment": "Malware payload (Mirai)", "value": "e5c5cc2e2dbd694f9bebd9aee672328373ece6dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516483, "uuid": "cb4076ad-c519-439e-a36a-10e732e2bf87", "comment": "Malware payload (Mirai)", "value": "5cc77143840ff59e2e857f94fc240c5a64e3ddc2ba62e753bff897c4e52084a4d4332098d9c91571c4919db2a85d7604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516483, "uuid": "c9c30239-081a-46e9-96de-6c16e97dedf4", "value": "T197F31802B31C0943D2632DF0363F2BE1D7ABDAD221E4F644251F9A9991B2E376945ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516483, "uuid": "dfc8fe0a-8b05-4467-80fe-347849ce7a95", "value": "1536:VcnZJdKpDe5686hxDH0oxTC//JVIAhDMih1/5fry/lxsptTzufvA77rYsBc3v1Fz:ynZ7Ce56tDH0ox84AhpLFrUs+g7AB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516483, "uuid": "a7b19ea9-6530-4887-8e13-ee9347cbb709", "value": 166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516483, "uuid": "20e72ff6-0855-4759-b8d1-2a2d3bebe6cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516483, "uuid": "ffaac035-6065-4732-8715-5796e75fee88", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a37bd16-969f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786574738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574738, "uuid": "34145157-0fab-417c-b684-3eab55851ec5", "comment": "Malware payload", "value": "02cb1b2082c1b208ac67d96cd235b495", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574738, "uuid": "70e449e3-7db3-4805-86fa-8ae509f958ea", "comment": "Malware payload", "value": "1ec25086be7fa2918db0f591bff7417190bec288ec668b8dce53950134c886a4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574738, "uuid": "f3853cfc-b5e6-4497-bed6-600f3d844b35", "comment": "Malware payload", "value": "0a2f4f54f396c74cf01bb57f45a2133ea94bb754", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574738, "uuid": "c14ad7b0-e781-407c-883c-267417d40f23", "comment": "Malware payload", "value": "b6175eee9039e25ef50a9e62c91bc9e10e81ec6f25329d32d8ace679c0f20a4dc0c0d216223d4f6f49a34d6865807eab", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574738, "uuid": "e3ff5954-27d8-4154-8abf-119e3e05d0b1", "value": "T13BD522033F04A955C45A2A71D9B1C7BC6731FD59AE96939B34D2BE0BFECAAC21C491C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574738, "uuid": "882048e6-19c8-4135-a1eb-a84bae523b91", "value": "91a6a6f60534f1893d8b6695452d5b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574738, "uuid": "2d93f114-7b4f-4eb8-997e-8432a0424739", "value": "49152:JHGKzG1Jjn9dmbQrf4y1I+r87N+VhodAoObsjiALX2c4GIN94A3mZjwuCC:p/zG1JzbmAI+g7N+VhoWY2ST+9tm9Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574738, "uuid": "62bab240-ce2a-4f1c-9a2c-83a7d6b0fc0d", "value": 2926776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574738, "uuid": "a0a07aa9-5186-4630-a300-4b943c502d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574738, "uuid": "f5697c2b-b92c-4c9f-b872-4dd81d59d4a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0420fae-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496661, "uuid": "38b674a8-8821-4a50-94eb-30a366889412", "comment": "Malware payload (Vidar)", "value": "47a03ce6ad0046e4e79a5cc29dcf6874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496661, "uuid": "943c43db-3f24-4e0b-9087-1aed9c26ae81", "comment": "Malware payload (Vidar)", "value": "1f40d6ff2f88c58bf2a2685da8a847fd9cf7a54e28a3ea994390bd0af4e96a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496661, "uuid": "6eae1f19-d7b7-4374-8ef9-df815b457f3e", "comment": "Malware payload (Vidar)", "value": "73c778fd1ae7ff90ed9375d50028a42d89337e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496661, "uuid": "aa465027-6c2d-4421-84ee-d0842e82e669", "comment": "Malware payload (Vidar)", "value": "b5a984a59e332ae214570cfeed4f8f9bad831e79916caef61ee9fd067051c521a923082c262ad754ca4b568e38f1c0ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496661, "uuid": "a56af5c2-c234-4fea-b4eb-cac470563871", "value": "T113167C13AC9189FAC4A9A335C8B75252B664BC0C4B3237DB2E50BEB82F327D06D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496661, "uuid": "d04485bd-43df-4d5c-a464-0c040517e920", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496661, "uuid": "7cf9d091-dcaa-413a-8e94-8e50d9b5a9b8", "value": "49152:PHMtiMH0Dv8Bm+6SopLexXHMXogG0c+sVwzpGU9dKwF:PMrm1SXX+npTHlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496661, "uuid": "764e35c8-c299-4c6b-9737-43c7a8c0459b", "value": 4194664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496661, "uuid": "1db62e63-7966-457a-8e53-0ced2b45eb13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496661, "uuid": "af8e8c40-c700-447b-bc27-ce85f8441bd7", "value": "1f40d6ff2f88c58bf2a2685da8a847fd9cf7a54e28a3ea994390bd0af4e96a80.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2f6134-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504066, "uuid": "663f7235-3d2f-4e85-b481-ee7790968fe8", "comment": "Malware payload (Vidar)", "value": "ead2d608703b1f392002236ca0ba4e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504066, "uuid": "2f602be6-f812-437f-b9a8-9a6a335da42e", "comment": "Malware payload (Vidar)", "value": "1fb0fdff619456881e574eb35534b1a8e6b75bf70dbfa73976f7e9c8413a5310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504066, "uuid": "cc9949e0-6b74-4062-9320-cfcb8e8f5e0b", "comment": "Malware payload (Vidar)", "value": "b7fb538d3f0254ed60664997ef4e2d81ce609fd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504066, "uuid": "a3087d09-5e09-499d-b1af-18b985601839", "comment": "Malware payload (Vidar)", "value": "68a13dbbedc34a06b7efc7df1e08bf4eb27329cc8dc9c9ed903ec8789680a017cf261336089a837eec3976711ceb9724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504066, "uuid": "37c54a43-11db-41e9-8ece-1955602adf20", "value": "T19E069D07EC9189A5C49A67328DB70251BB38BC4A4B3667E72F40B7762F71BC24D76B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504066, "uuid": "81bca56c-d2b6-4268-accd-40b7f4200388", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504066, "uuid": "8de05024-3662-4b99-ab75-443ab380c149", "value": "98304:dJmQLKrpkZRc9l74DcMTbnTm7NJ8kMIX:dJhLSSZR2l7ocibnahJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504066, "uuid": "d65e1ce9-e2c3-4bc7-bdab-65775a8028df", "value": 3923752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504066, "uuid": "9ed5418d-a995-4f99-a96c-6f54f0023198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504066, "uuid": "5b00d52a-3020-424d-aeb7-c18f91ed27ee", "value": "1fb0fdff619456881e574eb35534b1a8e6b75bf70dbfa73976f7e9c8413a5310.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfffdc7-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535015, "uuid": "88a60d32-a151-42c5-922d-596d228e1c85", "comment": "Malware payload (Mirai)", "value": "4b82da7712467eec3c26bc7718eca076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535015, "uuid": "0f889961-2360-4012-b78b-7e8cb0e44455", "comment": "Malware payload (Mirai)", "value": "1fb9e56d03b606f6f30bd1d1b74a641f312b7213778a39816b0fbda5cdfd7fcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535015, "uuid": "5d68223e-6174-4fc9-aa58-4f4c1374dfa3", "comment": "Malware payload (Mirai)", "value": "af5248d07a84ab5791b1bb7c4196711dd7a45892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535015, "uuid": "f49b09e7-0b34-4d60-b857-5a6c0283e34f", "comment": "Malware payload (Mirai)", "value": "2135091adb893166da43f2e485ce9e73fd1eff28019ed31becf4569b4937997191b4b8ce32f1f0bc5de24d5153cb56a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535015, "uuid": "f522188e-15ed-422d-948e-242fb3fdb9e3", "value": "T12CD31941B8515F27C6D522BBFB5E42CD372A57A8D2EF32038D216F24378A95B0D7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535015, "uuid": "8ed99803-1511-4c2f-a708-a2d356cdaeac", "value": "1536:hA8F/zg5ROjlELn43NrRpEIDRd2DdgY4V0a04TfbrJllJwyw/yLPQjUrbej3Q3sD:hA8hgatNpE2RdrY4HzLbfQiwBckP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535015, "uuid": "81f925cc-752b-4245-91ae-fa39de4600c9", "value": 133760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535015, "uuid": "4d503abb-2e12-416e-9f67-cc0b0142e3e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535015, "uuid": "37b3b3b0-8785-42ed-bd75-5f212c283669", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d697f55c-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786498416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498416, "uuid": "439ce610-291b-4a2c-a52c-c09fd115d783", "comment": "Malware payload (Mirai)", "value": "6082de2c61fea2c28839413267b70489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498416, "uuid": "0e652011-5792-4e50-a8c0-7b44eb5bd869", "comment": "Malware payload (Mirai)", "value": "20385fae2224fb4fa4a5f4aaa01a8a58ae1a53a889fdd65edce8414e4ec2be3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498416, "uuid": "4e748a43-e80b-426b-b6c7-c46047c9c4d2", "comment": "Malware payload (Mirai)", "value": "ea7d0b3011781b1d1b1492a112fa87d19b539f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498416, "uuid": "99477f7d-2ee4-4d24-abb7-ec463ef240de", "comment": "Malware payload (Mirai)", "value": "47551c9d3bd0a7347e6cdaa96201ebe978abb30c364845bf0946ec7e0f5aaa617f80b1a6aaa921db10c95c0620d020ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498416, "uuid": "ac9c7910-1a86-4176-91cb-d3e4db680d7c", "value": "T1AF43F248219F4BA2EE611FB0C2C5B000F301557C71795A75F17B8B82FBA2896FEF6259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498416, "uuid": "9816c142-b49b-4217-b0ac-9e215a0319d3", "value": "1536:3QZy58bWvfzbM0g8jgZNfsqy1KQ65RLE2/:3QhSv0zxbspG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498416, "uuid": "62b62342-cb94-45e4-bd8f-0ee0ec7f45c6", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498416, "uuid": "5c2c5cb2-cb04-4951-b92f-578955a862ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498416, "uuid": "fa0031a9-a7ee-4f44-a910-cba9493646d9", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bf1426-961a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786517551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517551, "uuid": "89641d41-1fb6-4530-a97e-f833498172e4", "comment": "Malware payload (Efimer)", "value": "bbbdfed0b5588f27cf2a33b2b68831f0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517551, "uuid": "64f3aa5d-72ca-49f1-a421-a9c3b57dc937", "comment": "Malware payload (Efimer)", "value": "2056dc51b9861e65ea7098afb60c55219b34d309c0dd9bd235bf85eb76530504", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517551, "uuid": "18f9cbe1-794b-4017-8065-1adc32a5c86e", "comment": "Malware payload (Efimer)", "value": "859ec8bbb7dcbea9f846c2937d31ebacd577b136", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517551, "uuid": "a1df3a6c-5696-4378-8bf5-3636feb83a95", "comment": "Malware payload (Efimer)", "value": "604798afad64d7f10d2db2f9f122f558649c3129231d7c4beb9ead67b85c5aaeb020f649c2fe3757c3244dafe9e6e806", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517551, "uuid": "f57ee00c-d151-4923-8780-70cdc9550dfe", "value": "T102E6338C08E255DED2B680B4FFF11A34722970BA1B374ADB372887A25D936D56C3C857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517551, "uuid": "767c7267-ea2d-4f7c-ae35-551221009244", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517551, "uuid": "e4b45314-a8b8-4584-8259-189b8cef8c6e", "value": "393216:6CrFAyAmo7KRnK7Kp2XMCHWUjecuI3/PGTAI:Pc5xKIXMb8TH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517551, "uuid": "8ab35ad0-0f08-468d-bbfb-399f5b8a3975", "value": 13877068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517551, "uuid": "5339a94f-f506-43c3-bb0a-175a833a0fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517551, "uuid": "89b12c76-c353-4efe-a34b-029d4ebb71c8", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b46f2d-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786523347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "3cc7ab9e-ad7c-47fd-8795-131fe28ce746", "comment": "Malware payload", "value": "1d8b9417f0ae593fc7b1f4b3eb3cebe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "c90023b9-79f3-49b0-937a-e4a954e163ac", "comment": "Malware payload", "value": "21543dd54b42648d7278f4c0fc258cc91cb9af76fbedf8d9939492c882bff2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "548ae8cb-611a-4af4-bd8a-ed2124f4bb4e", "comment": "Malware payload", "value": "17de057ceeacfad03d1fba989d57e0ebf2b7bc85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "7ccdc7e5-98bf-490b-96d1-b397a11eaf55", "comment": "Malware payload", "value": "63a54ec3ca829bcd16fde9de5eed944053fd6801bdb1c602078e8cb005ca103977fe3a81625753c51a30aa5dae419947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "762aee9b-88b9-4a49-a985-7047c09642f4", "value": "T143B312554A464375DC989B30A156CAFB50AED2277978EFB41C6CCC32EE922381C87E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "6fe2483c-b101-40a9-b9e7-1914955f2a56", "value": "3072:kzIxxpr8SbvwxHctOfwkhT3HjKE8xRWgdC/A6H/RV/G0:k6ySo/wkhT3DKPvaf/RV/G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523347, "uuid": "fbfd7b24-36a5-404e-af01-c1a10d6862c2", "value": 113956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523347, "uuid": "12f9fffb-7087-4983-b2e2-6330408a408f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "5eb101a6-5995-445e-b7b0-4788300fbc59", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9886423b-9683-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786562736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562736, "uuid": "76d8cf44-a34a-41ed-884b-d3891e3793cf", "comment": "Malware payload", "value": "253a0dcb4a46d2237eb9f172c09bab3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562736, "uuid": "1dcc6932-18c1-4105-8ff6-a189a4175162", "comment": "Malware payload", "value": "21ca4510eb93651c8daabbac3c5f4726b27e5efe1faaf3a0072d63c9beac903d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562736, "uuid": "f11a811e-f959-4dae-98c8-d01443d7acb5", "comment": "Malware payload", "value": "18b196da3ed92cb8d991099c2e00a3d009775933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562736, "uuid": "16177eec-acd6-4b18-b09f-c76cb1b0c9a3", "comment": "Malware payload", "value": "57fee3aeda2cc927e37624d485f1cf91cdadda232a133a7a437823f8b826cb90f2bc3f5d9c394b6e7ea988ee76b0d909", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562736, "uuid": "fdaf825a-132d-4f1f-8c67-aebf5a33d8e2", "value": "T156D4D80B6E328F7DF67587314BF70A249BAD23D623E1C581D1ADD1151F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562736, "uuid": "7091faeb-4e58-494b-8718-3d565adb3817", "value": "6144:wCe2zDJswMTEhU/S6PUzG1TVRmn0iEHeqKOoY8SgCPfbLimyp+LmYyWbSAXKokaF:1eMi0U/1z178AXKPy9P8Wqn/Wk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562736, "uuid": "0f19d4a3-2543-42d9-a607-2314c0716466", "value": 648320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562736, "uuid": "1551adb3-46ac-467c-a95b-5d4b4e5827b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562736, "uuid": "56fbb21e-9e09-4fc6-962a-551a619e093d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ad7c37-9648-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786537551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537551, "uuid": "ba7e763d-f468-4cb0-ac71-fdf0628b7e4b", "comment": "Malware payload (Formbook)", "value": "e40da4b019a10fd1aa65ce2d54059766", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537551, "uuid": "0630ea45-a749-403f-8c4c-f1054674d3f5", "comment": "Malware payload (Formbook)", "value": "21cb173c283968223ce89792b793a5bbc4c43d192b7b50715953c08e5bc6944c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537551, "uuid": "e69964fd-6d5c-44cd-b3aa-4e018394c2fa", "comment": "Malware payload (Formbook)", "value": "1fa6921bb7d1e0350bb8702ea36aa027c2dccb9c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537551, "uuid": "ba8acd87-33b4-4185-98ec-07fdabd2058f", "comment": "Malware payload (Formbook)", "value": "5ed518db8c0f11186f95e1566665106152f0630aaf8442d4e0f684227f81b2a656bb8148bc852b34db6628926dc910e7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537551, "uuid": "4349a523-476d-4999-8273-7e1ce76f2cd2", "value": "T1609322049983758493776BBFA22AA8D4F6760B2B01404917F87C74A8BFF2D19CDD1CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537551, "uuid": "495fd187-fa0f-4821-9ab2-8d0e1fb4be13", "value": "768:tUIXSFv7+t0hZvzXozSeijQKW+Gs5CeaEtyZ7aAvSLLUwS6XG2mYLXhb3z+d0UFV:CMihSCTrVo8tK5vFOYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786537551, "uuid": "d2a58508-9217-43bd-b671-be75bc9d0f9e", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786537551, "uuid": "e6cc5058-e120-4580-bcc7-80fff03fca0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537551, "uuid": "3236dde2-e610-4ed5-89ab-8337d7b2e368", "value": "SOA for Outstanding Invoices_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b195aec-962a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786524328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524328, "uuid": "7a7d2ddb-6076-4880-8ce6-ce01e746121f", "comment": "Malware payload (AgentTesla)", "value": "80ec4750874aa1eae0e0f5254849a833", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524328, "uuid": "0c0ac916-c850-4b20-a60c-d0cc9117e0ed", "comment": "Malware payload (AgentTesla)", "value": "21d5a0a7ca1686d434b5213713fa7866b47119f07bf83909f674f1066e559606", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524328, "uuid": "0c6c94dd-04f1-4575-a0df-13a14657ce42", "comment": "Malware payload (AgentTesla)", "value": "2c6057fed81edbde7c4121a30e98c46cfd089c00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524328, "uuid": "d18850c4-c408-4e01-91b5-3f3afaecf284", "comment": "Malware payload (AgentTesla)", "value": "ab1e92981d29a4f7c27d52b043d457905301c4356b70a631782c89781cb2c8c1a0a74b9f24c0df9cb02549a2fbb26497", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524328, "uuid": "f4fc4f0d-5b28-41d8-b5c2-baf95ac97c0c", "value": "T113F59440BB509132B331575C47BA8A32E52952A734E6DF1A786CD2C83F6CD877358AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524328, "uuid": "65c534fd-2d31-4730-8a47-0afb56feb130", "value": "98304:Ae6h5AmN/pr3p1ecUMKFq4u7PSqrX/iyr2FKLDr7ue3:Ap5RN/pr51ecDKF0LSqr6HFWHuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524328, "uuid": "108bf95c-94b6-40b3-bdb7-71825c64551c", "value": 3344454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524328, "uuid": "e7c8f8ae-5402-42e1-af5d-996704e496e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524328, "uuid": "b18e3d7c-b568-48f8-8a5e-55f04c524190", "value": "Purchase Order - PO-2603113056899.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67182b46-9613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786514550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514550, "uuid": "c9984e71-ca58-4681-b5cd-b0f2b7d8583f", "comment": "Malware payload (Vidar)", "value": "04b118addc210113bd78f19b701a4efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514550, "uuid": "77ce8bcc-7cd4-48fb-843e-6bbc6059be2d", "comment": "Malware payload (Vidar)", "value": "21f4413a443509325e360665c57c8ec70dbca2bdebc7a877cf677bd002bc492c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514550, "uuid": "8fd418dd-b5a6-40d8-bbc5-9ba065b2bf59", "comment": "Malware payload (Vidar)", "value": "ce2bd1f694786d7055b9ea16f7344878c3f99db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514550, "uuid": "30e77790-a2ab-4455-a67c-76b7d06a81bf", "comment": "Malware payload (Vidar)", "value": "8dee9427081f01ac61acbbd96f2a798c4fc47e8ddf9ca77a810f4019370c74bfa5804852e6eecfa28609f783e6b6be66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514550, "uuid": "648dd47a-c404-47b6-9ccd-e1550c35c89d", "value": "T1BC367C27BEA149B5C495E733897242017678B84F4B32B3E72D527A757F327D24A3AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514550, "uuid": "28497318-a08a-4088-8f91-e2107bd5890d", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514550, "uuid": "2ced1a59-d2a5-4f20-aa3f-a08382fcc853", "value": "49152:zg1Nd5llDLbUKp2asf65TszGpzlCsVoG2kXugAruzhdz7FlCpNXzlJ3Xu+S7BGAt:zgFjsEF/CpRuvdhQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514550, "uuid": "ddf0f852-d81a-4ede-8490-e54f03696f50", "value": 4979296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514550, "uuid": "b0fcb63b-f107-4ea8-a955-3e2f7295591e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514550, "uuid": "a999ea04-ea6f-429a-9a22-cbabc5e2c5ad", "value": "21f4413a443509325e360665c57c8ec70dbca2bdebc7a877cf677bd002bc492c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2544b43-95fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786504771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504771, "uuid": "2256d0e3-cc5e-4078-b857-022f1d097383", "comment": "Malware payload (Mirai)", "value": "21d7559ceb1dbe73206c9f19a6cea74c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504771, "uuid": "d4de81df-f8e8-40e9-9c7f-32127fdd6bf4", "comment": "Malware payload (Mirai)", "value": "2247df6d10ef4d4f919bae1e17fe280810bf3af308a226fbeb32aad8b5079090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504771, "uuid": "db034b86-ce30-44e4-affa-f07e84d82f0c", "comment": "Malware payload (Mirai)", "value": "3b58a550d02040dd5187f32e5757660d9536f4bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504771, "uuid": "fb03e328-bc96-4a9e-b0f5-3409d8ef500b", "comment": "Malware payload (Mirai)", "value": "b99fcc93974d019c5d3a05f54b7791ca7f140761f57a6c9285c7f14890998b6f196aedc711b8094c2fb55bac1bc834f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504771, "uuid": "ab175731-8e4f-4e91-8dbb-e5c33a6d589a", "value": "T115B2D034F1D0A9B4C2BA9D75DA6941CB3A150AF8C2BA30A25F1A07675DC736B387C44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504771, "uuid": "e7fef5cd-fb97-4890-8237-b730afd8c8cd", "value": "384:jh/SoUs8XLO63u3jgYhHl2VTgpZ2sHT7rCTnuouqHppUGIR5kphymdGUop5hJd:FaoV8XLeNyyZ2szKTR7UHkps3Uoz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504771, "uuid": "e54e011d-87fd-4a0f-bdfe-dbc8346d1855", "value": 25172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504771, "uuid": "2166d9bf-f875-43c0-b849-6d9010ca8842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504771, "uuid": "6ad01dce-fb00-4363-abd8-568bd4d4ee72", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77ac6f7-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515222, "uuid": "d36818e6-06d5-4da0-a936-dd78e01a2678", "comment": "Malware payload (Mirai)", "value": "4b2397317323cef303d2f510dab9c65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515222, "uuid": "dbe05303-2e4b-41e5-b163-e099e21d5838", "comment": "Malware payload (Mirai)", "value": "22e34369b9be31540abc0393f57c92950452af26454c75413481efe65b84dc71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515222, "uuid": "cf86bb19-c242-4098-9c75-093c68e919ed", "comment": "Malware payload (Mirai)", "value": "a27668ce17e9926bc82a59cd5973e91c7241f7e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515222, "uuid": "24033095-34f2-470b-ad65-14735ce0b9bd", "comment": "Malware payload (Mirai)", "value": "cec62318c3cd4fd00088c7e6cdc99c5ac48a2710924206716994f11199f0d1e5c09d289af01f43dab20dee5333bfd1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515222, "uuid": "9b8592c3-e451-41e4-a4fe-d9ff62e7dd45", "value": "T1D453F1CFD78B3DCDCDB914BDA45423285061F07765A5135F824E8949FB3A61EDCAA01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515222, "uuid": "9388cc6a-5ad4-440d-98dc-7d0528467bbe", "value": "1536:wi/G+N3e5zKS9F9g/HveODBYqlk4aeeYx8PQmP3Ehfxyx:L/G+I5DFGveEBYqGvQmPUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515222, "uuid": "de8051ce-5044-4900-897f-f1bd377027c6", "value": 66336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515222, "uuid": "77150112-de71-4489-96a6-de24926c92b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515222, "uuid": "57b90b58-62b7-4fec-b1b0-917dfd7ceff7", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5f9553-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786564761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564761, "uuid": "62274458-1db8-4f3a-8128-532b382e23d6", "comment": "Malware payload", "value": "b4b69078539188be988196c90c1a85e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564761, "uuid": "c27c70ff-1058-4bfc-92c7-c071b24242c0", "comment": "Malware payload", "value": "22ed18a454b32a12ea6a10d8f2f93569e2d3fb2c6fa2f317446cfe38dd112fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564761, "uuid": "428c6d4e-c12c-4e72-beb2-7c631793ec7a", "comment": "Malware payload", "value": "d586f8da70d82323149be551217f49c60a1e2340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564761, "uuid": "94c09718-9926-43c9-81fe-1a3000ad759d", "comment": "Malware payload", "value": "b255b794c330d620c94eea3f6adbe7a50903973eca51742b4cf116d358a5467f71468aeee210d11710c9e6c87777da98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564761, "uuid": "6c81503e-160e-4d98-bae7-8c44ab0a2160", "value": "T1FD568B13FC9219E9C1D9A23189A79252BB757C481B3223C72FA0B7382F727D06E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564761, "uuid": "23be76a1-cc20-4eb0-aea4-0fc3eec39879", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564761, "uuid": "25e1bbfb-fa57-407d-969d-7289f06b2362", "value": "49152:IHrrafewzFeClgZIiuRe2T2eiO9GoYCOJ10IgGzqzI5KGBeHKcK9KJE/xEa5E7Kb:Ii+sTViaGoYCO9bKGBEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564761, "uuid": "48e81d72-8b1c-4d24-b111-e75e5e21470d", "value": 6413688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564761, "uuid": "d93b7c91-640d-428a-ace3-18a3ac6e39d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564761, "uuid": "15cb6188-0d80-43ef-98e4-fe03e01d392c", "value": "22ed18a454b32a12ea6a10d8f2f93569e2d3fb2c6fa2f317446cfe38dd112fc6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3badfc93-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505887, "uuid": "49a3f78c-e5d4-462c-99dc-a036708d5c34", "comment": "Malware payload (Vidar)", "value": "f7ee44b6744bec701d3079bb9b9a0a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505887, "uuid": "1c8b49a0-3969-4623-90a4-3207d821990a", "comment": "Malware payload (Vidar)", "value": "22ef34056565ee2b894e77884d2d8abc160035e8be205beb0c9bcd627a6e5ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505887, "uuid": "a3b72a2a-279a-4b54-a7d8-0ae449fdae7c", "comment": "Malware payload (Vidar)", "value": "6fe47b3afa82a7a96e0991a12059422b0e0014f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505887, "uuid": "e1a1a780-83db-49d1-9e7c-dcb09156a1a9", "comment": "Malware payload (Vidar)", "value": "61ceec94d918222782983e407d5118109c009181e96dcb5d3f0aa9958073f77191cfd2b17f529ac7b9f76e3155852ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505887, "uuid": "cfeeff42-4c59-4ea4-85ca-17137b841654", "value": "T13E06AD0BBDE009E6C4A9A332487642517778FC8A8B3223E72E41B17A2F737E19D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505887, "uuid": "d516fa34-01d3-421c-b145-4836c0c5b238", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505887, "uuid": "5b33cb0b-86b7-4dba-a141-52e90394f51b", "value": "98304:8tSUmFPrE9YqZrnmeRd1wlJL/r6HVU/Ixj:8t3mhrEtnmeRdCJL/r6HSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505887, "uuid": "c21a0a27-a682-4faa-aa82-eb8f5029349e", "value": 3867992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505887, "uuid": "767972ea-9fef-45a7-9bef-69660aa1e1ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505887, "uuid": "e958919d-181d-490b-b1d9-fdb6374ebe45", "value": "22ef34056565ee2b894e77884d2d8abc160035e8be205beb0c9bcd627a6e5ee4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3eda95-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512946, "uuid": "9572f465-0dec-42e7-b3dd-8c70ade6ae76", "comment": "Malware payload", "value": "99579e5fdf5d6859987468570d3cf65b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512946, "uuid": "b4776924-0cf4-40c4-afdb-cf6ed5784889", "comment": "Malware payload", "value": "2405af35e97e953462a7f3e195fd30ea7a3edb4163700ee188541f202a8d730b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512946, "uuid": "6993d849-53c3-411b-98af-08d4ced5d601", "comment": "Malware payload", "value": "b341cf4448eb67c2958bbaa872a05d23a166d069", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512946, "uuid": "07608437-c815-462d-a328-4a5b4b4fe824", "comment": "Malware payload", "value": "800c2ccc4c55a57dd61ab2f689a0f98b097d32e5ae21bc25dbc879175ca3e985fa1b5ebbb02f8f79627533160e100892", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512946, "uuid": "a60fb9e7-fdc4-4291-b88e-9ee34b75fc05", "value": "T16F07AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512946, "uuid": "c1f8ab7f-5211-4861-ac53-b0a7b1d16f64", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512946, "uuid": "928a44fb-3977-4b2d-8dba-52da5c427c89", "value": 18186240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512946, "uuid": "8e281633-9949-4213-a519-1ec58fff4251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512946, "uuid": "478cf865-9dd0-4262-8bcf-f4076c56df30", "value": "2405af35e97e953462a7f3e195fd30ea7a3edb4163700ee188541f202a8d730b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48182134-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786509344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509344, "uuid": "a8125edc-cf41-4c45-a013-c0b02b686cc9", "comment": "Malware payload", "value": "fda1bc2805a24f39aff1ce3392583146", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509344, "uuid": "a8c25583-c849-4f86-aaf7-9765c9e29806", "comment": "Malware payload", "value": "245b59e45e6e62cc7d4dd018e77a682611195eb70028afc16e906ff89d715ae8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509344, "uuid": "13f473f4-9444-4f3f-ab55-608a2663eb35", "comment": "Malware payload", "value": "cf29a9f5316897e9d5aa0db36cd50558393621ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509344, "uuid": "ea083a6e-446d-4d35-8f0e-0e3ee01fdba2", "comment": "Malware payload", "value": "ace9bf881a9cc39b2d1a55c329406a8f55dfce3727e6f268ecaa73c07d250cac8a033d6ebda42cc501631b11d1d42ce6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509344, "uuid": "b91f9278-cca1-41ff-99a1-87700e4ee4a9", "value": "T152D63360F5D80918FC99F3398518F802D1E11A1A8FAC50D975B32C607EB9E618F6BF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509344, "uuid": "000be0f3-4caf-4744-a98a-5c72335d2723", "value": "393216:QGHfSsfXKEeQ5yEG0DPiGhyxXmY0FMmVdi:QGK88syEG0D1sxXmY0FMmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509344, "uuid": "40798ed7-278e-4d3d-bbab-9be2b8b79755", "value": 12627485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509344, "uuid": "eb4ba234-4b20-49c9-a59b-8ffebd3cb0c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509344, "uuid": "235471b8-07d9-480a-a25b-60ae17b24755", "value": "ztrace_maps.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda4a10f-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786521996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521996, "uuid": "667c5bf2-075a-45e2-9414-befb3278face", "comment": "Malware payload (Formbook)", "value": "74a9b8c3aae27de9638679d55f5ae019", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521996, "uuid": "9fec3fb3-9505-411a-9f5e-b21469f4013c", "comment": "Malware payload (Formbook)", "value": "247f6f51ba009d919195f74c991f32b09e9c8eec6282413b8647eb39e52f345e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521996, "uuid": "c65bedf3-6fbe-4f1b-ad9b-c9698ae7d44d", "comment": "Malware payload (Formbook)", "value": "f547e5e87add39d13b47be493ee5b1dcbad3230e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521996, "uuid": "e3099772-cb98-4711-9157-7db08e494a4a", "comment": "Malware payload (Formbook)", "value": "10f96632fed339b9493818ec953d9f9b0845e782481bfadfce366146a19177121f88dd6ef8487c0b3dc42697d066bdfd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521996, "uuid": "a1a9fd5f-30ce-4c42-aa76-c185b9226799", "value": "T195730C4448C376802337A77FB63AA8D8F736476B01804907B97CB554AFF1D19E9E18BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521996, "uuid": "b65132f3-d107-472b-ab41-c5c1e45569b7", "value": "768:PTfX4rHPv9PXeafhvsosnjUTx1PY9t25qft8B26VanhOo/C58j+2Bvv9JEGyj+B5:bf+0uLQ27mvCDdVapXRvqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521996, "uuid": "4f7a4b56-3f30-4c5b-9a3f-7dd471684eb5", "value": 73388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521996, "uuid": "7b45de83-b270-4e96-8568-0cbb3d3e8397", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521996, "uuid": "a54bba4c-b5dd-4b42-b158-c548e940bc2f", "value": "Order-Mokki-ref8092687.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81bd671-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511679, "uuid": "b5743675-4a1f-480d-ad02-edc6d77bf244", "comment": "Malware payload (Mirai)", "value": "f3b1845b07ca145070e17c0be7862009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511679, "uuid": "72b3197c-02b4-4c71-9cf1-2116cfcda7c0", "comment": "Malware payload (Mirai)", "value": "256d9258446c2210d6778eb0a9f50b755b9af1cc33c8ad060376ca5a6e679582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511679, "uuid": "62c44f66-f37e-4534-9c96-0db25802f4b9", "comment": "Malware payload (Mirai)", "value": "e1836990908515e2d65b49072287c3994af6f4df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511679, "uuid": "44bd64fe-19ff-4c80-9ee8-b60e884681f6", "comment": "Malware payload (Mirai)", "value": "6624e3e60a0dcbbf5eca2f73f9b5a7fc4cfcdccc9c7248afe08853f32c936884fdc3001cad26890c5af9536124601a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511679, "uuid": "110b7e6e-2574-4a8a-bb7a-c0f0e21d5602", "value": "T1CFB36C5AB9008C7DF78BBA37DD461A14F13EA3B202014F561ABAA7874C353285F5DDD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511679, "uuid": "3e851b62-4d1a-4888-9ee7-cd0aaebe5b12", "value": "1536:qHbnJKIJkb8t/lUREYafCr/iWevJiKAEGTdg9W8ujdj8BepIQ:qHDAZGbYm8iWeRiKAEGRg9W8uJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511679, "uuid": "3520363d-fa80-4316-adbe-c4c2d846cdb8", "value": 116596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511679, "uuid": "e9539ed3-2b99-4d6c-b754-745fa62dbf7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511679, "uuid": "1120864f-65e5-4b8b-880b-7ed2db8aeea7", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5bff30-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520171, "uuid": "4dfb0cbb-3a1a-4556-9a79-cd3ca004d855", "comment": "Malware payload", "value": "dcca26b280913e7445c5a4a5ab29e461", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520171, "uuid": "0e2b2819-802d-4725-a57b-34df5af3430b", "comment": "Malware payload", "value": "25cfc4923dc84e2152a9621350d33a5aa76a28186de813316b5a2b6cd7df0ddb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520171, "uuid": "71628f6c-39e9-44fc-a91f-4a9300dff806", "comment": "Malware payload", "value": "fbb4f772b1de37fc002fe587b4ebc45727e40737", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520171, "uuid": "40a577a6-5158-4c16-b210-1d6e78047e59", "comment": "Malware payload", "value": "94e426ebb748c7c8532e69c7dc36f98663fd17430bbe03507987d99e4eca39908885ff86c59c9e908463d340de703585", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520171, "uuid": "67c8d27f-6629-425a-b83d-08de8d364367", "value": "T197E512BB98B268576B504667EB0F1C0A339B19D43B24D345EA41919C3F3B1D38EA2737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520171, "uuid": "f0c886e6-ffed-4b42-86d5-363e3a3b6714", "value": "49152:EOc2yD4lTPMS+bKw/8iAu1e8oqPPHjSXsxC9/O76SaAU0QbbOs6WIV4cUvSCZ2b:EoyEFPMSlA8if1oqP7SGC07eGWIV49Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520171, "uuid": "c381360d-134d-4e0d-985b-beaa19c51458", "value": 3071637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520171, "uuid": "b08621f1-401f-4aff-b76c-a864f8d7cbfc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520171, "uuid": "f7ed2dda-b99e-4b7d-bfc2-8cab2db93513", "value": "SalesXOrderXAcknowledgementXJulyX2026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbff0f9d-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512598, "uuid": "26649b89-e64d-4020-b8f6-cf85a0779f9f", "comment": "Malware payload (Mirai)", "value": "b7eb02a49747e354c02e60d8b1de68be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512598, "uuid": "cbf99ce8-9732-4280-a7dd-22f8bcb0769d", "comment": "Malware payload (Mirai)", "value": "2649a3011e32aafcd0eae5ecf94e4c63b21bf7a478e753546044adcfa6bcc2dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512598, "uuid": "36ca946a-03f7-454c-a8b8-bfa339d3a3ab", "comment": "Malware payload (Mirai)", "value": "37aa9e116a990b93000dd2e919ca5f6312d9cb2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512598, "uuid": "48c0b899-2679-4177-a771-a3dfef8ad203", "comment": "Malware payload (Mirai)", "value": "247a61afc2f7d117bd8bcaaf8056c5b77ac44ec2d213e8dfd6828d5907439e2291cdf58f6cd9b1c77965ee355d139ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512598, "uuid": "48eefff8-ccb7-4973-9fc4-61fcd4603a3e", "value": "T14EA3C91E6E218FBDF369C33047B78E21A79833D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512598, "uuid": "9c59dbd1-a327-43d7-a09d-1ce70ce69d56", "value": "1536:yk8NZJjWAakPPcve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBakHzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512598, "uuid": "d4a4a224-34ed-4288-abb8-2b0a53eb82ae", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512598, "uuid": "5479f225-f648-4d68-9c20-6067eb4b0409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512598, "uuid": "42c2fe9c-8757-4b4d-a352-8c5b4000ec43", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2a9754-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786509141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509141, "uuid": "6b3cfcbd-0ec4-4085-91eb-885aa4437a73", "comment": "Malware payload", "value": "110ee766ab8d7ddb8ddd8ab5a3fb127e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509141, "uuid": "0c64c266-8576-423c-baeb-134a2b0339e6", "comment": "Malware payload", "value": "26783f1e8adddeba9ca489e9686a7b1b5f2cd5b134efbaa96fb935a81863174e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509141, "uuid": "e46c08c9-b040-4884-9174-8c18dd1b8aa9", "comment": "Malware payload", "value": "0e24af41626695b4570669565a6d1da706cd9626", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509141, "uuid": "a5ea6b8c-614a-424e-813f-e54868e0acd3", "comment": "Malware payload", "value": "f178fa7cda3dbca7e1ed8edf392b1e1256bde652cba803b0bdca074eed48bbe54027aa5aaeb77e35b403590d05c49d47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509141, "uuid": "0a2b35fe-c611-48d8-887f-7ef0edfaa986", "value": "T1045733B290C42887644F83706EFF7B5164BF21DEE9C6249ACE4693B37556701E62E30D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509141, "uuid": "f9a923a6-7a56-4111-b08f-bc85f6c0984a", "value": "786432:DVZGQjDbJ9txhVaeg2WTTleEQ7Qm0pAOVNKLD:DV/btDvSMEQ8RpQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509141, "uuid": "c95ed4f0-0df8-4495-bff5-d56c7ef51d65", "value": 29560489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509141, "uuid": "0a26bc96-66cc-4e6a-a543-d4a1d8d0a5ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509141, "uuid": "31d7f92b-0cbf-43a5-851e-2152a017598e", "value": "wlanmsm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a231ec-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509529, "uuid": "4cca15da-3e22-46b5-9188-e9825357b5c9", "comment": "Malware payload (Vidar)", "value": "bc652b3daee51fb12d20243fb85d9e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509529, "uuid": "c61b7fe6-967f-47b5-9e73-5ff17c0563c3", "comment": "Malware payload (Vidar)", "value": "26f5a04d5b0650e00ee0dd74ba85c4915b3465d0b280e9d66418aead8c375a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509529, "uuid": "43af49ab-a3f3-4621-94c3-84a60af6a9dd", "comment": "Malware payload (Vidar)", "value": "613d4396572c426e3fe28ca42372a30edfe758fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509529, "uuid": "cbda7a20-bfe7-4874-94d4-324da2c9d56c", "comment": "Malware payload (Vidar)", "value": "0d351bc844dc61cec4480fb53f370334252a98277cf38d7dad5e03cc491a013f8e4b3d11056abad3317d2a3ee3e88d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509529, "uuid": "5b1d42fa-c7ea-42e0-9023-ed24095f2ed4", "value": "T17D069E0BBEA05E68C4D6D73295A602517A38BC198B3A37E71F90B6392F723C18D75F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509529, "uuid": "bb3135d7-d608-4a5e-b312-aea72f8ee1c0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509529, "uuid": "92ea968a-8f78-4f62-9a3b-af318c1303b4", "value": "49152:4iDY/SWowNj6l7eTu3WnlqiVs3cmCNpArsG9Ipb3BwxM:4iiHfqGnIIsHCNpCsG63GxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509529, "uuid": "6d1fb262-b3de-4a34-bb98-4418baae0603", "value": 3797712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509529, "uuid": "cb5cb46d-5b01-4925-b218-53e418d21b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509529, "uuid": "4d8d1779-0354-427c-8066-4c101789c232", "value": "26f5a04d5b0650e00ee0dd74ba85c4915b3465d0b280e9d66418aead8c375a70.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f955a2f8-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786515225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515225, "uuid": "8868ddd8-58d1-471b-801e-b8069e13bb88", "comment": "Malware payload", "value": "fe7a639701e26599f6078332e2c1b837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515225, "uuid": "ea91695f-d2f1-4284-9672-1096ba07aa58", "comment": "Malware payload", "value": "2713443f82e94c2ccb500e851e3dcebd9173a6faf5348e25366c800d45c73825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515225, "uuid": "70655ef2-1fea-4107-9aa0-3c0bc30f0b35", "comment": "Malware payload", "value": "cf8948280c9ca5602478450bc190068b0716e401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515225, "uuid": "ef705b51-4c7d-4a1c-98e2-4926eae8d5bb", "comment": "Malware payload", "value": "ac50adb6ab0e5019c32ac6cc75d9634890c04fad1d3dabe677e6b7dfc52f852db0ece55de2deadcbeb20510c56f7052a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515225, "uuid": "19ea6ad9-f7ed-4c80-bc3c-e37f20fa92c0", "value": "T15BA47C0339760D26E4C5A57551EB03B2FAF693CB20BC4B1AF9940CDABF167A071522F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515225, "uuid": "10c65dd1-5a3a-43ac-9be8-92c53b7f5986", "value": "6144:MfFw2AgAN6YFf470JdT4gpJ9ORZAwY72sFmEMpo5cGBxwvO:uw2Agk3Fm0JdTzHgrpM2sFmANPaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515225, "uuid": "80a7b259-8eb1-4607-b3ab-242eae108814", "value": 460420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515225, "uuid": "8b7250b1-8dde-4f50-b09d-336b6c59e7a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515225, "uuid": "9bdcc580-fdf3-4b9c-8ac3-6389aa1498f7", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbe5a6b-964f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786540334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540334, "uuid": "810bf4e5-a846-429a-84b1-569150929dc4", "comment": "Malware payload", "value": "e1d35d2d895b0399bff341875f722173", "object_relation": "md5", "Tag": [ { "name": "adhoc-signed", "colour": "#1FFF18", "exportable": true, "hide_tag": false }, { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "Gatekeeper-bypass", "colour": "#02E1B8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540334, "uuid": "b16df0c1-aae9-49fb-b9f2-3bdc6a99ca6e", "comment": "Malware payload", "value": "275aeaa88d853ddb93c6e3c102beb1aa2ba41ca1b68af25b47781d9f4460bc5d", "object_relation": "sha256", "Tag": [ { "name": "adhoc-signed", "colour": "#1FFF18", "exportable": true, "hide_tag": false }, { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "Gatekeeper-bypass", "colour": "#02E1B8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540334, "uuid": "0a499c10-35f1-4d7b-9b52-ddb157389f61", "comment": "Malware payload", "value": "0d14d55fbefbbbdd37c29f1d5a16a3904a2929ed", "object_relation": "sha1", "Tag": [ { "name": "adhoc-signed", "colour": "#1FFF18", "exportable": true, "hide_tag": false }, { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "Gatekeeper-bypass", "colour": "#02E1B8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540334, "uuid": "76f928fa-07be-4194-8467-6cb7df438e54", "comment": "Malware payload", "value": "ec81b7eaed2f6fe11de01af6213e60cf06fd1a036ef77089e6bf8b722a363c075cd66bff9715593a05cd0b5302be6f08", "object_relation": "sha3-384", "Tag": [ { "name": "adhoc-signed", "colour": "#1FFF18", "exportable": true, "hide_tag": false }, { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "Gatekeeper-bypass", "colour": "#02E1B8", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540334, "uuid": "7797cab7-2546-4758-88bd-1216852dc37f", "value": "T1EEF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540334, "uuid": "b6ab7a94-3b89-43f7-bb00-addbe92bcd21", "value": "12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyhPUcyvmByHaRR1L+:tU7RyAOTtNvPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786540334, "uuid": "a48f5a0d-c223-4a1c-8a3b-0ff9c1fc5d3e", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786540334, "uuid": "dff37785-afe2-460e-997a-0c843d683e88", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540334, "uuid": "58d1ffef-c3d5-46a1-a6bc-04d57d9e0803", "value": "zeb8cgwmkkpvu7pc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535c4d1e-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493042, "uuid": "32fda2ab-39a1-409a-9875-46ccbe92a797", "comment": "Malware payload", "value": "0e1a79f8bc2573e111a5fb7f52a94f45", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493042, "uuid": "3926ad72-efbb-475e-8119-412d4566a33a", "comment": "Malware payload", "value": "27fb279e61eef8a6edf791bed3129dfdff60c27501f9a9126d97c904841eba29", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493042, "uuid": "78aec760-4305-4900-9347-9c325b581f03", "comment": "Malware payload", "value": "47fd90e4f551ab406eae5ecbbd0d4bd2d1034515", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493042, "uuid": "d9b226de-1d29-4ef2-a0be-e25aeb940b47", "comment": "Malware payload", "value": "32d1d0b8f86b450382a4d364804f5491c487b787a801b4aabb9460aae921d03ff6a150e756910e1891e6161e9d768dfa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493042, "uuid": "31535aed-8b5e-4a4e-8ec5-22bcfd199231", "value": "T125F733429C6E2705FD7213368165A67BE077A3036B26D484AB637F4D47FA803EF74A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493042, "uuid": "8c3b9f69-f407-473d-8b26-2147b7034f8b", "value": "1572864:6Go6MZ/ltJugcOqATBVWm02xDWIyPr4UpcmqRN9SvlGGS2M:BU/nJ7czATvx5yzppcyNS2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493042, "uuid": "e47a63fd-45e2-478e-9464-9b46bceebc10", "value": 75524210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493042, "uuid": "b3f20998-da0c-480b-8c83-0d862c268eee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493042, "uuid": "42ada36e-54f5-413e-a5c4-0bddd18b4826", "value": "RTMediaFrame.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcca68df-9680-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786561509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561509, "uuid": "3ed0ef2f-43a2-4c32-bf37-17ccc84aacb9", "comment": "Malware payload (ValleyRAT)", "value": "341ad3fc8c84bc6c61a00ff703627835", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561509, "uuid": "65d0c7d5-9f84-48a9-8d16-9bb81c47af29", "comment": "Malware payload (ValleyRAT)", "value": "2844aaa33cb6e85d2d85ae7bf78c901e84cfd6d59d6b4f4118e34e45dab417bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561509, "uuid": "e709ec0d-e19e-4ec3-a478-61d4f5259e18", "comment": "Malware payload (ValleyRAT)", "value": "f808b0e15330f1d671e8197b02bcbc74cbb4db0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561509, "uuid": "c169fbe7-0afc-4ccb-b99d-3a485924e8f0", "comment": "Malware payload (ValleyRAT)", "value": "a0e8b1c2d3971917bcbd7b591d711c55052ccc1052bd39547d97d44039400f7f3e2514d9d5e223f1cc5f0d8c62a68844", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561509, "uuid": "0c994899-905d-43f8-88f0-b4f75bac8ca8", "value": "T13AC37D21B660C032D5E6253E59B98B728B7F78319B7844CB77940F3A5EA03D1AF38356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561509, "uuid": "015044f1-7742-4b9c-8148-5805048bd758", "value": "61638da832bf3f4db7fa4da7bf2e02bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561509, "uuid": "7e2f08ec-d206-44f4-8c31-7998e74962cd", "value": "1536:eNp89dFZj9Icn4Umi45Gbd+p70L5qQBBGr5ur0kZlang2KJSEJ6QQ+IeFN:eNurpIchmV3p7aHgmIK8EJA+IeFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786561509, "uuid": "363af6b2-7615-4fb7-9a92-7f8dc0b222ed", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786561509, "uuid": "ecbf9f85-1e1c-4d19-8374-738ab40b6b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561509, "uuid": "447d3770-c2c8-4d00-85a1-b16e09ed2672", "value": "341AD3FC8C84BC6C61A00FF703627835.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51634b52-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521815, "uuid": "53f8a25b-9597-4a82-afa2-26678bc1a51c", "comment": "Malware payload", "value": "65a41910b9bf0ac80f97c1766cc03761", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521815, "uuid": "d82b0ed9-4f1d-413a-8fb7-b8b0e4dcaa1e", "comment": "Malware payload", "value": "286c76b753c4a163d58b1933dcf0f7b41290a357e84c9e80ae56dd95cc16a189", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521815, "uuid": "93224012-6031-4892-87fe-d71829e67535", "comment": "Malware payload", "value": "cedf9f35027c21af61988401deae4713a7a1d6bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521815, "uuid": "4f3f0b85-bbd1-4c51-9b85-26d303f7cced", "comment": "Malware payload", "value": "c46600e0fe3dfdaffaca9a94e334aa10ebb1b98b98779fee07fef9bc2df820355bc74200fc6da0a4c875256fdd99c461", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521815, "uuid": "5f2d7266-b001-43ee-ab7c-b646950f61bc", "value": "T13E730C4448C376802337A77FB63AA8D8F736476B01804907B97CB554AFF1D19E9E18BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521815, "uuid": "532bd132-0d0c-498c-ac98-0249f79e4ba2", "value": "768:PTfX4rHPv9PXeafhvsosnjUTx1PY9t25qft8B26VanhOo/C58j+2Bvv9JEGyj+Bx:bf+0uLC27mvCDdVapXRvqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521815, "uuid": "89300430-60ec-40e8-af66-60bd3b19ace5", "value": 73387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521815, "uuid": "5b58f20b-41bd-4c51-a896-6384911adb6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521815, "uuid": "009929c8-0a76-49ab-8437-a86aab713da6", "value": "SOC KOD TENDER QT240000000019450.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f5dfd5-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502462, "uuid": "d741b295-4896-46f2-8dc0-17c9ed2436a2", "comment": "Malware payload (Mirai)", "value": "9ace8cb14db216e8f80dbf82ec34c315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502462, "uuid": "5559b0d5-4119-4f48-b65f-bfb214775482", "comment": "Malware payload (Mirai)", "value": "28d8431c29a332a3c2cf4340f441edf32a47dda3f20ed599dda6fdae35e03db6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502462, "uuid": "2ed129c8-204a-4093-b1aa-953279f77bb1", "comment": "Malware payload (Mirai)", "value": "9b733d8803432c448847ac8126314040eac4c4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502462, "uuid": "e852cec2-8a89-4a20-98ad-75de762f07de", "comment": "Malware payload (Mirai)", "value": "a8617d54b85d495861e906d126ec6f048c27ade9c526e5daf89e1d385e869deea2e350b7e56b66b7734e3972286b7514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502462, "uuid": "f6320ce5-a7fd-4656-a784-d1e57ebe41e9", "value": "T118040B56F8818B15D5C1117EFE0E128E372327F8E2DE72039D245B707BCA5AB0E3AA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502462, "uuid": "e47f617e-040d-412c-82d9-6a1e27fc59ea", "value": "3072:ri00/HY7/nRJQSNuo7DgjO/D2YM2HtQDms4eeXPqAGa4D/4cGFOrRJXARuWOCGL:jGSt7DgjID292NZzXPqras/ttrR+RuWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502462, "uuid": "b147e07e-cad6-4d95-9b55-a03c3dfc1a3e", "value": 184316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502462, "uuid": "85a25daa-c710-4f35-98b8-cc106ad3cc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502462, "uuid": "ac9329f2-4ed6-4876-86f9-e922cb46b094", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e40c79-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786522042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522042, "uuid": "60d42d07-9882-404a-8829-4a46e51a7884", "comment": "Malware payload (Formbook)", "value": "92f8a932a9f5fe44f5d9c907819dd5e3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522042, "uuid": "0f66e142-c1dc-445e-a566-4f306e5c32ae", "comment": "Malware payload (Formbook)", "value": "29148aea579552e99c37fd916c64d1949bdc237935333d399d2597bff8fc5cf2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522042, "uuid": "08c43e07-de43-492d-9f78-30aa7ca49674", "comment": "Malware payload (Formbook)", "value": "c24f410e2dfde08a24456ea47baf7e47ff095767", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522042, "uuid": "6fbf62d3-4d19-4d1c-8c44-d53c93da48f8", "comment": "Malware payload (Formbook)", "value": "8cf462aaef8ad87824efec3b020a5dc35cf4d52a3541a4e422b9d3903b6277c2ddbac1d9abd6694de8486491571ed23f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522042, "uuid": "3432c45e-6f57-49c5-a937-460acd41b6e8", "value": "T1FEE5D7F522EF36064D1AB3E6640D69580B5EC8641FC752E9F0CF1599150F88B2AE0EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522042, "uuid": "b97436e4-6b79-4e39-bfef-778f78f61fa5", "value": "24576:xh5SK9Fi7L/sb+vCXrTW17b8KdNreGEm0C3EVJRSzpxCDalSjsL28zw3bR9hH:xh/YQrd4ZFoJ+pcnQLDzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522042, "uuid": "c7fefd8b-eb93-415f-ba32-de6b0f80b5e7", "value": 3125699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522042, "uuid": "088697a2-1baa-46e0-b8d6-c22121b24762", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522042, "uuid": "410ece2c-ca2d-43bb-86cb-4bc27c4bf96f", "value": "PO 0582604-1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02be9c0e-9684-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786562915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562915, "uuid": "7675c6bf-61d8-4bfc-8c8b-06412a8e1999", "comment": "Malware payload (Mirai)", "value": "9601e41448c0829a31d3918fdbeec58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562915, "uuid": "a9c7cab6-8d81-4057-89af-4c01956a769d", "comment": "Malware payload (Mirai)", "value": "29219071fa3311aee68c5e979d24b0716be1e845c41aedd2826bd8dcee9a02a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562915, "uuid": "6e47f13b-5b68-4c44-b2e4-d2ec803bf9ff", "comment": "Malware payload (Mirai)", "value": "d55d1fded935c6ec83b92d9e90acfa1cffd6daed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562915, "uuid": "9de41f80-2613-4e9a-af98-11f08522beb1", "comment": "Malware payload (Mirai)", "value": "06a436ca971f573506444b9d0892a31450c9ca85587491d2ff253f81cdac90f3db7b1565f81e3e1f5e5bbd5c61c11007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562915, "uuid": "df710f2e-50de-447e-b723-ce5cbf451b2c", "value": "T1CFC32C99FC90DE12C6C52676FA5E428C332317B8D3DA7106CD209F35B7E795A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562915, "uuid": "027ed918-e832-4a8c-a1a7-99c83d5b733c", "value": "3072:Sk+TJyND2CehboMiTRtOUQ4g8O7CVe+mpDBGjPpXNsnQf1Dl:SVEehItOUQ4g8OWVe+5PpXyQ95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562915, "uuid": "a802bbfe-36a9-47b5-add6-7b9e0ec29f7b", "value": 124372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562915, "uuid": "c65c290c-5fe9-43c5-a70d-6ee63e2d8f1a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562915, "uuid": "473c08d5-9f6f-448a-9195-15ddb4e0b1c0", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45704be9-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502467, "uuid": "d27cb6da-c27a-4e3b-9921-dc78156ec561", "comment": "Malware payload (Mirai)", "value": "b47989f7d07744d2e52ae292675939bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502467, "uuid": "90eb6448-de23-4d97-98c4-2dbaffb4f040", "comment": "Malware payload (Mirai)", "value": "29ce742b425c2d7987bca449d9a7a55b97eced1083b816522bb44853fd1299f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502467, "uuid": "6933de1e-7162-484b-95ae-6c0b86d1aafb", "comment": "Malware payload (Mirai)", "value": "e80fc47ad4e7ba53b1c91f175de534c989500ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502467, "uuid": "89c5d0ee-88e2-4ba7-9b97-e95e776a4f4b", "comment": "Malware payload (Mirai)", "value": "de42f81e5a224cb1b9d011c923e01eac44eb53d72737882b3f6ce9c2773f8d54f25ba13eae0dfe3dbfd01c6d71d58e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502467, "uuid": "1bd15f81-1c3a-4955-95b7-8d7aacabc202", "value": "T18AF31845F8519A27C6C6127BFB4E428D3B2667D8E3DE7203DD215F20378B59B0E3AA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502467, "uuid": "9ba5a26c-5087-4cc2-9b00-44707369040d", "value": "3072:YyaLPiC0pAeYXw4khllowncpQ4DkDUqsxzMkQ+bm:YHqCWAnkD2Q0Q4YDUq8vQ+bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502467, "uuid": "c9107860-ea52-4e38-9323-5454d48d5dab", "value": 172800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502467, "uuid": "c77b3e8f-2311-4807-9114-e1ca754388e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502467, "uuid": "d790ff38-cdf5-4e4b-ad51-e594ee671030", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6ced2c-964d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786539661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539661, "uuid": "48991942-92fb-4f4d-ae0d-753364f8e1d4", "comment": "Malware payload (Stealc)", "value": "1a4b49379f3da71c8d7d828535298376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539661, "uuid": "4f5fdcc3-e5c4-446e-ba86-15dd5568bb90", "comment": "Malware payload (Stealc)", "value": "2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539661, "uuid": "466619ce-b0d6-43c5-8d87-89fe7e634b32", "comment": "Malware payload (Stealc)", "value": "7360fcfbf857c151f23ce283cba6d268fade0a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539661, "uuid": "57d2753b-b8ef-4b68-b9e7-a7873f8cc629", "comment": "Malware payload (Stealc)", "value": "dcd84c77ddd746f2cba2326bfac460d7a7982b664feb5dadb4e53400abb135e5dfc9d5771a87a428b53d1566b0aef720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539661, "uuid": "4f07c182-6422-4070-abe0-980d6af7bba6", "value": "T1937522885A46EA0AC995473C0A61F7F40B784EDDE511D2076FDCBEFBB6B5E168C102C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539661, "uuid": "e6753138-713d-4cb0-9062-db7ee2ecd468", "value": "49152:GUsAQJBp4etpi/B9RW04IunIX1qKfiHlzvS:GPqOaLvinIA7FDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539661, "uuid": "a6e4a13f-af15-46d6-b7c3-f8ec3826106d", "value": 1634816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539661, "uuid": "4bfbaf83-4174-4bd2-9819-594ce570e2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539661, "uuid": "cd2b6344-613c-475a-bc6b-5cc427789c41", "value": "1a4b49379f3da71c8d7d828535298376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6235e96b-95f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499509, "uuid": "e698d6fc-b726-4af4-8e46-bed1951818ed", "comment": "Malware payload (Mirai)", "value": "1935aba3419b21dc494e0336fc0dd194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499509, "uuid": "ddb7d54e-e673-44c8-b7a0-794c7def66d6", "comment": "Malware payload (Mirai)", "value": "2c33eca7982abb1e2bfad8e559af61c0326e19fb48c21059eebc5dbf14f866c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499509, "uuid": "c6112aad-0cd3-451b-82cc-c1cddb7ef922", "comment": "Malware payload (Mirai)", "value": "fff987df63aba110c5c2a4c47e2c385f6167d83c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499509, "uuid": "e06dabe2-b065-4224-82ec-3f93a2bea52d", "comment": "Malware payload (Mirai)", "value": "8017dbc0e25f16c1ad68e3448bd15478d3bb7d15f247093e72f9ccc29176c76e5079d2cff8b2496bfdaa740ca173e844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499509, "uuid": "af93b597-6643-4d4c-a1f3-e491434ed1e6", "value": "T1A933F1B0EAD71C60CE716E31BA7DB11F1308567CA0EA09395B54CD64BBB14CE616EA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499509, "uuid": "d9d32686-0bc4-4fef-be23-0a0fe8cc36aa", "value": "1536:QLGikNkmnHhFwzVZ0zKpIuJ66AepDDcbZA+X66ST4Rt:nvktZ0+06AjBXRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499509, "uuid": "29407e26-4b09-4ca6-9504-dad9ed31d6eb", "value": 53788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499509, "uuid": "c2e65ddb-4acd-4591-80eb-dcd049b4bd1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499509, "uuid": "a44a91d6-7cb3-459d-9229-9dd8f73ad4b5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2824490a-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516162, "uuid": "9573d5db-f9ce-442c-829f-1627e3706b03", "comment": "Malware payload (Mirai)", "value": "92bad726875e856d2fa15aef10932791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516162, "uuid": "05106f18-1ea1-4d04-b52f-aa9dd500f3e6", "comment": "Malware payload (Mirai)", "value": "2c64c6270c6cb3caa16e6f5051102f25dfec903eb1017de5976fae422024553a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516162, "uuid": "3c385c2a-4bf4-48ed-94ad-994d198534c5", "comment": "Malware payload (Mirai)", "value": "4013bae0bd67de56eaa97abe903157883509bf48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516162, "uuid": "054754ce-c4dc-4213-8d79-665f87605941", "comment": "Malware payload (Mirai)", "value": "8dcd6768dcd9f83632d766d17493da2b9bd941ed4ed0ba8c2c8ef6907fa15817b9e7d536061b9de370ef44865dbe2293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516162, "uuid": "0ad310b4-ae7f-4dfd-96e3-660ce7c6a7c4", "value": "T18BE39D7BB30F2451C42206F41ACBAF5D2E3322C25E6BD5D76C6A263E2A765DB1801FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516162, "uuid": "0e2a99f4-d73c-4394-8b05-be0a75a82690", "value": "3072:+4HG5/q6P0cNr+FPUPlBzaTJwuIfg+CP9Z2BZVxF8yq:zmJth+FwBe1fIXCPnoZOyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516162, "uuid": "a525e398-2fea-492e-b328-f6995449cb19", "value": 149020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516162, "uuid": "abf62983-8d91-4c37-a66e-f97486ed73fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516162, "uuid": "137a4c83-aa64-418f-be3a-84495212dd48", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2fd6f4-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511364, "uuid": "e5b0825c-23b3-4bcb-9c57-be213dc29c60", "comment": "Malware payload (Mirai)", "value": "ea90779a6190d19b291feeb54f795ea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511364, "uuid": "f23f488a-abed-4fe4-8aa5-61b1d33e5da5", "comment": "Malware payload (Mirai)", "value": "2dbe61716ddc409f2da6fa5532241e9f7dfa38349a8c3f2b301815ba6ca4a19f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511364, "uuid": "f3e7f06a-0416-4111-a9da-f26de474bdc8", "comment": "Malware payload (Mirai)", "value": "88ebceddb965a63895aca0cddbb6621e4b608be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511364, "uuid": "c54f059f-e93e-4546-8a26-53449ff263a6", "comment": "Malware payload (Mirai)", "value": "ce423020854a5cf670c902e61f530dbc6d7406245fdf80f47c3562ac3ea970263046955249edcff693bc768ae42cbf99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511364, "uuid": "d36f73fa-41e0-4d08-bfa2-23ec1589f72e", "value": "T1B7C319C2B9C45A91C9CCC13BAA0E618F77369375E2DB77136A531F822663B371F5A801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511364, "uuid": "eae561b3-5269-4654-b60b-1efe700c771d", "value": "1536:9wne9Y550JLZ8iRPRMAL9/zgIAFJtSJqYXwIZEsNsHI:9wn6ZZTRzzgIAVSkYXwIWsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511364, "uuid": "d42244e6-c3a5-418f-bbb2-b07b03aef7a7", "value": 119208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511364, "uuid": "b9afef94-47d3-43cc-916d-b7403f664216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511364, "uuid": "1a51669b-b428-4d87-b1c3-3a9a891c3df0", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158d6332-9684-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786562946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562946, "uuid": "249f815e-68af-4af7-ba03-8c11a3a8ced5", "comment": "Malware payload (Vidar)", "value": "6e97f8087952173c5d76fd976d905935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562946, "uuid": "310b1134-e1e3-41df-a680-0bb952d34f14", "comment": "Malware payload (Vidar)", "value": "2e34f6db2914bae0f5c7b56334706ff0a3239d46f98b9247e3fe4beabb104c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562946, "uuid": "0c1d2b14-595a-48ca-950c-87e41d107bbc", "comment": "Malware payload (Vidar)", "value": "9eab9548156da549a46d6dd1e6f98bf50ad5c503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562946, "uuid": "dbe84ed5-2990-4fe5-8b57-e2c1a864a42a", "comment": "Malware payload (Vidar)", "value": "2226d8298a978acce47a48e92d654f8440b56398fe08a59f01302cbb49ba6d8eff8696e34b70184af68a19593b6e19a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562946, "uuid": "c93c917b-118c-4355-bdf5-d306460cc394", "value": "T1C3166B07AE9118F6C099E735C8B75252BAB0BC4C5B3263D72E607A782F327D06D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562946, "uuid": "56f9c0c4-fc42-4945-a52c-162a7cc1f31e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562946, "uuid": "a86d076a-3fc1-4648-99f4-cdc5ef2f7409", "value": "49152:Fsdhxwn489Ygrt5CZvptrkWtqB6ez4Dg6DUQx5J0ZDpH9foWvMDGZ9MAkK3s1TkB:FgQt45J69foWvMyZ9MLxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562946, "uuid": "5e8d92d7-1dc0-49f2-a151-5ea77b36670f", "value": 4206432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562946, "uuid": "ddfce0a6-dcf7-4f15-a370-9d9f1c0b7345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562946, "uuid": "8925158e-5027-4e01-b210-039837327f29", "value": "2e34f6db2914bae0f5c7b56334706ff0a3239d46f98b9247e3fe4beabb104c13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df88d4b8-9678-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786558131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558131, "uuid": "3498a143-6b8a-41c3-adf9-613f438d69ea", "comment": "Malware payload (AgentTesla)", "value": "f1952aef992c8328d815b30894cfe0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558131, "uuid": "9eb06328-dcbd-4941-8287-b2abb6c390fd", "comment": "Malware payload (AgentTesla)", "value": "2e76a50f38c136fba5f74d91e141869bf8cc926af5d416c3bf47cad884110f8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558131, "uuid": "7bd95445-f697-4b39-97a8-7d210a7214e6", "comment": "Malware payload (AgentTesla)", "value": "05b2f5d7c5806b14e7f067cf77d661b24ea46d70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558131, "uuid": "fb1021a9-aa6c-466f-adc4-91930b9b595e", "comment": "Malware payload (AgentTesla)", "value": "7ce424ad9f360f16f726be53da31d355b1e508584b990d731719576de2b31f185e9c3d5451fb08ab859ef24468f0b217", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558131, "uuid": "73ee4af9-cf6b-467a-baf9-aa1efb26bf05", "value": "T1943400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558131, "uuid": "a253e5e4-c579-4c38-8db3-80e19559e1cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558131, "uuid": "732050c7-70bf-4948-9fb9-9519de41b21b", "value": "3072:m+bqayiqH2zSyo+AskmTHo9rG8KaG5jnThYSYufzz:dqayiqWm1Isq8KaWTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786558131, "uuid": "24e82b96-cd34-4330-8405-49121ac0751c", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786558131, "uuid": "f5ada593-e29f-473c-8fd9-57242fb4f885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558131, "uuid": "905c8a23-4600-4851-9909-83b0c558f131", "value": "2e76a50f38c136fba5f74d91e141869bf8cc926af5d416c3bf47cad884110f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5abcb6a-9690-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786568396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568396, "uuid": "1a8692b3-a5f1-4098-b950-5257189dcb43", "comment": "Malware payload", "value": "89a8e4baede7381f4da5441d0ba25cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568396, "uuid": "bb5d27b2-6783-4e7b-b9a1-6cf5a3b04be1", "comment": "Malware payload", "value": "2e7dc6d8f996729e1091bc4886d5baaf3a7a36f8f45617e1ef9101fb5ec778e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568396, "uuid": "5c7a84da-0885-4af4-b985-789f30ef48ff", "comment": "Malware payload", "value": "06b382f0e785ff4e38b39672f26423e24a53e3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568396, "uuid": "8ca04531-d5de-495d-a991-9c839ac3bb50", "comment": "Malware payload", "value": "74c24e98092cce772e59cfa13b48fdddde92bb74dbe8560537a900ef9125e66a69fb39e11d4499042eaf0f0689af9e0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568396, "uuid": "5a2f27ce-c51e-477b-8f94-5a98ff39b3ef", "value": "T1B5567C07FC9159E5C09AB23189A79212BB75BC480B3227D72FA0B7782F727D06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568396, "uuid": "10213e06-71c8-4a2a-9392-8729ddc5d0b5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568396, "uuid": "22c506fb-30a2-48e3-83d4-79ced5848b00", "value": "49152:25gZbLbbN6pX8VWwzP/WAakctg1TMMOAU1ZNNmizCJrhQ47XPdT+1L4ulW0BeJKi:2yRTW/tQYpzzoy4TPdT+yoW0YEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786568396, "uuid": "17183861-469c-4a43-93bb-ef9f65e2e211", "value": 6406008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786568396, "uuid": "116f4d43-eab4-41a2-b634-7e1648ed6c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568396, "uuid": "dcfb054e-d8e2-4c01-9370-ba80c44ccf6b", "value": "2e7dc6d8f996729e1091bc4886d5baaf3a7a36f8f45617e1ef9101fb5ec778e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a454d654-9623-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521525, "uuid": "5652de3f-063d-45f2-98f8-f531f3bac581", "comment": "Malware payload", "value": "c439ce8f6199444bb361dba00b2fe990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521525, "uuid": "3b2bf83d-6d94-4b35-9a64-eb1cc94de032", "comment": "Malware payload", "value": "2ec04c542fdd51a1dd0b5875a142db7f3f21cf02f46653e66c41712e7094ca7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521525, "uuid": "65c27939-af4a-4a4b-976c-cd79dfc4ec73", "comment": "Malware payload", "value": "fed4a91e776902e962bf628ff7cce79b2a2bcba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521525, "uuid": "a891bc2a-d6ea-4586-bac5-19ebba70c452", "comment": "Malware payload", "value": "a748982e1b38347ce0d294c0e7c670ff1c626ddfe761b710c1daba56e946c9fb6da47d653ce9ec97461defaaa38e6349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521525, "uuid": "9870e6fd-60c7-4fbc-ab83-fb669730b715", "value": "T19363290AB35364FCC42AC5B442EBA737EA73F86606316F7F5364D2312E24D906E2DA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521525, "uuid": "50075cee-6ab0-4e1d-aeb9-45139a2386a1", "value": "91d8be4f49246c5818d6b02af88b4166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521525, "uuid": "3586b00e-8832-4e39-95ff-8064713c0d5d", "value": "1536:GRbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:GRLnaFHnmwcxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521525, "uuid": "0ca74965-852a-442d-98ba-a6a6a1d802fe", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521525, "uuid": "fbcd9051-a1d3-420a-979c-339452dfcbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521525, "uuid": "1fc2fcf6-4cb7-4cd7-a21c-feb9dfbeae88", "value": "debug_main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9f4215-969d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786573857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573857, "uuid": "b40d55fd-2283-48bf-92c7-e7956e8dd823", "comment": "Malware payload", "value": "52231938f6bf4d6db6f788b4c5abb44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573857, "uuid": "ebdc8d12-53fd-419a-863a-c6f0c22ed391", "comment": "Malware payload", "value": "2f0c7deae88b098583f9c6333a32d54b846fb684f5013bd7f93cac53642b71df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573857, "uuid": "966de823-4a42-428b-9804-6bceb13ff085", "comment": "Malware payload", "value": "1a6ee8fd48c85140dffaaf0dae95943a4fe67c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573857, "uuid": "457e7b0c-0ea1-4031-8271-3a4ffd991a49", "comment": "Malware payload", "value": "3a11b10e4665cd3225e8a65bfad68498e6fc3f97e7ceb800aa1bc53be2cdaec04a949112d226d2ee6a6f670a6aa28409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573857, "uuid": "805afb83-ae5b-4f38-9808-835c74201d89", "value": "T1A4568C03EC9158EAC1DAA23189A79213BB71BC495B3223D72FA0B7782F727D05D79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573857, "uuid": "254efd3a-4319-4663-9778-43e03c7e58a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573857, "uuid": "c5b10c5a-b520-424c-956c-7997de4aea86", "value": "49152:l3THB/zHQ3prolxyDqwusovdQIIQWio3etaLehe2ooX5GZlUqUZSOpfBeZKcK9K1:lTZyuvdtINMK2oo4lUq7EfXEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573857, "uuid": "7f2eb34e-182d-442e-8319-0eb7b279e388", "value": 6410096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573857, "uuid": "f7058e5b-707a-4e62-acd5-d31b7cc15c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573857, "uuid": "b8f386b3-901d-47dc-bb7d-7d5f6882a123", "value": "2f0c7deae88b098583f9c6333a32d54b846fb684f5013bd7f93cac53642b71df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fba2ba-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504057, "uuid": "6a3efadb-a411-45b8-904b-57abf793bc8a", "comment": "Malware payload (Vidar)", "value": "b4d4f56d3486760811cf4245694c0d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504057, "uuid": "900a1ab8-ecb1-4e5e-b66e-1c519ae48545", "comment": "Malware payload (Vidar)", "value": "2f0d97741d4e6c74812d3d60fcbaef53bd4464a5f50e46efc742398f9f259569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504057, "uuid": "6338ab47-f6b1-44db-a6b3-ca249b57a639", "comment": "Malware payload (Vidar)", "value": "a94586156298e2f782952123ce7ae69b2bf65045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504057, "uuid": "87debb3c-4bf3-45cb-ac87-b99a2e8bf843", "comment": "Malware payload (Vidar)", "value": "7d299b7e0884346ca2ef373736f256fa1e4448f4e4383711ef0818305b3c7597f8e140697d0f01f618d6c093a29f0602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504057, "uuid": "7c0fb6ab-8fa0-4eb2-a655-f4bba46ecda6", "value": "T15C069D0BBE945864C09A933168B602997B7EBC1D4F3637D72E40B67A2E727C18E35F44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504057, "uuid": "1392f86f-1c6d-4707-8983-19224be02887", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504057, "uuid": "aaa5abbc-8c0c-4c99-af33-5736f92882ba", "value": "49152:hXcZ+H6SOguD6E2c2grF4OSmX9Vb6NZNEfXBKFGr68BXVnt2Xsefx:hXtM4er7X9s7NUBKFGmuXr2fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504057, "uuid": "e6d3fb49-cb4c-45f5-82ee-952c18cf4a42", "value": 3800360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504057, "uuid": "638ba133-2cb2-475a-94dc-fe6d984e4601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504057, "uuid": "2f614b0a-7009-4fbf-acd9-bfab6d3349ae", "value": "2f0d97741d4e6c74812d3d60fcbaef53bd4464a5f50e46efc742398f9f259569.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3b0e14-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512523, "uuid": "4c76e568-6a50-4c70-8c3c-a3cc8ccfc812", "comment": "Malware payload (Mirai)", "value": "d82bb423c29f72555e2e3dde5ac92009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512523, "uuid": "64e0f1b9-0163-4c17-87c6-fe7c762daf46", "comment": "Malware payload (Mirai)", "value": "2f21742b9d10df0f6852b39c7f869533b7e3f9ffee80c79ade7b9a15a44de0c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512523, "uuid": "afa000c6-5336-4d5c-90b0-04cd2db7dcd6", "comment": "Malware payload (Mirai)", "value": "e5855032bd4546fa65d7dafe72e7b96eb78c2317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512523, "uuid": "8e0f51c2-2e13-470d-9f18-e678f15a9a07", "comment": "Malware payload (Mirai)", "value": "6db14b1ba9c062b959078faa37413757ae5fbb9ac68d19d90b8553c4f907957a65a1e2d24801e428afa4b765f9c79e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512523, "uuid": "bb2c2c26-1b1a-4503-999f-f8356f4ece3c", "value": "T1F3F2E067129827A08EE4AC78937D49C7A3F307299163B97139BC49E4DE8481721FC8ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512523, "uuid": "db138d85-0836-4b33-a8d2-45547a947062", "value": "768:/ZAb2jdTWDPtuRl/fdtAG8bQd4RYMO4NVdKsKU2IJghs3Uoz1:/ZAKjBWDPtuTltdY1fdCU7JgMz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512523, "uuid": "0d1fa2bd-e667-4986-bf5a-a7b8266ba68f", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512523, "uuid": "b3ee8252-d00b-48d7-817f-a283332de9c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512523, "uuid": "05cdfe6e-0d67-4180-861a-063a8d38f89f", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff040893-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511369, "uuid": "1cb1d1ca-0c59-4ee3-a15a-ccf1f1d1ffe8", "comment": "Malware payload (Mirai)", "value": "d304780ffe0aace5d8247d87bdb2f633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511369, "uuid": "57286a4a-5db8-4e3a-935d-92c459a50558", "comment": "Malware payload (Mirai)", "value": "2f38c27b7ed1530a27d294d5a0383f37713898db75d1da4aeba9a70828027198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511369, "uuid": "9f30822e-8cc1-4e25-bcb9-68a078782a3b", "comment": "Malware payload (Mirai)", "value": "cf89ba34d5b600386322f296aa8ea966f08ea80b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511369, "uuid": "525788ab-9f52-4f0e-9400-4b39ef1f7114", "comment": "Malware payload (Mirai)", "value": "f1045f2f2ea391e42e69bae3764543ad227cab949717829d3a88ea86becb96915a5ddc195384d726523dd2995bc1a4c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511369, "uuid": "0e0c577e-3521-490c-ac2f-245f67654b54", "value": "T1A2B33CCD720916A5DF8309399451395E4F3CE692D88FE7DB4FA0A8C54E72AEC2D0CE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511369, "uuid": "2c4c4266-710f-49e6-842c-4a4a367ebad2", "value": "1536:/52D4up6L86/CeG5ruUXoStPFsaeJKHxZ14sO:/4D4up6LpCHruUXoStPveg2sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511369, "uuid": "ed1d0f33-297f-4c2c-9f78-aae0f82c7ef3", "value": 115500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511369, "uuid": "f54a072d-ad35-451a-8fe0-e6e13f7f1b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511369, "uuid": "dee12add-98b2-4ada-9a62-92c61a04da03", "value": "miraint.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f555ea7-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786521919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521919, "uuid": "78aed281-dcd4-42fd-9c83-4cdcf3dd3c75", "comment": "Malware payload (RemcosRAT)", "value": "17fdd8d11416fa5a5c981c27090cd018", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521919, "uuid": "d4666e16-e63f-477c-b778-d509e2aec3cb", "comment": "Malware payload (RemcosRAT)", "value": "2f556e9e41d44c1fc81f6ee367ed825d5a9060565dabac487896c181cea25cb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521919, "uuid": "b1053303-4681-4b61-abde-d6a2d21c2f70", "comment": "Malware payload (RemcosRAT)", "value": "ba035943dbba51d3decf454b9486dfe18ed1dd2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521919, "uuid": "426545c8-f35a-41ff-bf1b-b792319e0842", "comment": "Malware payload (RemcosRAT)", "value": "51fc2606674858e020ca83f995cd1eadbb48cec7d6727d08580b1e9736060b56dc9dd03ec08845216a1c42cbc47cfe6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521919, "uuid": "bec54067-8582-499b-af14-46633190c73f", "value": "T14E075D7AE4E291C4F0F144834CF9FA95E9A92A93DEFB04D1C80F09DA99AF4C458724D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521919, "uuid": "b9762dc3-ce3f-4810-a2da-65b9e86d81b2", "value": "384:pwtq6El+AffM7MAS4LHdM7nEEwX6P/BmUfNzElE3Md1X6756r99HrbS7XDQ6qx+Q:pj06iaS7Bjd+MEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521919, "uuid": "8f60314f-6b5b-4227-8c12-431ab41426ce", "value": 16935532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521919, "uuid": "349399fc-3f06-4bd9-b630-b8dbeed4134a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521919, "uuid": "08b8df82-5042-415c-a324-efd34b8a4d46", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bcd22b-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499334, "uuid": "909ab4b5-11ff-434d-a524-6bf2336cf314", "comment": "Malware payload (Mirai)", "value": "5216fee62bd47503ae5047ad3f9c998d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499334, "uuid": "c82853ef-82d0-4643-ad8b-8cdd204ae412", "comment": "Malware payload (Mirai)", "value": "2f823f9602e103771ff0dcf0828107a3e10ad672d14541b8dc55e6c545b8ce16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499334, "uuid": "f2bf140d-0d62-4040-a962-9478cb05e330", "comment": "Malware payload (Mirai)", "value": "e95d89fd0d673f5a1c0c4d49b29645fe64382e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499334, "uuid": "2ac95050-eb7e-4063-8e4c-9a827e9b1d75", "comment": "Malware payload (Mirai)", "value": "1e9539a5713f7f5e066ab75561b4cf63bbac430bef608c1c3f34148e682186f4e6fd0b19b302024f51ab82e298db7b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499334, "uuid": "43753961-985d-4b96-9a2a-b0b6d57a365b", "value": "T10BE35C0AB0C188FEC4EAC1744B9AF537D971F51D1134B6AF27D5AB622E4EE205F2DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499334, "uuid": "88ad522b-d3bd-4a1b-8697-953a8ab32a76", "value": "3072:nXOedTqq342/pyqYQlva+lUkwAVTJTBLTyyyyyyyyyyyyyyyQyPyyyyyyy+yyyo4:XjdB3llnBLTyyyyyyyyyyyyyyyQyPyyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499334, "uuid": "403ce27e-938d-4fc0-98ca-d5d01eb0a390", "value": 151632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499334, "uuid": "634a8cce-85fc-4ec3-8e33-adb00cc80a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499334, "uuid": "fcac294a-f945-46f9-b5b6-457abd5221ee", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c06d13-9654-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786542472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542472, "uuid": "e62a5cbd-1bf9-410c-aff2-519b7bf6b16b", "comment": "Malware payload", "value": "53679ab1becb16c97c6a0504ecd8eeab", "object_relation": "md5", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542472, "uuid": "a0ec2f0c-b8f2-4ec2-ab03-759172c64386", "comment": "Malware payload", "value": "30762af09dad8d49540eae37af67ef21ac95842db9c766ce9650208813c1d014", "object_relation": "sha256", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542472, "uuid": "9b9e7783-86b4-49a5-b3f9-e740b290b15c", "comment": "Malware payload", "value": "16519e05ed7df9a1a737fa7dc4bd1946790faa19", "object_relation": "sha1", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542472, "uuid": "5257738c-0d6f-4242-8b39-b93694d7e0f5", "comment": "Malware payload", "value": "9ff8750a14568255e9336057b596e22ee762a11a9bbe7141b42988c3c2d45cc16951496d2cfea4349280107fb2f3a6a8", "object_relation": "sha3-384", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542472, "uuid": "8b9e3932-49d5-4afd-89a1-9afe33d530ba", "value": "T1B5C5338F190E6391D6B62CF916457B0A4E2D3777AF0F4AD92602A6CB1F09307676CC8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542472, "uuid": "a646d8c0-aae9-4edb-96a4-1ab1130c2835", "value": "18acfe1fbd430fd6e8a22e8df77a6f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542472, "uuid": "c7d84ad1-5004-4c6b-9b63-69015fcaa59a", "value": "49152:p0uID0rdk6j8xTkY1BdMFNRt1of/hqijbm/awjxoEWBHMS3:p0pc2x4Y1BGFrshqWC/altMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542472, "uuid": "b4d24af9-498f-4643-8b92-4a1de30782d3", "value": 2677408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542472, "uuid": "431813ce-f049-4ee2-8999-64356a4ae3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542472, "uuid": "5eb6cfbb-f8ff-4d58-a2a6-083aca655ec7", "value": "30762af09dad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642cbb17-9616-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515833, "uuid": "8c542499-3642-401a-a149-06d1b3acd16f", "comment": "Malware payload (Mirai)", "value": "d07b26596acfe00ea5513e121467b0fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515833, "uuid": "43e49720-76ca-4b7e-b1e4-999fb5b1f310", "comment": "Malware payload (Mirai)", "value": "30d441255b201263143b37c9b270b13999b8a7ffcb2f3a9ac2a374bde016ceb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515833, "uuid": "3b9dba45-203e-4c44-9abf-890ec4a55763", "comment": "Malware payload (Mirai)", "value": "7e9a3d333455884428827dca1acd3fe971c59826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515833, "uuid": "e4854f9d-574a-423c-9cb2-5a5a46bb3643", "comment": "Malware payload (Mirai)", "value": "6fdc849eec8f8e066703a0c0d897dd7e2d972fca22c0f9cbffc9772d3688830bfbfca2760c0fca867f1f964c5c999abc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515833, "uuid": "bb71eea4-c162-40b7-9a85-675913b21e2a", "value": "T114F47B623721DFA5D314C63009F3C6554AE525A21BE2548AB27CC3287E61B2E2D5FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515833, "uuid": "e9a9c5f9-4051-4cb1-8d55-8cf7924caaeb", "value": "12288:x5n4ENoS4gYzk3FFcXTl0vQbSeMk5FfPJBR8eWqa4honWJ8pD8FQdjJtEI/UGo:D4ENoS4gYaeXTIQbfXJT8ey4hUW/F8jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515833, "uuid": "58ebba82-254c-457f-b935-dd4f13ad357b", "value": 775060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515833, "uuid": "311bc6b0-0e5b-4919-a4f9-dac45bd18528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515833, "uuid": "163a4c37-2dc0-4b38-9fcb-32b5d3bfb059", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6743b78-965d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786546546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546546, "uuid": "85c1b0a3-4ac5-466f-a0d3-f420f9a76485", "comment": "Malware payload", "value": "f75ee327cdb281d826377fe0110f2bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546546, "uuid": "a7b080f3-6991-4c2a-a9b5-f95c7460f10f", "comment": "Malware payload", "value": "30dd7cad5975bc6f142af74b390f82886769900ba0953bdff53388e43f995f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546546, "uuid": "616ca1ea-bbc6-4afa-9b41-4234b28e8e52", "comment": "Malware payload", "value": "d8a447b9b0f106b5595b678168c0bba43d6d156e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546546, "uuid": "b7f6a25e-8b50-47f0-9fed-50392b20bb5c", "comment": "Malware payload", "value": "9c8429f8dec5c67387e0f642c05bf4bbb7fda189e5598af5771739d2d261bb6c81019b415a32a245c739ecb7ae679534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546546, "uuid": "029a33a8-ecc0-4837-80dd-b8b39d0509b1", "value": "T1B6366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546546, "uuid": "f88492da-9a8d-4592-b7fc-67a4a6671ad3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546546, "uuid": "40871cc1-2bef-44fb-8642-ffd2102290e4", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaT:uc3XND1aJrCOkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786546546, "uuid": "2653842b-588b-4ee9-8789-33044affad4d", "value": 5001013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786546546, "uuid": "0265c931-3721-4e17-92b3-c743abc3a163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546546, "uuid": "a6184a1b-662a-4c5b-9a7c-f5252d8180fb", "value": "30dd7cad5975bc6f142af74b390f82886769900ba0953bdff53388e43f995f63.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eb2934-9661-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786548262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548262, "uuid": "c6d54966-de78-447b-95c6-b47a2dd36d6b", "comment": "Malware payload", "value": "76a072699e9511373b842b9e4a7244d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548262, "uuid": "b44a910e-d825-45f1-88f8-940bc22836a3", "comment": "Malware payload", "value": "31484b3b8b28b89ec2f373d7dd6ed333cec905c49703d0f6ddeb8ddefabdcd4a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548262, "uuid": "9112d447-9341-434f-9821-c01e2fc60518", "comment": "Malware payload", "value": "5081a84e6ab657d62d41280ac2e8215daa54dd26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548262, "uuid": "60cc252c-c2e9-4a18-bbfe-9df6239ae4e6", "comment": "Malware payload", "value": "3fb9e79ae5e5fd50fb8adfe6f1904ac2849818e06380739cdbd61b01a3d687e2cc765e0bc101366ad9badc31a96065f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548262, "uuid": "078564a9-87b2-449c-9c06-c2d1a08e1e0d", "value": "T1BC236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548262, "uuid": "bdbb9915-d8c3-4475-95b6-87b22713bc67", "value": "768:MXRWNGxVx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:glxAcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786548262, "uuid": "fd426ff9-3145-4b87-8f61-1b8b0c534af9", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786548262, "uuid": "78683e5f-6724-4399-8430-ffd7b2d16de4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548262, "uuid": "0bb24d7e-47ec-41d6-be11-30910f1dd4dd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555b02fd-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786523110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523110, "uuid": "27cdef00-8627-40d9-b738-e51607dfd766", "comment": "Malware payload (VIPKeylogger)", "value": "d32395ddb0dcd8d3c2518a47ed8d251e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523110, "uuid": "1dda4f0b-33d8-4299-98e5-9e8eb2e196b3", "comment": "Malware payload (VIPKeylogger)", "value": "323b89209895cf53e34e0ed545fd8372f499d1c1a994c7972b5e7f09d17d60ae", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523110, "uuid": "59fb021a-2f4c-4c1f-bc16-24ade209ac19", "comment": "Malware payload (VIPKeylogger)", "value": "b4900d3c9d2ccdb7cea7267e5e28820a6dc3aef1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523110, "uuid": "94606fd0-fe99-48e6-95a2-2b9134263311", "comment": "Malware payload (VIPKeylogger)", "value": "cd79db26a581274caebe1cf5e7916143eecfadf914371498cefd815488b21ee4639a62a2c4ed591e4b92fb708257547c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523110, "uuid": "81e422c2-11ce-4e2b-8f18-6d2309103bc8", "value": "T11435AFB694D6D0C279329C538BFEF165C50D93323942386522FC025DC63ADBA3E929BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523110, "uuid": "653a24a0-4624-4ae3-bf26-34dc72a24a6e", "value": "24576:6V1vME6P19rSGEbnQEsSbE+V0s8wZWTb0h3SnGtuDkCj2vDyj0SvxI:6VK3rAvZdh3GGt9D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523110, "uuid": "c2167c0b-dc59-48e8-982d-e0d91958c0ef", "value": 1159959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523110, "uuid": "1a815b97-8e45-4b5c-9a8b-0119c49c2113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523110, "uuid": "87e3e446-c2fb-4e7d-9d19-5946a6641f5c", "value": "Inv.534635635.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae33b343-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512522, "uuid": "318f4707-2c92-4aa5-ad29-5564b51854d3", "comment": "Malware payload (Mirai)", "value": "ff38d98adc22cd52f7cc6c536427ad93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512522, "uuid": "f30a1aef-f45e-4603-8876-56af3f2ecb6a", "comment": "Malware payload (Mirai)", "value": "329b7103e97af475863576bc2a8ad50f2bd662a2f2517bdde807544d3f4af2f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512522, "uuid": "1df7b816-7472-417c-8983-bb676299a070", "comment": "Malware payload (Mirai)", "value": "c5900a8e98cdc4593f68c9b40db9b509f847ec96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512522, "uuid": "c0010bc4-5602-4ec4-be51-4a337730c463", "comment": "Malware payload (Mirai)", "value": "5a1461159c4a2bb0976060e4048dd592a55244bb841fb6db18985f90d2ad0ee9570606ae8c51c048d3103fd60b7d0499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512522, "uuid": "e495154c-2638-438e-bf12-187a6f40ca81", "value": "T14DF2D074D6863C6EF3BF7CF42898DAD5B3111AADE3719DB221879B0207578472629EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512522, "uuid": "bc42c2d5-076a-4f5c-8db3-866363381ddd", "value": "768:sk9hrdmlHUZISZTaRMIu8LZCIbC0aIK1uTy4uVcqgw09U:sk9Nd6HC7ZTavuCCRFETy4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512522, "uuid": "2f39182c-a531-41b3-a142-663b340869f1", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512522, "uuid": "27b8f737-0cbe-4648-9571-57e88d304eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512522, "uuid": "916443a0-da5f-488c-8923-170149a1cd1f", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8448d95-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515223, "uuid": "5f502900-7320-4acc-83d1-cc43f600d8c7", "comment": "Malware payload (Mirai)", "value": "bc19fb448363cade622ae1bc84bb6cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515223, "uuid": "2d2b40a1-aa73-4c91-8582-33dee112db7b", "comment": "Malware payload (Mirai)", "value": "32b4e64c0c02376549b878855bf49e11ede488d0f7230d7183ed726a373ff979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515223, "uuid": "fb25ceb2-48a1-42d5-a4ee-572112938715", "comment": "Malware payload (Mirai)", "value": "e995a79c660a3bf383642d0cc6ce27ff6803fe31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515223, "uuid": "89d4ea30-014a-4b95-ac4d-ed683936fc66", "comment": "Malware payload (Mirai)", "value": "0a46c8980f16dfbbfea73c49fc1f3b77db5a12cffd4b5a1f9c12889317c826048263d38feca50245561ad8f5db548569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515223, "uuid": "bcec75dd-c936-455b-82bf-17974189fc37", "value": "T136E37D77E83A2F64C265D474B0249F792F2395D482835FAB65B7C2B05483D8EF904BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515223, "uuid": "4f598346-109a-4522-855c-e13c44aa89e7", "value": "3072:HhHN6grNrtoB6VoIrUHnR3B6oWWmL44Em:BtZ/Y6VoIcqxWh4Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515223, "uuid": "7866ec28-58ab-4cf7-a5dd-51e641d8deed", "value": 146720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515223, "uuid": "f157bba5-eedd-4717-b0ba-16caa93c021f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515223, "uuid": "631dd6fd-5f91-40e8-b8fc-e33d530d48f9", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc543ab-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509514, "uuid": "688715a1-6b38-40e8-a6d0-23ee41c1f7b1", "comment": "Malware payload (Vidar)", "value": "a30317a63bcabcdcd88ad41aea168023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509514, "uuid": "cac9298b-0953-4f42-9f3c-979f986f2f6f", "comment": "Malware payload (Vidar)", "value": "32c46219516fbeed17522e969fba3fd16639199160f039bdcfdcc839ed97d9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509514, "uuid": "f8f59743-3bb8-4037-9d2f-d3e6ef490615", "comment": "Malware payload (Vidar)", "value": "cd9be540ca24d38ddb9d9cd04bcec094cb1e91dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509514, "uuid": "7aa7d5d2-7378-470d-9637-40c8307f1d28", "comment": "Malware payload (Vidar)", "value": "bd54526410e2fb2a89f35690d9173a874248727e90f9bf58728f3b146fe7a7377ec7ee73eb17a79acba156f8a74a06a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509514, "uuid": "6e66f330-b1ce-4020-ae69-5efb9a3892ec", "value": "T19D765A0BBB615A64C494EB34C8B65256BA707C9CC731B3A32D906DB82F253E19E3D707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509514, "uuid": "a463476b-b451-4aa2-8265-8a6c04d946a2", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509514, "uuid": "31476fde-acd1-4ea4-bbba-c632f8c040e7", "value": "49152:wCURw59L7Q/g4ioiHuInTrnR7HimHzuGJIK/qPnWrtNm8BWwi5NlonZWxuDsfTXK:wJcoi1n4Obi5W7G1229Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509514, "uuid": "c34231b9-97a9-48f8-9838-d9bd8b4cffbd", "value": 7359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509514, "uuid": "072c9ce7-e705-428d-8024-068bd670ae75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509514, "uuid": "ad0c6be9-4e83-429c-b3b4-f664d5a17b9d", "value": "32c46219516fbeed17522e969fba3fd16639199160f039bdcfdcc839ed97d9d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d247cdf-95f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503447, "uuid": "5558be40-f778-48fa-8185-9e4fd1409d85", "comment": "Malware payload (Mirai)", "value": "07cb2194f5c3f9f6c4cfb40b75cdb854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503447, "uuid": "b3978beb-869e-4f6a-8a98-82771c72be81", "comment": "Malware payload (Mirai)", "value": "3364e0bd2291aa6be29617a98610e8a06752a452c789c5135609f28bcb532e64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503447, "uuid": "8e85fdd7-8f34-41a9-a746-2c08a50ddae5", "comment": "Malware payload (Mirai)", "value": "f94f591e062f839331860b971389f05ff9c9e3c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503447, "uuid": "8a4f4a79-d015-42e7-aada-b8ac2833eb6b", "comment": "Malware payload (Mirai)", "value": "fa5b62dab71f7d1785c95fab24be2eeb7c7686a6af05c1e29ceb9aeedc1666ec8690408fd1221ca79231fdf3d211c913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503447, "uuid": "ba57bf0c-0a21-4d91-951e-3719e006f8dd", "value": "T1346302E8DB60FBCADE3DBD382CCF9141AA122093B1DF468A076B950CE5EB95533454C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503447, "uuid": "607ee1e4-d8f9-4acb-942b-f29848b3081e", "value": "768:u46oEsCvRU0V7bN0QoqGqZtwzQ5vMqTPpRjeGmpSegfKa4wEXeYL35GyN02M9Oge:u5N5BV7bSHqZT3axgioEOYVPN0NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503447, "uuid": "0592eb44-2b11-4f1b-8a35-69c0afa9e54f", "value": 66996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503447, "uuid": "ffda99a0-f4a5-4b90-97da-16be37b310b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503447, "uuid": "5aaeb47c-ef8a-4c29-95fd-54b7d8d9bb5c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff54a89f-969f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574935, "uuid": "4da89607-ef16-41de-8c0f-27c4573ef9d0", "comment": "Malware payload (Mirai)", "value": "55e59bfde3760e798bc3ccba0f814ee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574935, "uuid": "46bf76e6-b1d2-4537-a11d-89dd5c7bd33e", "comment": "Malware payload (Mirai)", "value": "3366350561c41f5d15994244bfd7358ca256d16a1e954d7a986bd4d2d50c895e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574935, "uuid": "f1c09b09-7df7-4508-8758-7fe5ea07beba", "comment": "Malware payload (Mirai)", "value": "f3d7f35f862912437c6eed21791d468e6fb54d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574935, "uuid": "49cff9d2-4af9-4c5d-90d3-396d3b26709d", "comment": "Malware payload (Mirai)", "value": "f6f9e0057c695ce8f81504ba66533cb3722c9ca39c5278a2d2fa36a5e674dfb8e795f7a5fc6a25489f1bcfba3942c902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574935, "uuid": "b963fc31-132a-4c0c-818b-56116402f52e", "value": "T1FC332ADAB8019D7CF80FEBBE84534909F525775554830F2767ABFCA3AC722548E22D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574935, "uuid": "d805422b-4daf-46cc-8280-7b83e21c060c", "value": "768:do/6VviAP+dsOD3aewluHNw3G78Twi1n2jwahfTF7PSB8rHE:doCVq86pnwKNk28TN1EwahLF7PG8rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574935, "uuid": "63c431d9-e4a7-415e-b699-300c9f95ce49", "value": 50780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574935, "uuid": "298efaf9-c93e-4a2b-a6f5-0283319d9905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574935, "uuid": "be829dca-2cff-437c-be8d-9e4666f41b83", "value": "3f9c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ff02d0-9659-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786544448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544448, "uuid": "0d058bbf-7047-4a02-93c7-aef025121b1b", "comment": "Malware payload (CoinMiner)", "value": "ebe17b7d476a159a3e9d8b7f55170779", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544448, "uuid": "6824d68e-ffa6-4cc4-91cc-2405e6700d02", "comment": "Malware payload (CoinMiner)", "value": "343cd8f9e4668554715db38ab4937a51d454fb80d76ea79ddf18b534877f5402", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544448, "uuid": "fcc26e7b-48e3-4f9a-b8b2-2a5f03c1d1b1", "comment": "Malware payload (CoinMiner)", "value": "99ddc65b6ae239090fbf93df8bad6d820f52f34a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786544448, "uuid": "6aea7b90-52ff-4e3b-8a7a-3415c795ea9a", "comment": "Malware payload (CoinMiner)", "value": "64e91ab5f71ce86fce79b3caf6640703ea7805b9902e99756fcc7e795e7d511a13d295fd56cdf0e9264d011f07c5dde4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544448, "uuid": "ec383772-d011-4969-b064-872eba66e37d", "value": "T1AF225A1A6E4A4071E3D04DF016B54A4E5A7D817327C6B6EFF773C5990EE9380C4126EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544448, "uuid": "0b938bcd-0bca-4890-9b49-1c7c2fad7ec7", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544448, "uuid": "f8e99daf-8254-4c29-ae0f-1fdb23013f01", "value": "96:INusd5omYz/J4hz90ZB2dlcrDL1x+ZQ8WTrJoPFJxGE9mZ2FFhxC7tCE637l:OuKoVc6ZBnx+e8tPFJxTEZmFhS65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786544448, "uuid": "81dc8161-c087-4b24-a5c3-0e0047633ed0", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786544448, "uuid": "df6c2f6c-f819-437f-9dc5-7c3362fb2ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786544448, "uuid": "7499bacb-5e8b-46d0-95f6-c1544044b3ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea63b32-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786521810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521810, "uuid": "02541698-cee2-4eb8-bc2f-13f6cedea5e6", "comment": "Malware payload (VIPKeylogger)", "value": "824162004da4c70ed7e60b7801dd3dd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521810, "uuid": "9a01a5bf-3c2b-478d-a95b-ba53403e5ec3", "comment": "Malware payload (VIPKeylogger)", "value": "35127aa9d124d28f1c039b6905cf4342a09abc3dbaf4223dd69d4e5d750c6cf2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521810, "uuid": "0bcc5948-d4d2-4e8c-ad5e-339aac840645", "comment": "Malware payload (VIPKeylogger)", "value": "6d4c4d5402c3487ce949a967fa45efb463f40ab7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521810, "uuid": "65596412-c135-42c5-9c00-b298173b2442", "comment": "Malware payload (VIPKeylogger)", "value": "e4288803ff34afc9f579a4849a35f865e24c21c42ef0374a695345945fe2827d7e02459e85454a6a72f8e91234408d2f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521810, "uuid": "69b93136-4d4a-4f0e-b615-70eabbdafd68", "value": "T144157EF033C8172C211C6AB13E1BEBFBBC25D2952932E8F4652C1E6BD54E183957785A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521810, "uuid": "b0db16a2-d94a-4798-841b-f45e4fcc85b9", "value": "24576:3HhRCOdA4AWAk6fg0matj/3zBjVeW6f9AyBkwriu:qfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521810, "uuid": "967c5d7f-14f9-4706-98e6-2a8cdd2e2486", "value": 879969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521810, "uuid": "13d29018-f11d-4ec8-af52-9cd28467a183", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521810, "uuid": "4ce3a98b-3a73-4a88-bf2c-66569334de7b", "value": "\u0110\u01a1n \u0111\u1eb7t h\u00e0ng m\u1edbi Inv.534635635.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75d2814-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534978, "uuid": "381535e9-6def-4ddc-b408-c114b2f1fe86", "comment": "Malware payload (Mirai)", "value": "6d464d64fe0c1f714cd674d441722be3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534978, "uuid": "01ecc8a8-35d4-4f2d-82f8-958b40b35cea", "comment": "Malware payload (Mirai)", "value": "358853b9a5dc5fd36ffdc7cd399834888450805bfdcb6a1059302d2fcaf87bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534978, "uuid": "72adaa63-ae21-413f-9330-4c7c1c43f93a", "comment": "Malware payload (Mirai)", "value": "87e70e6dabefd1b0fb5a979ddcb010c34611b83a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534978, "uuid": "918cf30a-b10b-4155-b856-502fb14de09f", "comment": "Malware payload (Mirai)", "value": "e7140cfbf89b5de9d42d9daee768a2d402672cdf2b606eb976e423e7d399c61654f8766117a2562d4802e2e10dee6585", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534978, "uuid": "7646958f-8d59-45dc-9928-4c4c631a9d08", "value": "T19C330298E468BA96C83E6E7410CD2BE1D10130C433A34D7FB7445DDCE61E19DBE8A076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534978, "uuid": "ef9da692-b6a6-41eb-887d-c27b13c54bfb", "value": "768:V1Q6e4t14PeldDNXrtWTbUFzt0AXAeZrGIRb1k3U5k8cLuokpdLmDWLLvm/hiWM:7e04Ax2QFHbnbSWcuokptL+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534978, "uuid": "9222cd77-8cb6-4b8c-8073-8182bb87e80b", "value": 52584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534978, "uuid": "1969382f-50bb-4cf2-9b8e-13f1749d93a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534978, "uuid": "044d0ebf-c626-4e28-a2fb-1f8241beaf17", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2d0392-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556085, "uuid": "63f24cfb-db3d-4e32-bb78-4754f6de266d", "comment": "Malware payload (Mirai)", "value": "3151f6a5585d35d1cd40677150d05a67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556085, "uuid": "c94c37a4-dce8-4ecc-8266-5ebcefa1b4a1", "comment": "Malware payload (Mirai)", "value": "35bf80f0af528d458d53a7f7179e0ae284d6fb2be613bab904b8fe115e730b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556085, "uuid": "09582d7c-353e-45f8-a524-470fc08e1e35", "comment": "Malware payload (Mirai)", "value": "78fd739d490074ba8f3cb3cb77c8e69d5353e709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556085, "uuid": "ab6223f4-323b-4f74-af31-8e707b59b09d", "comment": "Malware payload (Mirai)", "value": "340efbf90d8459603800109627b2116c7be9fb6fa4b5974422ad6f0a960599ebfd0c593defd109aa5d177375ceda39dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556085, "uuid": "cd4931d4-b796-4f2d-8c46-a33b019529fb", "value": "T11F444B82E7D3D1F1F4960571443B6B2B6B338939903ADA47EB952A32DC62641872F37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556085, "uuid": "09c0cd6b-ed05-429e-b1c1-348db322b4d3", "value": "3072:HeQQdslpUXWmxFWdKCNR/a+6qNDlBRbZTCm3D3J2hbNGmQNrN3BatWjUfZJ6:HKqumUGD9P3xT7D09NG7r3G+EZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556085, "uuid": "31cd7058-c0ca-4aaa-8424-a141d5dc105e", "value": 258188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556085, "uuid": "fcabf5e7-69b0-4d6e-9850-eb55c5f66db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556085, "uuid": "5aec76ff-7e7e-4a23-8cfb-01b7ea781fab", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61929d9-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516481, "uuid": "bba49093-ea07-4ce5-baa5-f3a19fe064e9", "comment": "Malware payload (Mirai)", "value": "fd68514a22ec767cd7ad8bcaed2076c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516481, "uuid": "5b67577a-813b-4ea5-9183-62d18c4c51f3", "comment": "Malware payload (Mirai)", "value": "36986765c1e72803aaa7b53803f42a2e4b1b066a1197221338dd433c6d2db02d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516481, "uuid": "a1febfb1-c046-49ae-8302-9d79a098a1e4", "comment": "Malware payload (Mirai)", "value": "5b7d33a9e1847dd86ab58effa5b898ba584f0037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516481, "uuid": "2edacbb2-f63f-4903-8f60-6409a3c912e1", "comment": "Malware payload (Mirai)", "value": "bc1a8e41470ad7b934cd0120a1777be97280245d30e77177cf9150b5d4eb3cabbf5e3340c963ffa9ab5fbbc7a446526e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516481, "uuid": "4a65ebba-7d83-4a28-bbc1-babf63e67a7e", "value": "T19D04FA56F8818B15D5C111BEFE0E128E37232BE8E3DE72139D245B307BCA56B0A3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516481, "uuid": "12c6bbeb-5cbf-4d7e-8c30-bff0eed71e01", "value": "3072:0gvVQJuLu5Sweo4l5qDSIyl9agNbQQ8iZsXPXOja5ny5lDd0zSNVv1Nu6jmDLE:Blo4rqDSIS9agCfRXPXgaNOv0zSr1Nu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516481, "uuid": "2bccd33b-80c6-471d-8c84-22eec7c364fa", "value": 182972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516481, "uuid": "f0e011ef-aab5-443b-afb2-5d65e99c7f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516481, "uuid": "c063545f-0611-47c2-9720-15caa4b4f6d4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0be2b5c-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511345, "uuid": "035b4cfe-d2b0-4ba9-ae2c-9e5d0d6b9f16", "comment": "Malware payload (Mirai)", "value": "6b6b96a153c68c94be9821c05bd4deaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511345, "uuid": "d7436ec7-e5c3-4e52-b76f-538fcb7d7138", "comment": "Malware payload (Mirai)", "value": "37bbd450764f6225a61b5a57ce7174d39f1d55bbe05a8c43ad96f38c9bc66b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511345, "uuid": "639500eb-5603-4846-b6d0-493ef75f4b18", "comment": "Malware payload (Mirai)", "value": "c16908344191bce78cff27668c9a17ea835d65f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511345, "uuid": "cca95ce7-196d-483c-b6b5-a60bd1762510", "comment": "Malware payload (Mirai)", "value": "59bdf41fccf523228ca1f4bec76950fb39f4b9996712ce90bc9874f8cfeb377e0855a2829e5234d79722e79e057955f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511345, "uuid": "4e5c9ee5-45dc-4b8e-925c-d3cb6f290947", "value": "T19FA36B89B0019DBCF84F95B5811B4A0AF53153504A931F2B722BFEB3BE711E5AA37D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511345, "uuid": "482ebdbe-44be-4942-9cf6-f1ff0b36b53c", "value": "1536:ADUKvExOvHnhuSJ2kPR+pbGX6msB15dXWElkN6EYgBxOGQ8W+2PMm5Y9w4fE2Y8a:cuSJ2Qsp9FFXWE5E3xOGGG9zfvPfkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511345, "uuid": "dd9e61ee-580c-436d-b244-9584cd515d14", "value": 104972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511345, "uuid": "e848e3af-45e1-44bf-922e-b7e29962a312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511345, "uuid": "8a513ece-4eda-4719-b01b-da54ecf0aa57", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04820070-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574943, "uuid": "a3154af1-2b5a-4651-ac92-d73855b87dbf", "comment": "Malware payload (Mirai)", "value": "01f089f522d2df28bc08f62a7f124503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574943, "uuid": "b4c1aa15-3b20-4737-8504-af2cfd99bfcd", "comment": "Malware payload (Mirai)", "value": "383819dd8c7df6077d193ace66715d7b3e5d82e0de0ad87ef8a783965786d606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574943, "uuid": "a1436641-324f-42c0-8e0b-916b9d1ca4e0", "comment": "Malware payload (Mirai)", "value": "03123a6d9159b9ce4a3bbd64dc250f891ef18e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574943, "uuid": "96574aae-d07e-4882-90d5-bc6c6633eedc", "comment": "Malware payload (Mirai)", "value": "e0a419633d210610d8473845a4728455d506e57c5c5e106f8c6e81e7e2ffde8a820cec0769f7aee38904b9092c080157", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574943, "uuid": "faec6559-ea9d-4c03-adc1-ae14ee3005db", "value": "T1B4C32A46EB818B13C4D5177ABAAF42493323E764D3DB730699185FB43F86B9E0E63502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574943, "uuid": "5996128d-c75d-496b-bd23-42200e4207da", "value": "3072:LiIF6cHuKUq4hezpywr6pyYxO9z8IsIM/9D:LJF6cHRUq4wzpywr+yrzPhM/9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574943, "uuid": "2fae284b-4b70-4c0a-beab-9fd082b7261f", "value": 123851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574943, "uuid": "bb0d2adf-c946-4c07-8989-41d4bfa6c7a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574943, "uuid": "8f230278-de37-4d22-8cc2-04cebdf816f3", "value": "bfde3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fb07fe-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511355, "uuid": "5323211e-a35b-414e-8915-d2e3f2e3468e", "comment": "Malware payload (Mirai)", "value": "a3d10d1a5be5daa9a42973e54d6c8d0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511355, "uuid": "228fbde2-2f3d-42f2-9e4e-0fa6e09a9819", "comment": "Malware payload (Mirai)", "value": "38a98b12821bec8c3cb797f1b67cbd21f87c6bb62302d2cb40e331244753ece4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511355, "uuid": "a93f7e38-7d74-47bc-9a5c-3609d811670c", "comment": "Malware payload (Mirai)", "value": "79642bd126585912ae3037998e24eaee0356eb54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511355, "uuid": "fff1e391-906b-4fd0-9c06-323df103000a", "comment": "Malware payload (Mirai)", "value": "fc4c2c96298bdb3d9b1b43e24c73daa951f739a886fff0f16a2ce2d345faa07ec958ff13b9572cb0d3e6d0d1af4ab43f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511355, "uuid": "16d4acbf-977c-486e-a800-d50f2cacde7e", "value": "T1D9D3D50BAF609FF7E8ABDC3346E91B05248D160A21AC7B79BD30D528B64B64F15D3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511355, "uuid": "5a2d90c3-772a-4492-8982-99cb7b1e83f6", "value": "1536:g3Ui5R7MuLKdaJKs/KgUfZ4UllCQVnyF2dy8eNTWJT/fnOF4GVb/:iRgaJxTUuKue1iGaFRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511355, "uuid": "dacf8da8-e198-4ce1-bea0-3d9424e9d003", "value": 134960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511355, "uuid": "d57a76bf-73d3-4a4e-9d96-9c3d174d8de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511355, "uuid": "92038b5f-4ab8-4b81-9be2-2fd8521f08c9", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7a96d0-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493295, "uuid": "0d82c9ee-73ab-47e9-acbe-81ce8c009a58", "comment": "Malware payload", "value": "9835de1ac1a1a3a0b946661bce992640", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493295, "uuid": "c4cb1eb7-37e0-40c7-9365-5f25a02ad247", "comment": "Malware payload", "value": "391376ce32655f7f29749241b1a8087521eb3ba3fd8adeb6b8037cff449ba38f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493295, "uuid": "2d038241-7395-46e8-bb04-07f9053ce151", "comment": "Malware payload", "value": "4cb26cbf69d406a6719271a47ec41ea8de6e49c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493295, "uuid": "4e3fe3df-0faf-4458-9827-c7df0eb47d6e", "comment": "Malware payload", "value": "e8dac0fc23c2caa8a11e6a1f9e5be72fc65e3b2ae6d8faade45e75ce7554c0900cc5d89d25d4de8b9cf7777cb23f0b6d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493295, "uuid": "774cddaa-ded0-4eb7-81f9-76f2a411f6cd", "value": "T114F63328ECB51E22C00F253F53BAAE2DA4D66F57CC08D5B214DD808576B6B92416FEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493295, "uuid": "e6c7cb2f-2e09-4f69-a15f-689f680d16da", "value": "393216:XBhAOt6697emgDPxTwxll+y4xOKvHkovMY+yOtVAEz6E:XXAO469SmgD5yjv4JvHkW+bVAEzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493295, "uuid": "5eb7dd1d-0b08-4659-af9c-56598af4aab6", "value": 15922185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493295, "uuid": "56213764-25f6-4493-86c2-99c63066783d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493295, "uuid": "fd7d5ba0-d735-4cb8-a59e-22dd30f6e562", "value": "sysclass.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ea7f13-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786523113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523113, "uuid": "42a07538-9988-4ad6-b17b-28fdf1df287a", "comment": "Malware payload (AgentTesla)", "value": "6e0bf20d707423265156282d00b90739", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523113, "uuid": "6fd39d46-4cb5-41f3-b799-160ce1eeb4b1", "comment": "Malware payload (AgentTesla)", "value": "39bd7e65ee9262c694d577245d0e7b8ad92aa7e83462473c24992b4dc1febe5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523113, "uuid": "2e79c031-b47a-4df9-8781-091717088130", "comment": "Malware payload (AgentTesla)", "value": "0b20352b74c1a81e8b3e9a2884c7a5489e68c20e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523113, "uuid": "49945325-b247-4dbf-a6bc-ead10239d575", "comment": "Malware payload (AgentTesla)", "value": "4a2b9c22dc20c76987cf62fc23d38e58fad9efb54432a3ce9c609d8c1f4ca5dd936a75fa1ffcafc67acec5a8d8352e1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523113, "uuid": "53b353a9-528d-4fc8-936d-cc2ba89e04c6", "value": "T1CF82FA6F8D7116548A4377EE8CEA0779C0701862CF6229F4AFABF1645C19BC8337D94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523113, "uuid": "f636b2f5-76f5-447e-b600-ae7716c22da4", "value": "384:b0u7Fp8U9Hf+0KgTS3m1dn1iFcMjghPWhvmZ5camF9zfNG0uC2:/YB0pMm1dn1iFzsOvmZSamFdtuC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523113, "uuid": "6269f89c-580c-447d-b733-edd87f004945", "value": 18229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523113, "uuid": "08922d01-01d7-4553-a0d2-4923939adc4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523113, "uuid": "83dd7060-9b8c-4650-b493-56d196f4cd18", "value": "Order-10045_2026-08-12.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f801433a-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "9b9fb712-fdcc-4f6d-bfd4-03a601397347", "comment": "Malware payload (Mirai)", "value": "f389bb6ef91398fcb90ea94d70adc5ce", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "98c20cca-3f11-44e5-ada5-59a876e5cf3b", "comment": "Malware payload (Mirai)", "value": "39e632ae0014657c8a3934da83be6e3a4466536f0463bcae6c10fde37ff1ff8a", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "867f8da9-396a-42de-8cf5-62566a9ab9c6", "comment": "Malware payload (Mirai)", "value": "42fac18336bf58034fde8ff75c391492345c1442", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "45488308-fb77-4b29-90a1-e79e4e6f53b1", "comment": "Malware payload (Mirai)", "value": "cb1df6b8cb7f88b23298199a331f8756c1fbd7d7bb51dc32dbda25327cc52d0f3db8ea3f71301af266bca314f645bfb8", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "4b25c272-463c-4593-bc08-9325b4351bd9", "value": "T14823F120429F0A30CF60353D226625CFD3BD543AE2A67462666A298C73C51BF67FD7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "2dff0d33-4d6e-4bc1-a0b4-b9de9b4515c7", "value": "768:75HwvUNScVznKXXLEhs61gsnATf1N2M4YofAKUAMGH441iMYctEiB2viBFWmjmBT:lBSInKXbos61aT9NV4Y/KHMo44kMQSzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534979, "uuid": "6491b983-1d2a-4ff7-b580-dfff9c84c856", "value": 46216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534979, "uuid": "9cf29f26-971b-4e2e-a21b-13bc9c552037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "12f3658e-39ab-486e-8289-4a72f21ae2a8", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51a41c6-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512533, "uuid": "b38682b7-2e6e-4289-99dd-0a850b029224", "comment": "Malware payload (Mirai)", "value": "d35cfb434532f32317ab5a9f298dec11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512533, "uuid": "c57bdf90-d6c7-4e30-a4bf-b5831d4eed29", "comment": "Malware payload (Mirai)", "value": "39faa2b0ca10c1fdcaba529dc857085821cb07f7caa4e94aa162ae9c9989ae9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512533, "uuid": "38ec40b5-c612-493b-8d52-119b9f8f24e8", "comment": "Malware payload (Mirai)", "value": "de33794d332b07da2dba93f412f9add37fc6db9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512533, "uuid": "80ce872e-433b-4fdf-877e-7b74cea7dd67", "comment": "Malware payload (Mirai)", "value": "d8441b3a59c787553f187edeca49624e901d278dd27e61305204e6ec9ff7d49cc02bb4a797cd7db0a62b0f6c3fc7c8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512533, "uuid": "22243efc-3835-45f9-8779-c57548086f33", "value": "T1CA539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512533, "uuid": "90ac816a-5637-46f4-ad1f-891827d485a6", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP2gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYOgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512533, "uuid": "7dc3182f-ed89-48ed-a3d6-c17f55b7d83c", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512533, "uuid": "67c1dcc8-c052-4ae2-a535-3f04928fb97b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512533, "uuid": "0bf84d2e-02d0-4171-ab5c-3aa8b9293df5", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bc0143-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786498114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498114, "uuid": "65ba175f-178b-42a0-acf9-246659769cc3", "comment": "Malware payload", "value": "5428d8894542c509ed2d9e6701c8a3cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498114, "uuid": "23a2a4aa-26f2-4725-a4c6-b880152b530d", "comment": "Malware payload", "value": "3a3192754cbd88649ada4b0d33d9d2c6f4348960271084f74d4686ebdc34c670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498114, "uuid": "9e579c31-1ed2-4b57-919d-165096879dfe", "comment": "Malware payload", "value": "e08fd49c83f464c4fd99f0f60b3445faf520ba74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498114, "uuid": "914d8bbd-2b01-4a0c-b0db-83adb3be3426", "comment": "Malware payload", "value": "5c778ab2088df8e51a7f0b3cbb37224060d01f22b9e0885855453789d5ca0546fa61a2860ac186683cdf8f06f1a6bee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498114, "uuid": "ae5af410-a0fe-48d5-b58c-a60a48f5717a", "value": "T188031B93C52B9FB5C006B8F1A5F68E780B277D458A1B0DA5A13ACBF0038B9D8F145776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498114, "uuid": "169d6ad5-4477-4428-b318-823146c02e10", "value": "384:73u1Uk+2XWo5s7kKAdi/mgkvkF/ghaX2fdQr2S2DTr/ThmfHPgC1jYBwZY1z1R+v:WC2vmkhDgXah5fQfHPJY6ZIJRW7pRms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498114, "uuid": "7ce85e7d-aad0-4e62-9d3a-0c776780de3b", "value": 40768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498114, "uuid": "eefef7f7-c368-4bad-8d8d-ea9467c0c3c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498114, "uuid": "a0777c9f-363d-4a02-9781-445995a98f71", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9f35fe-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535017, "uuid": "dba2bd03-ad15-4459-a8f7-92031deda286", "comment": "Malware payload (Mirai)", "value": "1ac16d1e5b0d2e4293ca72543cfa5762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535017, "uuid": "cd71b867-8462-49d8-94fb-13789aebf9e3", "comment": "Malware payload (Mirai)", "value": "3a8cba879c1c0031c8df7c58b6c0cea50cd54d2da2ed5dfb2b929cc6ddd6a9e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535017, "uuid": "e399f1fb-81d5-47f0-ba50-1b1b5117d33a", "comment": "Malware payload (Mirai)", "value": "8cd677e8f36be36133b326c91c19513fe73548a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535017, "uuid": "705cbe37-493d-43b7-bbe7-43c710cf7099", "comment": "Malware payload (Mirai)", "value": "5b20400a60c043718947762bbb0aefaabc5eb937a462ef326a9ff7af1b8d5c8c0a226c23b265b9d1f0d6234b1c53a663", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535017, "uuid": "14ba1db0-5794-411a-821a-ae0664462bbd", "value": "T11F04D806AF550FBBCCABCD3706A9070539CC641B22A93B367A74D528F54B51F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535017, "uuid": "734428a1-d806-4c86-9ea5-5aaafc5b7ea5", "value": "1536:41qDvzL28OQKSLlODY/Hrwz4mQdcu4uQS5jujn7hUZUl6hjuVd/7f83dNQr7R6NS:41EL27ykDY/cLQy7UJuVJ78Na/slKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535017, "uuid": "f849544f-f739-4bf8-87af-f25062da8344", "value": 177272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535017, "uuid": "6d9262a1-a19e-4ce9-828e-9c110243bbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535017, "uuid": "654bfd64-402c-4029-a3bb-0dfdf942e731", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0441a0-9604-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508040, "uuid": "7114824e-3637-4be6-b6c2-04fd0bac2dc6", "comment": "Malware payload (Mirai)", "value": "fc093170f5037be585a75d6b0d53c2a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508040, "uuid": "42f5f9c8-cbe7-497e-9cd3-6428fac20147", "comment": "Malware payload (Mirai)", "value": "3a8d9fe964bb7f7ab1abf29a84a5a48de5d0c2084c8e8eca89c7719f371ed5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508040, "uuid": "ea8d56f5-abcc-40c0-93e5-c7ce86992e1d", "comment": "Malware payload (Mirai)", "value": "de51bab705bfd931de4b568ff958d4c5370f1dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508040, "uuid": "d40b233c-31c7-4a67-a17d-8c8e91e553b7", "comment": "Malware payload (Mirai)", "value": "27026fc1a2004802e951e6a745e7b6cb7d9e7a15f7c3252f74460ba9cdcf809a4619e8e0615bb8219b0de6af3dafdc5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508040, "uuid": "4ffeea66-5ba5-4b34-8812-21889a42616b", "value": "T1EF044AC7F800EDBEF80AE73748530909B530B7E519921A377263797BAC3A1D90567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508040, "uuid": "98d14041-131f-47d8-9c7f-e9a45703f42b", "value": "3072:pcTfsPBs8hpxSl5nYtp1eDLEyNTshkzdTNAVejbiQLIxMwyD148O:g8HxbH1MLBNZhTNrLIryD+8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508040, "uuid": "81f984a4-f594-49d9-abbc-3af81d5bf63a", "value": 184096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508040, "uuid": "b795db16-ce3d-4c11-95fc-1cd1e909439c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508040, "uuid": "46d24102-5166-443d-b994-26ffbea3d739", "value": "3a8d9fe964bb7f7ab1abf29a84a5a48de5d0c2084c8e8eca89c7719f371ed5ae.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93fb185-9604-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508326, "uuid": "a2120341-55de-443a-a71a-d86c74de2868", "comment": "Malware payload (Mirai)", "value": "9e4c17f5767884dc14e568a53c280cf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508326, "uuid": "997fd146-9787-422e-aab6-952cd0004e53", "comment": "Malware payload (Mirai)", "value": "3b0d72fa1930a9b4df470645e3a5b1cc719afef1782ed8234931769ea0665118", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508326, "uuid": "ad25cc09-afda-4379-b883-bd0a8e399823", "comment": "Malware payload (Mirai)", "value": "487eae40865a34046dce42f048ec1936319c82cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508326, "uuid": "fda1895a-b6bc-4b59-b421-60c53ce44f81", "comment": "Malware payload (Mirai)", "value": "4e116bc77cd7c5be36e1b4cad0d17b89ceb6b24490bde6b9546821135110b5edea39a0e82345a35eb25a3398ddb2e0c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508326, "uuid": "7092f945-688c-4cde-b6e4-ada9de0d98ff", "value": "T1E2530A26B2742B17D4C5553E13AFAB12BA642BC416D8C60F7E320E9FBD613506826EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508326, "uuid": "d10e68e4-c224-416c-bc90-d3bb01bf2cb1", "value": "1536:RRRUFmV95cxXL8uHlh3tOP8h/dfYsjijr5LfIFuBG+Hu+Kpfylus07HXc3zVdNM:RRbV9wCIABG+O4Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508326, "uuid": "79b6ab18-aa0d-427d-bbc0-bc4dde0229e0", "value": 62236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508326, "uuid": "8eacf8d5-9ac0-4f8f-9c84-042e49272937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508326, "uuid": "92016d88-5f99-40d2-90dc-19455458d098", "value": "3b0d72fa1930a9b4df470645e3a5b1cc719afef1782ed8234931769ea0665118.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fdd301-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574941, "uuid": "f63b0865-a5c1-4f74-a8d1-25f082ef9f0c", "comment": "Malware payload (Mirai)", "value": "8f1b2dcf7e6f4f2d5b9ef723b3fd402b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574941, "uuid": "51699b40-eced-4a21-b088-ed147ad2fe1b", "comment": "Malware payload (Mirai)", "value": "3b2f2f02077aee3efe6dcca1bb84afc59af14fff78d1b6dd18aed0c24e08a313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574941, "uuid": "7455e8f7-1a2c-48dc-8f3d-229caa5f5b0f", "comment": "Malware payload (Mirai)", "value": "799df7d1265c2a2098f20a3919f4c267d2c6669d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574941, "uuid": "19062c18-2381-484a-b7f8-f79b95ba6cff", "comment": "Malware payload (Mirai)", "value": "f2bf1e636423ae801ff7996d99ed5213bd97cba988d526bbbcffdee09d49b84f398afb733ec6112a9abfad744c57b2d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574941, "uuid": "320560c3-8808-477d-b0b0-b1b3417652e1", "value": "T10353F856BC818A15C5D413BAFE2E118D33236778E2EF7212DE105F25778A96F0E7B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574941, "uuid": "e141f130-126d-4f8e-80e0-fd84b6a7326f", "value": "1536:gVnYeZUNim04yCN1sA1XyyEgWqUQVdDi1TxdEuwms:eucR4tPsiXyZg8TxdEnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574941, "uuid": "b26e450b-9156-42cc-b950-f5812b6af106", "value": 62600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574941, "uuid": "3732af1e-b274-422b-bf8d-c2fd965d6d17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574941, "uuid": "93161692-3f1f-411f-af42-1a2772facf5c", "value": "5b5f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5906b87a-961c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786518392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786518392, "uuid": "2a5cb54b-3a91-46bf-a001-1b9e8ef6ae90", "comment": "Malware payload (Vidar)", "value": "035e5276653ae2b45fd21bf44d467e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786518392, "uuid": "4147daff-2f4a-4e7b-a099-644edcd4ffd0", "comment": "Malware payload (Vidar)", "value": "3b6393dc2c7a9db73f7dfdd41edfbafd3ebd1dd31b90230d926c2725f9852c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786518392, "uuid": "79b99bec-8819-4f8e-99c5-82861cc8d7bf", "comment": "Malware payload (Vidar)", "value": "cbdc703ea658ac35e46869a912067a93f90508c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786518392, "uuid": "92273d70-369f-44ce-8a35-0195570f9995", "comment": "Malware payload (Vidar)", "value": "3bb1b688bec1e57fb2c17272eb398ce7647295ef45ca4c5468089eb0d9f00e86818a31f3a80d361f85ec9894689480f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786518392, "uuid": "acd33719-14d4-477a-928a-b39e07cdd321", "value": "T11796339473E478B5E3C485328E49B7A1D1BAF3A55380AE1652EFDF041ED29A132CF0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786518392, "uuid": "37a696dd-db69-4f99-8f60-e68e3dc0146c", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786518392, "uuid": "3878d387-e9fd-421a-8a1d-6e8add0f94f7", "value": "196608:+pUjLqgWFg7SsqUAjmVXljG5a6lC7Q+/GLU/FVqVj9X5EM5P:+pUug7S5u818/XFop5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786518392, "uuid": "9da8508b-c43a-4798-a02c-4e6889eb9d71", "value": 9424949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786518392, "uuid": "e3094826-e338-424e-8e4c-8f9dfc35aaeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786518392, "uuid": "a02654bb-2489-41f1-ac66-18fd1896c772", "value": "035e5276653ae2b45fd21bf44d467e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576fd520-9657-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786543729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543729, "uuid": "850076a6-2a0f-45da-a902-daef69161e6d", "comment": "Malware payload", "value": "b7431a4b9c590a43177bc0e868801515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543729, "uuid": "8cb9fb2b-22c0-4574-a7ce-777193c286f9", "comment": "Malware payload", "value": "3b9daa23078d3137d053d3583a373f093d0102efdb2547dcb30c55977e7da37a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543729, "uuid": "82e71a43-4dd0-4c19-b475-82f2f936ffbc", "comment": "Malware payload", "value": "add1c7124a16209e6357208bc4318169003de4d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543729, "uuid": "6a5eb1a8-6db5-40e1-8f9b-4551b4df920f", "comment": "Malware payload", "value": "41714027a32ca8812839a48ce5db9fc570f79dc56e0ac5e5a2a49d17bd2cd136b7fc3044887bf40ce35d78e5f0dad09d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543729, "uuid": "9a564106-1ad4-4144-93e0-8590798d9289", "value": "T17BA30A96F8A28B56C4C55777FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543729, "uuid": "1758156b-7030-4319-8e5e-3da1a882a257", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPj3AO:FOuhPHCKsqZ9YfM6g23ZJL3AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786543729, "uuid": "39436fce-8e6a-40a8-9c0f-b8df9b3b0bd0", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786543729, "uuid": "34228dd9-208e-48a4-abb2-ca620b941fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543729, "uuid": "9c3f2a6d-5aab-43a6-b1f3-3602fab6ab6a", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a946ae8-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505885, "uuid": "e2a37f45-fcf9-4e54-9483-fc04d2c4c387", "comment": "Malware payload (Vidar)", "value": "b1067b88b5df6604a5d44ba996eed92c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505885, "uuid": "46e7023a-2ac3-4b86-91d5-de66f75a2c37", "comment": "Malware payload (Vidar)", "value": "3d07d921b00676d9fbb42130d30aa697917edfab1108e91c935abf11e7194302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505885, "uuid": "1f97b748-64bb-470f-9c0b-fe505aed3e83", "comment": "Malware payload (Vidar)", "value": "50e8a8ab26190bb07c7c52176e3bb141f56c7703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505885, "uuid": "1ea1f763-5dfd-4473-a3d4-9a84de2beabb", "comment": "Malware payload (Vidar)", "value": "40afaacd591528db8357c3f8bdf9490be1980e6d8233e19d3e1c43eb58f8d401875e6dd479548bdc3f3d500b83380c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505885, "uuid": "e4ea8806-3358-408c-b423-96fad45f0b41", "value": "T1B2167C06BFA16465D0DDE732A9B6022A7F6CBC4D4F3223E72E50B2392E663C15875F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505885, "uuid": "9f54624f-5c95-491d-9b67-e059bcb58ccf", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505885, "uuid": "31be1db0-7fc2-43ec-b782-dcd89df0de2d", "value": "49152:vV4+50D3RCfPBHHkEEaQptvZJPxHqWAxCmRwQfYVXiZPAZf6Isjr:vlmv3vZJPxNmRAV4AxXsjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505885, "uuid": "aad19a97-4506-46f8-84d5-28a0c37a7b90", "value": 4395296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505885, "uuid": "926ed579-766b-4e41-82e2-672cc88bd32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505885, "uuid": "e0ec7fc8-f9cf-4465-83b6-ab190f667867", "value": "3d07d921b00676d9fbb42130d30aa697917edfab1108e91c935abf11e7194302.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87cd871-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "11aa8b84-a609-4148-b4e5-1992fa91e7e7", "comment": "Malware payload (Mirai)", "value": "cc262c7d2c4f7c23182f33b0b7c38e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "3f82a00f-9f8d-4846-9c43-52739465873f", "comment": "Malware payload (Mirai)", "value": "3d219efe6dd1214c4b087b501ec98c2f476c51c07f93a1ebc430f497c9885c16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "f503990e-a26a-40d3-bf12-732514bf084e", "comment": "Malware payload (Mirai)", "value": "aa3d0518cef4161e417fd19948f24505b66d55bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "d6077a1d-4fae-45b1-b1a1-c363e7cc84ee", "comment": "Malware payload (Mirai)", "value": "5b99278703d83973d35b227333f9e9836e1d02a75bcf75c4b0d2e82764e4ddc47f5ada6c055075b902a954dfb890a8d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "4cd299fb-4156-4fd7-b2cd-291824a88124", "value": "T119A33906B9C484FCC08AE278467F7676C16AF57E133976CF23D4EF162806E50271E9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "79a01dae-e131-4f07-8416-b9193734f89c", "value": "1536:JtTbqQbrPFoVXyMvNjLj1ybXDy656LzUJvLUYvZZ1Kyj4/yJ:Hb1rP2pF/5u56LQJvL7Z19j4/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511358, "uuid": "fdab20f6-3dc5-412a-ba2f-023cc430b713", "value": 99904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511358, "uuid": "ee364987-a6a0-44ca-b09e-1a1f06699c17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "2f177dec-017e-4f41-8d6d-11170e98700f", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dd363e-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511333, "uuid": "1d37bc45-55f9-4e58-84fb-c8ff436cd27c", "comment": "Malware payload (Mirai)", "value": "f5b1a0829cbc792b387c4f8d108b17ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511333, "uuid": "11ae1ebe-d862-4e82-b515-e68e28d52eb1", "comment": "Malware payload (Mirai)", "value": "3d3a39b3154dcfe594e5a30c223231ce84009ed4c0223e81ce0363d3f7b36bec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511333, "uuid": "51c92758-2120-4ffd-84d2-aa3205f47505", "comment": "Malware payload (Mirai)", "value": "d49d8847c51c0c31d5b3447a21d367d0b749407d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511333, "uuid": "9b071932-0159-41a7-9b9e-d5b70ca26a73", "comment": "Malware payload (Mirai)", "value": "de898c87467b2ce5d1caa07345c187de0b158cb369441d182ec83ed77ea47b95ee86412e63005a1452c6ab7300949ea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511333, "uuid": "b33dcfc1-bbcf-48ea-995a-1a3ee20fe2eb", "value": "T179B31986BC40AA11D5C61276FE1F118E330757ACE3ED72169E245B707B8B82F0E7B649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511333, "uuid": "a34375c7-13f5-493d-b7dc-263fdf55a975", "value": "3072:Xr3SY/naLTqG1x3N3Va81amFxywv/1/o1:X7ZGTv3FVa8omFd/o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511333, "uuid": "7c923e34-c8ea-4bdd-9fe1-520fc186e881", "value": 115860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511333, "uuid": "699508e5-733d-4a5e-b562-ebbd398a061c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511333, "uuid": "42bb62a3-2115-4144-9611-98ceee7dcc7f", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c171ca1b-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496663, "uuid": "513238fa-9b55-4a17-969d-cbe29d7b89c0", "comment": "Malware payload (Vidar)", "value": "71d0ec374dc30f91201ab99f17dac0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496663, "uuid": "8107653e-120a-4945-87ca-ea03b9aa102c", "comment": "Malware payload (Vidar)", "value": "3d8ea1a7e14847c1b25582a02cd208bd700de5420932b2905d4cf4272114d630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496663, "uuid": "841e8cc0-b43e-47ee-89c6-5e4e680db41f", "comment": "Malware payload (Vidar)", "value": "4567a020b1e5ab7d0c81c932ea64f81d949fbfeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496663, "uuid": "e01fc1bc-7fd2-4cb7-bb06-7065bc7a84c1", "comment": "Malware payload (Vidar)", "value": "a8ab54e72d97cdb86df9d3dce83c405d3e1ce8b11dc9d53a454882c2041476775e9f7de0bb737558ee0be266ebc31163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496663, "uuid": "a5978d69-e67a-404c-8fa6-835aad00ceed", "value": "T1D9765B17EE125DA4C0D9EB398536811BA728BC6D87393BA32D615EB03F353E14E39B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496663, "uuid": "25fca6de-a7e3-4481-b585-7c22c31f8d49", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496663, "uuid": "eeabd739-0159-4022-aeda-c73c9e36d7cf", "value": "49152:oMMB4jxcdKlgZ0Zn5oCLLNRaC2IWLfgUTdS5oLR/RZQqxRu+ftNhzCUcEFLZvpQc:osj+5IGIH20oL9QAft+UNFhswcR1o4xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496663, "uuid": "fc1e59ad-df58-4da8-8eb8-3d98b1012e47", "value": 7237176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496663, "uuid": "e221ff17-0869-467f-800f-701a92924e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496663, "uuid": "d38f9eb1-d171-4292-9000-9cc760cc2a18", "value": "3d8ea1a7e14847c1b25582a02cd208bd700de5420932b2905d4cf4272114d630.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fef6207-9609-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786510350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786510350, "uuid": "65d1130f-dd60-4f83-b4aa-c37b6af476c8", "comment": "Malware payload (Efimer)", "value": "e2fbe4259663915ce9a8130953e62c5f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786510350, "uuid": "5b87b1f8-5459-47fc-ac53-fbf5e9b68c5d", "comment": "Malware payload (Efimer)", "value": "3dc3a6d4431ce10cb1d50c7f0693297ab5bc146b48a78dce20e72cdbfec531d6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786510350, "uuid": "925190d2-5c34-4f7e-8803-4e1f52599ae2", "comment": "Malware payload (Efimer)", "value": "d7f71d84bb851d03172cf15f525a30dbdb8f4c73", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786510350, "uuid": "578e5597-1b5e-48fb-8cde-09b28af6f339", "comment": "Malware payload (Efimer)", "value": "f6d18b31645ddde3299c0fdda43b160036d3936d290765ae8fb2a79311b55ce27b6e9e2d797a4fddd77d88f962b7434d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786510350, "uuid": "7f7beffd-e786-41bc-97dc-4a0e8f6434cc", "value": "T16FD6334C5C91A19FECF08534BFD021699AA8B97427B5D6DBD33C93222C6B2E00D7C95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786510350, "uuid": "8db54d26-f354-4597-9056-2ff0b06b3132", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786510350, "uuid": "47d00bf3-c840-49c3-baa6-7dbbc81f6c62", "value": "393216:Us7FtgCAyAJsmKM4crXPnnu8Q2EEXMCHWUj6AcuI3/PGTAI:U+7+tsdu/nLYEXMb86VH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786510350, "uuid": "7aa1b1d2-20f0-4a22-a5df-995f6b36a971", "value": 13866190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786510350, "uuid": "284a6b02-f26c-4255-8f04-2ae3f6092073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786510350, "uuid": "33f3c830-1892-4ff3-8aab-d7843aefc0ca", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82758136-95f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786501711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501711, "uuid": "c2795bfe-0b19-4345-9e23-568f98980d04", "comment": "Malware payload (Mirai)", "value": "f3570ee590ead0499f498bf17a04acbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501711, "uuid": "7b9af562-7f28-4118-a787-fc619b69d7ae", "comment": "Malware payload (Mirai)", "value": "3e765d910b715b2d69d17254cd5e65cbfa4590ca8847e45ce434b26fded67430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501711, "uuid": "d8493595-af2c-47a9-86e5-bcb2f1f03fa9", "comment": "Malware payload (Mirai)", "value": "a505c3d7415d8c8e6b1368764ce45b9383503087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501711, "uuid": "60052ec1-9e50-4b60-b051-ab58aec623cf", "comment": "Malware payload (Mirai)", "value": "592ad26dcf502558ffa0f17815e8a2a8089a05904a80334c70328b20dc6dbe101e962126f10c291bccc23b4acc043a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501711, "uuid": "2d97ac6e-fa41-4dd3-981f-1ce7389a0d33", "value": "T17263B451F8929A6FC1D1137AF68EAB8E372173D4D3CE7223CC654721378A28B0956F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501711, "uuid": "c6f69e0d-65d7-4ff6-8e00-e106137e267c", "value": "1536:NvOoHHmF/aVErxu8OMSp/llG8ri/WTyQA+/Fy:NvbmBaEE89Sp/lrO/WTyQFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786501711, "uuid": "914f7914-32b2-4133-8ef6-4942c9ab12fc", "value": 69284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786501711, "uuid": "9a2c897e-22c1-4a1f-8579-01b295241a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501711, "uuid": "e2d1706c-7ec0-40bc-b060-84ab666a376b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c813e3f1-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496674, "uuid": "9fb07085-f4f4-4738-843c-dd36db33a6b2", "comment": "Malware payload (Vidar)", "value": "9ea19964d71482f9455ef5d346f37d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496674, "uuid": "a5dd54e6-0fd5-4032-a2b2-6d07509a3884", "comment": "Malware payload (Vidar)", "value": "3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496674, "uuid": "228f2930-ebc7-49bc-a590-7226816d2ae0", "comment": "Malware payload (Vidar)", "value": "ee659798992758bcb8e17e01be072311fa3a9d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496674, "uuid": "7d77cab4-571f-47f6-8787-4058eeec0e73", "comment": "Malware payload (Vidar)", "value": "57a7540f484fc41051826dd7474aabee79ccdd9d04c359e45fc323b69f6c344d6fe4e0a770a9236ca925510bf99e0614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496674, "uuid": "b075cd1e-cb9c-4cb5-a8e7-442d5e603ac9", "value": "T189165A037EA448F5C0A9E73588BB5252B674BC4D8B3173EB2D506AB82F763D06D39B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496674, "uuid": "7bfaa494-7928-42fb-9090-f929a8c8606d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496674, "uuid": "8ce46523-6965-4b94-9b86-2ab4ca035404", "value": "49152:am8YPwpyVSwGZ7hFl5yDZxQRlaqM89AgRu/mhfKxSnf5dW:aAaDBhFuDTqM89XfKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496674, "uuid": "17f6b2ca-d2d3-4450-a4e1-1ccf5766750d", "value": 4407656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496674, "uuid": "404465d2-23a4-4071-a51d-98ca89080bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496674, "uuid": "2e6b4766-b5bc-4cf2-8d84-d44093123113", "value": "3fb4958a2615b4652d6b55b22d623ca8409e1d452ca6134ce00a4caa118b74e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f69a49-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786499247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499247, "uuid": "27cb2060-ae17-45b6-8351-53a42905e108", "comment": "Malware payload", "value": "c52bc5b8f11d2f1d7045559a4f629093", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499247, "uuid": "c517be7c-1744-4945-b443-ada3ed18fbbe", "comment": "Malware payload", "value": "4039878821a2d5636b60b8d1d4290a765b22f66fb338cfc9091055b4fa929262", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499247, "uuid": "14154ac0-8bbd-4b39-837b-a57dffefb621", "comment": "Malware payload", "value": "5adea62c25b52816953dd60d52ed744612712850", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499247, "uuid": "861f63c3-dc8d-417f-859e-d9c086f192a3", "comment": "Malware payload", "value": "5bb43b5c49ad5b6b904056b4869e4246ada5c92e4388093853c6674a45c1071ce6110913daff85900fb5c3d5f6879f52", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499247, "uuid": "0c22c5b2-b575-4969-98d4-ed3ea7a10d46", "value": "T1E8C26C966A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499247, "uuid": "96cd030d-6573-40c2-84ac-f4bf372f1a13", "value": "768:s8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:s8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499247, "uuid": "cc0eea4f-96ec-4498-879c-1cd720b2d466", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499247, "uuid": "9a69c949-0a72-4080-a571-fed64287b59d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499247, "uuid": "6e3a1966-1d05-41ba-a6c0-49e5499c28d5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c140a5-9666-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786550431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550431, "uuid": "28750da7-b731-4233-8aaf-1ac5bf35351b", "comment": "Malware payload (Mirai)", "value": "e82a79995f7f58b09b07cb6561ce2092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550431, "uuid": "dcfef7c7-3157-41d3-a313-bcdb21a7f45d", "comment": "Malware payload (Mirai)", "value": "406d379b1661db2eb27fc5cbabadbb9639c1b78a5ed013d4c4a86f7c33c469de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550431, "uuid": "a46f4129-c073-45d7-a332-d9f7e720bf15", "comment": "Malware payload (Mirai)", "value": "d9e9e427a020864ac82905b5dac16862ec560960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550431, "uuid": "32dfc01e-e0aa-4377-98fe-6dad16d51750", "comment": "Malware payload (Mirai)", "value": "c25e9c0634090e5a36b611b72602b052b08308a1986933d8f2318e55d7efeb637e388fa6ff2b8c0142ef8758ce2e1017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550431, "uuid": "4eb0e57e-199b-4258-af6f-bb455ec76091", "value": "T171E3AEA7F20F2450C42206F81BCB57AC2A3365118F6B9AE76C6E763B1A375DF68053D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550431, "uuid": "ac5bfab4-54b1-4304-88bb-7ea0d20b0238", "value": "3072:YHH33uZhTavNGzmphl8ZCxKlIg1CRmk5hPHBq:YHHnvNdpjyC0lHCRmkBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786550431, "uuid": "df1fb24d-ffa5-4924-84ab-7da7f6376c51", "value": 157140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786550431, "uuid": "0f4b72bc-d301-4fcf-a58c-9db0492544f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550431, "uuid": "25ad7959-a059-4a19-a75b-8a62e4d870c6", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c07af1-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494841, "uuid": "f4fc4f70-8fe7-4d30-b0aa-30218a3d16f6", "comment": "Malware payload (Vidar)", "value": "624d9c3a6949dfed1425836c346fef4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494841, "uuid": "a325f92a-4949-460c-a3a3-513ae95e5c30", "comment": "Malware payload (Vidar)", "value": "40df1733675a2562b0a3e03f019f1b13cfc59688afdb7c39d5fa284d07040324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494841, "uuid": "4b6799ad-3d73-45f2-9896-e317cb486d92", "comment": "Malware payload (Vidar)", "value": "3bc4bdd24bf5c1688a714ec629e1830232cbe3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494841, "uuid": "3c31ec52-7633-4ace-8e4c-2dea87657313", "comment": "Malware payload (Vidar)", "value": "0dc543ee03dbd642c81ccce3aaf8ea063db12948b226ad01b92923bbea84f035edfee8788accd5c811af2fbaa0388cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494841, "uuid": "01208a6b-6987-406e-8595-efffc6fe9e5d", "value": "T19EE64A17AA9549FAC4A9D735C4B74615BA70B84E8B3233D71E52BE782F317C05E30BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494841, "uuid": "db7d87b2-f04a-4dee-9e22-44f5fb846efc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494841, "uuid": "2fc4a961-228b-48ed-9480-4342085a04bb", "value": "49152:jA1tAy73BWCnTdOYDaZDxWOZeMv+qGCZnHdSqFr/5SfiF5A/eK8zkhABgvMaraQW:j4ClzdX0KhHT5LJYLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494841, "uuid": "4481ad58-c268-4dc3-9377-a2c3d8749734", "value": 14973792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494841, "uuid": "c0f64985-16f3-4fb7-8b71-e24ee0c568c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494841, "uuid": "81992596-5b38-4fa1-b714-93e4d86ae0ab", "value": "40df1733675a2562b0a3e03f019f1b13cfc59688afdb7c39d5fa284d07040324.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adea724-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502154, "uuid": "f11f603d-1e21-4ca6-8440-1d5cac38e12e", "comment": "Malware payload (Vidar)", "value": "22f0652763cdd555e1bfb933ba836ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502154, "uuid": "e6f8b734-1f7e-4b90-9df8-0b7761df06c0", "comment": "Malware payload (Vidar)", "value": "412ec3e5a96657e849f427f416348d97351aa0c4692f29b783ffa6e8e00fd648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502154, "uuid": "28cc538f-980f-4e6a-a108-2ebf5abefd39", "comment": "Malware payload (Vidar)", "value": "3bdd59c7936f7809b3367b2e80374d06383f518e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502154, "uuid": "11ef2948-c70b-48ff-8db0-74dc589088f9", "comment": "Malware payload (Vidar)", "value": "55652b342e74bc16b66e7c3254b5e4d957613e2c4ab1109a5b95b110f4ccfaa8cfa569045eb149cd9deb5f78eb6fb27d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502154, "uuid": "496f12fe-2c58-4eb4-8ef0-c4894351aa90", "value": "T183068D077E9158BAC49AA73648B702553B7DBC198B7733E72E50A2793F223C15C3AB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502154, "uuid": "fcf9b6af-a37b-4dec-adcd-3ef4ca390dba", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502154, "uuid": "b6096ad9-2673-4d3d-968c-355629ecadc3", "value": "49152:yHrfrhepFpI3asyPNTiGIJ8ciY1sumDL94Pm0iDslRcYx/:yH/PATiuEsLiWyRLx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502154, "uuid": "887c2f53-8c7c-4ed6-aec1-93893bf053dd", "value": 3843144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502154, "uuid": "205ad101-da8c-42a6-87f3-176ef947d0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502154, "uuid": "e2f3a4af-b8bb-4331-9558-c8b987cc9c65", "value": "412ec3e5a96657e849f427f416348d97351aa0c4692f29b783ffa6e8e00fd648.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecea931c-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511338, "uuid": "a93d64f0-0839-4424-b19e-4c787d022cb0", "comment": "Malware payload (Mirai)", "value": "7b81a0b167fc23c63c6400311f500098", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511338, "uuid": "84276c1a-476a-42b2-9cbf-a0ce67b03b35", "comment": "Malware payload (Mirai)", "value": "4134596a2392a5114a31817f47cee5e97e3a12877d6129f6011c169cbb6ee2ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511338, "uuid": "367545ac-c587-4401-b01e-3bef52d82a56", "comment": "Malware payload (Mirai)", "value": "4170763bc6832ec3362f2f8a412689b7f523b153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511338, "uuid": "ab96c51b-a607-4932-9c82-44a6b0d1f3e8", "comment": "Malware payload (Mirai)", "value": "5e1f98ec72cc448aaa4626f8ca858b66086731fd01243049a210d095325a8acb7102f0eb566957138c4221152a5ed7a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511338, "uuid": "5f8bbba4-6c8f-4246-8570-1510ffe2704d", "value": "T150D30951ABF0D419F3DDD03A9392032D51AC5F9B1BB0AE1A7F901E48EF1A6903B167E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511338, "uuid": "23302061-d4da-42ed-99bd-f1f9c7fe6cb7", "value": "1536:OGZVFaIgBqFPmR/T4J32kpK47KyHbXLpJ:l3TmxT4AkE47JXLpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511338, "uuid": "481a6ec3-503d-4e4b-8f41-54e948bea267", "value": 131532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511338, "uuid": "417e87a2-ed0a-4757-95c4-13dbc7275d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511338, "uuid": "243305e0-3176-4f41-ad2e-24b6965d387a", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3192b8-963c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786532411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786532411, "uuid": "5bdbb8d8-f07d-4b0a-8fbe-37b1672037d1", "comment": "Malware payload", "value": "82d3ebe947b946577ad202a241f895c5", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786532411, "uuid": "ff093cde-58c3-41ed-a5fe-5f17e4d4df81", "comment": "Malware payload", "value": "41840ab4e9a156cdaefb349a9b32e3f0d33745b08cfe8edd61abacb13882454b", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786532411, "uuid": "5ef21145-5eb1-4d70-943c-24e45bafd876", "comment": "Malware payload", "value": "2f7fbe324e7b8d761fe0e4b5ad98d1854f2a0038", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786532411, "uuid": "52a74c6b-3d75-44ec-8a5e-2b78bfbad307", "comment": "Malware payload", "value": "498d467aba4ed012eae2ede1931cb2e0addd95d289f2ea6e5566e7f88b4dd79588f7b71c07b83b8da03c6672aec7158a", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786532411, "uuid": "74931f88-df7a-4830-8523-298cb25ad4cb", "value": "T1BA1423294DF82ABF6BD8B620A34D7AE29413105422181BC731C79FF6F1EE1A563D2D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786532411, "uuid": "7c782d49-6ff9-40a8-b30d-f31a0c1b1d8d", "value": "6144:1kR7o/wGrxvjYAJ0VDfxG4iLFsHJ5AZ7noTOB6TN3l:yR7o/CAJwZGBQ5CqOBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786532411, "uuid": "735c3638-e228-44ec-8e98-99936cb3735d", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786532411, "uuid": "b6f2cda3-3877-4e0d-84ec-a1548a607b1a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786532411, "uuid": "68396181-cd06-4056-9c74-59a1a2baca73", "value": "41840ab4e9a156cdaefb349a9b32e3f0d33745b08cfe8edd61abacb13882454b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05471f24-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574945, "uuid": "3f33c1f3-386d-43f2-b2c5-b7d5fbd1e9c5", "comment": "Malware payload (Mirai)", "value": "29d7b20380beabca5148b32f28d00610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574945, "uuid": "ab8146e5-9807-41ac-8eb7-a25507d00a64", "comment": "Malware payload (Mirai)", "value": "41ac975aa0638b879bade9f672fbcdacb303bc6ceb5e92083b85af9cd440cd04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574945, "uuid": "9db8256d-7439-47b2-b6bf-71eebb306394", "comment": "Malware payload (Mirai)", "value": "1cd405c9d057a51cc5bb21a5f79a3cbc288bd9df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574945, "uuid": "2c006973-ea92-45a9-9225-dc2bffb30ea4", "comment": "Malware payload (Mirai)", "value": "ae0af880a83cc522627164fa1c697a56fb4ea158089ddf11f081bb105076dc67362c1e1f6837e17d55ba143490c67814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574945, "uuid": "d28236c2-1354-4baa-8396-5307dd841679", "value": "T1BE237D7AC82D6EC4C55C96786829CABC0B53E104C5A31FF647D6C9A644C3EACFA193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574945, "uuid": "8461767e-e009-486e-a7ca-22eb35a371c1", "value": "768:clelZlh+PwtBBRN9eCUCyGekpSplC1l2jWqxxGwCnoO1uCh:cISPwtB39p4plCSWUxT3OuCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574945, "uuid": "16f6eac6-d8b1-4b2b-b91a-5005c45388bc", "value": 46288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574945, "uuid": "ee4a0b3a-9290-4385-9b21-d87cf313ec8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574945, "uuid": "ea0e938a-1078-4196-919a-b8bbae6393cc", "value": "f971dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae0d61f-95f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786501644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501644, "uuid": "acb005b4-b88a-454c-8cb9-1756adce31d9", "comment": "Malware payload (Mirai)", "value": "dc4675f27ccbe5076178434a704fc8a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501644, "uuid": "1aa0b01d-00bd-41a6-b84c-ef0be4a2dea7", "comment": "Malware payload (Mirai)", "value": "426cf29f2636dd4f6a658e76c475c735d3ad517889e8d051854e085784fbb146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501644, "uuid": "753e751f-8cae-4e8f-aebd-8bfea7ad225a", "comment": "Malware payload (Mirai)", "value": "5c63bb6785d36726b5e1c49537d2b64c2dbbccce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501644, "uuid": "36505c63-ff04-485d-8937-4be45d8a0a07", "comment": "Malware payload (Mirai)", "value": "82961e4feb6bd1eb471cf5ae01daacc05dc01a30b562541093bf8fb94d6326e0c34c13b1b10d6f4eb62622ec411596ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501644, "uuid": "66238ee6-41cc-412e-ba6e-78ed2c1f3131", "value": "T189B2D0A1308C7A62C6600DB5C9DDCA6AAF9317F4F1EE733311245126974806A7DBC78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501644, "uuid": "b8f80803-eebe-466e-8fa8-e200a1b6d19f", "value": "384:vsuS+d5tvR3+mgwrPUqcKlzZxCNu6tXwDYzBSIM+8zXDunnWJhymdGUop5hUF:Fdd5tvR3pLrhZQNLZdSrTunnWJs3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786501644, "uuid": "890000b2-6021-47ab-b72b-a932f9b67cc1", "value": 25156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786501644, "uuid": "a2c60284-3470-4d24-a684-93d3b3fc258d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501644, "uuid": "7bf2057c-0961-449f-8c3e-cc52103dbeea", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893bb33f-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494850, "uuid": "25644544-0dba-4ab3-8cff-f94b4d4fa0f7", "comment": "Malware payload (Vidar)", "value": "61ee8c539a8c153c2404d023a37639cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494850, "uuid": "1b9cd897-0017-4d48-8bc7-1ad672dc98bd", "comment": "Malware payload (Vidar)", "value": "42a0c075c468870f9c705a605d49de7d4c2f3faad9783f54c5b589e9495bbedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494850, "uuid": "31eab9f1-0def-4e17-bafb-8a923ff73455", "comment": "Malware payload (Vidar)", "value": "82ac55b0852416e25b12ab9d7b140d0e9b6e0b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494850, "uuid": "6a4a3f48-7723-4152-a446-5b44b7b76c7e", "comment": "Malware payload (Vidar)", "value": "97bd27558da7e6239d88ae4b0ed1f61f4b16b88ef01ad385df0e095f5910f15814c6bc92137c2913e29b1f9665e16dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494850, "uuid": "34747e2b-23ad-44e8-9e46-bc0ba8a11452", "value": "T104964A17AB614C74C498D735847B465BBAA0B86D8334B3A31E62BDB86F313C15E39B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494850, "uuid": "f517ed2e-e9ff-486c-9d16-861de2291126", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494850, "uuid": "157264d6-86cd-4a6a-aa68-ab23e92b6eb4", "value": "49152:NQ25n6M1Jz5GPa3Ro73lZeYT6EONpfN7f25KV3qCCGM8t5fokaOZl4t+iL/e9WY5:N1/9BvNXD2cV6Byl4t+ue93gAJcxt8Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494850, "uuid": "088d556a-c80d-4174-ada2-cb215d995384", "value": 8889416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494850, "uuid": "ca531ec3-39c7-4f80-901b-566c5da66535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494850, "uuid": "ae36be4e-203c-4592-aa93-747bac828d00", "value": "42a0c075c468870f9c705a605d49de7d4c2f3faad9783f54c5b589e9495bbedc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4312b3e2-9699-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786572042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572042, "uuid": "752b39d7-1750-4995-8440-7a553d816835", "comment": "Malware payload (Vidar)", "value": "44826cadb848eddd3550c0269fa2ad4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572042, "uuid": "d8b421ec-8e3f-4d18-bfdd-c84c244f48ca", "comment": "Malware payload (Vidar)", "value": "4339a4bf8be2b5e32f6ed2c644b9bf1181ac25b336e0ed5198c808098279d27e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572042, "uuid": "c7ebf7d8-c30c-403f-9dda-8207634646c6", "comment": "Malware payload (Vidar)", "value": "4468fa2b9975b4b7570f947f36829ae549edabee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572042, "uuid": "2137cf3b-0378-4889-a286-c9a5bb1a2834", "comment": "Malware payload (Vidar)", "value": "91b8611950dc01e9bdf77bb395d2589ea2d2a8ac4b1d7f12e7b0fc1a59ff7bbdab6ca800697ff433808d6c778e41d89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572042, "uuid": "afee5811-bf52-4dee-8a76-2a6ff3974c8e", "value": "T176567B13EC9119EAC19AA331C8A79252BB757C885B3223D36FA0B7782F727D06D74750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572042, "uuid": "fdc75a95-b1bc-40ff-9fb0-77a46d91384d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572042, "uuid": "c4ed2507-479e-4d9a-952f-cd7092d994d2", "value": "98304:2vbvfbyXEZ/BdymAzGZyJ8/LRYq/dSfUEM:2SXEZ5dKQRDSFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786572042, "uuid": "003a4bfb-c7e5-441d-8a69-8d71a446533b", "value": 6264200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786572042, "uuid": "af446f5c-b8ed-43de-88e2-38f13f7ee727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572042, "uuid": "0d827c62-7536-4e1c-9b4c-aa3fcf000c96", "value": "4339a4bf8be2b5e32f6ed2c644b9bf1181ac25b336e0ed5198c808098279d27e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae563209-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502214, "uuid": "89c0dcd0-ed14-499f-b64e-516c32f3c876", "comment": "Malware payload (Mirai)", "value": "221df53f7b5e1cf694c9ba017797f347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502214, "uuid": "03bc78c3-1317-4ef7-8d8c-9db007ce2d80", "comment": "Malware payload (Mirai)", "value": "437a1080ad80dc1849d2f9bf90048dad0b916f5e76ddab0d468bed0f00169534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502214, "uuid": "f1328f72-fd11-4bec-974f-e15807889168", "comment": "Malware payload (Mirai)", "value": "bd9d1ea815181f2509142b6a17d5cbc4f4b645a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502214, "uuid": "a6a55e99-2ac6-4e3c-b88d-c8beb2bb8857", "comment": "Malware payload (Mirai)", "value": "e46a6ffc7d963eb86145720e5c267c94e361419a78d8718636d4906fac89b5b8504e8955de0dd51feb0f4ed6a6ab4b98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502214, "uuid": "20a1c036-5f8b-4de8-8a03-063704ff1ce7", "value": "T191F31802B31C0943D2A32DF0363B2BE197AFDAD222A4F645351F969991B1D336945ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502214, "uuid": "ca7b79b7-ae57-49e7-913f-7e2f6de7bf70", "value": "1536:bta4TS+ipgrCzPDm3KxO9oztrbwE5yqzukoJZNZeeEvAMWcQsZE/fBA8qAT0Hkpp:o4TSyrCzPDmaxUiIgziZJZMSptwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502214, "uuid": "e42256b4-2442-420b-8fe1-2ed74075c1ad", "value": 168600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502214, "uuid": "622d2aaa-c71f-4d5e-8fdc-93b1f0375611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502214, "uuid": "010c04be-fc64-42b7-9de3-0db1f05b0592", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e16a36-95ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786496918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496918, "uuid": "c491c7f3-c719-43cd-beb4-fb751796f274", "comment": "Malware payload (Formbook)", "value": "75e3edf01d356d77c3800670284a0f55", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496918, "uuid": "2941657f-92c7-4c45-8c31-87daa072c948", "comment": "Malware payload (Formbook)", "value": "43ec2662d839781bbd41eb59f40ce37b0e505bf836d31410bc944a19fe72d1fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496918, "uuid": "9450f698-c813-4fde-abb8-45942b66d4a7", "comment": "Malware payload (Formbook)", "value": "a93cc5775f7b632defc6a25f94d6b615a67bc3db", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496918, "uuid": "80842ffc-675c-4cae-a28f-655722dff45d", "comment": "Malware payload (Formbook)", "value": "8410509595b75bdc2aa50c63d2580128db4482e252c5774717275932b692d45cafe5fcffa0971c2a01e5691cf286c643", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496918, "uuid": "a8c7dac7-f638-4676-b3ac-95c8342cf6d9", "value": "T10DE52B5133FEA6452E143B55B88C88494B0EE4356983A6F8F5DF0BD0672F09B6260F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496918, "uuid": "af257466-6007-49ae-8b78-f75dd7a06193", "value": "12288:yALW+sLDO0EB/KewZzKKToiJJ/yVsBNvrkuHnS27qFhhq5NdNu+YOmj8dlD6N/WT:yAy+svFEB/Kew3e+9gsQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496918, "uuid": "cffabe47-2b5f-4b0e-af1c-66608bd6fb29", "value": 3100011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496918, "uuid": "ffee8cd9-e801-40ca-80ca-2c8e48403f9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496918, "uuid": "a31bedc4-868a-447f-860c-31d510226096", "value": "MV_SEA_LADY_VESSEL_MAIN_INFORMATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8187de92-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786515024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515024, "uuid": "9d39ecb1-ef3d-44f9-8493-736e7e31fd99", "comment": "Malware payload (Vidar)", "value": "df3cc875c6a7d205c2994161c968a3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515024, "uuid": "f16849a4-cf09-4e76-bb4d-b55d4ad5d40b", "comment": "Malware payload (Vidar)", "value": "4595f0908dd60be01fd2892d284ac3cd9bdd11cecfd4b38e3d222b27a5ca3170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515024, "uuid": "e1a9a69a-e3ef-471e-ac46-98d3b3797a56", "comment": "Malware payload (Vidar)", "value": "e0cb7e2cf5870a1e39540cb10e1fe54ce315d5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515024, "uuid": "e3584a5e-256e-49ea-831a-2ffadffe7893", "comment": "Malware payload (Vidar)", "value": "67dbd3de0c9e9f94ddd9d0f8754cad5eadb1e88ceeefbd6542f1108d7b0ab79711c7488c8b17bc2e96acae1da2515518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515024, "uuid": "b2bbfea9-942a-437d-948c-66272c7159c0", "value": "T153566C53B9519979C0E6E73144BA431AB729B84C573A37E32E30AFB92F367D25A31700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515024, "uuid": "d426ec95-7233-4aaf-b42d-817d43054af4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515024, "uuid": "c01196cb-82dc-4d04-8bcb-9c30eedd1e52", "value": "49152:mVulVueWVVj80XnqanCDQ9NnAWciOdB4sw83NSNg2W/6WrMAgH:mdw03q3A290+//fgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515024, "uuid": "2ced52d3-6f6f-40c1-aed0-628dae9dda69", "value": 6267928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515024, "uuid": "c77e9c6c-087d-44a4-8345-e788a38527e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515024, "uuid": "6c428489-05e6-4464-aafa-53a843ca575b", "value": "4595f0908dd60be01fd2892d284ac3cd9bdd11cecfd4b38e3d222b27a5ca3170.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d59311-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786514976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "b4849880-0df7-45ca-989d-605bc092beaf", "comment": "Malware payload (Mirai)", "value": "08d5b90afb2d634501b50e202b613ef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "2cdd7714-97a9-4a88-be1a-09a517b6cf6a", "comment": "Malware payload (Mirai)", "value": "45df519b2760bdae0ec24c81e77f78c8a7e72e345c10fe114a13ed1501b129b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "9ea87d61-5130-4976-918f-d3c7c894b89d", "comment": "Malware payload (Mirai)", "value": "32a3c978ca3c6d29136ee5f17758ef1c0ae852b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514976, "uuid": "361cef3e-ef90-4139-b0f2-d918bf70f092", "comment": "Malware payload (Mirai)", "value": "4c166f5195abeff9dd9f74064eaaac836a25fa02e9bdb736114d909fda3dbea6c705d84d0bb3917bd22416bdc4b695cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "9fa9a839-8c6d-4a5a-9c48-c27cece47822", "value": "T1BF63B451F8929A6BC1D1037AF58E9B8E372173D4D3CEB213CC614B753BCA24B0966E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "ea054606-f1dc-4856-8d18-90a21d6b9514", "value": "1536:6WtTFnIqbKfROXLFWpFZZLa8usONezzyNVw3:ntRIqORORWpFZZxNONCzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514976, "uuid": "02f11f81-5b81-4b63-a4ec-c9e41382fded", "value": 67332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514976, "uuid": "b17a676c-43ee-4c2f-bf48-fdcae719099f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514976, "uuid": "8bdacfff-b28d-48b4-9508-c3bcad7726dd", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db28c4b-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786515017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515017, "uuid": "05608a3b-8ee0-4766-8ea1-1fff288dd727", "comment": "Malware payload (PhantomStealer)", "value": "08dcc825a4167d97858716aabf702372", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515017, "uuid": "97539940-5c3f-43f0-90ae-d6620b101bec", "comment": "Malware payload (PhantomStealer)", "value": "4660e775ecf09ae48a0c19a0c02713ea49823ca71d179c2d0a67feb18aa10215", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515017, "uuid": "9705c95b-9d47-43b2-9dec-916b12c512dc", "comment": "Malware payload (PhantomStealer)", "value": "b0617818bb3078e350baf56e05a781098f86b67d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515017, "uuid": "7abfda2a-2754-49c2-8066-ef146ef9a4de", "comment": "Malware payload (PhantomStealer)", "value": "36d90507752710ef5e1af29e766848bd13b7eb21e8658936dafea69ebb583731f0bdf6665a9a7cc52c648f37c0fff115", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515017, "uuid": "373ad09d-7097-4791-a95a-6bafe3909240", "value": "T1E5362950128899B0BD7E773CC53E77402A6D23CB13A4AA5D337C1984BBB9757AB4C8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515017, "uuid": "d6d5bf84-8d27-44be-84ac-c1b701adbb40", "value": "98304:+sWBsu7NcXakq1sVgPtNXs+og0NQErTVTcU5QmD47EGm1XLMISLSw41N1GMqVTLk:ZWBsu7mX1q1sVgFxxogpEfl35C7g1bMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515017, "uuid": "82989749-c457-424b-a106-1e5555c5dd69", "value": 5112438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515017, "uuid": "145869db-c321-4347-8988-dcad990efaf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515017, "uuid": "e65e4fb7-cc44-41ba-b1be-933bebc2cf54", "value": "shipping documents.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce721109-966e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786553807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553807, "uuid": "19a6c709-a419-4768-acee-ba3a8aa972cc", "comment": "Malware payload (Vidar)", "value": "2d65eb495c1d0b96949fcf555080a70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553807, "uuid": "4c2187b1-61b4-4efe-b3f0-d9cf5a851781", "comment": "Malware payload (Vidar)", "value": "467963eb25680f1184f865428e3afe91d6f1577552fddd2c68c008aea5d4b856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553807, "uuid": "b28edfa3-cf31-460a-b342-a0573c2429d4", "comment": "Malware payload (Vidar)", "value": "8223170ece34beb34d18dd7a67441b90c8ebb865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553807, "uuid": "4394da63-f65f-4934-8564-261e39fa8be4", "comment": "Malware payload (Vidar)", "value": "fd2ce7636d0ff97663b6f975fbcd52cceab6a49dbee24e99ebfc9f6e8748c57955e80273a876ba1b463167202012f69e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553807, "uuid": "9d66db59-019f-433d-816f-bd3dbd685717", "value": "T146268C13ADA548F9C0A6E335C8B7514ABA30B84C5B3427D32E90EE782FB23D15E36755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553807, "uuid": "7890c835-d54e-468e-bb56-6a317842d943", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553807, "uuid": "0236f8eb-a774-4dff-ab2c-5fcd08c6810b", "value": "49152:YEf7sjiJw1RwBr97A4AYg8a1wkiugrzJDku2nD4hpTDOlT4LVUqchxgHN47SoSqO:YUP528afMob4XiqLVUqchxgHhUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786553807, "uuid": "10971886-6d38-44a7-b992-fdc661f20928", "value": 4819456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786553807, "uuid": "6944ecc3-c339-446d-ae40-ab1d4bc29101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553807, "uuid": "c45261a2-274c-4da1-b195-7420c23cbbe2", "value": "467963eb25680f1184f865428e3afe91d6f1577552fddd2c68c008aea5d4b856.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b98f85d-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500330, "uuid": "a5388784-f9d5-445c-9fd3-464f2a7244c2", "comment": "Malware payload (Vidar)", "value": "0dad626724bd9930f5a39c6ea5bb6700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500330, "uuid": "d41028ac-fc9f-48a2-a2d9-1f1b23478c62", "comment": "Malware payload (Vidar)", "value": "468ec617a18a15cf015d73178ab210c2a24311b0b584eb75e8dbf2fedf4fc15f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500330, "uuid": "84e39f6e-87c5-4c13-9068-f03c0a0b8a9a", "comment": "Malware payload (Vidar)", "value": "edf6e6079d8bc084d5d3fb824d61f3ab2bfe9671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500330, "uuid": "0ac866a2-8386-44c2-8eed-f224dc37b598", "comment": "Malware payload (Vidar)", "value": "556b4ca6775141612fa37b2cf8381162eef747bcec5b2cf9adae00afbc20c3ed2cc4561f5aaa6549cd40a85368f61aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500330, "uuid": "cc08fd2c-93d6-4e8c-8d01-e9675f58437c", "value": "T163265A03BDA508F9C09AA73189B75252BB74BC4C4B3133E32E50AA782F767D15E39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500330, "uuid": "473e046a-046d-46df-87d8-ac09b4569fe7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500330, "uuid": "e42e1bb3-dc7a-40cf-8eb6-7ddfa94a2736", "value": "49152:5FEOg4k+5S1XO959TT/CzAMj0ncEZdbiUWiorigWkcp9:52+5X/j7O6gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500330, "uuid": "a6e5d44d-c43d-41af-83b2-b62201516e73", "value": 4599168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500330, "uuid": "ef614f47-32c9-4996-9f8b-fcf47c752ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500330, "uuid": "0746c567-14a2-4ee7-b437-b80f72e434c7", "value": "468ec617a18a15cf015d73178ab210c2a24311b0b584eb75e8dbf2fedf4fc15f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4647057c-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786516213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516213, "uuid": "7f4b672e-90fd-4015-b897-1aa400efbfeb", "comment": "Malware payload", "value": "a35421ac29f23c3d90d8ee920b046f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516213, "uuid": "985cc5f1-b99f-4434-bd76-fb73e9c350db", "comment": "Malware payload", "value": "47b936bf41b6b2da90af24ca43f884b915fd1da766be07478c780a1411ce444a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516213, "uuid": "55b9e5f6-c536-4d4b-95b7-f8546da473ac", "comment": "Malware payload", "value": "355b1787e1c43a09ccbb03cb2aec4053dab99c24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516213, "uuid": "2d5231ab-7e99-4cde-a387-bfbfb16a9175", "comment": "Malware payload", "value": "df10017b963f230dfaba1214206a34e6f9472d67a70761efa17709ea3f35dc608db5de6c023c232057e63d7236e004be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516213, "uuid": "fa2a576a-f728-4fbc-9536-8efcb5a5b496", "value": "T1D994230D84C16973FFB968F9ABE4DEF0848A59BB94D0920B98CB1B181CA9451732DDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516213, "uuid": "70805020-84e4-44a7-8094-a9386f3974fe", "value": "12288:lueGjDSupt7AcYONI8xF0yykvbUdQ7omjD:RGjDSuptUqLvFz7XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516213, "uuid": "424e07ca-0498-42a7-9ee8-a0b02c79d3d5", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516213, "uuid": "2626f0c0-6d02-43ce-b448-145e9b90a794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516213, "uuid": "eab90459-d7a8-4706-b1cd-1a7090a88db6", "value": "47b936bf41b6b2da90af24ca43f884b915fd1da766be07478c780a1411ce444a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34daf462-9625-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786522196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522196, "uuid": "929bbfef-661a-423d-995e-a0cfde591192", "comment": "Malware payload (Vidar)", "value": "f06f0d26b6e12e5ddc77c626c300d91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522196, "uuid": "9400b19c-3a36-45e8-861a-dfd9b84edb25", "comment": "Malware payload (Vidar)", "value": "47f31eceabe0d668833dd83de1bc91e84072d40b9ec23a34e2ed9c6b065abd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522196, "uuid": "348fb696-96a0-45c1-973e-508fceb6acdf", "comment": "Malware payload (Vidar)", "value": "60fa61f63d58b9307abcce0adcf2cd4d1046f649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522196, "uuid": "42a307dc-22dd-4d6f-bc4f-30099309fcd7", "comment": "Malware payload (Vidar)", "value": "3f23426e09a655ba3de4d95ebea6780b81f5a7113db221186dd41739fcb95eb2ba34292a3eb06378e17f5ed107833dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522196, "uuid": "8ad8a500-ada9-4ae8-a276-92b6943522ed", "value": "T101068C07BDE508E8C09AE33189B692967B74BC4C4B3163D32E50BA782F727D05E79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522196, "uuid": "cf3a0a69-8e01-4320-b2af-c398033009bd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522196, "uuid": "015f36ea-ec8f-4c42-8e94-26233ca06e92", "value": "49152:lRVhIGpE6hK27FTZmjD22acV8qPqBLz1czm8kH7IG9N:lFHKO5lJ/R7IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522196, "uuid": "deece0a0-fa69-44cb-91cb-91e283f2dbd5", "value": 3949920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522196, "uuid": "64bae84b-09dd-4181-8d70-b90992c40cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522196, "uuid": "63a223fe-bd62-42bf-a0b8-69bd198fe1e1", "value": "47f31eceabe0d668833dd83de1bc91e84072d40b9ec23a34e2ed9c6b065abd9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765cefc5-95fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786505556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505556, "uuid": "c49689ac-627f-4d37-95c5-463e520cba75", "comment": "Malware payload (Mirai)", "value": "b4359739f28a68f4da7e796e8ef1fbd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505556, "uuid": "b84f44cc-1051-481c-ab96-5aaac262953f", "comment": "Malware payload (Mirai)", "value": "492dfb527d6e5ab6add02c95cb930acfa85611967544e104546179cf6c8a1a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505556, "uuid": "c454c85e-fae1-4d74-a094-96a7c357656e", "comment": "Malware payload (Mirai)", "value": "75bbe0533e4f7c7a77c8798edc622e75ed027181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505556, "uuid": "d923596d-d921-433a-813d-abd792d7c608", "comment": "Malware payload (Mirai)", "value": "66e213adc72102d3cc41ea77d315c69a3a73ec7a3c69835f9064305d097d7f7bcfcceb1184c6749e46b22ba599df04c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505556, "uuid": "0d22751c-6a75-4003-a640-b6bd8041cabb", "value": "T10EC36CC5F343D4F1E8A604B10077BB739B32D0B65639EA42D7752936AC63A809B1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505556, "uuid": "9b3d25f0-2257-4d4d-9e68-10049e305a62", "value": "1536:wUYyMqSjMnEwotI9/KOXUKT1rgvWdfd3wMbrMeQummfW5Sd1TpZmf:wUYkSQE7tW/KOXzZkOfd3VrfdmQ/mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505556, "uuid": "969ff458-8cf6-437a-b86a-27c4bce5b12d", "value": 123528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505556, "uuid": "b36c17d6-ec3a-4e41-96c8-f6f594a18c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505556, "uuid": "ca1f0e4e-d3bd-43b3-a33a-94084426738c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31487a1-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512932, "uuid": "36f5ee0c-70f8-40ee-a626-4f971931f659", "comment": "Malware payload (Vidar)", "value": "4d90b1e99d379183f7d5c6d7f4652a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512932, "uuid": "b2584c5c-f2ea-4bb9-b8c4-b01df6e7ee64", "comment": "Malware payload (Vidar)", "value": "498666399cb1eafb5e8e2998d430ab67bccfa7b511e8bcb6be5011b09548eac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512932, "uuid": "6ea3d436-5aed-4a0f-967f-90a24ab8c5a1", "comment": "Malware payload (Vidar)", "value": "5d7722b943f00885e36f4753fd1f38c4f27fa413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512932, "uuid": "4a8c89a5-67eb-4645-99a8-e066ce59ebac", "comment": "Malware payload (Vidar)", "value": "39ce1bc5af9f8ff2631765389bbc8b880d5d7964dcaa75b87e07982baf2d01255222608a9492f26063c5d447b601e621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512932, "uuid": "d61ab32e-8f68-49ba-9988-bda799adac6d", "value": "T19C068D07AC910975C8A69371896B42627B3DB8188B363BD73E50B7792F377C09D36B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512932, "uuid": "142fddb7-f86f-4634-894f-a895ade68d5b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512932, "uuid": "451135ad-a0b2-410d-b755-661911dce193", "value": "49152:i2fbtrlfd2Ouo0vka6vFCDa0SaPW1TOzTDNCzNJsoVcIKGcMIqB8sxMtP7KDv22T:i2ZmPE01ZTyEUJNxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512932, "uuid": "c8815d82-4e9d-4633-8e34-fff9c2cdf312", "value": 3730776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512932, "uuid": "de0ce0c9-525f-4534-9b99-58a7423ad403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512932, "uuid": "66f9c05a-b6e1-495b-84c0-1731b790b72f", "value": "498666399cb1eafb5e8e2998d430ab67bccfa7b511e8bcb6be5011b09548eac4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d5106f-9683-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786562673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562673, "uuid": "c2759c8b-2c10-4250-952a-d56ecf39b696", "comment": "Malware payload", "value": "72982898f71e33aa3f347f225bddb5b3", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562673, "uuid": "9e7f4078-1f13-4ae0-be2a-a6e4f52613ac", "comment": "Malware payload", "value": "49906fc9a7f256de3bb2d8a79e05c0d621cf4561683ebb0fd2e6b634e6132a6b", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562673, "uuid": "d7810e9c-6af6-4d41-9999-8bf4dcfb50d9", "comment": "Malware payload", "value": "f1fad904f7af2cd13a2ae077b1b9c1f813199682", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562673, "uuid": "07587b71-f8f7-40bb-b3d1-4f6fe52c879d", "comment": "Malware payload", "value": "40c8b76f93aade43927fc6c733332f455cbeec6c06f2dbe9b4640e9f6dfd4c4fd458e92c39dffa8ac99da9591498c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562673, "uuid": "fae79b3d-e310-47b3-ac20-545b98a1ccc2", "value": "T193567B57FC9158E6C19AA231C9678212BB75BC485B3223D72FA0B7782F727D06DB8710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562673, "uuid": "27c5ff15-929f-42f2-8348-968b62b3b1c9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562673, "uuid": "5f64008a-c813-4c70-b0af-5208436cbb5f", "value": "49152:5BCyd4n0LYBLdg38JDEf119viUapyLECNkQqpW98k5E2rlv4/YtBelKcK9KtzoEq:5v4g3mED9aUyyARBFQ9TtZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562673, "uuid": "d29aadaa-c7cf-4087-a797-520d2ab7267e", "value": 6405496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562673, "uuid": "727719fa-a5bb-4a61-be5c-5cd9efc7ff92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562673, "uuid": "4b303af3-2e6f-4256-9790-95c4c279e72a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272e1d86-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516161, "uuid": "31e3f63d-2d8b-4928-90c5-671f2775bbf0", "comment": "Malware payload (Mirai)", "value": "c03e29ca2484cdc8f0093dba65f70ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516161, "uuid": "60438131-8217-42a2-8333-5682b84c19d9", "comment": "Malware payload (Mirai)", "value": "4a0ace4387ba9e7fcf894e7502d254c9a7706295d762f42e8b634497c528ec66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516161, "uuid": "9bb7e52e-976c-47ce-9aab-f67bd4dba7be", "comment": "Malware payload (Mirai)", "value": "af6b2c8ee0c0e308fe4f0addff8de6d570740283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516161, "uuid": "38e75efe-afe0-45a2-8a2b-21808aa31e92", "comment": "Malware payload (Mirai)", "value": "47321fb89c1e76761b3c2c31a949df0cfcce3bf68e005762ed33ec5c9137a095f856d51c9d84d33b7f6803f746ed0ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516161, "uuid": "97e99624-1bf4-4e61-b275-67e356c24df2", "value": "T13B23F21623EE8E65D169113C51CBF16805C0B23A6174CAAE3FCBF532CD63AF96716285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516161, "uuid": "0eeff937-8bb7-48b9-9e9c-3f37f35982b7", "value": "768:0Pr112xHZKgRW6rw2V512GTnAvDcTz7jD7Eezxmut51BmAXOCuMTwl5w5jHgGZni:Wr3QAWVf24nAvDc/rlxnP1Bm2OahHTti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516161, "uuid": "8db99b8c-4216-482c-a070-303c2987f0c4", "value": 48656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516161, "uuid": "664a4dd3-1344-45d5-8132-7bebdadf2de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516161, "uuid": "99ce7cc6-726c-4b3c-a2f8-7c60d1b0c1b5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009c91d8-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511371, "uuid": "0bf21bfb-e175-42a9-88dd-fa755cf19a38", "comment": "Malware payload (Mirai)", "value": "2d5dd61c36d7c81fc3b24205cae812b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511371, "uuid": "1d1cf273-2a0e-429a-b589-53ab6fc49e6c", "comment": "Malware payload (Mirai)", "value": "4a74dda7276c5941ba49e08565e1be01b120fce905382b85504435faf04ffe5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511371, "uuid": "45c642e1-3eb6-49d6-a431-dee23769fdf3", "comment": "Malware payload (Mirai)", "value": "502d66565aff5109f4e99f6d11758b96b6f9e4cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511371, "uuid": "b4d3d191-e9f0-471e-a92e-272e3aca8ede", "comment": "Malware payload (Mirai)", "value": "821f99aef91135a025486d982cf2ca5904c26bda122e996be14fa28ee1738b216ac0e0c3674277702bcff8ce69d9bc0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511371, "uuid": "042960af-229b-4e8e-9ef4-5be170ff422b", "value": "T144732886FC81A629D3C05777EB2F619E33119BD8C1DE7302CC255B647A8B81F0D66B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511371, "uuid": "d4388abf-db70-440a-b757-dd132fdd96f6", "value": "1536:e9sSvHYIO9/VsuhnUcW0fLfkQ6b3AvpOUOBsar3Zf:eZ/YJnh6bAxlOS8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511371, "uuid": "7e6cc2b6-cfbf-4011-8901-39ea66900b9a", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511371, "uuid": "1a2acb06-3cee-4ff5-8437-47381724ace5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511371, "uuid": "621e1ed1-acbf-4a1d-9792-e9360087a5db", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d419b0d1-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503995, "uuid": "bf7751ca-75dd-4701-a7fa-9bd2d88725c7", "comment": "Malware payload (Mirai)", "value": "923a24d3720ea34fddcba471dc2e603f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503995, "uuid": "93cb37cb-2f8b-49d0-952d-d8dbe8e8a67c", "comment": "Malware payload (Mirai)", "value": "4a9d497f48da75dc84fe9f05f15f75e1350f2685b2200b317fe8d34f93bc1b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503995, "uuid": "01ec86f9-06db-421d-863e-601651bb2f88", "comment": "Malware payload (Mirai)", "value": "823bd955c340266df69a0c7c69553a25283fc24a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503995, "uuid": "56f1695e-5fc9-455e-86de-68a542cca09d", "comment": "Malware payload (Mirai)", "value": "7ff886300ee8653d0e82454abfdf569f9bba102b8e6f62590a5f5d0d77fb9d0755cd7b63182f58134561b8c269ca1815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503995, "uuid": "292c3b33-4c74-49db-a9d3-edfbf53b7121", "value": "T120F47DD1E6C7E0F1E52301F0116FDFEB5931A1364016CDFAEA802962B461BE16B5B36E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503995, "uuid": "9e48679e-e134-401e-8095-b0325cedc21d", "value": "12288:KceLnENL609wh3JhqndmuwsYxkdkoMchbFLGnXwoi27ej632y0Py5/nj:KcegNL8h3JhBuPYboMQJIXwoi/632Inj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503995, "uuid": "203c789b-f96a-4897-8dcb-48ad8ec5e6af", "value": 737544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503995, "uuid": "3162a8f9-26be-4bcc-9e2b-833058688a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503995, "uuid": "310e0eee-b438-4b4f-81e6-f82927efba1a", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135bffe2-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786521711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521711, "uuid": "499799ee-8122-4fe7-b545-dc3693eedfdd", "comment": "Malware payload (Formbook)", "value": "7ebe2aa4966a3f0392123cbbb33b1fd9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521711, "uuid": "673aaf57-d872-43c4-9993-c4a0075a0826", "comment": "Malware payload (Formbook)", "value": "4aa15aa4be81be3758ba84bf8620ce3aeed507fa8bf33e30a4843ca000c77db3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521711, "uuid": "a25b885d-a0ad-44a6-99db-04edb624ad6b", "comment": "Malware payload (Formbook)", "value": "9806b956a571839cb28136a1d086df7f2b654965", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521711, "uuid": "db77bf71-fb6e-48f9-b39c-eca8262f4601", "comment": "Malware payload (Formbook)", "value": "638218d3bd20233c133ca212f569f6539c2cfa0081b5b6da0a174485fa47b3c87733f24e39684dd8e5fb36e0dcc6ac27", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521711, "uuid": "46003ad3-8879-4a9a-9fff-6e0a136878c7", "value": "T197259FB111A357A132ECD98217CFEF3B7BF7512B3926A60C583067916B77894E01239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521711, "uuid": "59293d56-a0d3-461f-8375-76ecfd4e1868", "value": "24576:rNXUEZ39PXvRvMECYLPtwIHOhd/0aXdis+fiX:51RXz3tiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521711, "uuid": "94347abd-367e-4889-a939-34a7941db5ee", "value": 968667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521711, "uuid": "aafb04c7-94d2-4b8e-93f0-e613cc709523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521711, "uuid": "0a92c0df-92bb-4d77-a293-73dfb679b180", "value": "103_FTX26222VADLV_4416.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4293268d-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500315, "uuid": "a6a9a010-a248-4a17-8cd1-013bea1243f1", "comment": "Malware payload (Vidar)", "value": "13a683b5b99e72f79eae941657f55ba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500315, "uuid": "783ad25b-6d23-4a20-8482-d36768c7cb76", "comment": "Malware payload (Vidar)", "value": "4ac6ab5d9557368b0cfd1f5f8b122cfe11524d93def1c53030a30e5a4886e362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500315, "uuid": "b49f5b1e-6a28-4c4f-bf4b-9539404cbc5d", "comment": "Malware payload (Vidar)", "value": "ad9fb2a44f037665050756db45927cd6f1cb3eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500315, "uuid": "d38c6d2b-6102-47cb-85ff-01d1c2bb9215", "comment": "Malware payload (Vidar)", "value": "b0a38f9414b3971a8465dcacabd59381cf93b8f792cf68c9a6bb775cf65da3b05b7cbca94fcdff833c2b94133466d260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500315, "uuid": "bffdde6e-deb2-459b-8519-1d9f355de878", "value": "T11E566B07BFA22474C095EA3488BA4656BB78BC4C873033E32E51AE786F227D15D39757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500315, "uuid": "d3405efe-20fc-466b-9870-27dbd1f1b740", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500315, "uuid": "6b498e1a-e5cd-41bb-91bf-9f882ee233ca", "value": "49152:bzaK2YlbeYhXYPK6+X58pgGvJJ+NIXafgKisZSCqmVsAcRi6hQdXyM8Bo6HPmYmb:bxhYPYLCuZ812dXyMUnvNUgqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500315, "uuid": "31deea63-b42d-4faf-aedd-aaa3a2934b63", "value": 6316696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500315, "uuid": "4db8250f-dc8d-4322-b048-aeb552ba95f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500315, "uuid": "8f271970-7361-4f29-bbbb-36d3cdced635", "value": "4ac6ab5d9557368b0cfd1f5f8b122cfe11524d93def1c53030a30e5a4886e362.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bf921b-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502148, "uuid": "cf2d6f67-d8b8-4c47-8780-621dd2e6573c", "comment": "Malware payload (Vidar)", "value": "5338c82a024e1f22d610639c5094c845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502148, "uuid": "48e4726a-6d32-4d45-b3f4-35d1aa4c5818", "comment": "Malware payload (Vidar)", "value": "4ac72d69d5120ec9f95f729856de5c8c23c03bcd3d38df8333d7fcb7c1ab6eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502148, "uuid": "f3b062e4-756c-4d7f-9a97-e629307f77b6", "comment": "Malware payload (Vidar)", "value": "5441f564c313d3b491d6525db445d05859f1e764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502148, "uuid": "3658d147-20bd-465c-8394-4606c1188f02", "comment": "Malware payload (Vidar)", "value": "28bb7c8311f99d4af192d1043ad608b3feb523ec2e7abd54a8f50e8e3139df80967ec8dde14ee96470fa149cf9451965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502148, "uuid": "864c456e-15f8-4549-b810-1eff43b61662", "value": "T167E5AF0B7CD409EAC4AA673688B651967B34BC494F3223C72E8077782F76BD19D39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502148, "uuid": "bcf3e4ba-9ddb-426f-9a30-48cce0f2966e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502148, "uuid": "3575ccfd-dcfc-4acd-968e-b1b7005a9add", "value": "49152:bOoEHPG+nw05k5slmZTB/EJuFN+Ju0/aIX4n:bODafs0Z4uSvaIXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502148, "uuid": "fb6a86a1-04f0-4f23-b8bc-108addd2eacb", "value": 3024256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502148, "uuid": "01b5970f-cd33-4f02-bfa4-cee9936fccde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502148, "uuid": "d40442c3-fbb6-417a-b1cf-49d609de46f5", "value": "4ac72d69d5120ec9f95f729856de5c8c23c03bcd3d38df8333d7fcb7c1ab6eb5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae35f69-961b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786517831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517831, "uuid": "dea754a1-c35e-4c12-8147-99f9d8546cff", "comment": "Malware payload (Vidar)", "value": "b97390c98669836175aa7af33af45ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517831, "uuid": "101ce452-da48-49b8-91b8-0573d5bd6900", "comment": "Malware payload (Vidar)", "value": "4b3154d853dc1b773e983cd7c1650975e9e1d1e9c4a776214b32597a0b0f1623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517831, "uuid": "767e72e2-47af-4886-839c-a1111b449cba", "comment": "Malware payload (Vidar)", "value": "1007b0fc8f112d5ccb104a7ad145c33b7565a9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517831, "uuid": "3a82ba4e-6757-46c8-a8a7-1dec69b97ee6", "comment": "Malware payload (Vidar)", "value": "d4322a3d1280aca3d713ccc81d4dc4f8f4cfaada8b8663ad2e0d6a38ef6a925b3fc4e3429acdfda57e1c074916cd5715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517831, "uuid": "6d07335a-fca7-4316-b7e4-d013c2e598c2", "value": "T14E267C077E9049F9C495E73688B75251BA70BC4C8B3133E32EA06A782F763D1AD79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517831, "uuid": "b871b2da-0a84-49d6-98a7-447617504129", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517831, "uuid": "feae87f3-70d1-42be-abad-8e271f278c0c", "value": "49152:AxU4Au5lGAptHeYRNNQx7vXI7RA6TJ2OQSpXWLoosEzbxigle:ADbHr/TtQdLoVGbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517831, "uuid": "6a16b44f-ba37-40dc-a384-dbce54c82b5f", "value": 4523352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517831, "uuid": "84aef7b3-e38e-40ef-9ac8-eb7ac573c4b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517831, "uuid": "4bfef086-787a-4717-ae98-ea68634be309", "value": "4b3154d853dc1b773e983cd7c1650975e9e1d1e9c4a776214b32597a0b0f1623.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b66fbb-9612-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513950, "uuid": "75824ba5-cc87-487e-8d41-994591b2502a", "comment": "Malware payload (Vidar)", "value": "cc8a16c52d504291c9b0786cfcfe9078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513950, "uuid": "28d9582d-b702-4d3a-b9c9-4ee4b8f708aa", "comment": "Malware payload (Vidar)", "value": "4b4a326eb368c79cc941d9c159c8bae64e9f1678eae59a20e57e9a2debd36129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513950, "uuid": "942c857b-acd1-457e-a85a-1cb8d6c4dcbe", "comment": "Malware payload (Vidar)", "value": "ef3321a37adf320287c2c0a164ff7ed0d70b0cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513950, "uuid": "744eecba-5149-473d-9e1c-bdc72d5b74c4", "comment": "Malware payload (Vidar)", "value": "74c0e370bd3eafdb9df4a43c293ff7e601d5542eed561bfd6d2cee49b432595259f51d0777498246f225b38d5e2e27e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513950, "uuid": "9edcf503-f374-408b-82cc-01df45d6d650", "value": "T188168D07BE9029A9C1C9D330A86611A97A2DBC8C8F3737D72E55B6362F327C24935F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513950, "uuid": "d624b92b-e017-4a6d-8894-f24d9b7c7751", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513950, "uuid": "42116367-1e5c-418e-845e-29ae11587c33", "value": "49152:fLAbIKDKp3S64gFKRBkhtBKYZDuGTnWBMbJk+VJ9u6TXysIVrIl216U1H9oNZRnc:fLAbNEKRBkhVZnkjsIVMhUtERnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513950, "uuid": "b03c0f84-97e2-4389-a8c3-bbac07df5ec9", "value": 4138728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513950, "uuid": "b0a28124-43b7-47cd-9b0c-95ae51d34d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513950, "uuid": "cc55079d-03b8-4aba-a0d8-361ea92c19c6", "value": "4b4a326eb368c79cc941d9c159c8bae64e9f1678eae59a20e57e9a2debd36129.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b72206c-95e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Heodo)", "timestamp": 1786493378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493378, "uuid": "6cfac473-3617-4dcb-b85b-f486e51e2075", "comment": "Malware payload (Heodo)", "value": "5f8fdd2ee6d5d58bbd38b68dc4a3d3a4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493378, "uuid": "d73f6634-46cc-487d-97dc-e2f8aa53554f", "comment": "Malware payload (Heodo)", "value": "4ba344b1fe6be392887486707b705fc845f6fe8e32c196f688431a03581584bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493378, "uuid": "bf84cee8-bd06-4d15-afb1-a365c9dc65b5", "comment": "Malware payload (Heodo)", "value": "60637d395f94f183ef172ad233d277b5ca486652", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493378, "uuid": "015f241d-3fd4-435f-b950-dbd90d54d8be", "comment": "Malware payload (Heodo)", "value": "d2e164831216ed29baee116475e2dead59986b193bb6de6bb52b385c70357102cf1cbeb834b058208c8af9152a5d05b4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493378, "uuid": "849c92ac-4fea-48be-a0b7-f1b6b5f8ecdf", "value": "T1C41733BFF8382F91DF7FE0755280B8A5104FFC9A1D960E432E13A844E2A52E5AF415D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493378, "uuid": "6a4f186d-e75c-42a9-be11-fe33d17ce563", "value": "393216:PFFnL7yuMVgr3qYl3FXwUiF6EBxwpuENya6ecVJpIGyx8RDJ1N40:P7yuMw35FA4Amya6VjpyChJn40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493378, "uuid": "45b15bfd-da58-472a-9809-a43bb74ed268", "value": 19788649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493378, "uuid": "97544892-2486-4698-9db1-cbae8e8ae8d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493378, "uuid": "bc0e0656-b043-4897-8463-4a9697ff3f41", "value": "tsmf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7e5ef1-966e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786553615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553615, "uuid": "38245a91-81b8-46b6-9819-45182feeb4be", "comment": "Malware payload (Mirai)", "value": "344c04b1fc275d35663f678869aecca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553615, "uuid": "0a74d836-487a-450e-979d-f33caf10dda2", "comment": "Malware payload (Mirai)", "value": "4bfd543a583cd6ed7fc8d46ca8aa2324346b787005609348459b33a72becabf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553615, "uuid": "cc92092a-658b-49dd-a590-943d4b7ce492", "comment": "Malware payload (Mirai)", "value": "3d0f12496027bab92f81c668d610cafdbc7f1c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553615, "uuid": "2287d16d-c968-4603-bfa4-713519d3663e", "comment": "Malware payload (Mirai)", "value": "4ca9d914931c776a1d677b715b8956a6d822e0464421d73d31bdf18829c5440677dc46d147724a6a4c3ae1dd92c1b841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553615, "uuid": "e84ade0f-68cb-4b6f-b094-f463603a7dd9", "value": "T130E36B59FA5BD0F0D6D340F1062BEBAA963A99216233F4F1FF563671F8B1301198626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553615, "uuid": "9d65721e-d4d2-4572-b90f-2ae25a4d1c7c", "value": "3072:YjQfeMvAQ8qAMg+IDmzUMyi2TatjdFWIECuEW:YjQfLYQtAQD1yxUhFuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786553615, "uuid": "0c0db6a8-b3bb-47ca-a8ef-dc1dfc4bab0d", "value": 144796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786553615, "uuid": "a74069eb-33c4-4e4c-8613-bd717000b1e0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553615, "uuid": "36e67f35-d7a0-471c-adbb-3847737c76a6", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d759ac-9613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786514689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514689, "uuid": "6885ffd3-5dbf-4ae5-98a3-592070580b5c", "comment": "Malware payload (Mirai)", "value": "624d7f6f1795105333fb4241daba1411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514689, "uuid": "56204306-1f56-48e8-a49a-afc17fbb46a8", "comment": "Malware payload (Mirai)", "value": "4c1beeb3e26e8bd3571c76047cd1f46fe778912b87ed74cd95a2c877720efa42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514689, "uuid": "9651cbe8-c44d-4171-90bb-a2780c8028fe", "comment": "Malware payload (Mirai)", "value": "8e186b42eb1db2c8ba52d0e19f128d7110be57c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514689, "uuid": "cdb9ee2a-4c80-4ffe-ac5d-7eacbd82ccb8", "comment": "Malware payload (Mirai)", "value": "0c8b7e4e574a83c01ec3c2c3528c2ed3af94870b6d2dd1d223c9d371a9805b1683f4a70db56c99ffb640cbc05c911379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514689, "uuid": "2d60443f-3438-4910-b0b6-bd5e5f2f449e", "value": "T1AE341B46F6418F13C4D617BAFACF42463333A79493DB73069928ABB43B8779A4E17901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514689, "uuid": "dab24f5e-bcd6-4fee-a44b-058257702550", "value": "6144:vwmQDS+QCRl20KY9TYbbVadvrP157tXYEUw2PaCudQaM/RfR1Uc3:sSFcjxubbVadvrP157tIbwSaHQj/pR1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514689, "uuid": "6f5995e4-7150-49cd-8351-9813098f38e6", "value": 232851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514689, "uuid": "4c7990c5-5d4d-465e-882d-842b9b8763f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514689, "uuid": "11691e80-3077-41b0-883e-278421866cd0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a053383f-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512928, "uuid": "56470b76-b7fd-426c-94d9-cd85fcaa25ae", "comment": "Malware payload (Vidar)", "value": "9ddf65f2e2ed1525c0f78ed62579efbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512928, "uuid": "c70653b0-4d7d-4243-8616-0442cd8ae829", "comment": "Malware payload (Vidar)", "value": "4d505705e19a7ddfc184cf6911536d2449d564ef6afc26b5e91c3ecfd19b080d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512928, "uuid": "dfb081c3-51f5-4630-88c2-138151a7d27d", "comment": "Malware payload (Vidar)", "value": "d7ceca2957e6966b57c1acf10587c6e20b9d3b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512928, "uuid": "fe0019eb-c19b-4f3a-ac19-df8b33f6057d", "comment": "Malware payload (Vidar)", "value": "7d9cf583d1a613b80de0ab7a0e1faa256f0e75eab110a58808ab600ea17b3e3169159c862dc52b3d43dc368af8b2d4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512928, "uuid": "0357c82e-df0b-447d-9c9d-8199353fb172", "value": "T156E59D0BBDD409E5D49A927698B242867B70FC4A0F3263D72E80B3783F756E09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512928, "uuid": "11ad1e35-0795-4733-9496-688249a7f307", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512928, "uuid": "65f9bc21-6150-4a33-b4c6-170e64c7d1d5", "value": "49152:VTudpTwXugfEatDMlOV1/NcPrrplc+aab9BCZNUg883hs9qvkpANbF:ViEOZli/IfI8BqzZkpA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512928, "uuid": "432c9757-9ed3-4429-9ea1-9e8ac904b5b7", "value": 3118464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512928, "uuid": "7935fc23-ecc3-44e4-8e67-98e217d43ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512928, "uuid": "2bf4baba-74cc-46cc-bf1f-97fd98c5b1ce", "value": "4d505705e19a7ddfc184cf6911536d2449d564ef6afc26b5e91c3ecfd19b080d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3efd4d8-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786494922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494922, "uuid": "b67a9750-cbbf-4134-8b6d-7b2673d60d59", "comment": "Malware payload", "value": "08696e552700fddb4656e81305f95a5c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494922, "uuid": "5dca0d5b-da04-473a-a1d8-fd2be4da86b2", "comment": "Malware payload", "value": "4dfba261e914d206c8417ea0fd93a8a760ffef744fabe799ae25f52b0deca527", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494922, "uuid": "6745a5d9-ea68-4f86-8c25-20d328bf0b36", "comment": "Malware payload", "value": "043f0755f4bf563d1110cfee27be18c9004369e9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494922, "uuid": "e118e317-19f9-49fd-9ada-616aeab81605", "comment": "Malware payload", "value": "a28d370bdb0bb2512ef261441d91cc23c329d1e8703673f19f8be86984c6e3cc10fe293254d013c2dbef333f4e0eae35", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494922, "uuid": "fe27600e-cc69-4e7f-8589-f38f8f504c0f", "value": "T11E17333290B7440AC70647B3D687C810689C85AFD66238D6F4F6FFD338ED9BEA254646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494922, "uuid": "b1917594-f24e-43ca-8fed-5a51f15fe895", "value": "393216:Sbxrt1Sny+2QsZ86YLT9XVWxMgl2XNX+vGsItkFbXRe6Rn2MwwNosUmn2:KtIy+/sZ86YuxVlyZ+espbheYn2JwNol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494922, "uuid": "44082fe4-0f5b-4db0-b157-ab010053de92", "value": 18820818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494922, "uuid": "a1d4c5d4-89f7-40c9-8e43-d982df52b0dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494922, "uuid": "c96fa9ed-4d93-40b9-835c-972607bf3672", "value": "Windows.AI.Agents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461a86ee-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493020, "uuid": "65c34f10-957d-47e1-8315-e352892b5cba", "comment": "Malware payload (Vidar)", "value": "c3160f18eda8aa185232fdbc90bc8f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493020, "uuid": "0bb8e57d-049e-43df-9efc-5b86ad86c5bb", "comment": "Malware payload (Vidar)", "value": "4e1a8b30e3f4d8bea4368c1555b0100a1441ae626a17c90cf782d0c807521868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493020, "uuid": "5d4640cd-ad1e-48ba-9963-15498e8276ff", "comment": "Malware payload (Vidar)", "value": "728570403a1d8378a30fde3fe8fea2bb008f6480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493020, "uuid": "6338138a-ae09-42f1-b4ee-cedadc338353", "comment": "Malware payload (Vidar)", "value": "947238b8bbff6530d0dd1004a662b9c94585f87e4ba8b88cbbf4e78150d29d7150bb9d0292d048ad8439e31a87f69575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493020, "uuid": "578cf2de-3edb-4bee-a1c2-deca16cf51db", "value": "T1C8664B43BB9128B8C495F734887652867AB8BC8C8730B3E32D616D74AF193D11A3DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493020, "uuid": "560a685c-88f8-4184-92d6-79e1f0fa2c19", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493020, "uuid": "58f89717-1878-4ad7-82f3-9c810b40d0dc", "value": "49152:HKwee/QxWT9D1Q4VyX4EGvDvF74FUI+4tL2bH2n9UF3wYaRfAhKuNPCJ3f+wdNTe:HTJWhGvDBUUGMWn9IgY+oK0PK1NTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493020, "uuid": "d7592bc7-83d1-4f76-9d24-b4ed46ece994", "value": 6719560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493020, "uuid": "7e6379bc-1a7c-433f-8d95-1ff68fd0faa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493020, "uuid": "35c829dd-ac4f-4518-bedc-687f110ef317", "value": "4e1a8b30e3f4d8bea4368c1555b0100a1441ae626a17c90cf782d0c807521868.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7a9d72-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786520146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520146, "uuid": "676bccb1-bea1-4a3f-bdfb-7eb66e723c6b", "comment": "Malware payload (SalatStealer)", "value": "d7318dbc11b8fcd1af10b2a5d2b1c69b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520146, "uuid": "bbf43992-e1a3-46e1-a128-8e96dc9fbbbb", "comment": "Malware payload (SalatStealer)", "value": "4e8133acc2156fcf66e2ed0a3ced5a239d8e2dc2c4d34e0110f6eafa251f49d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520146, "uuid": "d01988e1-cf38-4da7-9c8a-e2a921a34ac2", "comment": "Malware payload (SalatStealer)", "value": "57453e529fee66e199e897e3fcbe17003eeb3a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520146, "uuid": "5a2cc354-b111-4a3b-a079-37b2b7a5dd47", "comment": "Malware payload (SalatStealer)", "value": "0c404a772ca5240eea23aa05fb2f9175e8554d0d0589b8713c07c33cee13f3be6d5eddd7100ac3f1a615013593044e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520146, "uuid": "d2f1bdd8-6b25-427a-85e0-311fdc8851eb", "value": "T1F5F533D03DA9F14FCB73A2BA32644A87213D449D4CEAFC165F4B46A5DEC20F16B76281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520146, "uuid": "4ad516cd-c4de-43b4-bbb9-ffb7241ff2e2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520146, "uuid": "a7804138-52ed-46ac-88f3-f315deb8bef7", "value": "98304:FfXkZPkXTmdVbtd/enei52Bs3KkT8NAh8rS:FfXqqmtd/eneY2EoN9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520146, "uuid": "b965419e-bcae-4f45-a2b4-29a85f00ca97", "value": 3587072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520146, "uuid": "18fec17f-6583-4070-a0cd-467bf309fc29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520146, "uuid": "da84e84a-59c6-47cd-914e-f9e3678fc79c", "value": "d7318dbc11b8fcd1af10b2a5d2b1c69b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f0cea7-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500328, "uuid": "6feb40fa-9c9b-4ad9-b5a2-096ae282bcd6", "comment": "Malware payload (Vidar)", "value": "7ddae91bbdf7a1db6d33c1fbde5bd410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500328, "uuid": "9f1ca2a3-3f68-4922-9b22-4061743e5843", "comment": "Malware payload (Vidar)", "value": "4f18fb2dfbd0673d83f8ae33461761dcea0a38510a731881ba5cc96732c2ef63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500328, "uuid": "07e37dce-1341-4cea-9948-f7425a48b099", "comment": "Malware payload (Vidar)", "value": "464702e6b1b09fbe9f396436f018517834627417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500328, "uuid": "1c68fdf0-2090-4280-a4ee-9788f62dd217", "comment": "Malware payload (Vidar)", "value": "2fdd60c75c86aa18a6a8d04955259b49be9fbb9d31ba4ae185261df8edb19ad7302a355499f96ed4fea37a8d8b75669e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500328, "uuid": "305e3d35-e38e-4333-987a-978a4d9496ac", "value": "T1FF167B0B6E904965C8A9D23689B54241B32CBC0F4B3B73F72D427A757E727E0DA39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500328, "uuid": "cd23b6b4-038b-4967-845a-ce6d5c608b41", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500328, "uuid": "0a29e141-e54b-46c0-b317-31a51ec4e2d9", "value": "49152:FHLxH6c/g8s7PtUO0uJGCs1/HFxG6fW8zabu/fpRpzMzP58q2QdC7H3bfsG+sCHt:FHFGZTXhdUHYiVq3BoirPXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500328, "uuid": "e3e368b1-4ca3-491c-8fcf-25e5ebdff268", "value": 4394312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500328, "uuid": "7187f657-d6c1-4e44-bb38-15054266b9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500328, "uuid": "8cd80f6e-7338-47f8-b36e-61dd21aa4bbc", "value": "4f18fb2dfbd0673d83f8ae33461761dcea0a38510a731881ba5cc96732c2ef63.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0d12d1-9637-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786530099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530099, "uuid": "9dce372c-c513-4221-aed9-0f2a155f7c76", "comment": "Malware payload (Vidar)", "value": "72bc2cd086ffc02895ba73b2cd814588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530099, "uuid": "81a36608-374b-489f-bbb6-e98db1fa76fe", "comment": "Malware payload (Vidar)", "value": "4fa823c4439a01bd37c1184ba6e8d694cdef5dd77c074cbbadb2b9da0f8d4aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530099, "uuid": "2722a7a3-28ca-40f1-9325-82adb7157a04", "comment": "Malware payload (Vidar)", "value": "b93550fbce182cce074924decdb90156f9e0b132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530099, "uuid": "3b5c5d3b-4694-4bc0-81f2-d038433d7156", "comment": "Malware payload (Vidar)", "value": "19713cc353c22f8e9fe1019ed1ac1bef47790d6cd0a2f23208d3fa10adcb95baadb798e3d86dff090231f1622c8438de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530099, "uuid": "9b3ab1b5-9de7-4a81-907d-a5da961f4e06", "value": "T143266B077E9149FAC4A9E735C8BB5265B620BC0D8B3533E32E506A782F723D19D78B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530099, "uuid": "ac07cafe-09cd-49f7-a088-20146ed0df5a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530099, "uuid": "cc13ac9f-13d8-4fda-95e1-c99e86680b09", "value": "49152:oRiDyltn8xc5/b3av7yrOWFaLaha32RqD3sOAuysboL+iXF6wPki7hWlKtmVx3gv:oag3jy1cMoL+iXF6wPkmWLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786530099, "uuid": "1100dafb-2516-480a-a3f6-38b7e8fbf565", "value": 4523880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786530099, "uuid": "830e14c5-9a88-48a3-8e64-f66759b04828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530099, "uuid": "e1421715-601c-4491-b6d7-d753f810874c", "value": "4fa823c4439a01bd37c1184ba6e8d694cdef5dd77c074cbbadb2b9da0f8d4aa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca12693e-962e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786526312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526312, "uuid": "4632ec8c-3f7c-4572-a5fb-7f3be2f212b6", "comment": "Malware payload (CoinMiner)", "value": "e823e1470bc3f422095aba5b61cae4dd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526312, "uuid": "79135603-fc5a-4c6a-abf7-3dc5901a08f9", "comment": "Malware payload (CoinMiner)", "value": "4ff0d26f403c3e86688cd553d1bf39d1f45dc4e2354531ca9167ee6464546d60", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526312, "uuid": "8fad73f2-3750-4421-9779-1b027b5d2747", "comment": "Malware payload (CoinMiner)", "value": "361e3d6933d40d0bd4a90501769c02749a02c853", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526312, "uuid": "4da40454-1aa5-4df1-8e15-abe96cfcccbc", "comment": "Malware payload (CoinMiner)", "value": "c714b286d3208bb365e01203abd3014cf5f01d4bf14cea17310bdd1beff1294b4a4f71d54f281b3e33c1186fc71e465d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526312, "uuid": "21b06c80-3823-473e-8642-2ffbb6cf1caf", "value": "T16E553377CB9BFAF1E2351DF60F9205E94E262B51039852B68FCEF0BA744521143A06F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526312, "uuid": "19175039-92ce-4c10-bf46-abf29926c973", "value": "24576:sCuGXtl3nEsqbRT1li4xByD7fJerPDSEm4IqXc+i7IEcVBc/9:VXtlERVxw4xcD7fsrDS1qst7IHBcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786526312, "uuid": "28421e82-beb0-4184-8ae9-dec024fe3ab5", "value": 1310288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786526312, "uuid": "6efb53ea-400d-4ae9-80bb-dd15d60a224d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526312, "uuid": "8b566538-8fb4-4166-b828-08ad6e2a1557", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7573b2e5-9618-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786516721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516721, "uuid": "875730f2-2847-47a9-8812-954442aa39e1", "comment": "Malware payload (CoinMiner)", "value": "79982a68c6f44181b6954665915a7ee5", "object_relation": "md5", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516721, "uuid": "f38deac6-7d6e-4665-8850-be5eb0f0cd59", "comment": "Malware payload (CoinMiner)", "value": "5030d3965d51c4f42537ae6c90609b0e3d56e42f30c1994c1a90770960aab721", "object_relation": "sha256", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516721, "uuid": "d0d79ab4-ed9b-4e9a-8f19-116ce73e73de", "comment": "Malware payload (CoinMiner)", "value": "778427f2f15c529c6f8a07f3fab335d5f40c7418", "object_relation": "sha1", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516721, "uuid": "8da5218d-780d-4616-8bce-78ef8f4d3bdf", "comment": "Malware payload (CoinMiner)", "value": "b340dde3ad5ece25aacbac556e959c149f64ad920d37c5ce4939878b1496e1b5bdac0053ec4be1188ab144451ccc0bfa", "object_relation": "sha3-384", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#B4A098", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516721, "uuid": "71dc0ade-8543-40ff-9fab-1f8b019a683e", "value": "T1AA23F639DC463D5C770A5A5E2DCE48C11A5C13CF24320DDE1EABC7138729DAA91EF299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516721, "uuid": "51f98bf4-49df-4e85-9c1b-afa5379d32f8", "value": "768:GAi51xCmTkqNIpRxWA9gNH0JhGkBaLuK9te6iBVOT:GtMXbxD9cHI1Qe6iTOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516721, "uuid": "ec16aeaa-d454-449f-aa8b-b4c5980db7ec", "value": 45648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516721, "uuid": "e507c306-05ae-490f-8f88-1b6f0269c9ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516721, "uuid": "5a50e0f6-0765-4827-9d70-b5319943c88d", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032cb798-9667-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786550460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550460, "uuid": "d5cbb97d-af4d-4642-9f91-73134b855210", "comment": "Malware payload", "value": "197f3bb646f6b6655ad932ac04ad91e5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550460, "uuid": "4f013f1b-a2e6-4dd4-8667-2e8f1c6c7eb5", "comment": "Malware payload", "value": "509adccbbf77c60c763ac672680373cade00801c5e8108c7415da15f8f87fc1b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550460, "uuid": "cf8685b0-450a-4b22-9245-cb8562dc9e54", "comment": "Malware payload", "value": "aa80dfbeb47d154d87a432b2089c8147ea98f381", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550460, "uuid": "1302994c-2e90-4e27-a5c6-5ff98d685848", "comment": "Malware payload", "value": "a4247a9b57df1aa6c3963b09b8260d9cfb895715876f089c5574a95e87101345249904bc7428c477fcc3d4f62d78a80d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550460, "uuid": "4319d4ee-f4c2-43e0-8297-a4edd133fdd8", "value": "T19491DE21CAE8E9C006A4F2A0F29C856D23DD86D6D33C8BDDE50107465F1C29FCF6D6A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550460, "uuid": "aa096b75-dda3-4294-8f87-96299ff4d93d", "value": "96:ef9jXJsMMLK1oqX8EsEyqt56UBWXhdII7AWQmMNDIGZhzyr3oYniToUC:uP/XZyvVhBAdmAcmhzbCiTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786550460, "uuid": "d595813c-1d6e-47af-92cb-e27d7db28e68", "value": 4216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786550460, "uuid": "30fbb159-1792-4eac-98d6-7848d2c6f70d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550460, "uuid": "b0d5e974-a2d5-4f14-a92f-f4a6d708361d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb4f7dd-9686-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563815, "uuid": "f9fbe630-ee5c-472f-b8f7-7cf061c9a772", "comment": "Malware payload (Mirai)", "value": "a6471814fe1bac4edcb1061daeaf8766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563815, "uuid": "fae27bf5-5d21-4c9e-9341-03b616f034ec", "comment": "Malware payload (Mirai)", "value": "50e164f6ef78aaf77c2d5354b9f0caab0959edf7a77ac207a7b45bceb69868d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563815, "uuid": "c004fe8a-7850-4834-9501-37ad7712d412", "comment": "Malware payload (Mirai)", "value": "31c4675b7561ddfdee378a2192d7241de7920905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563815, "uuid": "bf104a93-a267-4140-98c1-93204b6b7586", "comment": "Malware payload (Mirai)", "value": "e348d40dea41f98112659ebe6a2823c467ca635fbec55ee649b08ebc0caf72ffdc31c033afde6f8680e976bfde013b8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563815, "uuid": "6eb13099-a35f-47e0-8a9b-f1b87547bf39", "value": "T12C04194F7710DF61C72DC93045B3CB5656E926622AE28849E35CDE08BE6434DA82FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563815, "uuid": "24327810-c2b6-41ce-8f39-6de9d1d64c01", "value": "3072:p84nxEF931aBaUpjOIm3DxWJNG4Lycy1Ddjj0D:pxxK931aBfpjnUWXXWcoFj0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563815, "uuid": "4dd40ec9-a583-4d98-8927-110ecfeb2a6c", "value": 181516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563815, "uuid": "8ee6162f-7790-49e7-b5fe-339ca69c75b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563815, "uuid": "a86c04f1-a8d9-46b5-8726-538acf9ed0a1", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36470db2-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505878, "uuid": "56326397-f042-49e7-bca7-0c1ef15db8fd", "comment": "Malware payload (Vidar)", "value": "30775e2858200f6e4c8fe45afd8a9668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505878, "uuid": "028a75d8-8d90-4d63-ba26-696fba81ce51", "comment": "Malware payload (Vidar)", "value": "517911f9c99ca4a108b8ef55a7ebb146df64115645c11a414acfa12e7ef13d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505878, "uuid": "0dfecc26-3952-40a3-a56a-93730f442dd7", "comment": "Malware payload (Vidar)", "value": "bd303a671cea5856574bd25e00abb2e66ffb4cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505878, "uuid": "f0fd31a7-f90b-42d7-a408-b7bb209fd010", "comment": "Malware payload (Vidar)", "value": "65e3d48a679cb1207c60e302ed143636225800ab32f86b860d0c7e33e5f0d2d80f333ea04c7d223396943c614a1c7e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505878, "uuid": "a2fd7b9e-0bd8-46ad-95e2-bb3893980f4b", "value": "T18C069D0BBE919866C599673688B702453B3CBC4A8B3637D32E94B2392F327C15D39F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505878, "uuid": "f96faf10-c190-4fb4-83d5-c7be17fa3431", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505878, "uuid": "22a0722b-bd03-4117-8ab9-0bc285b6dd42", "value": "49152:GXyo1a4uQho53qF/WHEZFdgvnfepT5jUM/NBpRU+YGYCwLKssgcdxg:GXCcoEZFCPfeptzlBpRhtY4Xguxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505878, "uuid": "458d94c0-529a-456e-943a-d2216fba5c69", "value": 3842128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505878, "uuid": "a5e78b3f-c3ee-4b68-9399-89fde488f495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505878, "uuid": "03f8a900-e6c8-44f4-92bb-10a886b3fceb", "value": "517911f9c99ca4a108b8ef55a7ebb146df64115645c11a414acfa12e7ef13d21.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec23fb08-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "cdd93144-9abe-4696-82e1-ad60175759ca", "comment": "Malware payload (Mirai)", "value": "e27fb7c5558474234b8a0f884a909ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "3576fdaa-96cd-4e0d-96a2-291dee0a03f6", "comment": "Malware payload (Mirai)", "value": "51b2b0a8e16780beb0a4b87a073644d1c8c3b08932890a354c20bbba5612cfbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "b20a55b9-858e-4bc9-abcd-279a84991d34", "comment": "Malware payload (Mirai)", "value": "3a64828297765632ab632205927a0feece6837e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "85acaf1a-d607-4861-8409-a216d72c8c72", "comment": "Malware payload (Mirai)", "value": "41e96db98c3ba4bc9de3f0ffa30046b7895f2973de5af789f6b2f8920365b720526188525e0b874e262c22fc6b33a28c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "d8aa2edd-0dad-47ec-a43b-d0e7baab882f", "value": "T15FA35C46E7CBF4F0DD4204B8216BAB31D936AC323120DFFEE7D4BAA36895242D45566C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "063d97ec-1dec-4468-8df4-e78f651de116", "value": "1536:NzPmW4Ff94fjbKd3sirSThUwF/8i9fCgci7G3Iqqbm9Jt48Uy31ATowcDX6r:s6PKdghUwt8o9ciUIq8kqMwYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511337, "uuid": "2c07f5fa-8223-4db7-ac04-5d98c30a2187", "value": 100272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511337, "uuid": "d65e7557-ce55-4cf7-aeb9-4d458e0c6f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "9a061247-f50a-41e8-bc0f-234f9ddcb9d2", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956697e2-9695-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786570462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570462, "uuid": "3bdbe935-8a2e-4a8d-8afa-2dacf72378c1", "comment": "Malware payload", "value": "01530f5d652b62efc9e1191dfc117c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570462, "uuid": "6be9f875-5565-4031-a843-03ce43ece32c", "comment": "Malware payload", "value": "524266500e8341c5c20a548d1f96c55b3696422e761a9c22044f60254d777a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570462, "uuid": "14958844-c3b8-4a83-8876-b38918dd808e", "comment": "Malware payload", "value": "e92aa2866df95cca5e40748611f90a8aaf0c2591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570462, "uuid": "b299ad88-bd1b-43dd-a9a1-459994b8b050", "comment": "Malware payload", "value": "e99a3781a459a09871a9e6a39e1f14900f4e2689c03a29db415e3c603bfbfa0b8cdbf723bf577abef381d92951e9041a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570462, "uuid": "0cbf2b32-9350-4cbe-a755-e7a1a76709c9", "value": "T14C872369A6BD00E6E86A8178C2865227D730BD5517F017CB5E64B6FA0F73BD02E7E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570462, "uuid": "3c4db42b-c1e3-4101-8381-a76d7ba5c498", "value": "4b9cdada3652e5e29db9b5b5ac8e325a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570462, "uuid": "4a23a2dd-ce45-454c-9f5c-132a2b56a410", "value": "786432:r9uwkhCHvFpmSpkIES+y7Th9mT97S7CzNwWCJK05IRTX+F3:r9uwkhCHXXkIESHR987S+pwW+NF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786570462, "uuid": "aaac3051-00d5-43fc-a0ce-c0b732fa7b42", "value": 37867824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786570462, "uuid": "5a74cba0-0978-4b93-92bc-1a43b1161956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570462, "uuid": "0f0af5bb-9322-43e2-b33a-bd4de4411d27", "value": "Advanced_IP_Scanner_2.5.4594.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b5e7e3-95f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786500027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500027, "uuid": "acb1d79b-2bca-44c0-b160-bc619292f3bf", "comment": "Malware payload (Gafgyt)", "value": "3ecc5ff6a6ca06b62f4baabb1a98a74a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500027, "uuid": "cd202b6c-8f24-48fd-a684-3007de89d33a", "comment": "Malware payload (Gafgyt)", "value": "52cddeab331e78ae9afb57aa525fdba03ded8d8ef58a58f0265e4dc3a3d1c042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500027, "uuid": "937a99a7-0d15-4404-bd98-712558ba6fce", "comment": "Malware payload (Gafgyt)", "value": "721d0a91f82af54f90dc5bd2d083e5224e68f829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500027, "uuid": "2df56589-f1ca-49ba-80f8-1590c18e015e", "comment": "Malware payload (Gafgyt)", "value": "65844fb16c2717c38f656f5ff5a9bf294c4a478fddb708a3c004d6a681f382b5d4875569c212d383bcf88eb1b078f191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500027, "uuid": "d548f7b0-8278-4e77-b354-37419cf89b2d", "value": "T1F153013E5722D28FE6B9DCB5123B07D47BF246C84217CB06E87093646A356293C7ADD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500027, "uuid": "a55172f6-4a14-4ad9-a679-0a8f60773893", "value": "1536:cF0FlccEbhNXErerW2mU7vvoYU5OlM0nBdeTZVEWo:cOATv3WfU7vvXfnBdeVE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500027, "uuid": "29df94f7-c0e4-4552-a769-5cafeddf07cc", "value": 61380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500027, "uuid": "78c80f38-4ee0-48fc-87d9-cd5e88babf8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500027, "uuid": "4efa6eb5-254d-4cb0-a9ea-8ed74c39d29b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff47a25e-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504068, "uuid": "b0691ab3-b8f9-4171-8720-e79880596991", "comment": "Malware payload (Vidar)", "value": "35ac7fd4f6a4a0c5205bc8ded0e95e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504068, "uuid": "b1b7a635-d5a3-43ae-b4fc-02d73d656cb7", "comment": "Malware payload (Vidar)", "value": "53189d7078ad0dafd0839c7abae6e7341fa231534d7679d55b4eb926a815f9e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504068, "uuid": "aea5a717-4061-4d4e-9820-a482c72e2cf7", "comment": "Malware payload (Vidar)", "value": "9a3663d69557c443d7b9a78d56e17a5a9c2c52fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504068, "uuid": "66c88280-9bb8-4cf2-b5a6-09ed4717807a", "comment": "Malware payload (Vidar)", "value": "061d69b2a1f9741c6baf59c4d869a9be118a61cee75530d238ba9689376fc62063b0ea13c1190b8f021df192931261a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504068, "uuid": "3d00cc74-2123-4512-b08b-46a602f01563", "value": "T12A069D07FD9009A5D0AAA732C9B74311BB38B8194B7227EB2E5077B92F723C25D36751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504068, "uuid": "7daed56e-b4ce-424f-9310-e6839ed3a100", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504068, "uuid": "a029f82c-a05f-4d1d-8586-7ad230d1cc95", "value": "49152:67Fpnis5WrWC4gJpcroFLNrY2uzKCtWQ351diFz1zj4S2YkftTpa80s456iBDJxJ:67FArbVkOJgPGNbPWWjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504068, "uuid": "5dcaacef-8ae1-432f-a683-d75f2bc5b162", "value": 3916080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504068, "uuid": "51f65b80-c4dc-4e5e-b6d3-593619eb8295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504068, "uuid": "0a2eb931-e6b4-49f0-b5d8-24785b033bee", "value": "53189d7078ad0dafd0839c7abae6e7341fa231534d7679d55b4eb926a815f9e3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd543eb-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496655, "uuid": "5c24892e-5a55-4dd8-80ad-79e96bf66920", "comment": "Malware payload (Vidar)", "value": "f35e32f0fa612235e8109ad9975599b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496655, "uuid": "60a545a4-db08-4a11-9dcc-80924370dcc8", "comment": "Malware payload (Vidar)", "value": "53dbad87c3016f7ae7f7561f58fdbf5fe5fa32c248c7678928dd2f34be69ee01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496655, "uuid": "d51487c1-6314-4b72-9846-c6878065569a", "comment": "Malware payload (Vidar)", "value": "0e541869b2ad3dda43b85c3cefc3dc026e67b5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496655, "uuid": "d879059e-1449-400e-8211-94678f07f7f7", "comment": "Malware payload (Vidar)", "value": "3cc7a584c5e04ac9a61c8071d693edd0e27ca9713483c3cc09a29cbbbec60a2454db4552cc708d00540afec580477490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496655, "uuid": "40544073-b009-40c0-9867-3d35a79bb677", "value": "T103366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496655, "uuid": "62b81f34-9385-45ab-8bd1-2d1050879880", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496655, "uuid": "7944cf00-74ee-443b-a2aa-7ac42e12efac", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaF:uc3XND1aJrCOkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496655, "uuid": "811d6902-0882-4a76-83cc-a01a2d1a9efe", "value": 5003763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496655, "uuid": "5d29819b-b6db-4c26-89dc-96085be068e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496655, "uuid": "61541515-fa6b-4987-8884-3e6a490e007b", "value": "53dbad87c3016f7ae7f7561f58fdbf5fe5fa32c248c7678928dd2f34be69ee01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7664639-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786498417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498417, "uuid": "105cedf1-91d3-4d65-a108-c50a0558fa68", "comment": "Malware payload (Mirai)", "value": "1c21f286b7f34c2716a7c26fbcbc4d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498417, "uuid": "c59f91f8-f9e9-4bca-9e00-632a2648d44c", "comment": "Malware payload (Mirai)", "value": "5439695869e49b0deb3c8de9c07aac99cd32515f5bcdfa5aff546e151911b06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498417, "uuid": "c321a4be-6cab-4c4c-8cdc-ff517a68c993", "comment": "Malware payload (Mirai)", "value": "0cdf964428386754764fd30193d69a926fb4555f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498417, "uuid": "d84354a5-828c-4cb5-8926-d11b2cf65c9a", "comment": "Malware payload (Mirai)", "value": "b5f1c453e12cbc9f37a22da1f29c289b1d34c3e99a41f7560074db64590aca5650225e409610f8f907fa5d7c591e669b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498417, "uuid": "1494482d-1a72-40bb-96d7-0b4d769875b1", "value": "T1CE33021062AB1AF1E7702A7DED6E0E62EF497BEC9380F1631ACB871CBC1145621B85D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498417, "uuid": "29627fbc-b893-4c6b-b703-d44df3d5fe96", "value": "768:cCQmfvz9jxYnJ0g1knCYu8DM6kahxwHnG6xo2N/gLIaOehGWRt78kW2+un4q3Uii:cEfLV631kgG1nxAG6iZt78kzfn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498417, "uuid": "0c39fb88-c87a-417f-ae14-05d9cd92e7e0", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498417, "uuid": "dde19602-83e4-4702-acb0-c25401f3cdfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498417, "uuid": "c1d5d155-7893-4a1d-8c16-1d7dbad68983", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694ce214-9632-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786527868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786527868, "uuid": "2df7ab21-91c4-46c1-94ea-62e5d88f4670", "comment": "Malware payload (Vidar)", "value": "0048247afc0ad68c11c4d7d1c7c83df6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786527868, "uuid": "9b59c7bd-9503-46af-91f9-9d095530c4fa", "comment": "Malware payload (Vidar)", "value": "554c2e2d6f9cf520e85640600ac90f9a0d3860019f66178ca1f07012f1fc5961", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786527868, "uuid": "8165c815-a199-4586-93b5-d6339fcc0f52", "comment": "Malware payload (Vidar)", "value": "120e8c2be8f35063f785a2063e64ded47945d96a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786527868, "uuid": "8aa695e9-c1c2-4ac3-a962-ccd7fd9ff88d", "comment": "Malware payload (Vidar)", "value": "f23c437c660ab78c7cb29d43ef4f759880abd46acd72e827a5d3af3ff670736eba0b636c67e8fda0f38b1b77cdef7d5d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786527868, "uuid": "ac866eec-c395-42ba-bed1-a6573c22a0a5", "value": "T19A763907BB158679C48AE2348476521AA961FC4CC73537A33EB2AE747F243F25E78B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786527868, "uuid": "7441f2d7-1ead-438d-97a9-0f0ea8de9bdc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786527868, "uuid": "b67dc0e3-32aa-435a-9d98-99440f613dfd", "value": "49152:LIwzOs14hbm1P0yEiMqhjy9uo47Gt64IkDeQXJ8fhoHpw6zPOZnRRMGkhrpMWIK9:Lwl/0HxZGttuZeAUfXxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786527868, "uuid": "6757d0d7-da19-4d9a-a6ea-1aecac5b0008", "value": 7140568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786527868, "uuid": "4a093c26-d1cc-43cc-8b04-e8b80b29d72c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786527868, "uuid": "b8f0c6b4-a028-4f4f-bfb7-b0f352019597", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1620956-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786502675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502675, "uuid": "0a652b7a-d2b6-4980-8a5b-18e669ccc29b", "comment": "Malware payload", "value": "7fe4ca857f76da839d7a51671bf5b80c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502675, "uuid": "51cba6d6-5db3-4f0f-aaaf-a758f23cb78f", "comment": "Malware payload", "value": "563f794f2126d6221e5fc5e60a38836a832b84cd9cbb9c6db03a6eb2b35057ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502675, "uuid": "e04d6c61-6a3f-4115-91fa-32f25c82467e", "comment": "Malware payload", "value": "9df5104aa1f0a573793a574f34fba92b6e03f594", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502675, "uuid": "804e9abd-15b8-4ecf-b498-8d714f9b99fc", "comment": "Malware payload", "value": "0716ce7f1a5e76bd7db3cd60e4e6d674a400862ac09c0a37533c0f02d81d64ab1bf6b1b49e6f63e6b49d2371993df3ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502675, "uuid": "80a16b87-7b35-4fbb-9562-fdcf7083d3af", "value": "T1A5734A829C218724C2E613B857F94A55E3D11F123ACB3301CAA1F735BD9E164B693D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502675, "uuid": "a6748c88-8472-44d2-99f8-252625a37587", "value": "1536:KouZ9On3ch4G5FBNKtX/7Zdo+DzVJc/XQ6A2xyLoTySoRQ30rW:s9OQ4IFBctX/g+DEI6A2xyLoTyjQMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502675, "uuid": "78445865-9463-45cc-9c76-2b0a03213db0", "value": 79088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502675, "uuid": "2d756e43-dc33-41fe-b063-8ff7356dc9b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502675, "uuid": "24f13a24-27da-4ec8-9a38-6a392198bbc0", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4583eab4-9622-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520936, "uuid": "b568e18a-48be-4978-9d3c-22aebb54bf76", "comment": "Malware payload", "value": "e8c92d1e3812eebcc8422d0e4afa58c2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520936, "uuid": "534da8f1-e93e-407d-a063-fdc0b8398276", "comment": "Malware payload", "value": "57a91106d35878b14c089e87e4aae9df85aed2875bfa2bcd2e13df8ad397cc67", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520936, "uuid": "cd2cacd2-439c-4eb1-998c-eb0f23191fd9", "comment": "Malware payload", "value": "3aa6d39c174b4ef7922448ce32d34278df5be809", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520936, "uuid": "a07c8ecc-52fc-45b3-94df-c0458d05e299", "comment": "Malware payload", "value": "4327725dca0fa2d736bbdac8d142e8a51ed2635875545cfd70c2fada945d5f2645a8fa14e58d0ff2c5b19884c5e2a0e5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520936, "uuid": "d7d751e4-0820-409d-97e3-d6de366b8b13", "value": "T188F433A54B5886B0B224981BF7FE88B4F8AD804FEF524756F9469605B53F0FD01B71C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520936, "uuid": "88ab3e68-f95d-4a03-a1ad-c0dd1b1cab07", "value": "12288:u1uYuhjF/0Td6EKoO1CCQzxQCrCuWun2uf7K6AvHaG9X0h9dTQZP60yg5B4IeCMK:u1bTLQE/xQyxK6AvHat/EP/r569juwIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520936, "uuid": "cad4db56-a148-47a1-ab42-7cf181d5ee14", "value": 737726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520936, "uuid": "7bb78f47-5b47-49ab-8736-1f59ab9c5c45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520936, "uuid": "1b7f4e7f-e373-4e11-9998-d2494376de4e", "value": "Please verdict - dos meses - 30200 - 09.12.24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147b81a5-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521713, "uuid": "75155e84-cf86-4495-828f-201518752441", "comment": "Malware payload (AgentTesla)", "value": "d0b88013e9668308dfc11b8ee3b1b04c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521713, "uuid": "d43682cc-5574-411b-a00c-8ed7d60a32f0", "comment": "Malware payload (AgentTesla)", "value": "58daf37444ec3b78fdea88dbf266ef70835de693c32a7dd22e911e259d4a1aa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521713, "uuid": "3e91a182-9215-4f27-b8bf-cddefce9b897", "comment": "Malware payload (AgentTesla)", "value": "375cbc6cbe0eeb57082fe3434cdfc61fe411114e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521713, "uuid": "57112f80-3175-4ada-9848-7a8e5c3bdd65", "comment": "Malware payload (AgentTesla)", "value": "85fd2ee95504d1b2ae0c6a34c6728d17f9b7a0c93e121a637fc549736b657fbd8d4c93bb8cb7fa73f84a9bb7952bf264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521713, "uuid": "786460e7-66bd-4f1f-8b74-cbdf38be2405", "value": "T154E5C74A9384923273A1574EA1B9DD30D42AD3C326C5CB11326DD51A3B3ED6B7B0CADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521713, "uuid": "a99be5da-cb08-4fdc-bcb8-af5a291fcbfb", "value": "98304:eP1oiH7pwEZjXvuAIsMEa7uNEbpOZnOskTw2FefBVr/gZtLM/n/c93mo8j:eP1oiH7pwEZzuArMJiNCOhODDezbgZaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521713, "uuid": "d87cd5ef-c6e0-42b6-87bd-2ea3b59d51a5", "value": 3297454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521713, "uuid": "9d60e602-a14a-4cb8-a5da-befda998ad14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521713, "uuid": "dd852f4b-89b1-4527-8934-c87a86ba0eff", "value": "Statement Cargomind 2026-07-31.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3dadca-967b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786559330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559330, "uuid": "1e8c5a13-0837-4dd2-9fe3-b6e5e22cf43c", "comment": "Malware payload (Mirai)", "value": "5e292c265b01a9406c20697da3fac049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559330, "uuid": "a15d083d-a82e-4273-a6fd-47afef839214", "comment": "Malware payload (Mirai)", "value": "5914d99ee82eeb667de41c74f210ac4b68f1801e5db2bbb28cda610592941664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559330, "uuid": "a936b6e4-31f2-4cb1-81c0-b8cd446c8d07", "comment": "Malware payload (Mirai)", "value": "95aee3d259e0e26bbee6db12c107d4bc2ad87268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559330, "uuid": "79ff588f-5b92-49de-a488-a1ca2b85ab54", "comment": "Malware payload (Mirai)", "value": "512e57724e6df258c99621c0beb659a2f81b2017ae70f50ac99f64cc2963b71d235c5cd7c52844648884014b69c8793f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559330, "uuid": "9f074c75-177b-4d5f-8700-9870c1ddfa34", "value": "T1D9C37CC1720C7EAED5937E3CC20613176E1CAE51DC83551150B9FA43DAA72E32E26ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559330, "uuid": "e3528c35-e16d-4499-b518-efd7248b2fc7", "value": "3072:WBJeZbaDCwfWKPvFrFaydoaPBP5TPypvsHFo8QLLjyo0TM:meHUvVFdPBPJGvsHS8QXv0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786559330, "uuid": "c402e144-ded7-4a2e-a5e8-ec0e78ec080c", "value": 125332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786559330, "uuid": "94320e54-fa8d-4a1e-a329-a25178d5bddd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559330, "uuid": "28811603-3ddd-41e0-9281-246c807e2497", "value": "5914d99ee82eeb667de41c74f210ac4b68f1801e5db2bbb28cda610592941664.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0875a5f-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512579, "uuid": "5648a423-4f9e-4855-88cf-8aa3b61ec57f", "comment": "Malware payload (Mirai)", "value": "1c096b8d73a0bff9eb16dfc4fbe11718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512579, "uuid": "fab3c7d6-666f-44b7-aac4-56d9fcf7d534", "comment": "Malware payload (Mirai)", "value": "596ed946bf28f2cb18cea61287884b9c32db91337e664bd034b7f7a1e4589b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512579, "uuid": "c4767e35-9235-42df-9853-b45406cec5ef", "comment": "Malware payload (Mirai)", "value": "3a68e7798967df486f1b40abe0b9523cecd97019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512579, "uuid": "95b6df80-c16a-46af-8cf1-09fa8e487796", "comment": "Malware payload (Mirai)", "value": "501ea6deac3f7169fbad02e89379835028ab06f63a074f11b90d534a995f247507bd2d34d84e691560aef26207ccf1ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512579, "uuid": "c09afccf-be10-43f0-a967-98c887420542", "value": "T1F0A3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512579, "uuid": "9d9bc95d-8731-43ed-aac8-72c1263d67e8", "value": "1536:LvGefaZSdtdn4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdQ59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512579, "uuid": "0d847b62-0388-442e-930e-9afdc3b46751", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512579, "uuid": "f8faf35a-3b72-4952-8b4a-fb5bd1973391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512579, "uuid": "783d5c30-b30d-41fc-9b4a-959f15b8e2ad", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635133a7-9616-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515832, "uuid": "fa29625c-52d2-45c7-a8e7-c381ae9b5d2a", "comment": "Malware payload (Mirai)", "value": "627878ba9ddacd6b06883a2d2da958cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515832, "uuid": "f7cdbb28-5356-4606-87ca-c8f34d1ff5ed", "comment": "Malware payload (Mirai)", "value": "598b7ddffd2c6f7188358d71674dfbe4fd8feef9294940c6825fee1191dbb34d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515832, "uuid": "a1170f9a-4e6c-4146-8513-747b1ccf8eb5", "comment": "Malware payload (Mirai)", "value": "6133bcb3fdccdb1fe54eaa2254023ff3309fc82a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515832, "uuid": "9a427fec-cdea-4226-a8f6-9645b5a34eed", "comment": "Malware payload (Mirai)", "value": "810ae60566a710737a4cc7772200036564c8defacdd64247358ce8f65341dd139aa7a7a4377aa58a561511e731b28467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515832, "uuid": "d68c33ba-80b0-410c-94e0-8508c2bcb9e6", "value": "T1ECB4BF67F6262D43C8E3963F146782680373EA4927915706A70EF5BC3EE52298F1A3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515832, "uuid": "1b8f604e-b5f8-435f-be73-ea6e0a6a23b2", "value": "12288:VPERAxL9WPql5keMhTGQ0xAng8pjqLulf3e4z2s/WmO:ZS25DkemTGFylve4Cs/Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515832, "uuid": "9f8330db-7211-470f-9ee9-77a1a44cd29d", "value": 528324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515832, "uuid": "65058790-b302-4cd1-84df-33ed6cee18ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515832, "uuid": "34209b6e-c3ae-4f40-9577-4a62cb511e3f", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb04e9d1-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504061, "uuid": "7a097e20-1e2b-4c84-97e8-7b3d4b13275b", "comment": "Malware payload (Vidar)", "value": "5492fb1d9859ceee776fec0e1e1f708d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504061, "uuid": "9fdb2f94-6144-4e68-91d0-8ec072191ea7", "comment": "Malware payload (Vidar)", "value": "59e44c510a19bc4a8beec1db099c554dbb6e0c6941c4dc63b473f883c7ed28bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504061, "uuid": "d7622253-d587-42f5-9162-5d735baecd99", "comment": "Malware payload (Vidar)", "value": "e5bcb6054f47f7e0dd8c7c39da4090fa909165b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504061, "uuid": "788d2a94-9101-4d0f-8578-824f3d83f700", "comment": "Malware payload (Vidar)", "value": "f41c684d59d68099bc6594da767c3a37891620facd02bb9c9e873c1a16da15f0a73dd6737512b9c418bf1c0c901518df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504061, "uuid": "a1493d17-fddb-4e0e-8f31-70f7ecbbdb4e", "value": "T108068B07BE8109AAC46A533698B712453B3CBC4E8B3677E72E90B2792F327D15D75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504061, "uuid": "9b9cd658-3cf3-4876-8c13-439d5fef34f0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504061, "uuid": "8eb45533-95a8-4361-84a6-e8ee5dcb72a9", "value": "49152:6Zin+Ni2enjGXSByBYKDVgHXKCvYMQRStv4masJbcSxe:6ZhNcPKDVg3KCvYMNaybZxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504061, "uuid": "e96fa451-72b8-493c-9990-36b83f4f4d06", "value": 3847208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504061, "uuid": "164fa434-9458-44d3-b7c2-a5e6c578908b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504061, "uuid": "f25d2852-ef66-41e2-a127-1b8fada235bb", "value": "59e44c510a19bc4a8beec1db099c554dbb6e0c6941c4dc63b473f883c7ed28bd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05184653-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498494, "uuid": "41362277-1288-4a4a-acb4-cbb9b1b9e85e", "comment": "Malware payload (Vidar)", "value": "e739c58250d1b6caf92f358e9ff0bd6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498494, "uuid": "58832f02-ec3f-460e-a266-3db06d5a1e82", "comment": "Malware payload (Vidar)", "value": "5a35dea1e941c4ae1f19d3ec781aa816cdfcde2982b4be30db1f9ef933329de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498494, "uuid": "da6eb51a-1289-44aa-ba17-47ba578e70f8", "comment": "Malware payload (Vidar)", "value": "3d686b5cbab9e57ef65af0e5dfdd9ee5853d0d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498494, "uuid": "9c9232ef-00f1-41b5-bb1d-1a00f038dc37", "comment": "Malware payload (Vidar)", "value": "8f20645a653fe24a5ab9976276e6e8c63f6e3832f2615596ac56c200f41ef4857c4f3226a0616687208298fc90e6722c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498494, "uuid": "146f5528-c67b-4c58-841f-e8bf0abd48c5", "value": "T126165A037EA448F5C099EB3188BB5252B674BC4D8B3173E72E50AA782F367D15D39B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498494, "uuid": "14313a11-5184-4574-8f78-801e3f876d69", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498494, "uuid": "4827b671-d037-4430-9d56-b097f36864ff", "value": "49152:qytk/FzCeEdUlKU6keK6YP0hW8iRRWsSDOnxszA7rJoxLo5F:q7q+P6s6rR87rJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498494, "uuid": "8135767c-9235-4579-b878-14b48aeffbd0", "value": 4407152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498494, "uuid": "ff801df4-23fb-47e0-a349-ac1e820cd7b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498494, "uuid": "51ac08a5-e083-4a53-b61b-4cdf851810a1", "value": "5a35dea1e941c4ae1f19d3ec781aa816cdfcde2982b4be30db1f9ef933329de3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc9e75f-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511370, "uuid": "1eafb6dc-e7a7-4be1-9d41-48869715c8d8", "comment": "Malware payload (Mirai)", "value": "96c7aeb39a2c885c5d55f613b55001b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511370, "uuid": "6015100e-01e7-444c-aac7-1655877cf2fe", "comment": "Malware payload (Mirai)", "value": "5af0da4408ddc32b189f3679fdd5d82be66586877f6cc337dc5458ea5b6c5ecd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511370, "uuid": "02f342e0-f53e-4202-b7c8-f13e061e962c", "comment": "Malware payload (Mirai)", "value": "32ef9be550a05866aaf3dfaf5e6dddfabde85cc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511370, "uuid": "da2bc207-af79-4bd1-af23-8754df6617d2", "comment": "Malware payload (Mirai)", "value": "3b15dffea9a26cec9f571e5f008c589abd7c5168bf5ab664daca786d8ea697bb02e3ecb58321a4dae2fae0f2d094a03d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511370, "uuid": "7e656934-e2d3-4598-9254-8302e46131ef", "value": "T1A7C32AD22B1C181BF443B9B0212626C85BADBE66D3A8F188D5DBF7C5C435A7149CCE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511370, "uuid": "5ce06591-e5a4-4868-9a42-5ac142248d41", "value": "768:egQBaRu7+6gv3l6y4uh2YBMjwHbaErAsdYCDcr5iUNIRSFJtzQdJqYXJc08:XQoDt4uh3lba8ziCDe4gIAFJtSJqYXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511370, "uuid": "6fa92d51-2bbf-42e7-b6c0-674b2cd2d546", "value": 122732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511370, "uuid": "bd2eee3a-e381-408f-9caf-f79c5c7aa5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511370, "uuid": "9d075ced-13f7-4605-8535-788ca86ddd6b", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97de20e1-9613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786514632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514632, "uuid": "bad7b28a-ff95-4f67-9fa1-421058418533", "comment": "Malware payload (Mirai)", "value": "27790dc965c8a3be338f1cd80e615c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514632, "uuid": "2bced176-da50-4d3a-bb22-2e42838f33ce", "comment": "Malware payload (Mirai)", "value": "5b2babb8411889f33f428c1650b56d69a526582fb36d7a39ad4baca4c2765d14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514632, "uuid": "d5720bfe-32ca-49bd-bd38-7e5e3aa52654", "comment": "Malware payload (Mirai)", "value": "e1c004558cd38e2f59ce05a54580cd5039d1de4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514632, "uuid": "836c5777-42d6-46d1-b6d8-5df9855363a0", "comment": "Malware payload (Mirai)", "value": "08b0885a30c85f1e11ab74d88a207182709325cf159bd0d37760cbf9e0f92e73e64e8658ef985392d89f80198fca38ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514632, "uuid": "58178880-8a28-4b93-97c4-56e76ef4a6de", "value": "T185730262978735F37B41A876DA7D8F80F3990F7B64D812A132889C78B7A568471BC4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514632, "uuid": "2f8d651c-1b4f-4369-8bc2-de2dd610047f", "value": "1536:CpHVmDhbn51cpBXoN1aLMgF9LeZq7LglmCWd6ZuuoaU/H2YMfr:CpHVwhbnncnoraVrLeZALglmCw6Zto36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514632, "uuid": "e52ffaf4-c52a-4b81-abe9-7758c2bf77db", "value": 80600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514632, "uuid": "824cd69b-4874-4331-8ccc-4c4d3530ad7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514632, "uuid": "f3a433bc-57e1-47e2-a144-0fde950fd2d7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d0fd4e-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786517334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517334, "uuid": "bfef1a3c-d33a-4a28-8fba-a5d726a60b7c", "comment": "Malware payload", "value": "b5edd304774e68b0a0b8fa87a63f7199", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517334, "uuid": "03b45dd5-082b-42f1-9d20-e1d8126fef07", "comment": "Malware payload", "value": "5b6fccf19a5d3842eac5323fe41340f0f117c886d8605a6085b910261f76f6b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517334, "uuid": "f3ce58a5-a2da-437b-a983-f1f1d1ba420a", "comment": "Malware payload", "value": "52af5fd79ef38b115686ac341cc624d72c598e7f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517334, "uuid": "049fd46e-2e89-4d2f-841b-8adc96833b96", "comment": "Malware payload", "value": "65eb2f8d445f1c7c182165e769a821b9db87de28e42196ee4afce08aedef8d715aa02f4e92ee6fe148b102c37ca3a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517334, "uuid": "7376e1c0-019b-4c0b-8c8a-dc8c35a4339a", "value": "T116236C651A857C149E99C4371D7E2F0CB9AD43E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517334, "uuid": "27a63143-50b7-498a-8a0b-4b7b173b2990", "value": "768:+VEJVIhtMg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:cEJ2Mdcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517334, "uuid": "70ef444e-ae66-4689-aa00-67c9fb34645c", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517334, "uuid": "037fed88-b290-431c-9bbe-06399f0c1fb3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517334, "uuid": "6ba33a31-9af0-4aef-926d-7129b347eb79", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df6a115-9682-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786562128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562128, "uuid": "563d445d-09b2-4591-b844-f0fff94e9346", "comment": "Malware payload (WannaCry)", "value": "0d1984aeed22063e07ee967fcab2d480", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562128, "uuid": "6b79f56c-6f6e-429a-acc7-b819456556ba", "comment": "Malware payload (WannaCry)", "value": "5b780d8ce89fc619cf53507cee7ab98020c61dff665f10a6230032fa0dd09151", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562128, "uuid": "747606e8-17e7-4a02-ba8a-8da585661ef3", "comment": "Malware payload (WannaCry)", "value": "b8b6b3ddc49154943581e93bcdfd404d9587929d", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562128, "uuid": "bc07ce8f-f19f-409a-848d-756297094dd1", "comment": "Malware payload (WannaCry)", "value": "f01e38663eee5ef7004b27cdaa6035f081c2829f1abdd76bb3e6cd64337b0d08d89104ffd8222812ce1360473a0cb663", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562128, "uuid": "55470872-f28f-433b-8caf-5ecd92b60e7a", "value": "T17F36236530E8C0B4D107157484F7CE22F6B6BC2617BA5A4FAF904A7E2F63B92E714742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562128, "uuid": "dd4f922c-4519-4bb3-90cc-f035de65a8b5", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562128, "uuid": "5948368f-fe7e-4cf9-90f6-f354837220af", "value": "49152:jnsnpFSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMpEoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562128, "uuid": "fa3a5271-9b58-4e55-a7ce-4377c2155192", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562128, "uuid": "4074beff-46d6-4bbe-8d9c-f7ec7eddac27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562128, "uuid": "7eacff41-282a-49da-bf40-d5748b264801", "value": "5b780d8ce89fc619cf53507cee7ab98020c61dff665f10a6230032fa0dd09151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4c3ca-965d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786546465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546465, "uuid": "93f9ca7b-7bba-4a30-ab10-691ac2ace93b", "comment": "Malware payload (Mirai)", "value": "4d7a3cc52ced06edee118360d5584358", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546465, "uuid": "d10c25ca-37bc-49b2-aa46-2c73ebb378b4", "comment": "Malware payload (Mirai)", "value": "5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546465, "uuid": "1a39d26d-5320-4be3-a215-c147af256fc9", "comment": "Malware payload (Mirai)", "value": "35f9d5099bcb44217b9c5d4f068eaa620fe246da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786546465, "uuid": "22a9e89d-0d72-46dd-bebe-49fa698e2fea", "comment": "Malware payload (Mirai)", "value": "c6cbcab7eb46a1d0b6c499f4783da59064399f59a4469c631674fd9a59dd59e0c2f0a6d01ab38ed04fd36c9cce271725", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546465, "uuid": "bdac1bd2-4b5f-4d40-88a5-3d2a94c1d436", "value": "T16B315C863511BE71E96F6F08F2649B6D910773B0ADFF2A4298624C033896580F9DBD30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546465, "uuid": "38f6a7a5-65f0-48ff-836a-732125eb62ee", "value": "24:5XREx+DvhXxFwhSxU9htxH+pJ5LpCoSvi8m9qGEqG+MGRIO1QxqqxGxF5ZMFds4f:fevopHLgo3ht/jw/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786546465, "uuid": "d92699bb-8fe9-4c7c-9eaa-2e3286f6dbf3", "value": 1718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786546465, "uuid": "590920dd-160d-4c71-9962-0e7eb0f8523d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786546465, "uuid": "557c115b-997f-41e8-8969-3aaa702b1a05", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fb5e31-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574948, "uuid": "ae2c2903-6f00-4cab-a71f-7733ff4dc85b", "comment": "Malware payload (Mirai)", "value": "5f3f383f55b374c22904e4fe5e1a218d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574948, "uuid": "0da1edd3-d3d9-4212-85fa-f883658dd195", "comment": "Malware payload (Mirai)", "value": "5c502903694591a219ca263247c4c159967c5838c9a85641f3fb908b983d1e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574948, "uuid": "a6b56d85-1aaa-4609-b8d8-06a22558cab6", "comment": "Malware payload (Mirai)", "value": "c65ebb643e64d641a61cb3b5b9cd5781c965a544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574948, "uuid": "e0aef0f9-427f-4d47-9259-4908c4ab870f", "comment": "Malware payload (Mirai)", "value": "8c249c55ee48aaaf190ac2bae4692c9d4c66b1b5f0025c4d49ea6f9daa94de35c99976cf434923e610632d07d4f277ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574948, "uuid": "5b4ff07a-b89c-4857-ae00-17a9a7ec8cd8", "value": "T11963A60A3E628FFCFB6D873447B79E319698339226E1D545E15CEA011E7030E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574948, "uuid": "836574fa-f91a-4767-b8fe-157f12d4c7ee", "value": "1536:rXXpOKyD100rKDrRpRbYrsQVGwal5KhxiK:9OjDO5rBbqVGvuhYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574948, "uuid": "a79122b7-661a-45d8-91a8-b55de30b2d62", "value": 67496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574948, "uuid": "26c18b15-3aae-474d-80fd-5595a88842d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574948, "uuid": "45ffc843-d320-49e5-acc2-30108ebd2ddd", "value": "341d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4c28d4-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786522773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522773, "uuid": "66401f97-3ab4-4b05-adf5-9f81f32debfd", "comment": "Malware payload (VIPKeylogger)", "value": "391b4e6f935184b50e09b66b9fa5c6fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522773, "uuid": "18f333d4-bbd6-49fa-a5fd-633b697d40b3", "comment": "Malware payload (VIPKeylogger)", "value": "5cd1091142583fca5324b1adf43f474d62e05409e11b422067b07b749bf0166c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522773, "uuid": "fd928b3d-60cc-4f95-9dfc-29f8b7bb89bb", "comment": "Malware payload (VIPKeylogger)", "value": "ef76fa6b9d825b921276c55ed03a70322f8be3fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522773, "uuid": "ca25d007-d30f-4f13-91a9-da32b4d95341", "comment": "Malware payload (VIPKeylogger)", "value": "7dfd123ca1fdd1e85cf2fdb36340d8a8b0b7cca07ac17b274c170d0b4682485ea1fe21da2a6877fdb83bd7b45ebae32d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522773, "uuid": "ac466847-18ee-48c9-b14f-4bd4bc41a1c1", "value": "T116F585611340D6727A29E74E45358A329E8998A334CACF45307EE36C7F9DF0F5358AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522773, "uuid": "8bed09ac-6b64-4215-9f1b-b72802eddbd5", "value": "98304:lkxdEVjHt6iEF+lkC5I9FWcbkYDst1Wwth6L8Q/FjXMvEzdaguPMcsw:lkxdW06GCEs8shT8XPuUc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522773, "uuid": "dd1bf1ed-3ad7-4c91-b421-8a81a9ea2210", "value": 3451854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522773, "uuid": "0c808f31-61da-43b1-ac9f-d03081ab8a32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522773, "uuid": "1aed12bb-b8f8-45d8-ab93-9f3201f1e3f4", "value": "iqqzgzxw.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef60cc6-967e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786560573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560573, "uuid": "d6a5920c-d1ad-4a32-88a8-81f2f3b540e4", "comment": "Malware payload (Mirai)", "value": "4700a87e5c77dc14e996dce9867a09b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560573, "uuid": "3d635da2-0383-414d-afd8-85d2a302475e", "comment": "Malware payload (Mirai)", "value": "5cfa6583cd9e509108240188caa996f4707dc57765a96c49ca68771f791f1b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560573, "uuid": "dd5309c2-4490-4409-935c-56b1a8233fdf", "comment": "Malware payload (Mirai)", "value": "f8532749ad63541ef8b7c66473e047d5c29e6475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560573, "uuid": "602b77e2-beb5-4de1-936f-06e5a06540b4", "comment": "Malware payload (Mirai)", "value": "bae9f8724d7b57a5681f35d94d16281ad3cee9ef79ab65b0e496d948aa177a98b98a6ef1930ccd5f962a2ebf65c5742b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560573, "uuid": "7eddaac1-651a-4bfe-be9d-26c035c4c9d0", "value": "T13F147F00FB081913D1835EB45B3B0776E379D98318B9F019290E7B565B33AFB5A87B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560573, "uuid": "a04dcccd-5cc6-40e2-9e23-5d9c29660a28", "value": "6144:rckQGe9m4umEWY03AUYcnP8AINi1FQdl9ck8Gd:o0msU5miQXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786560573, "uuid": "277991c7-f53b-4cbf-80c6-7a1eff7ae504", "value": 198040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786560573, "uuid": "bfae1024-f5a4-4df5-91af-c1ba93c5e761", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560573, "uuid": "97dc7375-896e-48d3-8f1d-d44cb1146f30", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48e101c-95e3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786494144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494144, "uuid": "120cf25c-a9f7-43ae-81d4-c4c4a16cec2e", "comment": "Malware payload", "value": "171f7c6f58a4aca14638ab3fdf9264df", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ws-painelacesso-com", "colour": "#3F539E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494144, "uuid": "eff585da-f7ce-4d97-bc23-d2867b119f28", "comment": "Malware payload", "value": "5f50e28ac96b376290c2443c0f6dfc38c44a770bc05c381aaca4b25535ac5d5c", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ws-painelacesso-com", "colour": "#3F539E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494144, "uuid": "00f96d8b-d12c-4b06-bd4d-1ff74ee08302", "comment": "Malware payload", "value": "d5ca444c2ea87a37bdfeae6abf852b2b655afd4d", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ws-painelacesso-com", "colour": "#3F539E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494144, "uuid": "861a0d43-3818-4a90-b869-094c7647bb2b", "comment": "Malware payload", "value": "b068bd264ca1a594fbaa6454b9e9259c003c8d5682c37c842c6b5436f8533a6e63e046ceefe92456de45fb76c78db2bf", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ws-painelacesso-com", "colour": "#3F539E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494144, "uuid": "64af31ee-00d9-4d00-9910-737f766c2ffe", "value": "T1F0D42398A2ED5388CDA2ED221FCF1B7B9E23B94AC604553555006BE4FDA47C7EBE0113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494144, "uuid": "eae0203d-0928-41d2-9cd8-59ff9ec2fd6f", "value": "12288:L1LRqzA+nCNXaBcGbjrrmda7Z7IG75nzz4RWdrWkW6A6yWZP5u18r:lRP+ffPmdaF7N75nzzm79l6HS8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494144, "uuid": "a65e2fe5-6381-4985-aed6-4854f330e8a9", "value": 645060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494144, "uuid": "c7779389-16d1-4f02-8dc3-9139de0c4d58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494144, "uuid": "18f2e7c8-8d0c-45e6-939d-50a76afb26e3", "value": "ptk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f8cbb5-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786500296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500296, "uuid": "f9ef429f-1d14-4c56-b533-f4bccca2cfa5", "comment": "Malware payload (Gafgyt)", "value": "0eb9fa945b9ec2e37adf13f80fd05e42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500296, "uuid": "325c7c03-ab55-4230-ad1f-9cee27e9d2a9", "comment": "Malware payload (Gafgyt)", "value": "5fa4d1b124b9129e088b730ee262f8a6d6afb3ee355fb60b0b336e08fe0a6006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500296, "uuid": "855eeff3-7033-487a-99a4-3b7c7b6774ac", "comment": "Malware payload (Gafgyt)", "value": "345c9cc9b4713204c01c4f0efa87e83b56e6104c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500296, "uuid": "9077e47a-66d9-40b8-930b-d4eb264c0708", "comment": "Malware payload (Gafgyt)", "value": "56f29153b6365954e8e08ac595dccb6e93f993550bea03c5cfbe059e6c077cb011e2323c8d930fd0abd2abb46f8adaf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500296, "uuid": "574e7fae-c3c5-4c7b-bb59-86e49549a9d8", "value": "T1D843F194F0488DB4F64B48B46CEBC5C067F1DF9577428EB249C08FA25161DA23BEA19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500296, "uuid": "0357ed13-b262-4fce-ac8d-859cfebbc168", "value": "1536:kCoQp04I0Naku1dFb1qhSE1qqUH4UZHgeMvLFL7UAVQbyUmn4u+qgw09O:dqQIH1dqhSEcqU/gJpLwAVQbu4u+qgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500296, "uuid": "46c7af17-816b-44ba-b384-fcbbde22466c", "value": 55832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500296, "uuid": "8bf7a949-4f05-4723-972a-2361fd731839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500296, "uuid": "f930e4df-ca15-4464-b164-fdc94c6c56b4", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a180e7d6-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512930, "uuid": "cc4c76a3-1c18-4990-835e-8653882f3140", "comment": "Malware payload (Vidar)", "value": "e246d554ab5d7cbce5f0dd8956d22e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512930, "uuid": "90cbded1-020f-4175-99e1-66fee71f0ca8", "comment": "Malware payload (Vidar)", "value": "60266c619ae01caa5de17ac6cc8580093a830e1663cd710571542ecb9ca5a872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512930, "uuid": "db3fd969-85d9-4640-80c9-5443f84014c8", "comment": "Malware payload (Vidar)", "value": "31563dffa20cb9bafaf24da903a7beee98d7eea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512930, "uuid": "55a0e1da-0e29-4b30-9bdb-96eafeeec2ee", "comment": "Malware payload (Vidar)", "value": "e3805479014b85b867475106b224a7914822b4d80e7e3c886e5312ce403924f05410269f9795b43ee9e47981b3dac164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512930, "uuid": "120014bd-d832-4349-bd1a-23e3db1be0fc", "value": "T15D069D07AC914DB5C45A4331897A1261BB3DBC198B3A37D72E20B77A2F327D19D7AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512930, "uuid": "b76d1e44-ce7c-4e2c-ae76-88917c01a386", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512930, "uuid": "380dc7f1-399d-47d0-a778-fd034f09ac34", "value": "49152:9WOucfyrsA5s0tTuxknHjv+zXRZLV5PUZqlgx4:9W4k8xknHjWzhlV5PUZqWx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512930, "uuid": "be131e90-526f-4ff1-b96a-50ab0c9ce591", "value": 3728176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512930, "uuid": "817639dd-456e-4e54-ae60-53546292d8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512930, "uuid": "c1618f05-b8b6-4f31-9baf-a5ddccc23192", "value": "60266c619ae01caa5de17ac6cc8580093a830e1663cd710571542ecb9ca5a872.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa63c6aa-9654-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786542580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542580, "uuid": "47713aaf-eea6-4a4b-a1f6-9be6538a5109", "comment": "Malware payload", "value": "b522271e7bbc6602fdfdce57be7343b6", "object_relation": "md5", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542580, "uuid": "9fadd86e-7640-406e-9ccf-845f79dcd86b", "comment": "Malware payload", "value": "60ac3f2f287731e26eefd1b8d78b26549cd0abaa7521a80ebeb1435b2b84313c", "object_relation": "sha256", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542580, "uuid": "eb8ac251-bc5b-4797-a7cc-d48ae2ef53f7", "comment": "Malware payload", "value": "a9a77c9b237353afb2403585f8cfae0472c73f26", "object_relation": "sha1", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542580, "uuid": "e4a1b3e9-14cd-42af-b65d-6645272af5a5", "comment": "Malware payload", "value": "5d1ea1047fb4fca045544c02e2b5a03619e0ac09c150b6a1fe7e86ab6cc5c39c55f7425ca3a9867bece70795faf5abe9", "object_relation": "sha3-384", "Tag": [ { "name": "AES-decrypted", "colour": "#7C4B17", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542580, "uuid": "ab14cde4-69fb-4b19-9f4d-3fd351b295b9", "value": "T1350612F27B819871D017CFB08991E7ADB369FF8647224F4731D96D02ADE16C2EA31291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542580, "uuid": "f543db21-910c-4558-b747-9ee4298eee41", "value": "c1a5c1dbe3eb1b4e4c7882e1fe3cfeb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542580, "uuid": "73157986-5ed7-4f2c-b60b-76bf6dcd4110", "value": "49152:0gLLfxoEPWO2Pw5y5ROFU/V2v5blFC4fDEAGJChhdlVAHy96tab2l9zk:0eWO2PwqRO6tmbC4fw/CzKS90zNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542580, "uuid": "2e1256ad-4344-4bd8-ad36-ea87ac7cd87b", "value": 3747624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542580, "uuid": "3efd4268-9e5e-4305-b0e6-51fad2d687f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542580, "uuid": "77fc652b-55cc-47c8-ad25-08cfff7943cb", "value": "20hx8bc7q0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eaed9e-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512530, "uuid": "61a9d5d3-7263-496a-9947-01348fa53115", "comment": "Malware payload (Mirai)", "value": "c88b2a9bfaafd7ae46bba2d8bb341ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512530, "uuid": "b08faa8e-d813-406f-a8b4-21a60f1558fc", "comment": "Malware payload (Mirai)", "value": "61946ef9553c3be03ba21df09f906e66a6e2c30e88cab1c290bcac83dc5bb451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512530, "uuid": "51eb068d-200d-4e05-a5f0-b32f1ab24ebc", "comment": "Malware payload (Mirai)", "value": "fc4b69265d89c7ced37fe487ba6bec8a4b0a9aec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512530, "uuid": "1c5efcd0-1400-49fc-babb-c55d6e409244", "comment": "Malware payload (Mirai)", "value": "90751f8b8fd46734537e44a2fe65096a696995607a1d58db417c6564fb436a912bd55f2032f8161bf07124394cb0609d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512530, "uuid": "7df7d6ee-35ee-4f81-8262-bd5918fd24ef", "value": "T13CE2D075201BFCE4F2E06C32AD2843D6A3F38AF8A6B87256763407AD21C744A55F5865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512530, "uuid": "71e537b2-134f-4073-9e96-eb48e050f235", "value": "768:PeBsVPxhgE290o6gWz9SSFCj/Qh38UoNaLX+Es3Uoz7:PeGVPxGhyVgWJSScQh3XXz4z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512530, "uuid": "c02ff712-a590-4340-8c2f-e09889b5a59d", "value": 33864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512530, "uuid": "5caf05c0-1e71-4d02-ada6-6d1a9ff119ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512530, "uuid": "a554a0d8-3e0d-4493-9bb9-ead26db1ae58", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68790ed3-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508969, "uuid": "f235b238-9d45-4972-9627-c6dbea2234a3", "comment": "Malware payload (Mirai)", "value": "7a13172db636af35dd2eba8aa7b090e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508969, "uuid": "4301d4e0-e360-4d78-82e8-8fe8e32f35c2", "comment": "Malware payload (Mirai)", "value": "61f67f33ed55e49daa6683e240648e667f9a8c992597bdb4b65d86ba9f52bd7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508969, "uuid": "17c76ace-dbc6-4465-86a1-3bc69c0793b9", "comment": "Malware payload (Mirai)", "value": "6930a7e4ebbc026c01836d474fe1090f9e6c327a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508969, "uuid": "a8414936-e0a1-40f1-b7c6-fdc36ce903a3", "comment": "Malware payload (Mirai)", "value": "a1962546207485c4c2a82192a9470be925e4249ff297ecb42abe89cd8d40c461df7377dcc878d841c610ca8709f69526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508969, "uuid": "55378486-1786-4819-bebb-ef3b41eec3f1", "value": "T1A3040A56F8818B15D5D111BEFE0E128E37232BF8E3DE72139D245B307BCA46B0A3A955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508969, "uuid": "97541bf1-8d82-4e9c-997d-94428ecfe424", "value": "3072:jLr9gP2Iw+Kmpfb7EqYDg88jhrG3tdu5qQ+GrdJXvxOyaovM++DB/gZaUBhBhMiL:Srdb71YDg8WhrG9dugN0Xvxda8bo/gD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508969, "uuid": "a94c798e-faf3-418a-92d9-0ca21706faca", "value": 182972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508969, "uuid": "f99886e8-77fc-4897-8340-66196aa94199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508969, "uuid": "daa13c76-0a32-4743-a898-c08ae5af0b20", "value": "7c4c24e0a2eada545af17e13238724f0d2facb46c6698736de23b93569127470.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b37614-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512526, "uuid": "f6d6e13f-3fe0-4257-9f32-a3e2bd289e98", "comment": "Malware payload (Mirai)", "value": "321882db218ae2743642f8b663101adb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512526, "uuid": "4e0d0aaf-371f-4202-8adc-da0a3e0827b0", "comment": "Malware payload (Mirai)", "value": "6226892efe162b50777d27ff9c8960676c81fdd9e8069b20e4065955e8f1bcb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512526, "uuid": "4ed54f80-b759-4e4a-ae48-5460f168aa1f", "comment": "Malware payload (Mirai)", "value": "4842b9e8453d45153b9f12542b19546281c46038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512526, "uuid": "512cb216-a283-41f5-be5f-ec5f2fa98804", "comment": "Malware payload (Mirai)", "value": "c96ea9dc598ad8abd1b29a7a396ebef73328c6aff35ea0bb44139d7825a0b0c81225e4b1922f5e16ce29bd7160ba408f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512526, "uuid": "ac3e145b-67b6-41c0-8dca-8ad3621fdd4e", "value": "T175E2F26A51ECB12CE44E903BC32FA98E31E75D11BE17C6A424C476DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512526, "uuid": "d2017de3-e07a-4488-8402-c720bd0e1caf", "value": "768:g32bRAqg2AQzSPMjFY8AFOEPB6ZSq7xnwNQBUc:DbRAp2A4ECF+FvB6ZSonwN2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512526, "uuid": "9ca07c3f-b64d-4150-b691-1d1daf1702c9", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512526, "uuid": "9daec5cc-c5e9-4b0b-87dd-46412bcc46e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512526, "uuid": "1c59c0b3-4fd6-4968-94e9-9e0b116849b7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2c47c9-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508972, "uuid": "a134d3ea-2142-4aaa-a348-82664cf2c644", "comment": "Malware payload (Mirai)", "value": "90a69ebc3c8119ef7ad5d672b5a4e2e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508972, "uuid": "34f7164f-d885-4ba6-8872-2564e40431b1", "comment": "Malware payload (Mirai)", "value": "63ef1254493c2ee23b9902bcdef303ed8192d109c9aadde7ee35def4b869aaa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508972, "uuid": "eb7acc3d-20e0-4603-94f0-dfd1f9d7cefb", "comment": "Malware payload (Mirai)", "value": "a7a1e499d9a8a7af062dae641f25f738d8777f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508972, "uuid": "2ded0396-2236-4a8f-a8b1-1ab299124f4c", "comment": "Malware payload (Mirai)", "value": "ad9e312ee16582914284ce1a5a5031840aab4b8cfc682f6ed4eeace7b201b9ec9251662fe3b3f1ec3ae6c79d842b4f71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508972, "uuid": "1bff6f50-edfb-4f7b-90b0-e95280bb28ae", "value": "T158341B56F6418F13C4D627BAFACF42463333A79493DB730699286BB43BC779A4E12901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508972, "uuid": "6a94c520-f028-41ca-a321-6311a8dabdf9", "value": "6144:z2mzSDnbOAdujifB2cuxwEa/PLT5F36UQYEHb3IaXrMZLM/R/bDQ3:CfniSueffuxwEa/PLT5F36ZYMbYaIZgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508972, "uuid": "4bf905a4-987d-4b0c-8130-4718c6ed5ee8", "value": 232891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508972, "uuid": "288c069f-801d-4ef8-8d5c-9dc4148a0409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508972, "uuid": "50fb3023-d906-497f-9010-09d59ce3e192", "value": "fcf5437a7884cdecc7fd0f9b88bf6e33ec02748caedea247732db9ad3993e5fc.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dbbf64-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511682, "uuid": "b30b7b94-64f9-4e8c-baf7-1ce1ce373a11", "comment": "Malware payload (Mirai)", "value": "d20377db094d05046684cd557a15370b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511682, "uuid": "ab1b8a3d-d464-4047-a986-e94ad5220b0a", "comment": "Malware payload (Mirai)", "value": "640ea324dc2237e42d2b398ccdd71a3416570e3d30345726a412fc8d9f5ffb39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511682, "uuid": "f1d13361-4c71-4905-ade4-b74b4c032482", "comment": "Malware payload (Mirai)", "value": "a9c73fa45028c71f55d42a72e8d5f11bcad7e5bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511682, "uuid": "d4b63af3-9f11-46fb-80a4-92d80bcb0f11", "comment": "Malware payload (Mirai)", "value": "1a49e7d90d2ad12d5da4bf598a64ed917e36a9196a485fb60a45910c4a5fc9fea5a331a5eac6c2eebba3ab303e62ae93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511682, "uuid": "575c13b3-8ea7-43dc-82bf-a26775dc7631", "value": "T13AA3E881F9CB41F5C807483460A7B33FC772E9758170AA6DEF99AF36D637A01912228D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511682, "uuid": "29285133-a1be-4cac-aad6-5c279130dd27", "value": "3072:2yQ+OKDBy9NczSlh+XW+niqQxeXspGfrIcgf:jQ+OKDBy9NczSf+XWnEof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511682, "uuid": "8e90e0b7-a330-40da-aeca-c0fc4e269dfb", "value": 107408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511682, "uuid": "f1fab98e-2a28-42b9-bbe5-d7c81274209e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511682, "uuid": "1da99bd4-287d-4dd4-bcec-d573ebb82f80", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c206a52-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502157, "uuid": "a90dd6a4-2781-4e45-9961-b5764d1ec873", "comment": "Malware payload (Vidar)", "value": "4efb555da547ea6bfce7dc2688dbdb06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502157, "uuid": "3a848a2c-1026-4ed0-8fbe-8af0f47bd5e1", "comment": "Malware payload (Vidar)", "value": "6438ceeb6f74863c6fe9981de0074cbd781e9b1cdf7ae08c9fb0a5091936f322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502157, "uuid": "dfcc339a-04a9-4684-bb89-9cf230dcf036", "comment": "Malware payload (Vidar)", "value": "d74ce11455ebde99d19bacc49ea5be495ba52f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502157, "uuid": "12aa52e5-b1b6-4e8d-a9f8-cf87da5f3a80", "comment": "Malware payload (Vidar)", "value": "dc798fffa1b7918fd37977b992b53f63f146398fe027469115dcfc3e79f2a8a8426f7e32622b9b76eaa1a91d26be0fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502157, "uuid": "f1a2ef72-81b8-4bd4-a0ec-dd0d8637affb", "value": "T1A1069D07BED058B5C499773649B752453B38BC5A4B3A33D72EA1B53A2E723C29C35B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502157, "uuid": "aab73ab7-fd91-48ad-9854-c2c571d2de71", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502157, "uuid": "3615ea13-ca06-4ed8-94a3-9a2b2544bc90", "value": "49152:dcyctANkuFFga1PZpy2RBPOIjdv7Sqn60slQMuL:dc7mf1BODDqMuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502157, "uuid": "0aaaa95a-f740-4e5d-b07b-f23d03149326", "value": 3835456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502157, "uuid": "8f39fb74-8628-4c8e-9283-c0afa2b54c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502157, "uuid": "41c08d12-39b7-4048-b8b8-16c34a436977", "value": "6438ceeb6f74863c6fe9981de0074cbd781e9b1cdf7ae08c9fb0a5091936f322.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f574cce0-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511353, "uuid": "1b0c1002-3ca8-4f54-abf0-84939e14ea76", "comment": "Malware payload (Mirai)", "value": "a6a3c1d2658ce9fe56e6ba5f97a91327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511353, "uuid": "a9a586be-f4a8-4fbd-a5ac-83a24d69c36e", "comment": "Malware payload (Mirai)", "value": "652e49116e3235db3fee273a8b9dc904c770c71649db877e97c0b7981d81bcc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511353, "uuid": "caddb3e3-c782-4c15-a067-cfe3f7ee49e5", "comment": "Malware payload (Mirai)", "value": "d8a42b0277951ce765f7d47cf9a3d12b9c8274f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511353, "uuid": "e7a7aadf-4d96-41c9-8957-e2f66ece19e7", "comment": "Malware payload (Mirai)", "value": "927ca11d8e2ad595eb4d817753bd9e74e1ed7429990c2357d738c801a4a5a365f0529ad20d1ed538780e47240d7fc398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511353, "uuid": "d540bc69-18f3-472f-917b-cacd329faf2f", "value": "T17593BE22C6B54DD0D0848EB272ECCA748713F60466937FFAD1A2C7660017EDCB55ABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511353, "uuid": "03fd74f9-35e0-43c0-b62f-3d2220de31d5", "value": "1536:ccIBuptjUn/ICe4bcIhzDqbjuPKtjoOeM3KsipgJ35Cwqw+Tm:KwtQn/teurZqbjdLePsz35t+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511353, "uuid": "7c06bd94-83d1-4393-a40b-10fe724ce4ff", "value": 95368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511353, "uuid": "6259806e-8d4c-4a76-b349-d1bc7b26b8fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511353, "uuid": "1542f327-134e-4e7a-88a0-272865c8ff2a", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff5cd1a-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511343, "uuid": "8d6f1037-aa87-48c0-9308-d428f70c05fe", "comment": "Malware payload (Mirai)", "value": "3d7bc4241b59780559d21e6433bf9672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511343, "uuid": "ea4e9774-bb6c-442f-a625-d887a208c1fe", "comment": "Malware payload (Mirai)", "value": "654ffebde245ef56436028fc70fee1c0cc20a30f3374e1bb18c9f9303bc3d768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511343, "uuid": "62dee785-8f33-4adf-8dff-963d3e9c2395", "comment": "Malware payload (Mirai)", "value": "f6c1acf46a9540ad2783d0d5da8ec02cc8e6824b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511343, "uuid": "2514b5ef-7ab9-457c-9d76-1f1c9984ea1b", "comment": "Malware payload (Mirai)", "value": "fc4ba866ff25a6627c6c5f0d4bacf1ad7f0ca73363ed2e23786f7a862af6f3b9f25bf42992f7dad75e0de46056abf8ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511343, "uuid": "6be574e9-e371-4b87-84f5-82dd3d191429", "value": "T1C80295AAC7D6B0D2C87844BC088B9B78631AA9E2D4354770635DD02B5CAF637AA250C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511343, "uuid": "3531c7c5-728b-4643-a236-4d7522b8e2e8", "value": "48:GGu69L4/WQ+GxiOJBshswykCu/NXvf7+h7:GGu69Lo+GxiYshsHu/VvfKh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511343, "uuid": "ce8aa64a-f8e4-45b8-abdf-d84e780a8827", "value": 8560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511343, "uuid": "934d85fe-6ebb-46a8-885a-db942a1b178e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511343, "uuid": "1381302b-07bf-496f-846f-20ef51482a62", "value": "dlr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f609e72-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786522751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522751, "uuid": "4d47dc56-ebb8-4f77-b95c-c2a271f32427", "comment": "Malware payload (MassLogger)", "value": "816d0633200bef303c0c515ffad2db4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522751, "uuid": "2e0deace-2ade-481a-9255-1c9fdb4b7f63", "comment": "Malware payload (MassLogger)", "value": "668c025faee701ad9abb9493f9764c7f322c6a8ea1bc099a418ff5a721d07607", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522751, "uuid": "2ff567aa-9630-4974-a774-d34584b6b575", "comment": "Malware payload (MassLogger)", "value": "d95c56e2ae7a83dcfdcc5f0b806bf7ed610121a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522751, "uuid": "6df06e09-ab0d-4076-8f8c-4cb7e50e0a4f", "comment": "Malware payload (MassLogger)", "value": "f853321332b5e74cd6825e5b152075465a085f95b7c846a819cfa8cfcdda6d604e8f6dd30589063b6d246d9caa53817e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522751, "uuid": "1be2e27a-4737-44f1-92cc-72dd0d1ed3a7", "value": "T11FF5C5A3279F50061B347BEF74495E59CF894928190BF7D020EF1AF1658E694E8E0E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522751, "uuid": "0ea6d38c-0f63-4fe0-a39a-9c7667f1ca25", "value": "24576:qJs5z2UfcXQBlbzR64hJ4AQwECpj/JtoA0Hm/zn:quXBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522751, "uuid": "e71efa2f-4455-430f-9b58-60a69aa68e36", "value": 3644039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522751, "uuid": "d3d5ef82-4941-48fe-86c7-629b89c66ca8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522751, "uuid": "13998b22-9b88-4646-9712-19e6b300dae1", "value": "Vessel Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84086008-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786507726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507726, "uuid": "07b84ecd-9644-4948-adc2-fbd77ddf31d6", "comment": "Malware payload", "value": "76ee69ea1b207e1977143ee1ca95de10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507726, "uuid": "b75d770f-ac0e-4ca0-b79e-0ace79c599d3", "comment": "Malware payload", "value": "674a3d2a55a30ad636493b3e51f3c587125462b0c32b431d698d176a1f5cdb26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507726, "uuid": "c63cf480-a029-4789-8429-a8908320942c", "comment": "Malware payload", "value": "98bbf1fa73dcc0843fa1024b9ab1ca68e0380581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507726, "uuid": "3e3c6b0c-79f6-4431-aaf7-9f8c1aacae47", "comment": "Malware payload", "value": "20f61b99a1964c904f68159c2545b0d726cbc0c4142ae7b198ff1284287fa6b3a535e5eccc51d5db828ae272fb3d2363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507726, "uuid": "144d215f-74d5-43aa-b81f-b1a96e93953f", "value": "T1A9D523E93EF66974D47BC7B68F92E42DB538778943A04C537A8C3A009E43458AC7A335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507726, "uuid": "bed04f8b-cd51-4336-8bce-8962e5c6dd7a", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507726, "uuid": "7e76dbe4-a1d3-4988-a053-6139940a851e", "value": "49152:I/tWTOcU7xjKQH2IozEbC4Vbt+jZgvCBruSQc3p/bi/l1vAdT4D:I/UTDkKQeEW4Jtoy6krcZuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507726, "uuid": "2d777c40-f02e-4092-836c-d617b8e0ade1", "value": 2981376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507726, "uuid": "6e5590c5-c900-40cc-aad8-b0ad0a053a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507726, "uuid": "8fbfa056-6500-4dd5-b724-a4aa5d30c07b", "value": "674a3d2a55a30ad636493b3e51f3c587125462b0c32b431d698d176a1f5cdb26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d7eb5a-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786498975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498975, "uuid": "8994f03d-5a6b-47af-87e1-fd09d2331a87", "comment": "Malware payload", "value": "d1faf64eb621769755ad01550bc39007", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498975, "uuid": "9ea68d26-5a31-4a36-a5bb-57adb3f28796", "comment": "Malware payload", "value": "675129bca5e2d893f1852243d6cd4c8ffa8cb8dbc9e60deb794e35fdb5b50e80", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498975, "uuid": "8c7cb10b-2c75-43b1-a81c-4727cf56ab8c", "comment": "Malware payload", "value": "e1418373ada2c562343add5a8223e99848fea083", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498975, "uuid": "0a00bdf1-3530-4652-ac35-f5c4238e0c6b", "comment": "Malware payload", "value": "e5b52c214f20f57b5b16a8062e7c1c20c952ce5b6b28b38569e9959fce1f16b7020cb5c9f5edbaad66700322d232e5ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498975, "uuid": "1a1a7dc9-70c0-477d-97b7-912a237ed68b", "value": "T141236D6126857C14AA99C8371D7E2F0CBDAD43E6320452EE7FCB3CF68C4A69DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498975, "uuid": "ea462251-756f-42fa-b878-df5eb046bc25", "value": "768:F6rDTPjHX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Yr3Mcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498975, "uuid": "beefde8f-03d8-4924-9ab2-cc48f54dc4c5", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498975, "uuid": "34ad601c-0b16-4e44-a21b-6689f5a18802", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498975, "uuid": "6bcb0ca1-ba97-403f-957b-37b12f9438d2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8117f040-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494837, "uuid": "6bce77b5-f509-47f1-bb57-83e2a91d7b2b", "comment": "Malware payload (Vidar)", "value": "ccb1eb58eb95f54b4e0ba6b38c108c53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494837, "uuid": "b01a61a0-1497-410d-accc-646dfdbee872", "comment": "Malware payload (Vidar)", "value": "686ee54815bee9b94b21cc24e9cbd15db26dbbbcae707ffbb0499f5ccf2e29df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494837, "uuid": "1937eea6-1d7b-457f-9013-30022aa811ea", "comment": "Malware payload (Vidar)", "value": "cec903779c8359aec36badbebfb1edf5d75b1ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494837, "uuid": "2418ed83-1d3b-41eb-b80e-1ca947ae7fc6", "comment": "Malware payload (Vidar)", "value": "0d8c06e3258018562a0a1d8b93b06014a27b2faa0d8159394915b042b14b0567455ba2f06c4e54c813f90109745cc7cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494837, "uuid": "2a079849-578f-4765-ba19-bee410311c1b", "value": "T1F8664A43EB922EB8C096EB75493B8202B6A47C5C873577F31D51ADB03F2A3D15939B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494837, "uuid": "958a6c27-6462-4486-ba14-ab517154b6bf", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494837, "uuid": "59f3df51-0a4b-4f2c-912a-a2de3b5b65dd", "value": "49152:tyhWbMhlFms3M2Y7L6F7j9bPoB76S269kELWXNa/xx0sfAHzIut11Pg1TkfBsJVZ:tNPOF7j9beWZsJVUvHUg20X6u/vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494837, "uuid": "6b112118-3ca9-4eea-a953-e3bd4e739aaf", "value": 7026248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494837, "uuid": "0d1a90ac-b8f4-4850-87b4-714b4c072c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494837, "uuid": "4f5fa8e7-97a7-4a0a-a4e0-419104f8b0fc", "value": "686ee54815bee9b94b21cc24e9cbd15db26dbbbcae707ffbb0499f5ccf2e29df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b22fd4-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786521787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521787, "uuid": "9c42e183-fd3c-481e-9c4b-0a94c6cb98ab", "comment": "Malware payload (PureLogsStealer)", "value": "4d9a2b2e92a893961ab920a0ca23a760", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521787, "uuid": "c01f98cf-66ba-4335-928f-e2e6d512bfb8", "comment": "Malware payload (PureLogsStealer)", "value": "6888967d6ab35e6bcaca0e041e24e457226f39cf81d0c16d6e772d6a806e2ccb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521787, "uuid": "1ad14db2-40c5-4416-9326-1b345f9cd862", "comment": "Malware payload (PureLogsStealer)", "value": "20535d8c16b8c47d8a5031243af8d3919073049c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521787, "uuid": "ea075222-47c0-43e7-9746-023a37785b20", "comment": "Malware payload (PureLogsStealer)", "value": "c73ef490b7097db90e6cfbfadbd6316387549725dfbed038513b224290e59ca477ca63a7bd2fb516a7df32f3f5bd4939", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521787, "uuid": "1764c6a0-37b2-4d74-a17b-7466de470729", "value": "T148C5E76AD8FEBD692F81F20FCB41E0B60C74ED424B82B79D64BD957602570708DF246A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521787, "uuid": "b5bf2c19-15d1-4bb2-8e71-f49dfc43f8fa", "value": "24576:cttbNo/5duMKPcvOURWgyn+4aZEX9+01ILXUm5M5xtokwJPqOb9swp36D7mplbSZ:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521787, "uuid": "3693420d-4e75-4acc-b84e-070085a02408", "value": 2737121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521787, "uuid": "2c7ca0d8-5b8c-4ddd-bc79-7c71a076ea72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521787, "uuid": "f346607b-cc90-40ce-b563-66011e623f3c", "value": "Shipping_Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb85879c-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503202, "uuid": "5fea1b35-711c-443c-882a-bc5ffe17f3b5", "comment": "Malware payload (Mirai)", "value": "724cb6db067359fd3576665c0b56dfd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503202, "uuid": "21c4a621-7b3e-4c63-bbd9-95a52601cd53", "comment": "Malware payload (Mirai)", "value": "68d89ae2eeae98080cf9e643ed5f5827860bc19caac80be924c5b909a979160e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503202, "uuid": "a6846a69-7278-4c26-be3f-eac89816e7bf", "comment": "Malware payload (Mirai)", "value": "ab9274cd755f70f872f34c1c8f5d6bb903042635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503202, "uuid": "21f3c69a-2f0d-4283-b30e-244d07324151", "comment": "Malware payload (Mirai)", "value": "115cd421782f88641970b14985c91d4dd79afd60b1f189c74fe4a2d6f12a68682b9611fdda3e807aa93d24dd33638a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503202, "uuid": "fb780d88-784e-4957-b669-fd84dead3770", "value": "T1A413E05B998BD346D4FD01B1385D7DA92C14D61BACCE03239FD269214CEBF1D2908A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503202, "uuid": "10e6b8a8-4403-45ab-822b-940fc7ddc233", "value": "768:3TVhqZQS0ERZirEQwFjGn9g2IaR7uI/Fx3MlTP+OL5L+nbcuyD7U0/2F:3JhqZr0Sih4l2pR7dX3+54nouy8jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503202, "uuid": "dd7f4dbf-4723-40a0-8a29-51dfae25eb24", "value": 42732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503202, "uuid": "76c1862c-8d4d-4e28-b515-665ab5fdba0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503202, "uuid": "de1aa807-74a3-43e2-9034-7fca09a48881", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d7d775-9695-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786570220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570220, "uuid": "3f0173d5-b0e9-4382-b038-5bc92b180195", "comment": "Malware payload", "value": "c617b419fb4f659ceebf1d102e382d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570220, "uuid": "95ac256d-3499-46be-aeb5-0a858c252c3e", "comment": "Malware payload", "value": "68ef1df7c303a4600df13103cbb093cd11e59775b39f5dbe391a28394191b45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570220, "uuid": "62c4ed75-c2e3-46c1-bc9e-b2d48b86514c", "comment": "Malware payload", "value": "41d684a76082e5c22c759e5c370be512d5f44a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570220, "uuid": "f66b869e-f0ef-408d-a0ed-e9b13266b73f", "comment": "Malware payload", "value": "a83d4b41ed5901387a120070a19e9a5ef6838b4ecbf367906fc580d56952c2614bfdff76daf3743608a43113112cc922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570220, "uuid": "7fba878e-184e-49e2-ad9e-22a94fc6bf08", "value": "T10C368C03DA6646A1C15B9B3145B642117AB9FC98873437F73EB0B7312F6A7E11ABCB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570220, "uuid": "637887d3-ce07-4c18-a9fd-e85d82decb9b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570220, "uuid": "1f5e3e6e-f0f8-4f9d-a434-62d1ebb78556", "value": "98304:fSAIHV9EyqZZfcyd/0NSH+9uFX+6nkKqd:fS1kZZhtBaG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786570220, "uuid": "093d4e8b-4fac-47bb-88f7-9a062873dd92", "value": 5160432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786570220, "uuid": "6fdc0402-c22f-4b26-9013-243a3d8d2fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570220, "uuid": "40decd30-b986-45d6-b83a-40a72df451ac", "value": "68ef1df7c303a4600df13103cbb093cd11e59775b39f5dbe391a28394191b45f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505d0519-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521813, "uuid": "f0260fbc-d3d2-44b8-9c62-a9fd25c8a0f2", "comment": "Malware payload", "value": "81c9458087ef3719ae9114b058a5afd1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521813, "uuid": "8644b897-db16-4f4a-af0f-0cefdf7ee900", "comment": "Malware payload", "value": "694957963dc492cb933bfb816a88e6c0da2811be3d958e555b3d1c63a0c46f2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521813, "uuid": "6ce8d656-2145-49ce-bcb0-53542758131a", "comment": "Malware payload", "value": "2032e0a0ed85fd47ef115d4b3ab90435a558b376", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521813, "uuid": "b85c0da8-c826-42b5-9882-46af3e0a37d0", "comment": "Malware payload", "value": "d71aa8d584e5599bd52b844c20f1c43c205f3c0bb8817463669c60e03090083ed600967567a2fc9870dc5681fb2ec8f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521813, "uuid": "4d977d51-beec-4621-b2c2-445c248d8a0e", "value": "T1CAB4322DF0AC4634DAD0016092F98D29853FBCCF3B5ED250A69E68FC9BAD1541D1BBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521813, "uuid": "7e42612c-e807-4612-87b4-c23c37b3a67e", "value": "6144:wjmd2xCQz4c+5Xjm0ZyiVXgF0dk0cXuM7ea83d2le6eVinMQd1roRCDJEE4XirDM:wSxQ1udtG0cXkaFlpotM3Be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521813, "uuid": "2ad6e0cd-4030-41ef-b9f6-b6f4d0585706", "value": 508916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521813, "uuid": "10d35f30-c2ed-43ba-8566-e01917d9a85c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521813, "uuid": "4f96e4da-6849-4d79-a055-132f92127560", "value": "Purchase Order-459.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd6762a-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786539229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539229, "uuid": "63f65a7b-662a-4243-8eec-a1db627b54b5", "comment": "Malware payload (Mirai)", "value": "5cac4a8db89f102da77d97a11abfa04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539229, "uuid": "85ac7d29-2f25-4c86-a92b-0cfb6d11b48e", "comment": "Malware payload (Mirai)", "value": "6a1aa262ce658a42362fd7489415cb93e34b7415ab972d78c63f09f413af5b55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539229, "uuid": "f89080e8-2465-4c00-a94a-cfd5df0fddf4", "comment": "Malware payload (Mirai)", "value": "92e77bf45c449eba553ef782b61954b1460b2003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539229, "uuid": "154cd810-645c-40a7-b34a-4862df400610", "comment": "Malware payload (Mirai)", "value": "3a277ae9b54b2923dc8bf35a1830cf7deff761f17a1bfcec69da1be319eb64d153844ab0b056404ee9c0a3bc4fcd2e19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539229, "uuid": "4274d2c9-49fe-413a-b8dc-99d09d332b99", "value": "T149A2D03AD2FA8AA4E3D858BD0C9E358C0514B14CC29980B49FCC2933A417B597E79FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539229, "uuid": "7a2fdb8d-c484-4866-84bd-819aff4f6814", "value": "384:M+3tPrFs7PE2ePF9MnVYd5805+ciQuT5xIgjnTtJHJqeymKSpRkANaNJawcudoDf:PtPps7M2eXgVa8HcOgsbppymRqnbcuy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539229, "uuid": "407704b2-34bd-4194-9512-c1085f64703a", "value": 21880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539229, "uuid": "3ed06288-0e9e-4a31-b47e-52ab32571302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539229, "uuid": "44910b68-267b-40de-98e0-a8ff7bf87000", "value": "miron.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11de1f26-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535023, "uuid": "1cfeb690-68f3-4a5f-b67b-9a21f2eb2cb8", "comment": "Malware payload (Mirai)", "value": "4332601bd28a658adecc59f1a4db48b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535023, "uuid": "a86c4e5f-7221-458f-a488-ac52bda11495", "comment": "Malware payload (Mirai)", "value": "6a8e20825dd6494503b306077c7c512b88412e740cae0bffd1066fdce9749935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535023, "uuid": "581c160e-d6e1-4f68-bca4-d7b034b0d98c", "comment": "Malware payload (Mirai)", "value": "4a89943a180995ea9e6b7e9e8e66ebad58545eda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535023, "uuid": "7b4d5e8d-02f1-421d-aa75-e60aba2b8107", "comment": "Malware payload (Mirai)", "value": "ade0fbad169cef25788032997b527b49cb58ee00d17fbc03d0c368176f0c1fd68bf681a72a21e6989666ed95ba921308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535023, "uuid": "5f769159-6d0a-4833-8a39-4530b8a3cf64", "value": "T1A4D31941B8505F23C6D522BBFB9E428D372657ACE2EF32039D216F14379A85B0D7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535023, "uuid": "d6b42dfd-02dd-4175-a405-529ea0376d64", "value": "1536:ujm44tabyCUDcT5dhdrZZ4Qtn2yQqGAK4VboSTnxCPl13iwywmyHEbLM5TGN6Ltr:ujii/PHZdtngqGZ4SSrxeybMfHIUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535023, "uuid": "fced1a62-9d42-4354-ae86-5fda6fbedfcc", "value": 133664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535023, "uuid": "3f3e1702-c37c-4f99-81b9-0db121f65832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535023, "uuid": "5e8b0395-2de5-4464-b756-cd4e12dcc1c6", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4973ec-968b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786566046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566046, "uuid": "26f56d32-156f-4459-96e5-b37592c5022b", "comment": "Malware payload (CoinMiner)", "value": "13beeac1ef1955b907b4e878fd24e904", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566046, "uuid": "4c3c0448-ac2e-4c41-b649-b2b1a7a9b0d8", "comment": "Malware payload (CoinMiner)", "value": "6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566046, "uuid": "e92c6fd7-8e84-46e8-a00e-8eea59d7b622", "comment": "Malware payload (CoinMiner)", "value": "b2b315b0b2f1ba03f18f5a48dc3ae97088b22821", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566046, "uuid": "fcafcacf-da20-43a2-9459-09f7f8befade", "comment": "Malware payload (CoinMiner)", "value": "1061f485bc5627250697f9f20f2cc75d492f896a073f5bba9db6bc70f2df091a9cce41da857c873189673376ac07810e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566046, "uuid": "3ff11476-385b-42bf-b068-35fedaf9e17d", "value": "T1A9068D03F69580F9C05DC079874B9632FA32B8890635B2EF6BD45B213E66F906F1E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566046, "uuid": "1d43173b-d4e6-4598-9056-a95232b784bf", "value": "160c101dd73adb2f729e5b922904fc20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566046, "uuid": "13b2e64b-ddb5-4ff7-a9ea-c0833091f8dd", "value": "49152:jFzjDLG7Q7B4FGgLRqZ1lMYgInYo2VKzSVvwGtulnWjiRnSJgLw15UlO4TsEFq7D:4W3lQ6rSuA2SJ+w1MTg7N+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786566046, "uuid": "66bde59f-5fca-4705-9f1f-b41f1600e359", "value": 3966464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786566046, "uuid": "34ab8351-2730-4da2-8c88-57b204e10d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566046, "uuid": "8c959a21-328f-4996-a763-3cdd0b03609a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926bb76e-9684-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563156, "uuid": "86727890-2c32-4e4b-a455-ebb9971d3045", "comment": "Malware payload (Mirai)", "value": "361b1d1ea43ace75078ce061e0e630e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563156, "uuid": "abe5a38b-104a-4d0d-b367-d1d675dbdb2a", "comment": "Malware payload (Mirai)", "value": "6aed3b4141af46c2de4183bcc5f078da6a3ba62e70529f23128859b62b3ec725", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563156, "uuid": "f831e7b3-7499-44d1-b88d-cdefd9488144", "comment": "Malware payload (Mirai)", "value": "e68e9f82d9b67f60dbbc97bbd1c891f9e8b1177c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563156, "uuid": "5e3f920c-1edf-47a6-9d49-462e7f310f75", "comment": "Malware payload (Mirai)", "value": "a0ea07b229ceed559945696194c41177d7e113b825b83733952335ea9b573398902965c06b1bf3ab45ca90c08564f929", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563156, "uuid": "5b1eaf8b-22cf-492a-953d-a37074015d22", "value": "T187C33A06759144FCC15AC074C77FA927EA31785D13343ABE6B84BA71AE22E365F0AB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563156, "uuid": "05d4a42c-cb0c-41bd-b273-9bffee0325a9", "value": "3072:8VHvHiRTZ6cYGA9A5AGknCPFA1A9hdG4tw:8V03YGdkn4FAIhdrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563156, "uuid": "729759b0-d51b-4e79-a587-9308fa0f989f", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563156, "uuid": "af84b649-dcfc-4880-929c-2b3cb87986e0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563156, "uuid": "3fd9eb91-b2ca-42d3-95bb-a4ddc6780c99", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d5abbb-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517066, "uuid": "9b8c4f35-89f1-4a51-930b-b02b85b81d6c", "comment": "Malware payload (Mirai)", "value": "ac74a87a2aea4b3a4a578754679bf616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517066, "uuid": "f3cd29fd-9dcd-4666-a4e2-75024a1bd655", "comment": "Malware payload (Mirai)", "value": "6c10f3598aa30c8668c9b006bde05c88ebd460682fb91520516591afba774818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517066, "uuid": "200a7bea-ca8a-461a-a99e-706cf811defc", "comment": "Malware payload (Mirai)", "value": "7c50d040c54e1eb8abe9e1b07bd1ed1adb296dfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517066, "uuid": "e660278c-60e3-440f-bd0f-00a5652b0b29", "comment": "Malware payload (Mirai)", "value": "55918f1061e47b01457565c48e8eac76c321c2a1c2d672f20ac77f0651ad0de3286029c1044591f7edd221273b2116f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517066, "uuid": "b944a659-9e11-46f1-bb0c-7cba48626a07", "value": "T117F3F745F8919E27C6C612BBFA4E428D3B2A27D8E3DE7103DD255F20378B55B0E3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517066, "uuid": "a98da7a2-ab64-44d6-ae7e-79ccee2c4576", "value": "3072:1tXqoxyKkp/nsB0SyO6vPmZl4y4s/BF4pM9XK25Rm:1QQyKG/fS9iOj34aBF4Gb5Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517066, "uuid": "08d58af2-ed1f-4a87-9a1a-0707a299f90b", "value": 170816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517066, "uuid": "c07f6e57-a9e1-4b06-add0-4645bc6dd947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517066, "uuid": "512267d9-ca56-4e00-9e43-89bd83c54ed4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e412e5-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786509229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509229, "uuid": "78945bd0-5a01-4bab-8c80-f0a2159c847b", "comment": "Malware payload (Mirai)", "value": "9a0ef188dcac4697be8092daadaf0b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509229, "uuid": "f20ef40e-d032-4080-b33b-0f28899e3b7f", "comment": "Malware payload (Mirai)", "value": "6c15b783dd29f5d28b1dacd9154947931d00f442539c4218c36cc54fbf76b885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509229, "uuid": "a0ad4b0d-044e-4e7b-b5de-cdd51945e3b9", "comment": "Malware payload (Mirai)", "value": "533207a43d95f8a89af3cc05108a06815f6e05d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509229, "uuid": "621c957b-3d4e-42cc-92c3-8d635e08ffd3", "comment": "Malware payload (Mirai)", "value": "21cdbbb6360497fe6b9cb6dccd8121431b342aca9993799f70afda6ceac5d43986a696ec093cfb9458724ad42548e418", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509229, "uuid": "dfbbb237-db21-49e7-829c-9a06877a2c6c", "value": "T15D23F1B1D099FB5DC88C10316C1E7D5B8D24F18D6D5F8E6A58F480F1C921FE52C2EA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509229, "uuid": "797681da-e6dc-41da-a09b-40c617a9c0f1", "value": "768:4hHNXUVTQipF+FPU04es3tktMZ95/1aD7zw/Mw4a6b9SybDaR+VgPY1qGiV5kmKD:UpUVMFohtWMj5/1y/q4/9SybDaOfQJXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509229, "uuid": "8e59686c-c9bc-46e2-927b-3be21c94be35", "value": 48688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509229, "uuid": "beb3aaf9-f481-4cf9-885e-3f66c2abac43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509229, "uuid": "de3ac4b8-62d5-4730-a37f-0135a1203c28", "value": "6c15b783dd29f5d28b1dacd9154947931d00f442539c4218c36cc54fbf76b885.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e11f5a-96a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786577288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786577288, "uuid": "e61f9006-a436-4135-a45f-448b5951c67d", "comment": "Malware payload", "value": "427a8774a668af50e0023b34c244d979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786577288, "uuid": "a68488f0-2d45-4c0d-a039-9c5835970bfd", "comment": "Malware payload", "value": "6c37df31d27e6bd1baeb985ecaa4b9b3767b70076c9c7aa403b5c4f0e68fe0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786577288, "uuid": "5866299c-dd61-4c87-bc34-7746669e5504", "comment": "Malware payload", "value": "aa0e5a047e6e5b6937dc96d0fe5ef5d2f249c0ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786577288, "uuid": "f221c575-7816-4b51-ad1f-aa5188ec5b96", "comment": "Malware payload", "value": "7d74b65476200cf8efeb6cd4d196d62216be2f0b5c4cbd3ad853912f4e6bc57ebb2a70a4830e59ef32acae4790eb53e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786577288, "uuid": "47ddbc71-0264-40ff-9595-3fd4699d84f8", "value": "T189173376A3E548F2F8E397314A03859477777C981730E8DB43A09AA52C771E83A359B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786577288, "uuid": "e6c79119-03a5-43bc-af8e-3ff40a9c062b", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786577288, "uuid": "54d41bac-0a1a-45a2-9367-25be83a3f82f", "value": "393216:h85vzd2aoEeJ0LohVEHCYFqAONLuC9hHTodRGkXMkVtbmvq2AAvd6:W5vzd21nbhVEHCYFqfSCX0LhXMiyvFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786577288, "uuid": "52345105-e33f-440f-a7a5-eee76c3af240", "value": 19751892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786577288, "uuid": "bf43fd5c-f0a1-4444-96bd-298bc82f37ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786577288, "uuid": "08a46084-d6c7-456e-a27c-f6505d6ced65", "value": "reportsaccs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc09ffa-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786520116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520116, "uuid": "e81e88e6-9cdf-4f76-bc11-6f205c025756", "comment": "Malware payload (AgentTesla)", "value": "6fdc770a811b292e4a300beaf378b43e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520116, "uuid": "c2f27f93-dc73-4015-a937-27109604eb96", "comment": "Malware payload (AgentTesla)", "value": "6c9aca8232da68846da73c98b6d114dc2e343456a6aeafb8e6fa5d00b0fe2e9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520116, "uuid": "ab46c3b0-71f6-4adf-8569-cc019e889eaa", "comment": "Malware payload (AgentTesla)", "value": "0b34ba68b3618316736447eda9ee8e6efad325ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520116, "uuid": "1e2fa551-c3e4-40a6-8291-6a1e870b98e4", "comment": "Malware payload (AgentTesla)", "value": "b34c188b24a0b09a888ecc62fc4aae77325249fac05af57dd32ecd24b61f52eadc3240446d0bd43ff3a6567aba53a42b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520116, "uuid": "d8affdb3-b023-4428-afca-0afd9132a43f", "value": "T1B582F75B6D3236244A8727EE64DB46F4C869387FDF1219F07EAAF5044D16B8C32AD40E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520116, "uuid": "e44397a6-e61d-46b2-a136-7ef65b5b47c0", "value": "384:gUM7lZ0HxAEjulgrmFg3QKAEF6rW9tgUZ5cb0FfhFDHkjbaMq:m0xvaMmFiQfEF19tgUZSb0FfhF7kjxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520116, "uuid": "83ad38b3-b26d-4421-8c61-b7a8863e6780", "value": 17830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520116, "uuid": "bc58f84a-77b3-4879-9bd3-f9657104b840", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520116, "uuid": "a1a1a26d-58b0-4373-9623-cea472b48547", "value": "VAI 114766_260811 Rev01.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fdcf68-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "ddd342c6-ca71-4cb5-9564-ce9d2e75ae37", "comment": "Malware payload (Mirai)", "value": "de274327bfdb78f3ae8d4cafa65ba6ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "52011126-5199-4f13-ad54-fafa460a4ee6", "comment": "Malware payload (Mirai)", "value": "6caa85a5e69e21f529dc2b246b38e13ba24902dc5721309c70d7c1fdf2d4367f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "658b2937-51aa-4fa7-8ad1-aa90613780ba", "comment": "Malware payload (Mirai)", "value": "7235a8f293679845eb49f8c090cbdbb96b35cb50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "e5cdbff7-5923-49db-8136-688cb42892f3", "comment": "Malware payload (Mirai)", "value": "9e162ffa99cf231d093230dbc0d0816b21c9d0db0dc8e4b8242452bdfb933efa33848f0ad2c609fe89f9e3a6251b6d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "3483205f-4cdc-40f1-8e05-04244fef621f", "value": "T106D3A3552A519FDEF6784231B27F8A21F75873D22EE2C2E8D75CC5000D2025FA91FEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "91395fce-3303-4645-8b93-433c71f97a8b", "value": "1536:mzHP+wHALzfozfr0fn9SoPihN2A4e1im9iAlN0Ayxi+3cgIAFJtSJqYXFZs:w8CCxAlNZyxi6cgIAVSkYXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511360, "uuid": "60dbc8fe-0471-4b01-a35c-b5deceee1696", "value": 134060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511360, "uuid": "fd7e3e01-22a9-4587-9619-45275e2d5c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "6aa4c473-2571-49ef-9cc2-4b10facab7b7", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de81dc7-95f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503448, "uuid": "dfd50d7f-ead4-4120-a741-a9eaf2faa912", "comment": "Malware payload (Mirai)", "value": "6ba20c44231a7372332801fc0f8f3f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503448, "uuid": "c9a68228-0d50-4bf2-b834-33b5395171b2", "comment": "Malware payload (Mirai)", "value": "6cc212883df2861669b9b61feeb9b7735fbadc81093f20feea95612375f87d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503448, "uuid": "f3f685f0-ddd6-4b2b-a697-1d1a5ca07ef9", "comment": "Malware payload (Mirai)", "value": "ed3775ed4bb729e88444aab680f63ebb962f16a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503448, "uuid": "2a964df2-291f-4f67-a7a1-5763b3a7d479", "comment": "Malware payload (Mirai)", "value": "1a25d53ff0857e80b990f232f278f7c6fb14d0331cb06f8d27905fd7b56b61e6bdc37e5ec9f143837f7be12c7aff32d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503448, "uuid": "209984ea-9f5b-41b2-b441-a26a62f9da64", "value": "T146D3126AEE48A2C5CDDCCE7C67C7509155B870E3432AA2B4AEE04194CD1704BF97FA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503448, "uuid": "c148ff97-7cc3-4f68-a5db-a017ac19c1d6", "value": "3072:3qVu4HohRQqW6QYG/SPRCLhMCSOn5AHgz7M6W0zCFQ4H2Z:aUv0qSXaRehth5AHgTW0zCFQY2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503448, "uuid": "8e010d99-67cd-4bb5-913e-8ffb27b9e112", "value": 139420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503448, "uuid": "48ee9fbe-61df-4afe-8d69-ddcd35ac588a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503448, "uuid": "5a844b6a-e86b-48b2-94eb-ab8909d1ea1e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94899558-9656-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786543402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543402, "uuid": "efff1842-183c-43a3-9106-397717c1064a", "comment": "Malware payload (PureLogsStealer)", "value": "0a7f6cf66f1cbe59f7805848b4f772ff", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543402, "uuid": "3456b46d-e98e-439b-a3e8-e4e42d13a1eb", "comment": "Malware payload (PureLogsStealer)", "value": "6cfca1df5d4956a891132cbabaf41ec39e24ed3343a62acd5d47f9d2bef6b138", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543402, "uuid": "8b33c484-b23a-40fc-8665-144e166cc9e1", "comment": "Malware payload (PureLogsStealer)", "value": "7258c9b0b20b927b6fb8b7e146c923f4fd9a6a92", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543402, "uuid": "e55d43d7-9ca0-4c44-a8df-ed8fb7704e3f", "comment": "Malware payload (PureLogsStealer)", "value": "fb4ce4e3b859f596cb7c5c5c93c5a352ad8e92a32cd6372daeed4a12fb10ef408bfd0afd11816012c21b2a101cd39835", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543402, "uuid": "cacc011c-be71-40fb-813d-52c0b23efd9b", "value": "T15CF5C02439FB502AB173EF6A8BE475D6DA6FB7333B07641D1091038A4623A81DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543402, "uuid": "b523a703-6bea-4ec5-a4c9-983f6a273fa3", "value": "49152:NG3aQiEcdoOFojfyF05CBbJ/JlU0dekZQ3fF:s3IEcdoOeEBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786543402, "uuid": "a9b6217c-6d66-4f63-a121-179b89ad3956", "value": 3504640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786543402, "uuid": "f8196003-2893-42a6-8bcd-6999027cafd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543402, "uuid": "0dfca439-fb68-4af6-b71d-955b570ccf00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cb5dad-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786498710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498710, "uuid": "78c6fb22-5b35-455d-82b1-9765a0918bdc", "comment": "Malware payload (Mirai)", "value": "0529da452641ee0146d85b69b31ce7c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498710, "uuid": "a2f4ddc2-0eff-4565-a10b-6421083ecd5c", "comment": "Malware payload (Mirai)", "value": "6d10e468b2d515ac2a5a9113c4feb3ad06b3cd7f1df92fd94acf056c35836996", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498710, "uuid": "5706f56b-e051-49a4-b778-cf30515006b3", "comment": "Malware payload (Mirai)", "value": "c25fdac85ff3c46e22348a1f4842a7143f7612c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498710, "uuid": "eb78e26d-3abe-4e0f-8fee-3d270b2ddede", "comment": "Malware payload (Mirai)", "value": "643908e3d13b40558fa6130d27e2dd71b32fdef823f0a2842c7b968c8baf259e24ea6fe38fbd8018a01610c04a15bc71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498710, "uuid": "caaf9e21-1d29-4c74-9204-a3abe7bcf75b", "value": "T13453F17EC1872EDAC69DDE79F068B3459D8554F160EE42D42B13D882B602706D8C9CFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498710, "uuid": "baceb978-7626-43c3-afd2-4726f349b0fa", "value": "1536:kTV6S9NUwTtqSoz07EgDGejE7LpiC1rl0KV27bYaGMhic1NS:wvtoz0ogyxpi+rlt2xrHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498710, "uuid": "9f2d51e3-4b83-486f-b819-156a50acbe39", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498710, "uuid": "96378220-1406-4f25-8e82-558e5bbbb740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498710, "uuid": "6d5b1f6a-b45d-4098-9687-cb76193655e8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9bea1a-9655-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786542804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542804, "uuid": "3e352310-b8f5-4d9a-8319-f1d8a4843dad", "comment": "Malware payload", "value": "ac7135d0f6791070d7b290909af57e62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542804, "uuid": "6da59888-dd15-4c82-9a4a-f8b975c52b5a", "comment": "Malware payload", "value": "6d62cd3bdbefebd6e8d3ec5ab2dfe540ba0a66ce5ca777fe0533fa8a3f3cbb7d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542804, "uuid": "44804e0d-5d15-4155-8de6-6c19986a7530", "comment": "Malware payload", "value": "522652f8a0e5e90aa024845e4bb7ed2bbc38bc9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542804, "uuid": "1ac14823-f65a-408f-a160-af5a12c9056c", "comment": "Malware payload", "value": "91ce03d2ea2ee5924c69bcbe6cd022af6c133051d3df2b4e1f68c92e22aafe0fca0f6a50d7152df46a1153b6f2281a54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542804, "uuid": "c1cdeb4f-7ee1-48cb-a8da-5eb1cdc059d9", "value": "T1C6C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542804, "uuid": "bb0238c0-da16-4729-8062-52e077ef8ccf", "value": "768:h8vCB+25j6es8RG/9FYpMSUpi+20qUpi+20YQX:h8l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542804, "uuid": "f8532631-de14-4410-b1f3-5d9362d97850", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542804, "uuid": "96ffe386-59ce-4d04-ae88-49d56d9a3b73", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542804, "uuid": "8c945983-8225-4780-93c6-2f00a5eeae61", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4425929a-966f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786554005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554005, "uuid": "f2a817e9-b5d5-46f7-bb1c-784619ed54db", "comment": "Malware payload (Formbook)", "value": "c4637228898b32d3b0f545f8f6abe6fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554005, "uuid": "22fa0632-973c-4091-88cd-b304ce248e63", "comment": "Malware payload (Formbook)", "value": "6db1729e39bac1b582584c68919f2ab31ea015e7bb6ed5e4b1d2a5bf5b020095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554005, "uuid": "db712e12-a8b1-4fc0-8212-5a5227768a7c", "comment": "Malware payload (Formbook)", "value": "b85317a6c4bf72076b51a6ed6c6cd401874d48d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554005, "uuid": "b37699e2-2449-4e20-b80b-3f716931022b", "comment": "Malware payload (Formbook)", "value": "8898eab8c91bab47d668d7bc764b784b20bf30b5fbbd0c193a9e22f7204eabc3e9bcf9bf228018026e8ef0b4ed20b1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554005, "uuid": "6518377f-7d50-4d0c-bd31-deb3c92c6fd8", "value": "T14035DF542217DB33C462BBB0C933E2F516A45D95E911C23B9AE57DFBBF36E342844282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554005, "uuid": "16d7ce18-9fec-4219-89b6-888c3470cb27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554005, "uuid": "9bab2ec7-37e3-4119-925c-8b65519ad0db", "value": "24576:FThRQUotxNsAOYwDX3gI2t00QPkHc8Ik8SrW4x7GH4o:FNuUoBsAOYwDX3gIBD888IFSB7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786554005, "uuid": "fe09788d-432b-410c-818c-4ce77a725952", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786554005, "uuid": "7018aaf5-934a-41d5-8308-65b477bfb2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554005, "uuid": "448ca5a6-c0a3-4d04-a17b-ca299edd30d1", "value": "rnovaordem_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04326913-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502788, "uuid": "dcb3a409-5c0f-433a-9586-f804901499c0", "comment": "Malware payload (Mirai)", "value": "93f5a59281610bcd209613b130b7b48e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502788, "uuid": "7ffae59c-7c6a-4e2b-804e-a5f97662c3bb", "comment": "Malware payload (Mirai)", "value": "6e061c8b4c4c97b16eb51f90538686bc5378ecf7a1072786f91ae5556ea3d383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502788, "uuid": "3a192600-8905-441f-b541-cf31936df0d2", "comment": "Malware payload (Mirai)", "value": "c62e56a40e38a98453c90d86a552322049aa37ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502788, "uuid": "139bf39f-c684-41a5-8f72-b2a68ef712e5", "comment": "Malware payload (Mirai)", "value": "2bf55205a994e3595aa400b40a5e4af19316cf65300381efca01634ccf3e9da4d132286530e713840ee9fc9a10de1064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502788, "uuid": "d479c420-af6e-4ebd-925f-0f7581784e2a", "value": "T13034B71EAE228F7EF669873447B75E259B5D23C623E1D541D2ACC2101E202DE641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502788, "uuid": "c5da48ac-fe75-4c90-8bb5-ec9cd8ff06a0", "value": "6144:5JPrzzWFDd6Ojhmqr9abSyH+7YWOIn0l1A:TrzyFDd6OjIDHgU1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502788, "uuid": "eb3d9d0e-cb7e-49d3-a960-f2c0cc2699ce", "value": 231140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502788, "uuid": "c2dfd8d7-61ee-4098-91fe-8317b774cef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502788, "uuid": "e3f79a77-f1e5-4f10-a513-d933a2db611c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f07318-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520244, "uuid": "e0d86b1c-cd7c-431c-b1d2-3bef6db19591", "comment": "Malware payload", "value": "986ad15179e746a9b602e548b9db48dd", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520244, "uuid": "778a5305-426b-4ec1-9fe3-031fc080a3eb", "comment": "Malware payload", "value": "6f558a93bcaa6c348beb37dee9a0d05cffac8b328d7300bea28123303eaf9dc4", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520244, "uuid": "764c52e9-f83e-428a-a866-d4cd9b2e51d3", "comment": "Malware payload", "value": "c2f8a042e617573635d22249f29184972072d83f", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520244, "uuid": "d18c3c2a-a498-4682-b713-1cff66e4f1aa", "comment": "Malware payload", "value": "981d6df235d57c6c50163620b7314f360b58327f0aad2fbe073a698698ff7d11b2063c92784109c0592f5bc179c18e34", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520244, "uuid": "fe5843ea-b836-4468-80cb-1797847655cf", "value": "T165051202FF408C77D58617351BAB61D6972DFC27EE728A4B3301732ABD766E1C96081A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520244, "uuid": "dd0882e0-11b2-4a47-8db3-89c2a94563af", "value": "24576:HbLSv9k73KIt1QRT/64rmWNB27M7upNkE4u:HbL33KItmB6I327M7upqE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520244, "uuid": "9fb4d408-68db-4037-952a-48788a34093b", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520244, "uuid": "7574e5a1-7513-490a-82f9-d16a195cb052", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520244, "uuid": "9025aba6-3e07-44b5-9c1c-eec44099cd25", "value": "3301-20260810.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819f392e-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512876, "uuid": "149dac37-7516-4efb-b17e-b04ed0b0fb35", "comment": "Malware payload", "value": "b32b1f845f289117c532f65bcacdb70c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512876, "uuid": "f08c88b6-b303-4f0a-9982-f3b3dbebe7a0", "comment": "Malware payload", "value": "6f836cdcc07732bae850a57b5eabf9a69697dba35af5272a71795f67fbd84202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512876, "uuid": "c1c658e7-9099-47b6-a220-bc68f563ab0e", "comment": "Malware payload", "value": "8df7493bb11d1f7d914b0bd44c258bfb5c16028d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512876, "uuid": "39370767-ab04-497f-89e3-9252432fe01f", "comment": "Malware payload", "value": "e4602d2a2bb957d89e02d4d6154afc044738ca95037f13fa7a7cd08efe0f1a8a41d1dfeedc201d9b347f45bd97b58321", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512876, "uuid": "bf2f6e4a-5015-4225-97a8-4c37dbd5dc7c", "value": "T118B67C73905324D8E1A889B4D51416527DBC3C8B5738A3C7BAC471F66BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512876, "uuid": "1da50a94-c886-4543-979c-85874273ec65", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ9:cqYUQuVDt0TZEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512876, "uuid": "21d309cd-1107-4d7d-a3d5-5c3ccc807ee0", "value": 10518528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512876, "uuid": "388ef5e4-c412-4dfd-96fc-b5e0f42d179e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512876, "uuid": "f1a88935-4ca1-43a5-89aa-0ac3b8dc9cf8", "value": "6f836cdcc07732bae850a57b5eabf9a69697dba35af5272a71795f67fbd84202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cefe986-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505889, "uuid": "cf8d138b-9895-4cf8-9a06-47c5c693ff67", "comment": "Malware payload (Vidar)", "value": "9623eed7395d431ba8f0caf6ff0aa6b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505889, "uuid": "e02321af-96be-4e97-80e6-4bcd63093838", "comment": "Malware payload (Vidar)", "value": "6fc1a755028e6cf2d7e30daff9fde36bed33bf0aa58ecf2c2172e1f4726888b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505889, "uuid": "69c22749-d00a-4cdc-be1f-d480a22240a5", "comment": "Malware payload (Vidar)", "value": "dac520fec1cdcf559bacbf00f10c1a3a29d84de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505889, "uuid": "e138562a-9b68-4d88-a32d-fd5f82924126", "comment": "Malware payload (Vidar)", "value": "8c30cb56fcffbb238f940380eb8576343015ee25e068eb88329436fab32f2d2e30faa8e9c0139ec1755afde403925267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505889, "uuid": "f61e1083-4220-4ee2-a1db-98e5f13a870b", "value": "T179D59D0BBCD009F9D8AA673549B24296BB34BC590F3623D32E54B6782F327E15C76B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505889, "uuid": "5aff0632-8ac8-4958-858b-7349af3309db", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505889, "uuid": "2715d5fc-7d11-405c-922b-b1efa05b3b7d", "value": "49152:uJzs03rMnbDKZbxvLuOEPJWckOXf+ZyvQJD8L9Yd5UvvQjeembfia0Prog:uJB5xvLulf+0EASduQSX2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505889, "uuid": "511bf84c-6331-47d2-8e90-0c08d8aa7994", "value": 3003280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505889, "uuid": "85d32466-2c1c-439d-877e-93c7b981f40c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505889, "uuid": "77c9632b-4ed0-4aba-aba1-4b35e4adfe38", "value": "6fc1a755028e6cf2d7e30daff9fde36bed33bf0aa58ecf2c2172e1f4726888b8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd94f371-9692-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786569295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569295, "uuid": "c8bf930d-4ab3-4fd0-a23d-cecea090feb2", "comment": "Malware payload", "value": "b5fb6ab87d9d2e0fd02008f29597cf4b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569295, "uuid": "db90b1df-161e-4326-bad7-9ffd7d7c455b", "comment": "Malware payload", "value": "6fd1c8e3daedfe0ff0c6ec7e4f0bf4d085cdb17b0230f13b6d33496785a9c9cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569295, "uuid": "4b458091-e0e7-4861-babc-cb6636f3ba4c", "comment": "Malware payload", "value": "e1af6b59a3661aee0bb8087a59a283da39a23119", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569295, "uuid": "690cc53f-1e09-49d4-8e63-acfc409351a7", "comment": "Malware payload", "value": "4fd1bb5964dbf60d2cdc567aca89ff9cdf6f4c0a34f61d240fa5ecfe50f26a4873279b0933361350edf8e0167c485392", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569295, "uuid": "fe4a7157-6d2a-4c4c-a388-0632782ef67a", "value": "T11DC26D956A867C44BEC94A3E4CBE2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569295, "uuid": "5dfb80ef-581b-4e83-aadb-c3ade90a8931", "value": "768:t8vCB+25j6es8Ri9FYpMSUpi+20qUpi+20YQX:t8l25JEd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786569295, "uuid": "e716d5ee-42c5-4177-8cd2-b17151480946", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786569295, "uuid": "91ca23ef-98dc-4954-b846-2cd624dd49d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569295, "uuid": "065e0363-5e25-47d5-be7b-9c0d8e9d7e71", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaa1f8c-9648-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786537539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537539, "uuid": "ebf0c4b3-58f7-4402-901c-b3315d36ace0", "comment": "Malware payload (Formbook)", "value": "3fa91e82764b9e277c8cfd4f364d91c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537539, "uuid": "468a42ab-64f1-464b-a88b-0c327ec08eba", "comment": "Malware payload (Formbook)", "value": "703ef22683b3a6f2e160b3b32ae81e9bc7e5a84b05c84bf25a9238d3b93e05fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537539, "uuid": "26105898-33cb-4760-88be-b957e3426e49", "comment": "Malware payload (Formbook)", "value": "431dce6cedabdd677261e1d8525eb6be53c1c078", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537539, "uuid": "6548387b-86ad-4fd0-a2b0-32723f287382", "comment": "Malware payload (Formbook)", "value": "9fc8affc45fe2e79393429a70a71d29919fd38faeeb10a45c5ee70e6c49e05c5949561ce62d9897610ff6ac9979cd83f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537539, "uuid": "b2a7cea8-cb03-48c1-bcbb-46a074baca4a", "value": "T155D30E4456D22954A3336B3F762A98D4F77717A701840907F87CA490AFF2D0BEAE1CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537539, "uuid": "dde2f8e7-d5e2-4c8d-a9ca-400740867c9b", "value": "1536:oogLZb5Gec4vvdSgkVrzdAjICvj9QQemlW6QLc:tebkhFzajZj9QsW6QLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786537539, "uuid": "7b8b4994-549f-4881-852e-c0964c3cb294", "value": 133189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786537539, "uuid": "2a37fd2c-0cde-4247-ab37-fccc5d51ffa9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537539, "uuid": "7b70da7a-e5eb-4b3e-9b5d-c9075a9e536d", "value": "Swift-Receipt-TTUSD34,456-ref1208268650_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede05979-969c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786573617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573617, "uuid": "a9ce524e-065d-4d28-b620-cc3ad1efca16", "comment": "Malware payload (Mirai)", "value": "b9b88d387e82c59a331368298f96cdf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573617, "uuid": "2119b286-0bce-4cef-b50d-81c656ea49c5", "comment": "Malware payload (Mirai)", "value": "71613db242e2659dec7a3ce13b56367dfde705758f66a140baf24907bcc8ade7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573617, "uuid": "10187165-c134-4dfc-8b1d-b5e69cf7b653", "comment": "Malware payload (Mirai)", "value": "24f354b866e48b7220a0bed1f233b896a64bc982", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573617, "uuid": "cca7cdd5-c9b7-46b1-8251-4ed0cbcc2f77", "comment": "Malware payload (Mirai)", "value": "9bb3bdb3077ba8d95f26cc9df28ee08fe25820d4059bf8831844301e114fbfa75e634ad5be5ea8098d3258439b68b28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573617, "uuid": "34b88b6a-d2a8-49a5-87e8-d7a4a6422234", "value": "T176F31856BA519F12D5C321FAFB9E814933136FB8E3F971029D206F60278B89B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573617, "uuid": "1fffe933-9787-409d-b0f1-30d1826cee9b", "value": "3072:cCnNFd0HNN4Oeb1JiDtpRMtLJcyRhaHqCKy+oI1mHpzZ1BtFWbogfm/:cUNFeHNNfCJiDxWJhhaHqCKy+oIkHpXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573617, "uuid": "eb1e0d9d-21ea-4166-bd96-29bebccc358a", "value": 163044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573617, "uuid": "89b479c1-1dba-4967-a5b0-23b867e14ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573617, "uuid": "f2eaa15b-ef91-4959-a0cf-c3a570b4c92a", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ba40b7-968f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786567931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567931, "uuid": "5be3646f-fa55-4cf9-b849-3ace7c39dc0c", "comment": "Malware payload", "value": "bdaa5df2fc0926b1f0f20b9217631147", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567931, "uuid": "0b0c319f-3dea-407c-8f35-eee47aad3561", "comment": "Malware payload", "value": "71883121b2f9a24a74c37974317962160b3af5bd1146d8ae8307c3d28c75a2e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567931, "uuid": "aaa471b1-2716-4ee3-bd45-27ffc0bbfa04", "comment": "Malware payload", "value": "0b3197b593fe439f67ea525388d4c37cd0130391", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567931, "uuid": "14e14c2c-dfc6-469f-b943-1f2e8108395c", "comment": "Malware payload", "value": "b11b8bf285183a9f024f728a6bd498d9c6916b51a1a4f53264aaf8652643bff12470d8328d30bdd528420292a42432fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567931, "uuid": "75063146-9760-472a-88ae-a79370e044df", "value": "T1F43183DA04151E322103CA9D7362359CB18EE2EB695FC7D4DD494EE9418838CF1A5B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567931, "uuid": "82462513-6701-4e98-a377-586899da5678", "value": "12:U066xlf6RU8AL6ApIWxKWblY6KOOl9DDi76Wzt6eCNWGi6NWGa4zaVL6V0uL2vmV:ZShhscl9Dy6qe0Rzj3EWx54wAqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786567931, "uuid": "a3432252-04d2-453e-98ca-038b4ff2c0f3", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786567931, "uuid": "746207d8-3446-407e-9343-0a4b84aa2f33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567931, "uuid": "3ac62c04-60d3-4184-af72-82eb24e8a613", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40956554-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500312, "uuid": "909cc24a-40be-4d88-a814-27952ab4358f", "comment": "Malware payload (Vidar)", "value": "2fa6948805ff8fcae8c922517892052d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500312, "uuid": "85baa42f-b7f7-448e-8b8d-4e7f244ead2e", "comment": "Malware payload (Vidar)", "value": "719b5941f17a6bb3b8692f531d7f335c774cd679c9662baed9364cd08f40f6a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500312, "uuid": "381bd03b-2585-4142-b473-bec6dcc55e06", "comment": "Malware payload (Vidar)", "value": "9f41a035120349c0a3b9dca85bb1baa37f73f3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500312, "uuid": "9b4ecfad-a41a-4761-b67f-b3ebfc41af13", "comment": "Malware payload (Vidar)", "value": "d8ac417e31cfb2843bd42e466c73acf4390e8f53e60c31865b97cdba8397a7d25452c2c8870cce07d3b2c6caff690f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500312, "uuid": "ccb1ec49-b12c-4422-87d5-0f5f76426d73", "value": "T18C168C03BDE009A6D099A3328DB652927739B84A5B3273D32E50B77A3F7A3D09D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500312, "uuid": "7f00aa92-cf6e-4647-abbb-e396355223be", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500312, "uuid": "7812d23b-8535-435b-a939-ca7cb04d402e", "value": "49152:Lk6SB3e3FDHJ8thPBy+ADh3dNDn36knJYd5yS3IkQxVAXeZKaOkZyvrUB6e8t+7b:L2VtCfXDITVBYH0qmuDElj27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500312, "uuid": "80ca02df-37e8-4533-a2ea-7a4b0edf345f", "value": 4322960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500312, "uuid": "0a52a36a-f082-4361-9b8c-dfb9bdbf68bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500312, "uuid": "3272f96c-eafc-4a47-ba87-25798e9b1855", "value": "719b5941f17a6bb3b8692f531d7f335c774cd679c9662baed9364cd08f40f6a4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e44eb9-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786522767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522767, "uuid": "264c14e2-2782-404e-8f8d-82f8fbf039e2", "comment": "Malware payload (PureLogsStealer)", "value": "54dfd654156cc7436c5919ead36333f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522767, "uuid": "3d5c748e-6254-44c7-ae6f-929a718726d6", "comment": "Malware payload (PureLogsStealer)", "value": "71d46630eb726648735f2bfa628fd03d06389335e0befd05ca6da226748df8a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522767, "uuid": "6814ef6c-0628-47fc-9b0d-943286145341", "comment": "Malware payload (PureLogsStealer)", "value": "2920bc4a082dd6e4cad9ab8a08642e79bab278b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522767, "uuid": "27d992c7-a3de-45e5-8266-a839a7ae3b34", "comment": "Malware payload (PureLogsStealer)", "value": "ac04e4be7265a37cdce3ebdd21a20d2854ca49f1a24da6e1b2c0570e1addc3117fc548f70a715803547957972a6274b6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522767, "uuid": "2632c209-8099-4ccb-b072-2f1b54f2d15f", "value": "T12BC578F09B40DCD0D82F5A32997E7B54F2391277DBCD5ACC0244FAD02DB7A45A90E98A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522767, "uuid": "f9eb90c8-a3a4-45d8-ab73-58d8274e6b48", "value": "24576:19RW86uS0OTvh7K5ieKljpmoH7BTGZe03jPrY48Dj8yyxl2MtiEuwb:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522767, "uuid": "1ffc4589-b811-423c-887f-699cb973eb86", "value": 2707375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522767, "uuid": "a34ceeb0-9b4c-4b1c-a6d5-810e6f124c4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522767, "uuid": "dd08b7e0-9e42-4158-8f68-d9c4e99a3a29", "value": "INQUIRY SPM-241254700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ebf743-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786523346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523346, "uuid": "4388d7b1-b5c7-4ad5-b348-78a617092861", "comment": "Malware payload", "value": "4e955e0959f7f1fc8828aa53ce2af419", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523346, "uuid": "0c582dee-761a-4bcc-a02e-e937addded79", "comment": "Malware payload", "value": "7215c8ee4310975f9c73077f4c1a30dc45cff5354287e70a53949814fe08cec8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523346, "uuid": "00459b98-b007-4de4-a639-e6f96ade9c73", "comment": "Malware payload", "value": "d60720211c99ffd9c207139136670c5c965711d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523346, "uuid": "ffc5f62a-173d-4f53-bb7a-e7f2a9a44437", "comment": "Malware payload", "value": "d045434303b65dc726aa6d8ce365346f815c633b318f46a94d30e424d091f6652194cc5f0833c8833cbda307967328b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523346, "uuid": "30bb85a2-3962-464b-b80f-fc04c8ccce88", "value": "T16CC27D966A967C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523346, "uuid": "210648a1-d27d-400d-9d76-61e425b722f0", "value": "768:78vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:78l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523346, "uuid": "3e99e8f0-d144-48a5-a2f7-349cf37abd12", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523346, "uuid": "05f33f1a-c689-47e1-8a36-391f0a2010e8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523346, "uuid": "982b45ef-02cf-450c-b20c-7f34dc6ed94d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0e9c91-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539286, "uuid": "ba12dab4-3ccf-4821-b6a1-56028f15645c", "comment": "Malware payload", "value": "643458d2c19caaca1c357a82bb86899e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539286, "uuid": "75ea21ca-e6f9-44c7-99ba-daebc37a79e9", "comment": "Malware payload", "value": "724f2fc4734775d3e9169f9d75a888bb6281674b35bc6d7190ed743fa62227fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539286, "uuid": "3f3f99f6-c226-4e5e-ae34-4c73d4fd9799", "comment": "Malware payload", "value": "5e06f523d515d39b777e575d301572e02e7644e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539286, "uuid": "65cda30d-ea83-4702-9eba-e7c874f46d25", "comment": "Malware payload", "value": "a7ecdf82c4f80ec3872f4f8da21eb88173d6347c18ffaffcb0bfa42a526c8d329f26cbbe641076e959324085345e32d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539286, "uuid": "159fa005-0065-4c90-941c-80b043ffdfe9", "value": "T13CD34A06731C0E47D2632EB4373F13E093EFDA9120E4F644251FAA8A9671E365586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539286, "uuid": "6dff8731-e09a-4252-8d40-1acaae5112f0", "value": "1536:/UcjDnQC501xh2kRrxoRYvHhc+NmvA+3UJFB6msK6qkIYLFg9gq9uE:BECGVRrxfW+Z+vt2zuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539286, "uuid": "9e511aa0-a566-4fbb-8d10-9f6938e5a52b", "value": 133812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539286, "uuid": "483617b6-fbdb-4799-9fbc-a55bb0c27868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539286, "uuid": "84d7af02-3462-489c-9d5c-7a983fae50d6", "value": "miron.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93ab1f5-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511359, "uuid": "71f853b5-c843-4751-b639-0273def9adfe", "comment": "Malware payload (Mirai)", "value": "a74830e959a9cff765cf936b43b7f854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511359, "uuid": "95268f32-8190-40ae-b200-0dc23ee8fb4c", "comment": "Malware payload (Mirai)", "value": "73b9a1b5e556eba387c5c4220a5097e898617f6ec3a67b8076dd0a1bb7b2399e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511359, "uuid": "d7d89182-9d86-401b-be51-a45aff693432", "comment": "Malware payload (Mirai)", "value": "57e8ba4215f90d87bb5355ada76bbfbf465d584c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511359, "uuid": "36781994-f63c-4ac1-ae59-a1dc43a362bd", "comment": "Malware payload (Mirai)", "value": "5aa2635c55652231ff8b76a45899361a78730c44e7d66781b8ba0187eed07ce975abdb41e6e5ad69b247760d5922f288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511359, "uuid": "9c244029-23a2-4f00-9511-a6c01b7390cc", "value": "T177C34BD427EB1816F05249F0A82F63C9BB5E6DAC1893F2C9647A7254803C9B35948DFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511359, "uuid": "844b6b28-8a18-4201-ab7f-bf9c480c7b3e", "value": "1536:4+mGDiYy4NohSuPjtgIAFJtSJqYXz6ypZ2ohJwFiC8Xkqm77F:4dkNYSuhgIAVSkYXz6ypZ1hCFiGqm77F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511359, "uuid": "25720c47-2a87-4418-be8c-8acff0ca1839", "value": 120052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511359, "uuid": "b8e89e9d-a965-45e0-ade9-5980481aefd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511359, "uuid": "4e296309-0b18-4328-96e5-5aeec6af7d33", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12692bc-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517332, "uuid": "041a07a4-cc56-4dab-a6dd-3ed33a2d70f3", "comment": "Malware payload (Mirai)", "value": "5eb3ada37844532b22e79cd3915a3063", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517332, "uuid": "ecfa6c18-bb3e-4428-8564-68326ead16e6", "comment": "Malware payload (Mirai)", "value": "74807d0932a9443559c12c035ebad996542d971d0b9f17a4b14bb955eed556ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517332, "uuid": "4690605f-702f-400c-918d-da9717f6a86f", "comment": "Malware payload (Mirai)", "value": "a581cad799aa887aeea8da235691bdcbcd5b59dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517332, "uuid": "c52f0aea-50c2-4f60-8a97-e2263c48ca5b", "comment": "Malware payload (Mirai)", "value": "04ce5b61b5b4b27adcd09724e39c4c80c0d314c4705f64d44ce7d92fb71f3da2edb857498ec6464bc94ce2a678d112d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517332, "uuid": "6f38b076-9a60-45eb-ad0d-ef16a903cff5", "value": "T1E8530A27B2742B17D4C5553E13AFAB12BA642BC412D8C60F7D720E9FBD642506C27EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517332, "uuid": "e2adb1ba-8e95-49f3-bd9c-336ac2eabbb8", "value": "1536:4cPPLOZPEZMCXMp8QpfxR6UWLqX4+Y3jtjS04Uqbun9pAQf26WD8W7OuIQoOOyce:4cKZPCDqCn9pJfc+QPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517332, "uuid": "fcc9b21b-aaa5-462d-ac53-daa5be509860", "value": 62284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517332, "uuid": "e6ca4eeb-c752-4da1-9944-e62b7af1ea6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517332, "uuid": "312eea48-f0aa-4f93-a3a1-1625b50be70c", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c58ab49-9695-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786570259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570259, "uuid": "30d98d64-ff8b-4554-acb7-26483fe26d1f", "comment": "Malware payload (Mirai)", "value": "127c16645484d777a5794866aae0777e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570259, "uuid": "618984e3-dd18-42e9-b8fd-591de0b3eca1", "comment": "Malware payload (Mirai)", "value": "752816328ef0c903baea78bc49a1aa8047f248758d91d4c903bad82546706d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570259, "uuid": "625b9959-66be-4789-8893-45c363e4c2ca", "comment": "Malware payload (Mirai)", "value": "d1eb5eab9f8e345103f95665d6a336ec9028cd03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570259, "uuid": "df44d9e1-1a3e-472b-a8d4-1e1e8d94a89e", "comment": "Malware payload (Mirai)", "value": "acf61d97c58487a0a57946f418356be0bfbc97d6451ea7d2fc22b99a419465d253d1954373700d8688e31f943dd9fa44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570259, "uuid": "3f5a040d-f679-420c-9f85-244df4062b9d", "value": "T15C14961E6E329F7EF268C73447B74A34976D23D623E1D684D2ACC1101E6035E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570259, "uuid": "b5d12250-e2f9-4240-a339-62f6ebb8d140", "value": "3072:soaRqWNvWjNUy8yAFJ0qcqEwwZSEkXXNpEVZQq9xvUimhJEhUzHlIS:soaRqWNed8yAsEtG/xXYJEuRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786570259, "uuid": "75687bff-f3cb-4ecb-be42-88359758fa0f", "value": 203496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786570259, "uuid": "63f4dae3-e7be-4313-9aa2-db1610c24314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570259, "uuid": "42ebea81-707f-4d81-8f63-0cef45dbff47", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45849669-961f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786519647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519647, "uuid": "55222078-d929-41a1-8e05-ad23e73ccc2c", "comment": "Malware payload (Vidar)", "value": "304daf902af97f8946738a363b14d721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519647, "uuid": "91b09132-0d7d-497f-be11-975aefbced2e", "comment": "Malware payload (Vidar)", "value": "754ff67f11cd4f97f43ea7c00b000a593bbc0576550d818b052ac6d34f3cbd1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519647, "uuid": "e6c10860-d32b-4af3-8b0b-1c3efa69a331", "comment": "Malware payload (Vidar)", "value": "6286f8598a2c9411cac81670fca173f7d14d32e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519647, "uuid": "e16e4fd7-59e7-4b5b-8355-b17db661e98c", "comment": "Malware payload (Vidar)", "value": "761ceda21a8ecff88d59985eb7dcadea019f506469e7fa84039d12a728c2246833ceb9f8aa6303f2186641e62a0586ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519647, "uuid": "5b5adf83-29d0-4785-aaab-3783ee8c566e", "value": "T1B7368C03BEA1C9B1C0DAD235C57622923BB8BC590B3233EB2D216A753E767D15E35760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519647, "uuid": "841b947d-88e0-47ba-9ae5-419bb1254b13", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519647, "uuid": "034431ce-47cc-4fc0-a6d2-2ab995c98716", "value": "49152:A+HlixSMcbkqBKPzoIkm7CyyJYWHh01U4CP7uDZ6kEu3IY9QqWqTLi6WB/AS:AddzupJ4H9KY9QqmV/AS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786519647, "uuid": "7e63240d-a8df-42c5-a518-553bc3e420a1", "value": 5044216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786519647, "uuid": "89eb88f8-8b3b-465b-a9a4-1e439e1fc602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519647, "uuid": "d960d27b-3537-410b-8a43-34cefe2bf198", "value": "754ff67f11cd4f97f43ea7c00b000a593bbc0576550d818b052ac6d34f3cbd1b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676022e8-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786500377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500377, "uuid": "21bf0a40-f2ef-4feb-bd1a-cba742e0dbb9", "comment": "Malware payload (Gafgyt)", "value": "ade92ace8354b4e3c4fadb9d4eafb28b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500377, "uuid": "672f8b88-3f8b-45fb-a175-5d347092fb31", "comment": "Malware payload (Gafgyt)", "value": "75761cb6afe1c0f94bf99b0d0647fcc843f205904892f71c912f7d3290ed29ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500377, "uuid": "e76211af-37b6-4ba2-b992-cbe4d52894d9", "comment": "Malware payload (Gafgyt)", "value": "876a77efcd4faf421f67e273bf5514410d5d33be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500377, "uuid": "5a22fd04-8328-4e4e-b4f5-610c6febb649", "comment": "Malware payload (Gafgyt)", "value": "7949268a10e54b4fbc23e466b83c5ca019e07d211dead6a976b98a8caa7c5e6bf485d208683308432e5ed8f64bc96af0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500377, "uuid": "739dc7ca-80a8-42ba-beb6-5cc942e85a47", "value": "T1DFE34B41B32C0A47D1632EF43A3F27D1D3AFDA5120F4E644255FAB899272E32454AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500377, "uuid": "3bd8d566-a954-40f7-97b3-fcf8e4d66beb", "value": "3072:P+BtB9p5pJB9p5r4B9p5QDFxdZWrf1jxRDJHlBjSzGmaZRnx+:P+BxF+rf1jxNJHlBQGNZRx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500377, "uuid": "09e54703-b827-4ee9-92fb-9a3b1413dfb9", "value": 150336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500377, "uuid": "2bbf57e1-fba4-4ab6-8f62-26f1a2127354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500377, "uuid": "5788afeb-1dc7-4dcc-9a74-c45d8e2ec336", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10397e2b-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535020, "uuid": "1dc75c7c-2631-4b19-a224-3c1ca99d09a1", "comment": "Malware payload (Mirai)", "value": "39cfd15c72efbc7df220b15694ce5f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535020, "uuid": "acca7470-b53c-4805-ba7f-8a0883c651be", "comment": "Malware payload (Mirai)", "value": "7726c81458d6419157a302a7c777d8a6791f2e25fbecb4e181a929b6e35825cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535020, "uuid": "89deff75-9190-4c22-9cbb-147336e937eb", "comment": "Malware payload (Mirai)", "value": "629d1e2d7eb44e687d6c81f47fb246e440555bf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535020, "uuid": "67b591d6-0e95-4bb7-9eb9-5392dbcac8c5", "comment": "Malware payload (Mirai)", "value": "4038accc7ad83ef78801f671a3c3bc8e289d78762c0d199f2ce3c85975a77382792629c17c42259cb71f30017ab3d556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535020, "uuid": "644f90d3-0a4d-4859-9aa3-9cdd99b7c8d7", "value": "T109E30A55B8818B16C5D412BEFE1E028E33231B7CE2DE72129D246F247B8A97F0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535020, "uuid": "dc010221-9816-4d2a-93b4-d8efbbab6925", "value": "3072:v8VXZeEEz7l62s1axtXNZuS8pOzhzmEFm9ankJuQ:mXZe7z7l62s1MXjuS8wtmEFm9ahQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535020, "uuid": "206db685-ece4-4163-90cf-04b95e9975e0", "value": 146044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535020, "uuid": "7619db29-8671-4090-a8ad-c82b828ef8f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535020, "uuid": "96c7d4e2-6c82-44d6-a1ef-628f913adf83", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab61f102-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520248, "uuid": "029073f1-57e8-4f77-b4e7-2296483f6b0c", "comment": "Malware payload", "value": "5f7eb3c1ac0f73aa2836f14ecd5c31cd", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520248, "uuid": "0cfe503d-81ed-4aa3-a0fc-8b646f2f0800", "comment": "Malware payload", "value": "77cb19d8ebb05aca9a7b7ccddda6630d594b7176cf113d09cf023d90bc3f39d1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520248, "uuid": "0fc1c4f1-c142-4968-9fca-108878109c12", "comment": "Malware payload", "value": "fde5d0f6d04ab8d1cb516c1e000b81d68c8e1d6f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520248, "uuid": "95e94515-e758-4391-930a-0188a34cd619", "comment": "Malware payload", "value": "c639923a7d8c1898b1e39cdee3c7279ffe1bb4df1cb7aa371ce1ec00427528f29263da77c7bf7ff3a9e3da8abd600452", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520248, "uuid": "e3eee15a-2bf6-4ddf-9cd9-adc6f5e875b8", "value": "T142A3A401B296C626D5584B354CE6C7E93B31FC059FA65B0B3248B31E7DBAF90D922362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520248, "uuid": "baa7fa8f-0532-46e6-8dd8-07e9f7715ba2", "value": "3072:FfxEtjPOtioVjDGUU1qfDlaGGx+cLYIxgus+MM4/yIaOxuC1x3nVk/bORjT6zlIu:VxEtjPOtioVjDGUU1qfDlavx+WYIxBHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520248, "uuid": "d8a27eef-277f-4036-8cf3-b2b77ac60dcf", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520248, "uuid": "15d3649a-6d07-4644-88a1-e7e0a6bd4f6a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520248, "uuid": "27889507-00ac-45a5-b99f-2dbfe055b0aa", "value": "PTTK_Balance Sheet Form III (All)_PNTW_11082026184515.XLS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e83a58-9621-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786520797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520797, "uuid": "ff5a2c9e-4dd9-434e-aaa8-412228991214", "comment": "Malware payload (RemcosRAT)", "value": "4b2970476257a913ac1efb2a8fc5bd93", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520797, "uuid": "ef616f92-d09a-4911-a388-157b3d61f269", "comment": "Malware payload (RemcosRAT)", "value": "77ced5f47cf30bb02925866e753f9401e87493473a472e2b6adf8f3541f0a697", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520797, "uuid": "20ae2d99-76e5-4b59-a8e6-d02716ad1746", "comment": "Malware payload (RemcosRAT)", "value": "8a8b36f762a0932ac07b91c15ab5b5b39046187f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520797, "uuid": "6cb134ac-8d90-474d-9b97-ea63850b6ed8", "comment": "Malware payload (RemcosRAT)", "value": "52e92b9b30558949d1c8f07e6f6662d89ed31a1c17dc1592ad146f8d31559615a0617827e7b339d74bf3608e178079f1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520797, "uuid": "1a944840-aa4a-41be-8a20-bf36cede23ca", "value": "T1893594A1CB2B92F199EB0954D838808CC7BD555BC79F2E4F765706F841C8D0B28B987E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520797, "uuid": "7bea0117-7e56-4661-a289-caf222ee1261", "value": "384:GA8epzckIOe561cM9qELb+FS+24HWKsUKsUV4ZIytA8yFeDTgGebSyzj8ACNeg+o:GvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520797, "uuid": "a92c154d-ef1a-4315-88ed-875470d4e657", "value": 1077595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520797, "uuid": "4d167c10-dd0f-4ca1-b888-738f7e3b2b97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520797, "uuid": "2aa795bd-f04a-401d-8247-14f42add37b5", "value": "goodthingsforbestfeelingsweformegood.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4eb53c-9604-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508329, "uuid": "0168569e-7e9e-4aaa-8d31-affb00c203f6", "comment": "Malware payload (Mirai)", "value": "c76120395113d630e15fc4acbc75da07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508329, "uuid": "deeb9b9b-29c9-4539-9dfc-16a4f739dc12", "comment": "Malware payload (Mirai)", "value": "7835d27f42fec19a8eb3104e74f6ee17da47f653131444f4874ff9b96190d563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508329, "uuid": "bac22ed0-f77d-4a12-b653-d7ff5ae23be5", "comment": "Malware payload (Mirai)", "value": "124b170ce05ca3e10166fa77875afb93c206781a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508329, "uuid": "d85ca844-332a-4d9c-80bf-3628a6de4993", "comment": "Malware payload (Mirai)", "value": "2a0e81679a5845f428bca475dc003f87eba3afdce7f565749905464bd9ed2a208332aa2ab66ae42bc5e73853e0b7b58a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508329, "uuid": "0f0b70b8-9747-41bd-a1be-fb4b2e8609e5", "value": "T10543F2347793CCEAE741197BBA14C34727A60F3C91AA14620F226B365F0FB4715B6693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508329, "uuid": "584e42a8-7b07-474d-85b7-35f644c35503", "value": "1536:dklm/HuoHeIbBI1DVB3DL5KDf0vbIj67Cvj/g5zg9:dB/HlHeKa3n5Kw8jRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508329, "uuid": "f93c7639-a19f-4060-b073-76406f9eb03d", "value": 59480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508329, "uuid": "2a7cfd75-dd2a-4c79-8b72-075a2b81a564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508329, "uuid": "733053fa-ac3f-44fd-b4dd-0dcd66c837f4", "value": "7835d27f42fec19a8eb3104e74f6ee17da47f653131444f4874ff9b96190d563.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badc156d-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511684, "uuid": "70fa05c7-454f-4d8e-b15b-eb162ef86f90", "comment": "Malware payload (Mirai)", "value": "9ef0f6692afb53c082195948a17ed85f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511684, "uuid": "3ca2e954-5eee-4949-8ce8-1d4cb10d9d0e", "comment": "Malware payload (Mirai)", "value": "788229b95027fb0837a7f2b8397ad8c1ce8c1cbfcef5826d121e9ae64dbffd3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511684, "uuid": "f76bd7dc-f154-4b70-a200-ea65d7db10af", "comment": "Malware payload (Mirai)", "value": "8c5c60b0596ed73ffd5c905552f2b5d1e6a19f2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511684, "uuid": "244ca8f4-01f1-46ed-8e58-f33e97cea06d", "comment": "Malware payload (Mirai)", "value": "f2212079c0677af3a2595d30774d48f635224129fd407327d1f74b816ec4a8d95585343aba5b7da11815832aa90ad6af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511684, "uuid": "588cb593-3e03-48bb-b865-10cbc0210762", "value": "T1ADB30653EDB517A0D89110B96C4C0B3893E7E5214682AEF9E7518158870FFFBBA1E398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511684, "uuid": "3cf46fea-75d6-4af1-a902-88deb1ff49a1", "value": "1536:ZagVRpJoHuRsxddk70CsBkgIAFJtSJqYXB3hPJ:ZbXpJGs70+gIAVSkYXBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511684, "uuid": "d874cd2d-9d77-4085-b605-5ec8a9944afe", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511684, "uuid": "fa5a5b55-caa8-4107-a7e6-97da92cbea36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511684, "uuid": "86b9ddde-30d0-4a93-b295-0eba3029310e", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa9c8d0-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786523387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523387, "uuid": "b4b409c4-6945-4002-a585-a5b50e81693f", "comment": "Malware payload (RemcosRAT)", "value": "4df114dc93ef57583ef4cda686653d89", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523387, "uuid": "28c51123-a9fd-4a41-ab58-7ba0361526de", "comment": "Malware payload (RemcosRAT)", "value": "78b017913bb7d79037ad1b8f0c63060d48430bf122ea4825e07e370beefc68e4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523387, "uuid": "2fb2934f-a761-4717-b231-f6c3d9be3e96", "comment": "Malware payload (RemcosRAT)", "value": "683ebfaa85c1028aeeb64eb6756e7a0bd822341f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523387, "uuid": "c97fc5b0-85ff-4f25-9bf8-31062b40c26c", "comment": "Malware payload (RemcosRAT)", "value": "e043eb5c27951ccd3ee318ff5e1a60b69f12f3afd012c62ed7ce822402ae8c7e968dd4d151d371911eaf3eb9eabf1e6b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523387, "uuid": "42bf216a-6983-4cb0-af2f-9693d4637b12", "value": "T158075E92E22F5D77F86C9F7F1151E739DA4EEE97C4D94C2B70D1AAF7618A0022C48818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523387, "uuid": "bb15675f-c6d2-4b6f-a43d-49bad51605cc", "value": "3072:PCwuK9xRKUjqEHBzNxacqOBuDrAczExbyfNkWg389YERMs3Bh0g34DfiKGbdjZIK:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523387, "uuid": "e663c133-60eb-47a5-846b-37eea8fd10f5", "value": 17886854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523387, "uuid": "bc5f26a8-615b-45f6-8d3e-8bfd976c4dfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523387, "uuid": "1e5d6c0c-a2a5-4a1c-bdf6-669c6d135958", "value": "Specifiche dell ordine in grandi quantita.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5924c00-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503998, "uuid": "516b1e3b-b727-4b02-8c1b-e50a8520267e", "comment": "Malware payload (Mirai)", "value": "a27b0acc3ef8316635049a3d30afeacc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503998, "uuid": "6242d65a-b830-471c-aef7-4c6fd6f3af6c", "comment": "Malware payload (Mirai)", "value": "78b877b3d55a2f74ce74f955913e16fe523a9d942a1dc1a49a04694a6bf3d7c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503998, "uuid": "8c1faeca-56a2-47a7-9673-ef78bb79a0e1", "comment": "Malware payload (Mirai)", "value": "0772e0e218ee4b49e0dbe55674e9780dae82fbcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503998, "uuid": "454a753e-7f9c-426e-a7f4-427ef8206ff2", "comment": "Malware payload (Mirai)", "value": "8c5f6f56d8dd5d2610d2ba98b9aef5e6a749cddeb3dff75faef2472abe5fb9fdeaddc7fccdf03c2f2b5f795e486e0dab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503998, "uuid": "c65254dc-195a-44a4-b446-a06eaac730bd", "value": "T1200439D7F800DDBEF80AE3374453190AB530B7E119521A376263797BAC3A1D90967F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503998, "uuid": "ff4c062d-7b59-4034-8f36-8f1004a976b8", "value": "3072:GgA2vdnTpcB263YNJsxjmS5/aqNkfZ8XAweoLVejbidLYqoiyqEg2PZ8uy:T9cBrZme/vNPwweoPLY4yqZ2PZ8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503998, "uuid": "e25fd950-4269-43a1-8c51-fa0d6a2e9f4a", "value": 185984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503998, "uuid": "0fcc9158-c050-4682-9105-a1171d774c17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503998, "uuid": "2f8fefc8-a15f-442a-b596-dcd7a4ee828d", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02caefc6-9612-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513952, "uuid": "03812fed-b9b6-46f1-9696-9909c03e310f", "comment": "Malware payload (Vidar)", "value": "1f15b8c3999c5be1ca18960150b6830d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513952, "uuid": "a72e4665-6b73-49ee-91b0-f7ad616eb3eb", "comment": "Malware payload (Vidar)", "value": "796a9204c0800bc08b0b618072a270bb73ce6aa2f2c3c4db693f22c3d4ad4841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513952, "uuid": "618b881d-255d-4108-bbc6-7b4fcc7cee1a", "comment": "Malware payload (Vidar)", "value": "fcfa75377c231a869ecd2fdb073e0bf396ea6d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513952, "uuid": "76dc5e81-e609-4e16-81d8-78ca76761c0c", "comment": "Malware payload (Vidar)", "value": "1a4f5702499a423273e5f8c299f4dc54f7ddb483461fa811557790698ee4618dd1405b6c13281ef3c2de5f721b68db8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513952, "uuid": "e7622207-73bf-46e3-bcc5-d560c3fcea8f", "value": "T1A1E58D0BACE049EDD4AAA6398CF641867775FC054B3523D72E50B2783E32BD29D39784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513952, "uuid": "92cdfa8c-d418-469a-acf4-e4d2dd237db3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513952, "uuid": "c0647e5c-8b04-4f48-8919-4c1506ae118d", "value": "24576:ZWFt9LENogldqG5XoEqLF5toKwZp+6Mtp2EiUT/qj2MmGxxfQwC2a8z7txzBeleu:ZWFjLEbl35RqZfrSFMJ/mnDxxflCcDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513952, "uuid": "006afec2-d7e2-41b6-af4d-aac8b4ac8af8", "value": 3030896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513952, "uuid": "aede3fac-82b2-4e88-89fb-e6ba6f08f8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513952, "uuid": "dd2fb255-3eb8-44f7-8f50-47936900bbd2", "value": "796a9204c0800bc08b0b618072a270bb73ce6aa2f2c3c4db693f22c3d4ad4841.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75c2abd-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511678, "uuid": "a703f71d-5a43-4ddb-9424-fd5172e049b7", "comment": "Malware payload (Mirai)", "value": "0fb8b1f412b3550596e958cab055e0f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511678, "uuid": "6c9a1f04-d769-4cab-92f1-ab9b10dbd122", "comment": "Malware payload (Mirai)", "value": "797374fbcc72ae7c24f218f344780ff240076aad99cf8ea86284fcddd7c341f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511678, "uuid": "1e15295b-ff75-4a8f-ab4d-2481f67c8480", "comment": "Malware payload (Mirai)", "value": "d6f754e061604677fdc563abc184ce6dbf4c6712", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511678, "uuid": "f6a4b8d8-0df1-4ead-b1c4-d3aa2fbb96fe", "comment": "Malware payload (Mirai)", "value": "137a10dd02c22a0a22f2536268742261071e58c584f6dd4886bc903f3dcf4608144d82f7bb86ebd794b73a8eece9c8bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511678, "uuid": "06b5377b-9274-48d9-a2bf-331edacbf35f", "value": "T1ACE32B4EB98C4BD1D5C411BEFA191E4D33026774E2DAB29E5D702B409BC9A2BCF369C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511678, "uuid": "232dbadc-8b61-4fb0-afff-63f01708c630", "value": "1536:ggnHxwjoh/2hUf4PFkTB2AgBcs7HH5wklm8dls2ieSlmklgIAFJtSJqYXXQ4M:6kh+mgWXZs7HH5wkuGSlDlgIAVSkYXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511678, "uuid": "8f15d737-c903-407d-ac5c-c29c2bbd01e0", "value": 143252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511678, "uuid": "e4fb01c3-d974-4852-af77-07d4c7884480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511678, "uuid": "f7a5c614-fbb9-4766-beb3-159c67dd9d6e", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdfcf53-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "e0525cf9-f31b-469b-a2ba-53f1a8cd4c23", "comment": "Malware payload (Vidar)", "value": "5c2acad94a032dfa1f13b7cc6fa873a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "eae0b4af-74dd-4d56-b8c1-1a96de1422f5", "comment": "Malware payload (Vidar)", "value": "79c8aab13928e098a14e926a31d5f0e45b757ec1a16f5719620e143d6247448d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "8b617b19-b1df-4a87-9e81-a7970d1ec98a", "comment": "Malware payload (Vidar)", "value": "22d1f0f0fe484fea263abecb9bd79ae435fc657e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511337, "uuid": "c6ab7cee-2ad4-4386-9584-2c4b6b6fcbe4", "comment": "Malware payload (Vidar)", "value": "ddf0e485874135ebae15cf0d140c5250377b19b3e91e99149d599c31ea18b9aef18a4a36b84de080bae1ead592852be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "9b5e2fc7-90ad-4e44-8e00-0a1fe64e3f13", "value": "T188369D13AD9164A5C09AEB31C5BB4315BA74BC4C4B3123D32E60BE782F727D1AE39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "71f629c2-0970-4685-a9a7-e45cf30d730c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "3ef15aa0-d1a9-472f-b86d-e686bac82b12", "value": "49152:dln990iunoYFYHgqzcCJp5AsX+45KTD8ImGsxCcccA/A4rTu//jPqbK120:dnQuPxCDUG7ra3jqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511337, "uuid": "1a4599d5-4c76-47fb-a95c-81b60377bf11", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511337, "uuid": "9ddcaa51-88eb-49a7-a9fd-fa9fa997c536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511337, "uuid": "6dfeaa8d-3b73-4272-a30d-2dd6c2c6410c", "value": "79c8aab13928e098a14e926a31d5f0e45b757ec1a16f5719620e143d6247448d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331e2f69-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516181, "uuid": "f0aae9d0-faad-4851-9878-99aa137b2f15", "comment": "Malware payload (Mirai)", "value": "4b5acf4f36ab2af6152fd33fed51c759", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516181, "uuid": "a2100262-5616-4e5f-838e-4af33ddb9415", "comment": "Malware payload (Mirai)", "value": "7acd0f1122f062fbb9a9f6aa276b94eaf52e9b6a5f47a5eaba824e3f2c875b79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516181, "uuid": "9305f331-f4a4-4475-aae0-1ecd7beb8199", "comment": "Malware payload (Mirai)", "value": "3a1f1c90fe9cceb7e24282eb31a2e04da387a034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516181, "uuid": "28e1021f-35da-48e4-869d-3bd56b493595", "comment": "Malware payload (Mirai)", "value": "408c347664ae7b109f935f5da4c5de6dae7999c340d5cd0978ee18fc868737b04b9998cc4f2d73aea41d572956c94225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516181, "uuid": "21b36866-3b43-47d5-85ba-eddf54a309b6", "value": "T148C37CC4F243E1F2FC6604710137A7238F32D176563AEA52D7B52936AC63A509B1BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516181, "uuid": "a830f4bd-4609-48b9-a161-a34a42e7073d", "value": "3072:ZPF6nb7ohdI+xz3oFlk+9+FW/374tgz2CF:ZPFA7ohdFd+F3Mi6CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516181, "uuid": "de0b482a-2246-4637-b19f-0be3cc63d83f", "value": 121608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516181, "uuid": "5d9ab664-6e96-4a7d-8f41-b3a2ff173014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516181, "uuid": "0013d100-cda3-4d1f-afe5-c54d5284a62b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cec3bf-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786523024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523024, "uuid": "c6fde6cc-a7c5-47f8-a6c2-1e21e66bc452", "comment": "Malware payload", "value": "21596624a6e5270dc9e38f4c027da10a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523024, "uuid": "009bcf07-d6df-4fc2-a0d0-47ce368f214c", "comment": "Malware payload", "value": "7b0c41ac7e6194953da6c98689ddc0a763dc92c6825adaa0a001c4ec12552ae9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523024, "uuid": "3f308dee-5d93-4f15-9ec2-ba8b773162d1", "comment": "Malware payload", "value": "00ec7136605f5c54b32a2b7990d3e02e898c064d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523024, "uuid": "1f426d59-e7f7-4830-a477-fc92e865d035", "comment": "Malware payload", "value": "c8884e15d917c03796e66f58d46a4d2f22ce72a73bc93dab4faae36be00bfc988d4817181793e8b24c05b9399caab450", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523024, "uuid": "4b28b24c-be08-4259-adec-dbe5284e8a05", "value": "T1D3C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523024, "uuid": "fa4bf151-fc2c-422b-ae8d-bdc03eb71ac0", "value": "768:j8vCB+25j6es8Ru9FYpMSUpi+20qUpi+20YQX:j8l25JId2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523024, "uuid": "783cf45e-b1af-42b9-905c-e956cad6c867", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523024, "uuid": "168cde4f-2c0c-4caf-a0df-946a396720d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523024, "uuid": "47199bb6-4aec-4759-a1c2-6bef74b8c588", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64cf54d-964e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786540130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540130, "uuid": "eeefb20c-5416-418f-9189-952935b2407a", "comment": "Malware payload (ValleyRAT)", "value": "f4f7714b9c3c056794c20ede93593197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540130, "uuid": "6dcba856-1ae8-4902-9f9d-343775ba928a", "comment": "Malware payload (ValleyRAT)", "value": "7bcb6b3adcb435fd804e1b791bb687573b7df2e8f5c08517e0b4de9d4f3b9776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540130, "uuid": "0d270c51-efe3-4f90-b48a-81a6618533fd", "comment": "Malware payload (ValleyRAT)", "value": "d1f24bebb41d15b92773cf2b13ab4f46de52160e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786540130, "uuid": "a7f31ecd-c4c2-4d8e-92db-9f626b235f13", "comment": "Malware payload (ValleyRAT)", "value": "eb23d0f62da0f09b916f952f761c0e087e61e7bed33dc41b09b953a94687653c3dcd47bc260bc89aee45c25b8c2570e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540130, "uuid": "3e53f4c8-2972-4298-95aa-fe88d7a5c3c0", "value": "T112C73313B6C2C5F2D45612B0956AA73647BEBD304720D2D3EBD99A0E1F706C0EB37662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540130, "uuid": "36c97e55-538a-455d-8c0a-145a5ae96b17", "value": "d2c82993d1a616abe994cabd5db7b4f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540130, "uuid": "dc4c4e77-73f1-4da1-8e56-36c9b55a8a21", "value": "1572864:TIuBcQqtTt03MhuiHaYgXgkHquQQIDm0I5RJwRoPtR:8wc1tV6YgwkHq3QIDm0QJwkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786540130, "uuid": "80677356-625b-4565-85e7-3b2b71b27cea", "value": 56043749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786540130, "uuid": "23115db4-c2e6-43d0-8e24-717ce10132c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786540130, "uuid": "aaa27a68-a055-48dd-be07-afae4b1c6066", "value": "yuanbao_v2.371_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b4777-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508924, "uuid": "0930502e-e25e-46fb-b153-5aab901fd2c1", "comment": "Malware payload (Mirai)", "value": "ef63c2621d86704167a100f24cd24c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508924, "uuid": "d0becacb-90b5-4daf-a0be-fdf987cc9a6b", "comment": "Malware payload (Mirai)", "value": "7c4c24e0a2eada545af17e13238724f0d2facb46c6698736de23b93569127470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508924, "uuid": "4e86e070-2406-417c-bfbf-e6c7c26fc424", "comment": "Malware payload (Mirai)", "value": "a0dcf95c0407c10bb6882a5a839ffe2c31d1362b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508924, "uuid": "f39d419d-a22c-47ee-9b40-fb9258bbea81", "comment": "Malware payload (Mirai)", "value": "e2188a1e8dcf92d58f0b7594fe0231fb2c136e19663dfef79f735d2dc9a99addca0e8a3335ae081247d0a1d0135a9a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508924, "uuid": "01d48850-d502-4f66-abfb-fcc61df0251f", "value": "T1A153021274179AE8CC616E77A85B87CEED2D04B8CC5935C101DACA919E9028ADFFC7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508924, "uuid": "b062405c-51a0-4906-aee1-9447911433f7", "value": "1536:gV1ikBBC8dYU+PXh5AjEQdhGeq0C/ymAyAbLHZycHXErlT8nXLw:g3ZdY/Px8f2AF1ycHXKlTGXLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508924, "uuid": "be7bc1e9-9d51-490b-b41b-5cfe2bec3478", "value": 64820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508924, "uuid": "8067a63b-0842-4c65-83c4-e3236dac6a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508924, "uuid": "e3ce072d-dad6-439e-8e9f-08b6b77db592", "value": "7c4c24e0a2eada545af17e13238724f0d2facb46c6698736de23b93569127470.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8974606b-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502152, "uuid": "9075e201-e966-4451-a26c-091143f61157", "comment": "Malware payload (Vidar)", "value": "0546a6692d41bfa19eed4f9a247084c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502152, "uuid": "bd554ba4-f58c-4e09-9995-f0bd31cea04d", "comment": "Malware payload (Vidar)", "value": "7d4eac37592a4a17d138b74421e93bbd426e5ab37248a280f0ee6c41538b37f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502152, "uuid": "17f4663e-b9cf-44d0-a8e7-244ffec4e239", "comment": "Malware payload (Vidar)", "value": "e6e48c81d1f0a43b46e1f43fd327bd6aa8a536fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502152, "uuid": "57b6bf02-5e4e-4c0b-ac08-23cc760eb0b0", "comment": "Malware payload (Vidar)", "value": "0c269236a78aaeb0e0e70b869426f2a9082c1ecb7c989b6f2e5e45c58c3ef79a21c7ed11888fc4bad0b50d1368d08742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502152, "uuid": "6bd3744c-a46f-44d5-b6a9-4fff14bd61f9", "value": "T143E5AE477CE409E9D49A933289A69296BB35BC050F3233D36F90B3782E76BD05C79790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502152, "uuid": "c05d0b1b-578e-4314-941b-861762f3f763", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502152, "uuid": "fc234d7d-53df-4370-b471-25fb89c5ea89", "value": "49152:eeXZA9VUk6QiZhvPrIeMIqNJGwZh2fg5iL8nH6w:eeJlvP19qjGwZh2fg5iL8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502152, "uuid": "d7a97c92-9ac1-4a50-aaf6-afdcb1772d61", "value": 3221864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502152, "uuid": "ebb8832f-3c21-4590-a36c-5fce12516009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502152, "uuid": "e6f42aeb-149f-4ed9-a453-652b24edbf53", "value": "7d4eac37592a4a17d138b74421e93bbd426e5ab37248a280f0ee6c41538b37f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a9294f-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507701, "uuid": "cf4f7e58-d7f9-43c4-9900-55ba3f2f616a", "comment": "Malware payload (Vidar)", "value": "dcc197be262948075fc309eefde4269a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507701, "uuid": "186270c7-33d5-42ba-9f57-2a3ac640d152", "comment": "Malware payload (Vidar)", "value": "7d836ba56c3d4e885d9afb613d48b508f116ca088b08d16778fc96f0ecfcbfaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507701, "uuid": "12e342bf-fb8f-4c3c-affa-47a29d781574", "comment": "Malware payload (Vidar)", "value": "b72ae7a2207232c05b7bec9bf0ea52d1220207e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507701, "uuid": "26705ae9-a240-4110-bb71-1ca0dfe954c2", "comment": "Malware payload (Vidar)", "value": "44da6335febdbe38c993b3b925443538c855bf14295f2129d13d6aac1447b678a8d918061ff73d9881255680f8925cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507701, "uuid": "486295a3-a342-4120-b334-1737451c0540", "value": "T1E7265A12AE9088A1C455D23389B6A315737DF88F072A33EB2E536D747E32BD15A79F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507701, "uuid": "952e8d6e-8c22-4d96-a128-e19ac178c055", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507701, "uuid": "88b983fd-fb6b-4a90-86f7-a80786078e44", "value": "49152:i8+q52iVc3otggsQC5AZ9b/msXvXkn6kqi2+ytffPgBCTwaZaObt1dQiRozIrBZF:iE/Bxy8BuxhOb7dQiRUIliJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507701, "uuid": "ddca1fb5-e89c-4cd9-a66b-2ed920f11210", "value": 4467552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507701, "uuid": "67e57551-4478-4e43-9217-408c61632227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507701, "uuid": "4a7681a0-21c0-4bb5-bfae-e02d04f4f143", "value": "7d836ba56c3d4e885d9afb613d48b508f116ca088b08d16778fc96f0ecfcbfaa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd605a2d-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786522855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522855, "uuid": "c2151dc3-40bf-41aa-8385-4b5cdf71b074", "comment": "Malware payload (Formbook)", "value": "6f758a7dfdc2a8e6580a83155939328b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522855, "uuid": "ace8b4b6-81e8-43b9-b5fa-9bd929c46150", "comment": "Malware payload (Formbook)", "value": "7e3e5ddd3ee64f1b2dd76d974e3087505cfd3b1997a263b0169f2fb89f4a795a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522855, "uuid": "e0b09cb3-9946-4085-b332-7958eee5f788", "comment": "Malware payload (Formbook)", "value": "0126daf1159c741f19c5aeaadeb1522a490c007e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522855, "uuid": "02c0d75d-b53a-44e9-b953-8d7bea742da1", "comment": "Malware payload (Formbook)", "value": "c36f86a9edc419a33830d06ef29504d23c92f250773f6d8cfa13e5c5c1b823a1bef93879dcf90bd48661b48629ca19ff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522855, "uuid": "5ce2b523-dcb3-4e99-815e-e47fb35c4612", "value": "T1EB257D61D12070CDEC668785F12F7C00D5C5BB32BD8196D23971CE1E3BAAF4A49E2A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522855, "uuid": "7b0ea3b5-c5bd-4ddb-8639-f94ffa1e4365", "value": "24576:rKS3/bwiz68r7uF3LUg7nw7icrdGj9kdXCaKsHjH:/30iZE3v7Qicru9kXXjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522855, "uuid": "3698b892-5125-489c-a9bd-d6449ac421f4", "value": 966378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522855, "uuid": "29511f40-776a-46f3-99ad-4cc20d62e650", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522855, "uuid": "f2f99d6e-3381-4547-9045-fb2db22408d9", "value": "Pago_436761.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e8f5ca-9605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508649, "uuid": "0b367a23-a754-4a2f-b872-1ac16b47d253", "comment": "Malware payload (Mirai)", "value": "bae46616c570371fd91afcfb0692b5f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508649, "uuid": "bec0916a-303a-4177-a92c-0dc5eae17ff6", "comment": "Malware payload (Mirai)", "value": "7e8eaec2976165bf1c94b21a504a16c6be07f7d4f5b78e46f9ed100431894cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508649, "uuid": "396dc1e9-0f2d-4343-8967-0cc44bc92788", "comment": "Malware payload (Mirai)", "value": "b879354d77ae6775ddd06382ba00320644aa787c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508649, "uuid": "b5f9fe4e-c81e-4865-8ec6-eae853193e9a", "comment": "Malware payload (Mirai)", "value": "40ca7a2dc97637abdb18851027ede1a5e8c361ee8ef8abe2dd78583be96de4e7137037a8bccd48254b020b1553aaae02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508649, "uuid": "8e5ff871-7fd1-4a28-9ec1-28c69726bcfe", "value": "T1EC5302BDABB209E5EB49E8B04684533C8DA15FD2D11BDC6F105DF0539C1703538A5BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508649, "uuid": "13e44945-d575-4e5a-926e-b53e4be2afd5", "value": "1536:d9b1bAA26dB/5hU8mMjxohyyhhIznR62NVJupl:Xpz26f5hZmn0yfKnR62NVQpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508649, "uuid": "a59ed7ef-30d3-4de0-8d27-81989f62d2a4", "value": 64652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508649, "uuid": "7bb30b4b-352d-47e8-a96b-10b42c7c0767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508649, "uuid": "4f1b0513-b2f5-4920-9f33-8947d45bc7be", "value": "7e8eaec2976165bf1c94b21a504a16c6be07f7d4f5b78e46f9ed100431894cab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0b4762-961b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517912, "uuid": "f1531213-5d96-4b07-bb55-cfa3caa3e791", "comment": "Malware payload (Mirai)", "value": "fa9f3c1293d9d744ab4cf83f2df98ca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517912, "uuid": "6565a254-2770-4d70-8e46-79beee197f98", "comment": "Malware payload (Mirai)", "value": "7ed4b9e2df2ad352ac3daa5d6439beca77d5180eca901e579242b33fbcb82cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517912, "uuid": "b390c819-0e12-4047-80e5-24e4fb62c0b0", "comment": "Malware payload (Mirai)", "value": "041d78a16f0c962ee5c065d4c418cb3eeff9e58a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517912, "uuid": "a4d7bd90-b2d6-434d-8be5-465951cf991f", "comment": "Malware payload (Mirai)", "value": "57e836376bd016125f0a82d5c12adc009b88023f4c526faabd2d3ba77a63e7257f80cdf8ba4d1ba9d2595e3501a80b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517912, "uuid": "7c2740a3-64ee-4091-9589-1f80beb1f36b", "value": "T123530274174451A8F478F6F867DBA3F09DB007355241EDBB5A63B3458E9A4B8BCC3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517912, "uuid": "c1221f8e-4f5c-437f-ae3e-4bfd996abaa7", "value": "1536:Y/4ICPYCvO3Iv9BB4AD7Nj+7tiH3kixLqpob2rV2VJuk:Y/blHY1BB4AwQHxpJ2x2VQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517912, "uuid": "f26681d5-ae45-4b50-9f5c-b8ae7178edbf", "value": 64652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517912, "uuid": "c8cb05e0-c3c4-4f80-808e-1663fe6a77f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517912, "uuid": "cf3b3401-e975-46b3-806a-41eba1908ac8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca8ec5e-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786575065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575065, "uuid": "dfd733c4-bc0e-41b6-a5d2-2bd98b6820fa", "comment": "Malware payload (Mirai)", "value": "60612f788bb18bb1bc13ee569181fe0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575065, "uuid": "dc7ec778-9b0a-47cc-83d1-db5acb7a8986", "comment": "Malware payload (Mirai)", "value": "7fc40677a79d0cbc675d8c0042d6cfbc87ca1a9982f5046008feb7bd4fe799b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575065, "uuid": "89fb8fd4-52c6-4aa5-9363-c6f341b75e12", "comment": "Malware payload (Mirai)", "value": "b70fd63661d766420d24e48b6cb1eb7d72f403bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575065, "uuid": "b9a4051b-320d-4587-a3c3-31f4eea954da", "comment": "Malware payload (Mirai)", "value": "9a35b0d8038757b0350ac7466e76972510bd9bbc32767a2abd8c30643d10c7d09f470180b303bedcec0ba7bab0406977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575065, "uuid": "5eb0df87-ad71-4695-903d-790c18c8a876", "value": "T1CD542966BD819B95D5D12ABFFF5E824933172BBCE2EE3102DD145F2137CA84A0E7A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575065, "uuid": "f88b642d-da36-4129-a9f5-3c0292eeb17a", "value": "6144:FNpw17tZpsC0PKhnz/Fnd7Kc1r+Ewhoe0aGnD7U6tOLyPBumfJO+7:FstZpsC0ChnzJd5yhhoe0a+D7U6tVZl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786575065, "uuid": "69a48b79-0151-4cba-b6f1-9088a3923603", "value": 289420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786575065, "uuid": "8e22e85b-a1e5-423a-8db8-aa7acb2aa85c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575065, "uuid": "25a5db7f-2bd8-49a7-bc7b-6fcd7622efa7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd124a8-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786517061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517061, "uuid": "5f29184c-0b7e-4546-9628-6cea6a712433", "comment": "Malware payload (ValleyRAT)", "value": "655bc97584876b110db5e07464af6522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517061, "uuid": "faeee524-f469-4ec6-a656-2e01f215123b", "comment": "Malware payload (ValleyRAT)", "value": "80ffaa35ddfdbe219dc67158d1e456d49c8a813bed24b5a882f2f89e0ffe0297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517061, "uuid": "e5bf0cec-4df5-4d34-866f-9db08b41c9ad", "comment": "Malware payload (ValleyRAT)", "value": "ba4a5126156520fc1d7e71b8e6151598b492bd5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517061, "uuid": "0a74f7e1-7f54-4b08-ae64-50927eb6dcbb", "comment": "Malware payload (ValleyRAT)", "value": "3bd6c2319fbea3f7fafc4fb0ca85c064984825d25a8f6c0e3db7fb3ffe55d3f75926d0d2046236eacdefb5dedb421cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517061, "uuid": "4a701eea-f520-4d3f-91e6-efa0ae2559fc", "value": "T1BC974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517061, "uuid": "1092cd2f-acf2-4620-abbe-439613a8aa67", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517061, "uuid": "04740921-6de9-4e72-a838-c12136cc07af", "value": "49152:HJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejnt4:Hu/9nmHZLxG80DuKA3XAD8ntZfh6fgCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517061, "uuid": "f5e466e1-7f0c-4600-aa9b-9874fca3ed93", "value": 42629632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517061, "uuid": "ecef75a2-2a05-4bc8-9773-93ad9ff6f66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517061, "uuid": "f65478ce-0a28-4538-bf76-00cf40c3655a", "value": "install_c0b004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474a8ab5-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493022, "uuid": "1956db6f-8f54-4665-931c-cbd134aaee01", "comment": "Malware payload (Vidar)", "value": "44ebe76777dd226269ce7cd4825fcecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493022, "uuid": "09f0af65-ae2d-45c6-9b8d-98dfe58ce168", "comment": "Malware payload (Vidar)", "value": "8121bfe9ad33158c553f7c95c8d6a42ec6b1377f3ddbfa43121efb430526c492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493022, "uuid": "46c046c4-3dca-498f-bdd2-a37e214b0612", "comment": "Malware payload (Vidar)", "value": "97dff10a87686d094599876414e412b82505e420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493022, "uuid": "47e37b48-d034-4cc6-bd2f-41c3b31f30d7", "comment": "Malware payload (Vidar)", "value": "64e2f833455e50d924550a77c12b738be58227ffe477cbaf4e70ef7ba5625ffdab7a7c23b13452d8455e2cffb40c4dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493022, "uuid": "5b5a89cd-ebc1-445e-908f-d3b52820cb07", "value": "T163368C03AF9548F9C0A5EB3189BB4252BA74BC4D4B3173E32E60AAB42F763D05D75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493022, "uuid": "a73b9c03-69dc-49ad-935c-32e04c7d47a5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493022, "uuid": "45b71a01-5a0d-4063-9010-0c0eba2df1e6", "value": "49152:jqQpOHB0fCYLvnanX+kFWPAHuXMFXkaq19w/BA4Kv:jYEanX+NAOXMFXkaq1Ymv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493022, "uuid": "e9a30446-e2b3-44c5-8018-a556287b9fba", "value": 5024624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493022, "uuid": "c40d263b-a477-49b5-a82c-df8dd8f38964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493022, "uuid": "d9bcc94a-4f8b-4502-b42f-2961353a8916", "value": "8121bfe9ad33158c553f7c95c8d6a42ec6b1377f3ddbfa43121efb430526c492.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3591dc-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "645e65a8-2fb7-4920-8e0b-f5837fcbd48c", "comment": "Malware payload", "value": "26870dfa614302fc3fcedd6700c09af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "79591fe9-b1b1-4614-8e53-9bc0e5bac05f", "comment": "Malware payload", "value": "81edc0b4af09f855d026fac7cb8612cc760be4bda58bd5b6242effee69ea9bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "7d203332-dcac-411d-ab79-728e2e219017", "comment": "Malware payload", "value": "7f392e514d05bc2293b7b0b5275b6fcbc0245a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "3a7c6da5-e0c8-4e1d-ae5a-c90a8c2a25a2", "comment": "Malware payload", "value": "f071aa4e621796eaf8d90a840bbf7b77109a26b9ec73bb32000a9da7863ec93c7ff3b7fd0ee97d3e3817a1b04212930b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "1cf47838-e469-4bb6-81ca-224e51b8c7ee", "value": "T17603081229792F07D0E0B97E31B78791F2A16B9A2794C54FBD731C4FEE26310581A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "b9aca5f7-e88f-4995-9867-fec3a2e4adf9", "value": "768:SjCzgE1W/fCnpKMCTF9ywVcVPZ8qIKbiq9rCTXHE6lVjRNEgac:SjggzmpKv9DVcVPZ8qIKbiSrQHE6Ljc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539233, "uuid": "82aa8516-fb5d-4721-8137-7a9a7ad9ac90", "value": 37792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539233, "uuid": "7be071be-75db-44fe-839e-29024cb8f9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "76fae3be-7292-4656-8c44-809eea15dd5a", "value": "miron.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e01c0c2-9639-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786530721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530721, "uuid": "ebebf6b6-e20d-4161-b99b-342be778aede", "comment": "Malware payload (RemusStealer)", "value": "cc91844b5e093ea021a6f38ce97c0dcd", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530721, "uuid": "f918378c-3d27-4b8e-8ccc-843a7e8603d0", "comment": "Malware payload (RemusStealer)", "value": "824570f6c57659b61ba7f8dad31d7cd37d61d58b417bda953a5eaa0b064df328", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530721, "uuid": "c0bac367-071c-4c06-803c-3f4efc4cc581", "comment": "Malware payload (RemusStealer)", "value": "7635f9f41f9527fd849d0a443af5648f3ca823b1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530721, "uuid": "8fc434a7-f258-4bea-930c-802715784937", "comment": "Malware payload (RemusStealer)", "value": "afbde95a74aaeca6c90783459e8b25fa038dbabdaa5e0a62d529deb1c777bcf2582d3516366544a4974cff120910fd8f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530721, "uuid": "ee5b73af-2fd1-4474-9fbb-af069e27037a", "value": "T1FA263A177E9148F9C0AAE335C8BB5255B620B84C8B3133D32E91AEB82F727D15E75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530721, "uuid": "355412ce-3801-4a11-902e-6bbf77c26d56", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530721, "uuid": "9a0ee450-5140-4e7e-9e29-83ad43330b69", "value": "49152:NxqyBuLlYvu2+q0py5qoEFTSmVLIgj7OG/XhUbWsJ/2:NhE2Bo3iQhUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786530721, "uuid": "feca70d7-0be6-4b83-9c30-1511a1bbf469", "value": 4782432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786530721, "uuid": "ea919c9b-4c81-4777-8220-7bfdde359f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530721, "uuid": "3ba1f58b-346a-4b44-83a5-aaa953ed0c21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb6c09a-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786516146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516146, "uuid": "c866eaf6-88c9-4c5a-89ec-9032005eebbe", "comment": "Malware payload", "value": "c11ac7356289da2c3fc11a764d9bd7e4", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516146, "uuid": "27283cf1-98a6-4e0b-88e9-bc2d875a1508", "comment": "Malware payload", "value": "848ba1f98807c464aa19c28b90be1a6c3bdf09a8d3f6e811678aa33dfdc65ee3", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516146, "uuid": "db21b71e-5a8f-44d8-832a-79038b4b61f7", "comment": "Malware payload", "value": "b8d0229aece7be1944116ea4dd42e1d6acf72d2e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516146, "uuid": "d96783cb-47fb-4d1f-a883-cf5ccdfe926c", "comment": "Malware payload", "value": "b9f89c4fccae2c4d8f05b4ce6d63e4b3546c53f89a7c94d17e7bf60fc7392316150a4ce9160ba42930d4e8a12fadd17b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516146, "uuid": "8bb70e3b-5f51-4622-868d-49295eb31593", "value": "T16DC68D05B6E581E8D476C07C8D97D903E672B8920F30A7EB3191572E6F376E09E3B660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516146, "uuid": "a5c46d5a-03a2-4cf9-8301-755eb62db4e3", "value": "7cabc441789f036fe6fbaad2b488a57d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516146, "uuid": "9d0c8fe0-920f-465b-9bac-73724d62fe1e", "value": "98304:7Y148pekOrS0fNq0dwIRT0ZUEEvzOwpZp9+iYTyy5O+oYFLvdUTOdX+BNsn:7gTpepG45d9RwMvzOwpZab3hQq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516146, "uuid": "ed120c35-db0b-4e1b-bd22-f22a8a12efcf", "value": 12495360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516146, "uuid": "46675931-e1bf-43eb-b6f9-67436788aa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516146, "uuid": "64bfd17a-3103-41c3-a1c6-11407f6f2825", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d9f14-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786521730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521730, "uuid": "4bd1036f-582a-40b8-9a8d-487b68c7a7c8", "comment": "Malware payload (AsyncRAT)", "value": "4105e21f01decf066a6e3c137c41328d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521730, "uuid": "429c1578-398c-42ff-83bc-df668d41b85b", "comment": "Malware payload (AsyncRAT)", "value": "84b7d6488b178558fcc7d9af32cff9491e6d46b1461027f70de3162415525d10", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521730, "uuid": "21736ff6-b7ad-4561-a5b2-016f86fa29eb", "comment": "Malware payload (AsyncRAT)", "value": "96ab7e733476f3d71a911896dea130c150fbdc1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521730, "uuid": "e2368bda-403a-4366-b4b6-ddf794259db7", "comment": "Malware payload (AsyncRAT)", "value": "6c425338740a1306791e50dfa90e3a859cbc5138d5a9746e0804d44e412bca9854b80c1600d808a3e2a840117d3bd4ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521730, "uuid": "f476422b-3d5d-4c5a-ae41-46a14f59750c", "value": "T1F8247D442F010B29A3C9E4E4B80F28DF19F5E9B17D7A1A64A6F5ABE33913C81A1F5531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521730, "uuid": "3570011e-a512-4780-8cf8-1e3fcc476479", "value": "6144:bJgTfwyLYK8lYAZ6sJe2txPl20vew5b2UuTOmw:FTyLYjiAzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521730, "uuid": "ec5aae7c-ee2c-43a4-8ab6-cd547f4e707f", "value": 215900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521730, "uuid": "2804274f-c712-40ce-8109-ae98df819c87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521730, "uuid": "a20e3a02-3378-4abd-91c5-dc29c1cf6580", "value": "hesaphareketi-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae739b80-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786498778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498778, "uuid": "9f87c3f6-e01c-447a-bf74-fb6b95845d0f", "comment": "Malware payload (Gafgyt)", "value": "efe65b8c5d863c8eae40c392e93b52b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498778, "uuid": "82190c98-d6be-4168-90c6-9f918daf8188", "comment": "Malware payload (Gafgyt)", "value": "84bedc6e24f76a488a88f28078cca8d8d0a720201e753119b7d51f20c070a023", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498778, "uuid": "9fa90158-d6bc-4f28-b843-98444dd2770f", "comment": "Malware payload (Gafgyt)", "value": "c2cc55d57b954b6ac58af858493a247836d68dea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498778, "uuid": "5f1202f6-36eb-480b-adcc-14e0ecd1c7cb", "comment": "Malware payload (Gafgyt)", "value": "1a5cb52140516d194567070c7c93865180ede8d0fb84fd7ecfad3d2b232e488362406940dde6d80b043e295e2b858242", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498778, "uuid": "9e3ce909-363d-46c1-949c-31e7ab11c34c", "value": "T18314D909AB610FFBDC6FDE3702E9060539CC651722A43B7A3674D528F54A90F5AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498778, "uuid": "d8566f00-5b88-42f9-9ad2-9274c4495e9a", "value": "1536:IIU/ALpuviU6OYO/gC61PhA8wLh3jmTYxU0FhNQF16YOYcJZeWW5TREqSgyLJzOp:nKvfYOP61ZWJNQFsYcJclMJzgOOx6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498778, "uuid": "11929c22-5f73-41da-b562-418b92ea65b5", "value": 199368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498778, "uuid": "bd7bf3b7-ac4d-48d6-9443-5d79eee26bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498778, "uuid": "ad8ca300-69aa-4bda-98e9-48b97af5f93d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7329d7d9-95f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786500826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500826, "uuid": "284062d0-0a8c-4e15-9f66-7001b873b4b9", "comment": "Malware payload", "value": "3776191e0a66e32c591009dd262619cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500826, "uuid": "8e0c8e9f-a0a9-4d06-90ec-d095a8f75a04", "comment": "Malware payload", "value": "8525891ea500f864200ea363c6a554de547e4672b74e52a950f16f06af58bebe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500826, "uuid": "a5f273d3-1193-4f29-8aa8-b53b094d0d6b", "comment": "Malware payload", "value": "a187e345aa7832d4ff269ad52ada761243d76b32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500826, "uuid": "94e482d1-7ae0-430d-b959-d77ca4fcf92a", "comment": "Malware payload", "value": "60be502b14f998ca57a9113fe770bde30d1a929906d3d7b970ba73a0d0980d55d5e703cf4a93779d9ba5b8cda6394f99", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500826, "uuid": "e67a3151-698d-4ec2-9b6f-1d0d08d450bb", "value": "T1D83164DA54141A312502CA9E7772390CA29FA2FB2D8FD7D49C9C0E9942887CCF661B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500826, "uuid": "fcb8a2e2-55a8-4e9d-9d1c-6bae2a524c98", "value": "24:+WSWg6SDTFpJCSzFbEXLFqUrQcUtUn1JLOejIBQHpGubuAW1XW1avv:+Tp6SDDJCSzF4oU7JGubuAuXua3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500826, "uuid": "8fb5880e-ad7a-4454-9896-21ba67f9467a", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500826, "uuid": "6673d415-86ba-443d-b859-eeab5603e8a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500826, "uuid": "5ccb011e-d09d-4dd2-a7e9-b3826e2f0702", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657f89b6-9613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786514547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514547, "uuid": "85b78192-12c5-48eb-b8bf-cff5d407fe89", "comment": "Malware payload (Vidar)", "value": "26a023345c27a0a1d6ebc732a11e1368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514547, "uuid": "35df34e8-3619-4670-96ee-4dab85d47730", "comment": "Malware payload (Vidar)", "value": "85580c4a570daf046f0ac5dd88b5123af2acce5e30ed3afcf29001e8b963fd75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514547, "uuid": "5baaf9cf-6728-4534-ab84-8cce031e69a8", "comment": "Malware payload (Vidar)", "value": "762e60dbd59195ea952218ede23b730a8f7a1bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514547, "uuid": "ae862d8a-35da-4e54-955d-2914619efc96", "comment": "Malware payload (Vidar)", "value": "719fe26caf9d28ff45e2926f2c9e3741108443964d2fa6c15ec060b8bd6e167ee64c9ede802fc076d0ae0af4eb657971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514547, "uuid": "3423527d-f321-4ac5-88dd-9cdbee6099d1", "value": "T1B6367C07BBD20964C099EB3099BA4256BB69BC0D8B3137E31E60BA753F367D15D39B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514547, "uuid": "d0fb95a1-a2d6-4ebe-9c09-f1b6ed825c25", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514547, "uuid": "39efc248-a76e-49a1-8947-fd6cec87a8b7", "value": "49152:WdM/4RFTNuQNZJWvMCeUNBHaMarC5iCMLgetLirEcT8FmQ8ljL2FHR:Wu4FIEiNlbWLNnFWIFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514547, "uuid": "4eb78685-be8e-4d8f-888c-082e674aa558", "value": 5234064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514547, "uuid": "0b4eeff9-c78d-42e2-a1fa-e57a82fa02de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514547, "uuid": "e93d296f-b977-4198-bfdc-13a73b589396", "value": "85580c4a570daf046f0ac5dd88b5123af2acce5e30ed3afcf29001e8b963fd75.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea54bf3e-963b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786531950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786531950, "uuid": "a0fb2237-0f89-48a2-93d2-e9c65defd44c", "comment": "Malware payload", "value": "bd4e755fdcfcca64023b588298346c8a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786531950, "uuid": "907049f5-8443-43fc-b52c-38cc4ace8f7f", "comment": "Malware payload", "value": "8649a37b00dc608622665b15e76fe3f349b8e986f779163b72e7bc1772b6977a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786531950, "uuid": "4c024f44-16ab-478f-82b9-1e1fbc58cddf", "comment": "Malware payload", "value": "118d8dfe17be48f0cda5bdb88aa999fc8c833a14", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786531950, "uuid": "7636697e-c9db-401e-af62-4daaefc36885", "comment": "Malware payload", "value": "66f576f79e2ef2a1ad3f1c5c014653f9203f6f90c854dfc9c08ebd633eedfff55f0520dea7b07334396bd0bcc4189b24", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786531950, "uuid": "df156bf7-7afe-4b60-8d1f-7cbcd0737c21", "value": "T151E6334A1C91719BD67B8478FEA042D1A53CB569037E85DFCF108361ACA72F46B3A42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786531950, "uuid": "7c811209-bbf1-4df4-95a2-28d0e05c6a81", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786531950, "uuid": "219f6cdc-bf1c-4112-aa45-a6c2d3741665", "value": "393216:GVH8uqNBlbP3g6uzwMs5pWqXMCHWUjEcuI3/PGTAI:GtklbvezfgWqXMb8RH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786531950, "uuid": "aa2da590-2408-4fdb-9275-97b63cc73f2e", "value": 13906264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786531950, "uuid": "e6d8ac7e-4c58-41c5-ae97-9ae3e4930e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786531950, "uuid": "07a81d5d-6d61-48b7-9419-68d64c0d08c8", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96235205-9689-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786565309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565309, "uuid": "1b635a0b-4ca3-4688-8cb9-e6ee6ce0bc5a", "comment": "Malware payload", "value": "8628c297e1e6613f18c19184b75ac504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565309, "uuid": "786b724a-e166-4cf6-bff6-a544b347a49a", "comment": "Malware payload", "value": "86853a0c9272afe15734577c5a7a14a5f98632b89aa986945e3bed3aa0c39b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565309, "uuid": "750cd7fb-f2c6-4271-a60f-9c38cb497444", "comment": "Malware payload", "value": "fba53867f5eb1c6f0a62e45db164794b7bba0f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565309, "uuid": "ad6874e8-07ad-4506-91cb-331fb415c4ee", "comment": "Malware payload", "value": "e9b3a58455d6cc4dc0b060098e4ea65ce075beaaf6f153d9763b452698cfcab8a2eebef7f159b83a6424d3d3a2fcc284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565309, "uuid": "c7cae15f-9a6e-4a9e-858c-6e5798d9e3b4", "value": "T105E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565309, "uuid": "6c720f50-8605-47b4-b567-0771cb40c73b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQH:cqYUQuVDt0TZEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786565309, "uuid": "4f3e90b0-073d-4fa2-8fbc-2374ad5137c0", "value": 15204352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786565309, "uuid": "635e3615-b98a-4247-9230-714497b4be9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565309, "uuid": "1bfa1723-0631-4ad3-8e6d-b941ccf4cad1", "value": "86853a0c9272afe15734577c5a7a14a5f98632b89aa986945e3bed3aa0c39b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ea6a47-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786500567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500567, "uuid": "89d65281-a660-41c4-adaa-0b04ee97ebaf", "comment": "Malware payload (Mirai)", "value": "24ea35a58c6a8f218623c38000d26192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500567, "uuid": "b26462a2-d565-4c75-99ad-07f61992a3b3", "comment": "Malware payload (Mirai)", "value": "86df3302af26ae932bf1704023ea4bc9399301563cf8207bb1a119fa6d01371e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500567, "uuid": "6315306d-046e-4d34-9026-8614ae1310d9", "comment": "Malware payload (Mirai)", "value": "19294672bd61d0a8c0c6283142515f9f54225d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500567, "uuid": "40396b1f-0a0d-48b6-9fd0-383c321f820c", "comment": "Malware payload (Mirai)", "value": "b125d37c3600b7ab2bc3ee4063d377fe5882a19405eeb3fddf5e62ec55cf6174307fb78c6fe567f94934d9a17bef2b14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500567, "uuid": "5085bea9-8d66-418a-9a33-c6b8c28a9025", "value": "T14C43026166628530C9F87174E662868D8D4B26FCD2EA61FB6FF6000B51D2E40F77F583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500567, "uuid": "31fe20c9-8499-4fb2-9533-0a5b70fc386e", "value": "1536:eebWWq0TXb8r/qtH/wUXgi2X2Ng94/PZ/Y6AX:eeb3qmr80+i4Ud/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500567, "uuid": "eaa0a4a8-800a-4257-99f8-2758262a3a77", "value": 60340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500567, "uuid": "8510a63c-8ca6-404a-ba4f-64eba1f6629f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500567, "uuid": "de46a499-5ac5-48e0-9ffd-5382f7354eec", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ed4fd8-962f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786526634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526634, "uuid": "2cebac0c-49cd-45f8-9402-ad4d1962e8b8", "comment": "Malware payload", "value": "f120e988e82d6e3ac280539e4abf6fbc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526634, "uuid": "594c3e0b-e829-42df-beb2-ac69c843ff47", "comment": "Malware payload", "value": "870ccf7d2b6d9b5ed378ccafdd7c58daa18d64889ce2be04a5f3579393c20903", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526634, "uuid": "44a3b804-522c-4776-af54-477d69ee0b44", "comment": "Malware payload", "value": "202af87d4a04a4fa17d388788bd89a2951c8141e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526634, "uuid": "2e2cf5d0-def2-49fc-8949-cabb816b2d03", "comment": "Malware payload", "value": "413bbaaff77bdd2819d6046a1e9bc7492f87f3a3d43896344983b1f0528d6345475a01b418a82d53000169d3806e0346", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526634, "uuid": "94cbb3e0-2a48-4f8c-b1c5-80efdfff9882", "value": "T1A3C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526634, "uuid": "e68c8196-bcf4-426b-911d-5a22b9d3eba1", "value": "768:Q8vCB+25j6es8RGD9FYpMSUpi+20qUpi+20YQX:Q8l25JGFd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786526634, "uuid": "1e059599-18a9-4c8e-83d2-70df674c70ca", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786526634, "uuid": "353b048d-cc7f-4412-8755-5da68cb04754", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526634, "uuid": "ab6a6c29-d5bf-4865-b89c-f90e57b8eec5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95fb070-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496676, "uuid": "dc8349e7-4583-4815-88b3-cf12b8d52199", "comment": "Malware payload (Vidar)", "value": "a8551bdd3bedb5dad0271923e0f071ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496676, "uuid": "7c24feb7-5b6b-4d8e-82fd-c397c6d5abd6", "comment": "Malware payload (Vidar)", "value": "876634b69315538b382e7e046e61c3323c704737cb4b2b2d637aa25382d513a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496676, "uuid": "214b26a2-9d85-4f79-b125-a9e56992ba94", "comment": "Malware payload (Vidar)", "value": "b20e30db31150507e52cf235858e3671a256f1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496676, "uuid": "2431cc97-a65b-4787-aff8-15d16ca39141", "comment": "Malware payload (Vidar)", "value": "055555c29f92a0936c59ff7ec534e7e308d764de411016500660342dc4cc86cf88ec4ba8055f6eebfa76241a7b8f72b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496676, "uuid": "5b8dfe18-4c64-4087-8d51-12d09bcad3d3", "value": "T1EA964A179B614C74C0AAEB358477861BBA70B86D873073A30D626D786F353D26E38B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496676, "uuid": "9ddd9ae2-fd27-4761-a17e-c38c71250565", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496676, "uuid": "cd88a49b-cbfb-4ae8-9bc7-7a823904263e", "value": "49152:bW6miotS3AxgVXErcD6BXd5uhJcLzqBRKR6GlIs6eHkXN1Tuc0SIlszIBnP7dFy/:bFcF2YZlIsLHu/ySIlszknP7di3Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496676, "uuid": "2f4edd3f-1218-4804-8401-efdd44c0ef5f", "value": 8883768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496676, "uuid": "cdd1e73a-85ad-4d44-b9e4-134fe0f7e914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496676, "uuid": "05add14e-663c-4b8f-bcbb-b2ff99a5f077", "value": "876634b69315538b382e7e046e61c3323c704737cb4b2b2d637aa25382d513a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b8d45b-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511357, "uuid": "c26ad2ea-f20b-4812-8cce-1bc7abc549d7", "comment": "Malware payload (Mirai)", "value": "a7f0d982b58dae03de576bd911780f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511357, "uuid": "497e9945-8956-4ee9-9281-4bb5326a6b08", "comment": "Malware payload (Mirai)", "value": "87c9afc6943fd6dbec0594312c8041068dd70f799bf8597f8f0d76cc6e1130cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511357, "uuid": "59c2bfb6-532d-4014-97cb-508c9dff0f5a", "comment": "Malware payload (Mirai)", "value": "b0abdd6bab937fcf37b0ba7b46ccca4aa18a7883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511357, "uuid": "e8379285-d390-4f07-8ad9-93c29a91ebf9", "comment": "Malware payload (Mirai)", "value": "627b0127c20fcdac0d5370f3e20b15e3aac13564e647f3f9bf3bfa0ac735eeedbb2102a446e08d7c4d76c3dfd3ce9fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511357, "uuid": "46093f68-9948-4dfd-bc04-45a231998520", "value": "T1E7E1B67EFF436DA9C422C9B495BA473C69E9841FCCA10F7538231B59FC05D8D8A221B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511357, "uuid": "3eb0b9af-a2f2-4439-a5db-2448fab0c318", "value": "192:RuZVUCyu4P0eB6kd+D2rrPllTTTo0GBJ8:SFU+38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511357, "uuid": "d499ae0c-d42f-4dd2-b21c-3dd8a558a0e3", "value": 7288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511357, "uuid": "8917c340-15d7-43d5-af10-7140e7c0458a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511357, "uuid": "fcf2fdc6-9e91-4501-b120-a8fd1344a3bb", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a772f26-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521857, "uuid": "240b03bb-01c4-436d-b92e-90c659d6c18c", "comment": "Malware payload", "value": "905b794bcf5189b89163f5633c293aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521857, "uuid": "9b7f437f-efd9-4736-bdbc-d32fafbae710", "comment": "Malware payload", "value": "87ede06f4eefe1e961feeed2d3d856bd7b1ff9746b78179b9ae06b870d5fe4e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521857, "uuid": "0f0d8d8f-b1cd-4005-8488-d93a225bcaca", "comment": "Malware payload", "value": "58dd89e565a6b536fd31f0a983c6e69ee7961629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521857, "uuid": "3ebb6763-ed40-4aa2-98b3-5df904ab6a9a", "comment": "Malware payload", "value": "8c4f83ae3e9302f9bee01b2b2e0edd86bb4fd61a2fc01d0d148fc3950990afe6db75d983e866cf354866aa54709f1506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521857, "uuid": "04e38388-043e-4725-9a94-d58052bcaaa7", "value": "T10C14291B339A32E9F4329139CA528543EB7D34751731877F2754422AAE636B4DE3BB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521857, "uuid": "6edabc54-99a3-4445-abb0-1143d767d70a", "value": "130b2dc32133536211cac2d13539245d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521857, "uuid": "f6bdbbc3-cbc3-421f-9792-ea0f24b41089", "value": "3072:7yrjIkNYVNAU3CDzv5HSoAJgsSkPNRKyD0t0Psr6cVCHd8foY46QZnV3cj0T87y:7KIb8U3Cnv5dA6FkPNky1PlcBohbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521857, "uuid": "b637bd11-248a-4d28-bf17-2e1d69a3f6d3", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521857, "uuid": "00269589-98f5-4d7f-9d11-954222765f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521857, "uuid": "a18670d3-19fa-471d-bcf0-17e73b8ad00b", "value": "87ede06f4eefe1e961feeed2d3d856bd7b1ff9746b78179b9ae06b870d5fe4e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3226adfd-968d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786566860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566860, "uuid": "067c002b-7eba-41e3-b5cf-93430ac44dda", "comment": "Malware payload", "value": "5aa904eb96c13f55b43a11ee0f2e4432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566860, "uuid": "7beac4b6-6b0f-4012-baf3-f06439e88395", "comment": "Malware payload", "value": "88174718adac0d95c5c2d87eab47b63d8b135dcec6c77b5962d9cc2c1433204e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566860, "uuid": "10e63bae-b759-498f-9f40-469a5da07677", "comment": "Malware payload", "value": "731808b77c7ddd0a1ba649a804684cdd18bc4828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566860, "uuid": "cf4e00ae-5422-4719-a5a5-81e7b25e38e9", "comment": "Malware payload", "value": "38f639f0cfb0f5ea3a0355a92ad1427eff187c37b0ae7f5eecebd6a06b5eca0d4976ef7dacd6a95051e4488b062815a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566860, "uuid": "60409733-de80-43a7-9edc-6873053f5e49", "value": "T15AF4CF117640C436C2B70A365669C6641A7EFC306E618A9B73C43F7EEE317C1AA24B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566860, "uuid": "9920313e-c797-481c-8381-6146ad017357", "value": "12288:sRsNW7ehwj4lkauPx5Ki7BvmZGRiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmC:syNW7nvUAW1lKwPOvfcvUnGJJulXvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786566860, "uuid": "8fb09a6b-657e-4b82-a5e6-b71ce0f0067f", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786566860, "uuid": "f23ad454-5db8-4d33-a150-c6469a167d49", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566860, "uuid": "47ae9c65-d3dd-47af-977f-3ee720f1a85c", "value": "Invoice_Adobe_installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51a2f99-962a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786524640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524640, "uuid": "eb35cc60-b777-406d-86b5-6dee8969d739", "comment": "Malware payload (Vidar)", "value": "7e414de844e2f8084a0265ee1bf549e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524640, "uuid": "e28f5d2e-0b5c-458a-ad34-1deef604664b", "comment": "Malware payload (Vidar)", "value": "88f820c540b2112b12f28ea67f5b31fd299422faa30e7a22bb5ca3f5c55fdaa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524640, "uuid": "f81cb964-dfbf-487a-be1a-8662bfc49af4", "comment": "Malware payload (Vidar)", "value": "906593ffc1808867fbda53f0cfbfb368749487fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524640, "uuid": "7c175ed7-d2f8-4a12-97a9-c01778810813", "comment": "Malware payload (Vidar)", "value": "961ea37fc28b6e193ec8deed195594fa9f2dd358b92604aedb78740745b01f5cf13ee6db4a64644b08f0cd58d84fb5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524640, "uuid": "31a0de6c-1dda-4a4c-9aa8-095f35440021", "value": "T180268C477DA848E6C09A9731C8BB4656B630FC484B3137E72E64AB782F727D19E35B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524640, "uuid": "96154cfe-518f-4d6b-818b-64597078a036", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524640, "uuid": "8072abec-a590-4f23-90cb-12058e97454b", "value": "49152:0GIRDfzEqLLUvrRnsPe+mJI63Wv+HE8XPdiFVtmpqPV:0pqWwI63e+HM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524640, "uuid": "dbe63c92-cdce-4b65-8946-1040680f2600", "value": 4432728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524640, "uuid": "0e235428-06e0-4650-9e7b-cef78c9db29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524640, "uuid": "dc18816d-6536-49f6-bf3a-0fc13e494342", "value": "88f820c540b2112b12f28ea67f5b31fd299422faa30e7a22bb5ca3f5c55fdaa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e352991c-9661-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786548259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548259, "uuid": "fce8115c-b834-4013-a2f5-dfced14aee51", "comment": "Malware payload (Mirai)", "value": "7cb1414d5a9a367a5697053d2facd7cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548259, "uuid": "854db536-70ae-4148-90d6-7e48239b03f0", "comment": "Malware payload (Mirai)", "value": "89017644143a5adeb65755cfac0c40dad205a3725b57b7f8c064cf9afabe5e62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548259, "uuid": "d12ecfd3-7bdd-4e94-852b-055833639221", "comment": "Malware payload (Mirai)", "value": "1706811925659fe093d9f81601d7f1cd4e8ed20b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548259, "uuid": "d5067b1c-7b3a-4edf-a3bd-9ae495734d39", "comment": "Malware payload (Mirai)", "value": "fb75e113600d32c90c148faa8d7191860fd1ff571af96ec3b331bb444cf5377bd4e9eafe3e92b7e293ef2a13c619c5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548259, "uuid": "2da42d5c-cce6-4d5c-931e-ca7ff53ba9eb", "value": "T13014D71A9FA10EFBDC7FDD3702E90A4225CCA51722A43B3A3674D524F54A94B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548259, "uuid": "1c51841e-3f23-4e3e-ace4-1903fbe354f8", "value": "3072:qUD/A+pmPxinfERvSRFCPo/m93XYAHYqr:NxpG/RvSGPD9HYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786548259, "uuid": "cd3e9e6d-ea22-46fd-836c-f3ba4cb093a7", "value": 203336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786548259, "uuid": "954a5e40-a577-4429-933a-51ef219f4cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548259, "uuid": "025bd11d-659e-439f-a30b-08d7f3d20d23", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04002593-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498492, "uuid": "17e28026-fab2-497f-bee1-06f732de9bfa", "comment": "Malware payload (Vidar)", "value": "b32a7e44dc8171d56cf610bfbcfa6d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498492, "uuid": "00d9fea8-9a08-4c6c-8f27-b38261ffaa8f", "comment": "Malware payload (Vidar)", "value": "8936b492f1e4a8c7685cb07d40df6e818cb8eb2997d2d2542a26c2204a9224fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498492, "uuid": "9e2c21e1-9962-412a-8648-97edd0af0d21", "comment": "Malware payload (Vidar)", "value": "d95e5b9cebf1dde21a036dc429cffb0ddba522ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498492, "uuid": "b01e9f1e-af5b-4cb1-af2f-70692e139e10", "comment": "Malware payload (Vidar)", "value": "f12b047494f33ed76df54dd7e02931d6a7a471ddb3c3811c8e71df98a684d9a7da70294e2972a5bb764e8207889dd23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498492, "uuid": "b5aa48ec-89c4-4e0a-b5d3-c5483128d7ed", "value": "T12A165903BC916CE7C0A5A73189B75242B6A4BE085B3273EB2E507EB82E737D05D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498492, "uuid": "3f26dfd6-aa55-480c-95ad-349a422e93a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498492, "uuid": "de262b2f-247a-443b-927e-27ee2dbf2050", "value": "49152:Oajn9EUdo/3qOwU+9MUqvPIRwABekhI+tRB7j/BGu/Ewy:OA/M2RRrB5lfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498492, "uuid": "0c0c6f68-eccf-4434-b6e1-170b0364365c", "value": 4363600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498492, "uuid": "6729f3a8-b701-4aae-a032-071400301644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498492, "uuid": "ccbd2b8f-efd7-48de-b355-39d03f6c758f", "value": "8936b492f1e4a8c7685cb07d40df6e818cb8eb2997d2d2542a26c2204a9224fc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0640e7df-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498496, "uuid": "b4ceed7f-79a7-48f4-ab10-4a3782acae1a", "comment": "Malware payload (Vidar)", "value": "1b2ed2db17c8d5d18ff73010d2b3a896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498496, "uuid": "af864d64-9097-4043-8f1b-1915b8de0847", "comment": "Malware payload (Vidar)", "value": "8a461217574508eec77f12bd6cd3ad1d43ba28050e853ff664fdd0873382377e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498496, "uuid": "f70a9ca8-bfd4-4b00-acf6-cf921a9cdd66", "comment": "Malware payload (Vidar)", "value": "024e4dcd12e55586d9bb07d823e71a8f4b66bbce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498496, "uuid": "f37fa193-9b8f-424d-b700-5468b74327fe", "comment": "Malware payload (Vidar)", "value": "1b9b7da65561b33d996aad066bbdecb64d1425059e122662553f3ce0204b1e44fe5457e871f12f8ba94fe06caf4ae419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498496, "uuid": "d5645a7b-4492-4589-9858-d27ba4d9aaff", "value": "T149665A07AEA15478C085E77488B652557B38B88C873173E32E21BE78AF2A7E11D3C757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498496, "uuid": "01f2ca0a-2042-4190-8d66-b3c6283e7341", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498496, "uuid": "e51f241d-4574-452a-a9f0-f2d84d126085", "value": "49152:8Yk9q51FtLOfqppWUGDux8uTY76MVzDIrcTwbsTDvJ0maAyUabsmaPPIi:83ffq5xUV3PwgDvGsyjs7Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498496, "uuid": "ad9db68c-7bd1-487c-ad59-a77911f84bbf", "value": 6491712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498496, "uuid": "b29315fb-82e3-4cb2-bc32-1a4ec1cf7cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498496, "uuid": "9352f80d-fac0-4d26-987c-ce4755c68e2a", "value": "8a461217574508eec77f12bd6cd3ad1d43ba28050e853ff664fdd0873382377e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ce6939-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509535, "uuid": "81c7113e-c790-436a-a2b6-b09744abd44b", "comment": "Malware payload (Vidar)", "value": "e38d1678928c12ca030390d295abf193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509535, "uuid": "230e9bda-d132-400b-a6a6-453dff4f8241", "comment": "Malware payload (Vidar)", "value": "8afa292780fe21d583fb6029d8cdf4f6e7463551004d7bb9a48424d0e8913f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509535, "uuid": "636cac8c-552e-4440-9870-c9d2bffa31c4", "comment": "Malware payload (Vidar)", "value": "d48ca27c5b94752bc215829ce1329022785dc743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509535, "uuid": "392079d7-d020-49cb-a18f-8429f63a6a46", "comment": "Malware payload (Vidar)", "value": "8cea0e0a5b213b59b6af8c4130839b642cf108aedd09959321536fe8d4ad52e0bfb5cfeee8a001d3645c728e5030d6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509535, "uuid": "1f0b7990-8b08-4fba-a987-33461bdb7941", "value": "T1CEE58C07BCA109E9C46AA33289B652927B75BC490F3227D72F9073382F72BD09D79745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509535, "uuid": "fe5fa6fe-bec4-48d5-a85d-6bbdeb22d8c8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509535, "uuid": "7d14b343-560d-405e-8456-b511900a5ff6", "value": "24576:Z++HimiQm3Xbxv2ZWuSi4tNFdwI4m0zKHOkNtu3NwO8kiDJZ1uHL/RtAJ7mvnxWc:Z++Cmw3tvoW6qHd9N3W8kiTE800gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509535, "uuid": "4d8c8979-3852-4e04-9f59-cbaf8ba29b5b", "value": 3032416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509535, "uuid": "159abcab-e3f6-4efb-84bf-cfa813eeff1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509535, "uuid": "31431420-9e14-4ed7-8b1d-04023bbfa538", "value": "8afa292780fe21d583fb6029d8cdf4f6e7463551004d7bb9a48424d0e8913f02.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c860aea-960d-11f1-bd95-42010a9c0009", "comment": "Malware payload (WSHRAT)", "timestamp": 1786512009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512009, "uuid": "f4c12c0c-e475-4433-b1f5-99d6216838f7", "comment": "Malware payload (WSHRAT)", "value": "ce87dd218969569f0012d89e71d1c412", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512009, "uuid": "4c5b5cb5-c8cd-42bf-9475-9602b13e3880", "comment": "Malware payload (WSHRAT)", "value": "8b96b7be0153595b751a0080b58276968895b213c27e2204688d67957d8bfcbc", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512009, "uuid": "cb8227a4-05ad-4e71-baae-74d2b8cf23ff", "comment": "Malware payload (WSHRAT)", "value": "e223af85987c0c8fcf4f791d8e0c68c2128747a5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512009, "uuid": "7e0e3578-3c35-4211-9c56-ee5cfccd2ddc", "comment": "Malware payload (WSHRAT)", "value": "72af5278df6421c9dfbd9f3ef1411c563bee261bb73110275ffc8b8203ad3dda1d3dbf1c60120ea87b4699be6cbab370", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512009, "uuid": "dac5d06f-52b7-4663-b866-8611ac5c3203", "value": "T175947A911F6F60BD929CD877EE09695D0F4A0F628CB307671E8E07E71434CAE2E68785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512009, "uuid": "377ca75c-1421-49f7-b941-77dd5acd97b7", "value": "3072:PNp/B5RB4g5bKTrWD/S6B3lBqQLqglkD2JO2JfHH1hfqKTYxtkxtfRg6p3QV8dKj:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512009, "uuid": "b40957fe-e0bc-4eab-837e-d54ec957f005", "value": 429590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512009, "uuid": "e81730df-7550-462c-a547-452ec7e124b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512009, "uuid": "b80af92c-b6f5-4917-99c6-694032ebeb73", "value": "DOC026812907864.jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024756a8-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574940, "uuid": "b1a61e4d-24de-4662-ae14-6573adc045cc", "comment": "Malware payload (Mirai)", "value": "295f3d71940f224699357163405d9553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574940, "uuid": "5e6d9bfe-b2c2-42c5-9ca9-9c35ff6eb3cf", "comment": "Malware payload (Mirai)", "value": "8bdbe21eafc7223a75ea9d075237d389e0c39f6370721f1ea36214989e5bab63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574940, "uuid": "96367c89-3908-4f38-b920-cf048d2e45b6", "comment": "Malware payload (Mirai)", "value": "73445dcaff640d213ca811cb07c6062ffed5696c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574940, "uuid": "3b16c1a1-4968-4208-92ec-50a9a534a9c9", "comment": "Malware payload (Mirai)", "value": "93b504ade060e94b338f1fce898b6b8fb04019431eaa5afbec3261e07f12a63389d19d8ed7a8b03fc2a573904780614f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574940, "uuid": "c4483fdf-91fa-474b-9014-4c1f8e53c4b0", "value": "T14033F881BC929612C5E423B7FA6E42CD332563A4D2EF3213DD222F11779A92F0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574940, "uuid": "44df08b9-bc0a-46e2-91ce-7e278abfc009", "value": "768:nciTxwAAo7758yVIoEavixJYrrxVglC/qWgpCmAAUS3L+adZnLWM4ZQoNkaPNOPG:ciTxOYsaRgpFjHLWMk8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574940, "uuid": "de8b107d-e611-4b9b-9ecf-8b3e129a8c74", "value": 52496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574940, "uuid": "7a3257f9-1537-4d40-9c55-90c25ea02f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574940, "uuid": "ff580600-7cd2-472a-a1c5-bfe577d859f0", "value": "ec54e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f5f8d7-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499250, "uuid": "c04ceb64-e8f5-40c5-9f74-baff9dd61d5e", "comment": "Malware payload (Mirai)", "value": "330d97a2295896b5db6f24071d6e3e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499250, "uuid": "78547dcd-c050-4564-ba69-72b51dfc217a", "comment": "Malware payload (Mirai)", "value": "8bf58a0e93c7bf558d7edf84f24a6e690fc8cfb0e48b2bab4060240606c61c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499250, "uuid": "5bef8e5d-61ac-4188-ba23-2e80ceadcb41", "comment": "Malware payload (Mirai)", "value": "16856bf17dfde3e6cef0b3aaef637b36814c0b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499250, "uuid": "cc58669d-478f-4b7f-a5ee-f00245f960e3", "comment": "Malware payload (Mirai)", "value": "9c45fb445223678dfebb1409da4ea0cd368d0c1d134ebc7a2be59fd5d54278d767d0160ca38fa407534c74e6a24863c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499250, "uuid": "88dd8841-1dcb-4b64-8b29-72d2b2dbfcfb", "value": "T1A043021251B7A536C561F73F7E21EB986424764EBB680EFB40D86ABBC4131223F29F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499250, "uuid": "51e3be2c-bedb-4b2f-b5b0-0200c61b0457", "value": "768:Oocd4IoJHbhFrqbtcv4+Hb4wmSwtVd5KJaFRlOL5SK9UJ3WKlstNKVCFAf5+C:OeXFxaU4wmSw7dMWI9uWMs4CY+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499250, "uuid": "5ebfcc1b-8e4c-4da2-8edc-35efeef771f8", "value": 58036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499250, "uuid": "189e3936-c8d4-4edd-a238-f7a66f32a750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499250, "uuid": "40ab39e1-5b1c-4303-8381-6bd37c4629d6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6906a326-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786521855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521855, "uuid": "fe12b6eb-b300-434d-a623-dbcb3d65d672", "comment": "Malware payload (MassLogger)", "value": "207260db35dbaf93d07e076082e02736", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521855, "uuid": "c7ec5d3c-96dd-4044-9f7c-0f510b4e5139", "comment": "Malware payload (MassLogger)", "value": "8c4b3e92aed63d09e3880db4cc04907906a6e89cf72aa91cba37ff4e0e460e83", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521855, "uuid": "9772745c-2c00-4bf3-8c82-a1e0dd5e1b49", "comment": "Malware payload (MassLogger)", "value": "7cf1e08cc5723c72423f19a1b1683e943c97bbb7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521855, "uuid": "4a3e9170-d860-4d4b-acc6-fef9db179465", "comment": "Malware payload (MassLogger)", "value": "cd8ccab87dbb00336f8b8f7b766511512943c7acad7a23b073dfffd2d351d609c3e51644ba0dd3af8760ac891b0a9044", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521855, "uuid": "d0c7d4a5-aa31-4994-a14a-c7555afd7992", "value": "T120F52A9637DF354939103358DD8C40144FAF807A9B26639670DA0BFCAF9F04A95E4AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521855, "uuid": "a1baf601-2898-42c8-96a6-9e71cb817ba6", "value": "24576:w5XpmV3yB+JWKtX7enTxcVUPx6WM3cQRGd1LOZ7f:w5XsV3evC7Yv0r/RGdpOZ7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521855, "uuid": "e41111f4-f887-4a01-a2f8-6d95b96e3682", "value": 3644039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521855, "uuid": "27db6177-4725-4f55-a879-65ad2b59ff1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521855, "uuid": "c0f71e85-3ff1-4994-94a3-dfe7914ee7ac", "value": "Vessel Particulars.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c529303e-95f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786500105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500105, "uuid": "c9e34a80-9b5e-45fd-a529-8b93616e8e71", "comment": "Malware payload (Gafgyt)", "value": "c6e6def07b228ba159ffb033fe084837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500105, "uuid": "bd9c602d-36ec-4733-ad90-beec8472e7c8", "comment": "Malware payload (Gafgyt)", "value": "8c7dfe6e0c62d3ff25f1f0b24c78a9d7932bdd8c20a9ce69881bb86e28f02ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500105, "uuid": "401ecac4-d8c1-4d13-94fd-9d9da581d127", "comment": "Malware payload (Gafgyt)", "value": "62696859184f65fa0531d38517404135ee949539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500105, "uuid": "7d58ddb1-1c31-46ea-8f96-edcf5b11be15", "comment": "Malware payload (Gafgyt)", "value": "220cbb52c0bbc3bd1d2e27e6612a6791eae7adf98364872f634774a4639a1ff7bab9546f045d2ed942ad932b50b99035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500105, "uuid": "a476149a-6d6c-4c2d-a295-f85cd81b304f", "value": "T10D14A71E5E228F7EF668C73047F74A20A76923D627E0D684E1ACD2145F2029E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500105, "uuid": "154ed1f5-7f17-46ac-a607-0ad4486f40ac", "value": "3072:0tzNco/MebNK8DFic87nVXvw+wRYam6xh8tgJ+WE:0tzd/Me5K8DKRvwVhmK8t3WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500105, "uuid": "25a14b4b-1317-4f91-85ff-3ec5a6f07df9", "value": 195272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500105, "uuid": "8e469b84-088f-40f0-a6a5-0c2851e40a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500105, "uuid": "e1e8b38c-23ba-4ef3-af54-e062ddb5ec22", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cfc17f-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786534976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "33650bf8-3b6f-4421-b036-7ca3b8c2b93d", "comment": "Malware payload", "value": "b19d2a779183c78b2dec40c4b93f0a1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "cbb6bdf1-04cd-4722-9d10-9799f152c68b", "comment": "Malware payload", "value": "8cdc5e2a7a7fd14b403ed0540bf6cfea08335a4e90065d90ee666e29526516e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "fde904e6-c08b-4802-8703-ba3812b51e54", "comment": "Malware payload", "value": "f003506f3c1df4901773f77668fdf22b6c92ca03", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "7ecbb88d-3d08-4a1d-a56f-9f41ce3e5423", "comment": "Malware payload", "value": "93a540d07ca8cab80049e510056ac0f26758ebf6292f727ef6a48c4b5676c3669ef56d5a3828ac8c5c3626b12c332af5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "1f6c0150-83aa-43d9-907a-20e25839f434", "value": "T13231FCA6101559699A578A03F374DF7EA22B7FB47DFF3B09DB89AE03444448031E2DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "a5b14347-b35e-43ea-8d80-25a392132c08", "value": "48:EBie5heJUehTe4HE45SqJxJGlIeG0v0ED5u5yVmjw/j:v+/YuUfbU/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534976, "uuid": "c5b94a7a-69ea-4d5e-b7c2-6f713322dfc0", "value": 1770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534976, "uuid": "edebbf56-4705-4ed5-888c-87601a72750c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "a96b0245-5c28-4f8f-9af1-d9fb4252a882", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20193e9a-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556092, "uuid": "68425c8e-5869-454f-b6d2-16d17d57a9f0", "comment": "Malware payload (Mirai)", "value": "0c126bdbdb3ce2f4debe337b30923a31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556092, "uuid": "bc804c53-5c39-4aab-9216-3e950fcad3b1", "comment": "Malware payload (Mirai)", "value": "8daa6ad802b6a6036aee176a7070198b1affbd56529b5b6a6af79475c1afdb5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556092, "uuid": "6340b37d-eefe-471d-b86e-c7f9fede1311", "comment": "Malware payload (Mirai)", "value": "56777c2676a86562959642079f7ae226c78a611c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556092, "uuid": "c36b8d0c-e3a1-4fe7-b917-1b243b8d016b", "comment": "Malware payload (Mirai)", "value": "380c6f3bda8188b9f4e80c8fc77656bbf20745a449ef67df53d31cf55d0771c9f56cf0babac0324b8dbcf5f709d6ffcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556092, "uuid": "32849d9e-57e9-4de8-bf9a-8557188617e3", "value": "T172142B0295504B57C1C21BBABB9B425937336F64D3DB3302AA24BFB42F86BAD1E2D511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556092, "uuid": "a1578091-85a2-4db4-9177-2f26a02cf92d", "value": "6144:/D1vt3yYaau0K/mQqDx4mWltYrZxa5F4sss:LZtCYaH0Hjx4mWltYrba5F4sss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556092, "uuid": "49470b00-bbd2-4d9e-a849-4eee275136bb", "value": 205314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556092, "uuid": "a4a2b290-83fe-4cfa-8599-d8a3a4315103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556092, "uuid": "d6332ed8-4035-4870-b058-3cf97c874ca6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8609ce03-969c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786573443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573443, "uuid": "504d4d4a-15b2-4543-a164-1d3eead49224", "comment": "Malware payload", "value": "256a2c7e8913d763a6510f561dbed7a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573443, "uuid": "c8ee7a72-ea5f-4bde-898a-6a8753d1fcfa", "comment": "Malware payload", "value": "8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573443, "uuid": "bcf137de-5455-48cd-847c-f765ae3f82fe", "comment": "Malware payload", "value": "c52a152e2a5b150936c6ac7d723f2883f043c5b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573443, "uuid": "ac66131b-3ebe-47d4-b3ff-7a0d24f81fc9", "comment": "Malware payload", "value": "fdbd9f9a05db13c6a114f57465fb6efb8a6eb4657225b8b8ecfec4c023d167f84635630237e1405ce841aad3684b980f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573443, "uuid": "3abe2bcb-0736-440a-a384-da7f1c7bb0cf", "value": "T157D5239A7CF358B4D07AC3318FD3E8AD71693B8587614E9B36CC5D409D228889C7A778", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573443, "uuid": "6bb072d1-abb9-4454-a82e-a4f7d88fdefb", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573443, "uuid": "ad80b2e9-289a-4d3c-9da5-377ae608ddfe", "value": "49152:TFWXPM677rPksxo+2Dw7POzuhSlu8s8gk7ZJeSA6Qr2/FE9aIHuBDw9dfLZY:TOPX77nxo+TPOzuauz8gk7ZJM2/FEOmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573443, "uuid": "0ed08444-af5b-4eee-9f7d-09df73eea33d", "value": 2989568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573443, "uuid": "d217bab4-3c10-4e59-964d-28b5caec9d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573443, "uuid": "59479a65-8605-4c35-90d8-9d2f39640f04", "value": "8e57f52d19952b761b82a28b528705df1e3d607b4d317bc3d96f1a27f8242d72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03b04c2-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786564951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564951, "uuid": "7b44a527-9281-4f86-b3dd-1290a4036b91", "comment": "Malware payload", "value": "d71f22e7f371fd8cebdfcab4f513e58a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564951, "uuid": "209cae7b-f2ec-4815-9b0e-a1f5810b11f0", "comment": "Malware payload", "value": "8eaa8e6cc4ddc443d7a8b81dcaf07d86531995c34b83b5f91b77817bf2c5182b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564951, "uuid": "14bacf04-4f73-448b-9726-df4670689581", "comment": "Malware payload", "value": "ee66a8ecb39623a4215c02dc3e4cd94ef1a5ba7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564951, "uuid": "6b591e7f-182a-44f2-80e7-0698c7892418", "comment": "Malware payload", "value": "1af431bea46e3d8f7f46aa79d1cb6c8929df15be84c4ad7205ecd1cb977ce40de534db4cd3580136160486bf9d20e151", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564951, "uuid": "ae1f441a-23a8-4767-a428-6096b20cf315", "value": "T1DA235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564951, "uuid": "910737a5-a906-4e1d-b20c-095f3ecd67d7", "value": "768:2Z+19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:e+mcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564951, "uuid": "ab1ffad1-a3a7-4f07-bbdb-79e912cb4fdd", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564951, "uuid": "e4c5c2cf-c5d7-4235-9e81-efeaa7da241f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564951, "uuid": "aa41c8fc-0bb7-4e4d-81ff-0be25eed10ee", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bfb6e2-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786564819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564819, "uuid": "8cb373d3-a04d-4e54-b6a0-c50fc5a5fa35", "comment": "Malware payload", "value": "13bcd8a8df210853eced8a9df9463edb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564819, "uuid": "0e0775dc-fb6a-4362-bbb0-eae877e3d375", "comment": "Malware payload", "value": "90202cdd88054c0deb81cf35d2731163da155d16ff56af548bf12c9af8d750d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564819, "uuid": "3fe21880-a65a-48b7-b356-623b4e984668", "comment": "Malware payload", "value": "25559fbb32cb7ebba84b550c62b30e367b571b47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564819, "uuid": "dd21bc9d-d8f1-4490-8e48-14f28101cc0a", "comment": "Malware payload", "value": "bf8862ccca65ee63ffdb08eec2cb8ce0ff173f3ff967f99fd1e88df49412983f5ad442fc665c23974e4ae6a08972affc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564819, "uuid": "2a94a02c-6584-4e3b-9409-51a282e9e18e", "value": "T1D6C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564819, "uuid": "ac16420e-cc1e-4770-b3e9-e6267ad1d4a2", "value": "768:bj8vCB+25j6es8RMI9FYpMSUpi+20qUpi+20YQX:H8l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564819, "uuid": "6b15c049-6a9b-4482-a29a-ff124ee3e1ad", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564819, "uuid": "cb610e62-bcad-46d1-88a6-6b7b6b06525f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564819, "uuid": "cf3b7e36-6023-49a7-82b4-7dee501a6feb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e915005b-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511332, "uuid": "75830316-e1b2-4372-9da5-91334289a454", "comment": "Malware payload (Mirai)", "value": "518dfee94dd7f153797a3eb1346ce620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511332, "uuid": "99c85e1b-5fce-4947-9ad7-7b6210a51431", "comment": "Malware payload (Mirai)", "value": "91749671fb25273b1bb59c409595b74d7dbb032c86153b6bbfd95edba817f91f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511332, "uuid": "4a02e344-b7e2-49ad-8d23-89a829d928ff", "comment": "Malware payload (Mirai)", "value": "dff9b1fc27c3aaa0eb51b9c138a839268328d4d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511332, "uuid": "e36cd914-b008-41be-a7e3-c6d76b2cebb2", "comment": "Malware payload (Mirai)", "value": "0549818c2d6507ea2fbbe19e8e7a2ebf10403dd0f23b90d4fcfd0a8315f19b316cc936e4d810070a1506935e5fa2afac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511332, "uuid": "6e577b9c-72af-4136-a7a0-22d9909cb0a5", "value": "T173317414B21A5843D5E03EB1F7371B14B77A8F526618960CEB8FEA89E8B5830C99D08C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511332, "uuid": "46972bc4-6e2e-4d68-9857-048d3b99fd2a", "value": "24:3CqgZpWS5SWLnZ3SwISBk8SKuQyN8/FkvtAFl4G/88uiENk3eZWZVkGo4AmCnOSG:Ku4RbluQYAd90qeuVkGo4AmCL97v4YDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511332, "uuid": "71ca47ca-9938-4fbf-a25a-e148dd8927dc", "value": 1644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511332, "uuid": "e799c3c4-2b57-46a1-8f24-3410e084f0c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511332, "uuid": "75aca931-ff7f-4b48-b395-7b0a6feceb5e", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee56672-9686-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563955, "uuid": "9d2c608a-4e9e-4500-9072-5211fb71a4a7", "comment": "Malware payload (Mirai)", "value": "1c9799071ed181099ef51a62621f0065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563955, "uuid": "5cea735b-f64c-434c-957b-f0909eceeb39", "comment": "Malware payload (Mirai)", "value": "91a227128d954b490d2c0efae44f79d15eaed016947eed179e97ad49f5467908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563955, "uuid": "c2230d38-8b45-4cc5-b6da-15b318b33797", "comment": "Malware payload (Mirai)", "value": "58e81f63464a31fff29a8e16c991a857c59a80cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563955, "uuid": "6519e304-72f1-4708-98a0-f1e60152e451", "comment": "Malware payload (Mirai)", "value": "f233dc81177bd10860390f99e81a4be9a31ae12142942177f934d1281cd6dba8e976d1e824c9dcc870659b22ab5509dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563955, "uuid": "f88a6adb-8c2c-44d8-aa57-e83c17eb0ec4", "value": "T163C319A9F880DE52C6D52676FB5E418C33231778C3DA7105CE109E35FBEBD5A0E2A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563955, "uuid": "cb63a372-c423-48f5-8bbe-8e42bc365095", "value": "3072:k8UWljtkimUjqI61hcYEEUjTisJOOvL1IlPUvz5NIFxNZZudf1Dl:kLwjrFShcYEEUjTisY+LeBUvINwd95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563955, "uuid": "44289b53-c294-4e21-b78f-9158683f58c5", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563955, "uuid": "03d6b248-d5d1-4844-9923-61ca5d790ac3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563955, "uuid": "f1a4d12c-dcbf-4fc6-8ed1-5f61c5114e9c", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06542e36-9695-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786570222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570222, "uuid": "ba96b6be-d47e-45a8-a846-e50906921b28", "comment": "Malware payload (Vidar)", "value": "d9c064c8839561510fd48495aaba5e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570222, "uuid": "39f72588-4542-4718-9fb1-b749c0876602", "comment": "Malware payload (Vidar)", "value": "91b2d597575f74009b8502c77279761cea8635606e7ca1fd146fb1a4a3127785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570222, "uuid": "6ced41c7-7bdd-4b75-8bcf-035d007506ea", "comment": "Malware payload (Vidar)", "value": "a887ca3f33c97a52abd352b8266c9559f0de7885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570222, "uuid": "6c88079d-3362-46d4-a7cc-faf856dfdf5e", "comment": "Malware payload (Vidar)", "value": "ad89f09d2752bd2823da291ce4f9a04193a1f0fe7a5844b4cd18bb52eeb4c7db3c3abc44d1fe03d1503be1b33792168c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570222, "uuid": "b5223ea7-2c35-40e5-bfd9-86dd6253ed6a", "value": "T1A3765B0BA9515CB5C09AF63184BA4247FB707CBD573263D72E90BA782F763C16A38316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570222, "uuid": "6a318b51-dd9a-49a7-a6c5-0610e60b44a3", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570222, "uuid": "e1d8b5bd-46a2-42c1-9b79-263342378fcf", "value": "49152:qYOcEhGogLzwpw4GXr4k8dvGNjB1UPOhNElfw9V+Ea5ELwPm82Xf3INVG3YPTV+E:q868XN8BGelfw9UEMPm82kXr/tvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786570222, "uuid": "8e95f4d1-3b45-47d2-a063-6e4f8ee16b42", "value": 7808392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786570222, "uuid": "5616e85e-ffd5-4d29-a861-46b83563017f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570222, "uuid": "0174ad6f-4d87-426a-b568-dfa8e08d2c3b", "value": "91b2d597575f74009b8502c77279761cea8635606e7ca1fd146fb1a4a3127785.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dd05fb-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786511681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511681, "uuid": "54c35333-29e0-4f81-bf36-497311aed22d", "comment": "Malware payload", "value": "b5eec72224d932572ac479f0737fd98d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511681, "uuid": "d30d902b-bd87-4991-b80f-9cf421ae578a", "comment": "Malware payload", "value": "91c79d344dfb70158c8bc240d5ff69a13cc7e667232fd1706aa9001d52b45f20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511681, "uuid": "9be35a15-e04c-4ae8-899d-fd97ae9de707", "comment": "Malware payload", "value": "fc6308d7be0a25bd70e676f6b768760c04891dd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511681, "uuid": "0aff01d8-d756-48ab-88e7-d99d5c8ae3b3", "comment": "Malware payload", "value": "ac3063aae848cd2cddc375a25de57ece3000d72e6517c6f610abf298b82a189b3df40db0022ec005c5bfefc344812c3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511681, "uuid": "38160a08-687b-43f9-a279-f8c33180d968", "value": "T18F221B5AABF29E37EC6C133D21EB832C7360D88147E5C7A7060C79152DA33D82D65A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511681, "uuid": "ab91cb00-2f51-4cca-8250-3935ed55ce4a", "value": "48:MiFS063i3c3O4WMkxv+XVfz3XD883vw7mkpt8uRgAX5fjXqSLjHb:ZFS063iM3XXkKVzTxvw7rpnrJjX3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511681, "uuid": "86fa1042-8372-463f-b170-416907d21176", "value": 10600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511681, "uuid": "8727d51a-aca8-461d-9abb-6bcf7ea78f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511681, "uuid": "a51e060f-fd36-432c-a04b-e57bbfda4813", "value": "a.out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb427db-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521784, "uuid": "ddad5494-5eeb-46e9-911b-f4000cec1861", "comment": "Malware payload", "value": "0e6237323f3da1170c47a7c82fdaeaab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521784, "uuid": "ff3921e6-b941-4ced-aad0-84a63b835d42", "comment": "Malware payload", "value": "920d1811a907862961f1e72083d46e4a62976a592ba515386e6c2c0637438262", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521784, "uuid": "3ccd77da-9cc0-4151-acaf-0c1ec486e485", "comment": "Malware payload", "value": "0be11623704c19d6be21a6f2fd715d43aa506f8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521784, "uuid": "eb8bbaf6-9ade-41c8-a853-b45e71d05e5e", "comment": "Malware payload", "value": "bd398bc26d1962f0bb137c23c10279e27de5fe59e7a87a5cd755168a3bc24107261f4af3d7ccf966dc591262e8722f98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521784, "uuid": "223694e5-f8cc-4910-bf98-cacd411bed1b", "value": "T19CC7009347D0105598B850976CADC00FB2E33665483AD366630EE0D3492FABFEADEB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521784, "uuid": "b35c4866-d91b-4c33-b595-7e591ece664e", "value": "192:xEqqiX2rw52Brmr5rGSadN+AlpPv6J1g0IkHw7:JqiX2rw52F0tWdLlx6JrI+w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521784, "uuid": "6015822a-4601-4a01-bdac-5a819e44f305", "value": 55109957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521784, "uuid": "0c0984f1-c0bb-46f8-a43f-b47071252eb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521784, "uuid": "3654e160-b4ce-40ef-81d3-b827a8d45912", "value": "purchace.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43675b66-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786535106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535106, "uuid": "6cedaee2-f9f5-4123-839e-9c9d211f6f1b", "comment": "Malware payload (MassLogger)", "value": "52523a3c3748e7b508fcd4484362c85b", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535106, "uuid": "bb9d2c98-60b6-4455-ac4d-9c893dbd1cbb", "comment": "Malware payload (MassLogger)", "value": "92b2989827051a5ed0d423a9114ba2a09663da312159df167f5a031ed796b268", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535106, "uuid": "5c061898-c4e7-4f38-aced-d910b5943a2a", "comment": "Malware payload (MassLogger)", "value": "e95b6f63cbb70bd8997398c19dd9c1e8181e2537", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535106, "uuid": "b636fe53-56ca-418f-8340-b7028b88ceae", "comment": "Malware payload (MassLogger)", "value": "52fc1b919db12d7d0d9f2e538df0d9981a5bbccb6e24f7ac45698519b231026b1d284c1fb7ab69be1021a359da9a30df", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535106, "uuid": "77ba855e-9708-4f16-be82-e6082e00196e", "value": "T17A53D5F05F28C0E38C5BB8D8C8A5DF90A7B4AA1BBCED8D4B55C1D7928A1D58378C55C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535106, "uuid": "b80d8036-152d-4771-85fd-4ed470395612", "value": "768:N6C4C00RS1WQTd9pjtoqoijh8jNfB7B+6wiHq567c8JY/VTLSd4dfr8ayuVa2F9M:UJ12ky7c8aiUYYLxvQ7yh8Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535106, "uuid": "5b66a50b-8801-478a-8956-892d1e154fb6", "value": 62181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535106, "uuid": "0223922b-e56b-4a8f-9ffa-a8acf692200a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535106, "uuid": "367f7fb2-0f73-4dc6-b8f4-ed8b30273701", "value": "rk990321.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437abd72-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493015, "uuid": "8266ce8a-eb73-40f6-aa7d-9059e786b5cb", "comment": "Malware payload (Vidar)", "value": "dde5c152c1b8a17745c42da6ea93c5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493015, "uuid": "d941017f-fa22-4b6b-a5eb-064a343c85e9", "comment": "Malware payload (Vidar)", "value": "92fa32320648c6d78cd7b9413f334c049102049b4b6975f2d922466b2ef46ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493015, "uuid": "ba7071be-ed25-4132-a422-ad07907b1a53", "comment": "Malware payload (Vidar)", "value": "583c6b9da264df4d8f6da10b8bbdcb082c82dd9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493015, "uuid": "080243b3-0650-439f-add8-c51ce3f34b86", "comment": "Malware payload (Vidar)", "value": "0b89700afecff2045b65f1151c793665123535eb024b561bf47accbc48f7d7fec8fcbafd38de9d9c24d8ae7c08c07832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493015, "uuid": "6d932660-5053-40ee-89da-17eb3601d788", "value": "T127367B03BE9518F9C095E73589B74252BA74BC4C4B3133E32E60AAB42F763D16E78B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493015, "uuid": "28656caf-d7fe-41df-8e1d-6254ef1c4be1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493015, "uuid": "6b7ba856-b0ef-461f-89e4-a3f3c2fc0f36", "value": "49152:VBNorZ5zxwq+GnKX84XxYsYXg6gmp22DnbfwrYuJghNASSnAfKa:V0TKs4SsYcg22HfwrYuJghNxqxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493015, "uuid": "4ebb6a5d-281c-447f-a61c-e91a67a839ac", "value": 5025640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493015, "uuid": "a9ec600c-4cc0-4a78-b2a1-a6295caa6987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493015, "uuid": "75a90da9-5368-450f-ab49-fd7f9146dd8d", "value": "92fa32320648c6d78cd7b9413f334c049102049b4b6975f2d922466b2ef46ad8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2967c040-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786509292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509292, "uuid": "86cc6ed5-5aec-4d43-a3c8-a49a5f06c86f", "comment": "Malware payload (Mirai)", "value": "e9c358f095ce2389b432d6701d1d9c33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509292, "uuid": "d0e684db-46ba-47f7-90c3-894550826721", "comment": "Malware payload (Mirai)", "value": "9509bd33f3375a7fc3ac223852ba568ecf1f9d3bdfe1626b54b1fa5bdb96c86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509292, "uuid": "a766bfb8-5d85-436b-969c-b01854a7bc16", "comment": "Malware payload (Mirai)", "value": "962344390f0d77122b0346cfd55ebb0e3749ee69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509292, "uuid": "79d07738-9e49-40ef-b0f5-39c1445532be", "comment": "Malware payload (Mirai)", "value": "eb33f4c497c013a4b6694a37e721c7d5747616207a5e701a0c194686b1181bc30cb893ec5566f33fed674eb3ae42da87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509292, "uuid": "2a1ce2ff-9539-498b-b2d1-760f78b051dd", "value": "T12BC36CC5F643D0F2EC6704B1013BA7238F32D176563AEA42D7A92936AC63650DB0B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509292, "uuid": "278b843f-4993-4939-ab98-3bbd8443c9c9", "value": "1536:jnX4ZSznC3ojV9NsBaL0w6tPYYG3GvprGsL6elWyDSqu3v3eb:jnX4ZSzn2obNs0YQYG3UpKYfPOAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509292, "uuid": "9122a85f-da90-40b5-a9c4-6135d825c9dc", "value": 121576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509292, "uuid": "050bcba1-6dae-47a7-8819-f7f15862020a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509292, "uuid": "72b21927-a9a2-45c4-91f2-a1f340d3fe7d", "value": "6c15b783dd29f5d28b1dacd9154947931d00f442539c4218c36cc54fbf76b885.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cc8234-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511675, "uuid": "11d62010-7e78-4b05-a607-bf586a2e6f38", "comment": "Malware payload (Mirai)", "value": "d6b693cbf763f5e6ab3300a10a11a663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511675, "uuid": "576e12f4-c5cd-4b24-a5cf-c3ecb18095c9", "comment": "Malware payload (Mirai)", "value": "951323faa4569e03917d566d05ad9270dbe5d4b1384d440759be6711a67bbba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511675, "uuid": "2baedfbf-73cc-475d-8b7d-32d694877933", "comment": "Malware payload (Mirai)", "value": "51f8044469838cfdf738bb754a8634d7539dafd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511675, "uuid": "35804661-e4dd-4176-89fe-bc4ced05d449", "comment": "Malware payload (Mirai)", "value": "f0b602f44d7e9849ca5bba6c709854f12f95f81aed80315cdabb5cce72a62a6a7899ebaf82eab137e6192792b07316f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511675, "uuid": "cea8226f-fd3c-41e2-b626-66268bbd2c9c", "value": "T13022E555FE42AF56D8E414BEFF1F030833935B14D3EA321696658624278EE1A4FBBC06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511675, "uuid": "2bee6570-2858-4a2b-9008-d979239b7097", "value": "192:gll6lE6P9dMgmEZx4e9JQy5mHfiePIOFrx0ROtStXIZdU5haofdUmbBG:9ltkgXx4e9Jr5MQIezQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511675, "uuid": "e47cb0a6-c520-45d2-abe6-0c9ceaaf8b66", "value": 10448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511675, "uuid": "14a185f4-7c86-440b-bae0-6de3bdb24678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511675, "uuid": "7a1b8cb4-4683-4252-b2fa-f843e461d8d2", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdcffff-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521700, "uuid": "6e186b6b-cffc-48a8-b683-39e27df34109", "comment": "Malware payload", "value": "566024e92b636ff997bb3bcc88b6bc35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521700, "uuid": "2145648a-bed9-44e3-ba25-992171388f8a", "comment": "Malware payload", "value": "957a6b6e43933cd4f04b113ce45e58b3ba92ffb08dd93a7a0c4dbdf969d9529b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521700, "uuid": "1dfc312c-38d1-4180-a468-7211d793135b", "comment": "Malware payload", "value": "923704a40cbd27e681f05dbf1e529169ac1047d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521700, "uuid": "3bb9febf-a1cc-4ac7-ac9f-17c8fa8acda4", "comment": "Malware payload", "value": "6d872d5eff3398ecd992fc8ffe1a4fb5b508d3147817b778977c8238ce11629cde7ba521de33eede0f1b298f3de019b5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521700, "uuid": "88b88e29-e8a6-425f-bed4-bcf795a4f9e2", "value": "T171A4882FE0E48235785299E2FED18541013EFCEE1BDF52502AAEE8DC93A517631D39C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521700, "uuid": "fae58b3d-d420-47b0-9ca5-d4cc56d40688", "value": "6144:2YwnBydNRH9QP63Einly7DjOVS5NacRiWZrpzn:29Byhi63tnlI6cFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521700, "uuid": "ef096ab0-9c04-4fe3-abc7-b993c26f20ca", "value": 483214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521700, "uuid": "fd01088f-b034-42e5-a0a3-92270ebb3cca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521700, "uuid": "adddd171-52a1-4056-9da4-adc2eb2cd24d", "value": "Inquiry Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48aebfc-96a8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786578755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786578755, "uuid": "889f3ab3-6000-477f-acc1-00ba910d5639", "comment": "Malware payload", "value": "d39394efe3e231253b5730d4d6c5fb74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786578755, "uuid": "048260c1-6ddb-4ee8-8a6a-20d35b2f270c", "comment": "Malware payload", "value": "967fceb5b057003cb398afc50a071ff55dd004e0b1088c80daf8146ef2caed78", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786578755, "uuid": "71633ecd-5b46-46c9-a7a7-51d8b5fa6cd8", "comment": "Malware payload", "value": "aff63d875ed62ce9300ec2ccd236fddb34e4f99d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786578755, "uuid": "520328aa-661d-4ac5-9e1f-18fa07bfba3f", "comment": "Malware payload", "value": "d239e878c3759be4fe70a514fbdda3b02c6e63381febfb9c6587feb5ee077a975dc05d4179e7d667c5a1bbf5ff42e489", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786578755, "uuid": "88234078-9288-4a60-ab43-7c70eb41881b", "value": "T1FFE6330E95D2339DE6B0623CFFA062E4F44879F65B32A2F75B68D2605CA31D06C3915B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786578755, "uuid": "cccf1fcf-3343-47cd-bb67-a324534487e8", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786578755, "uuid": "daf1e5e3-c837-4f64-8a3e-cad2e5d25cea", "value": "393216:evCERZ8MNtmWuREobXMCHWUj0cuI3/PGTAI:evTM8mNRbbXMb8hH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786578755, "uuid": "611a7eae-3979-48f7-a2dd-9bc43b043efa", "value": 13879038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786578755, "uuid": "edabfde4-897d-458a-975a-dd9f405e23a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786578755, "uuid": "2a971b06-a947-43c5-876e-1111d84dca26", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77444eee-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786522737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522737, "uuid": "2fd159b0-7996-4b51-9207-c60de8a85cbe", "comment": "Malware payload", "value": "707aa7d080a4a2b8a48ebbc5c08529f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522737, "uuid": "90f77771-e4ef-4baf-b435-f1bf63e6dfc5", "comment": "Malware payload", "value": "970cb12c9b262d0088f8a01cd5bcb4b13248a6a980ddf89e8f9ca78531b44770", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522737, "uuid": "7aa61b3a-808e-47ca-ba15-289780fd868d", "comment": "Malware payload", "value": "88b8e567978a67057a5be9267b5410f8481bba2a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522737, "uuid": "c9ff4e83-3289-4203-afbe-e863618a1ec0", "comment": "Malware payload", "value": "d02d750c432a9934d5dcc708192c136eb682af5bf5ba9b3cb9ed365245a7543215b075531c84b3cfcdf60fad0c0d24a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522737, "uuid": "484671c5-07a7-4806-9229-ced2a9dd7449", "value": "T171236C6516857C14AE99C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522737, "uuid": "eb5caf11-0d0e-447a-a8bd-7181d334cbc3", "value": "768:cr9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:6HusZNcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522737, "uuid": "06f03452-b586-490b-b889-791e0430f53b", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522737, "uuid": "73731ac0-29bc-4e83-a3c6-6d66ef8a0986", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522737, "uuid": "212e0adb-da3c-4b1b-b956-4610e35b6dd3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f1d34e-9663-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786548861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548861, "uuid": "7484d73b-d34b-4699-a331-e9773d0c901c", "comment": "Malware payload", "value": "0ed42b2c44b873bf279c9544db3f7eda", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548861, "uuid": "eb80f581-2bb5-4366-a078-26f1c17335d5", "comment": "Malware payload", "value": "979fd05f03fe4197096b4b64711bc933c5b3897a2f6095b32f00e9fb52cb1304", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548861, "uuid": "a3e3c745-7886-4cb1-9d33-5ca8b13c19a2", "comment": "Malware payload", "value": "121948f4850ac9d8323e34272cab1216cc9ca9b5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548861, "uuid": "0d9295d4-8a3e-4e94-ba19-285f2dcdbfa3", "comment": "Malware payload", "value": "7e20abb6f5db7346188ab7c36e48e7ca45e178d4c3785228772f84a2056fda0f5e0131ab80fa726c7b80caf33e3e1ae6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548861, "uuid": "471f2db5-78a7-41a6-bc50-a29aee66a549", "value": "T15CC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548861, "uuid": "e0cf0269-46dc-40eb-a661-f7b9317d6666", "value": "768:68vCB+25j6es8RS+9FYpMSUpi+20qUpi+20YQX:68l25JSYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786548861, "uuid": "25a952be-e02a-4272-9c2a-45163d1bd6f8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786548861, "uuid": "f49b0192-7064-4f77-ba48-41555f595fc0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548861, "uuid": "cca0a152-75f4-4d08-a404-dbbf57fc5eb1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79855728-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502984, "uuid": "63bc3b1b-90d6-4cd7-8177-fdc22b5343bd", "comment": "Malware payload (Mirai)", "value": "ca2ef10d568ab44a4ffd933951a520d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502984, "uuid": "aacf8389-18d7-4070-9ca2-0fdea858c1d1", "comment": "Malware payload (Mirai)", "value": "97c5dc8c66c4b51ba6179244cbefd3498669392f06528d840b38790981e21aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502984, "uuid": "b8234e95-bf61-470c-a302-993ec324a134", "comment": "Malware payload (Mirai)", "value": "b7bfe4ef2cc1cc79354597d0a47d286a7635fe4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502984, "uuid": "fc89f109-363f-4ef9-bd61-076d0647fbfd", "comment": "Malware payload (Mirai)", "value": "c2f0da4ccca9db498bf339e21fa223ea28d2e3929d8b8dc97e96167d58afc3af91ac0342a1ea36fd126fe466a4a48177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502984, "uuid": "99fd30bd-bfc5-4ec1-9ea6-488e92a0d5fa", "value": "T17D533AC8E383E4F6EC1B0670101BF77EAA75AD222024D967EBD8F663AD32752911751C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502984, "uuid": "53c29377-e940-41a8-ac48-ceaf655792b3", "value": "768:euiqIMrjRKKP43M5NSNku3AAW0mDRu2b0olCL07ywS1cBkhRwY34PYD6iRR/7qDV:eGIMrVKq433CuQlFhoTwS2i34m6i/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502984, "uuid": "07a56221-0618-44fa-912e-ed7e1e07b972", "value": 66404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502984, "uuid": "76e4ff2b-8e8b-4fdf-a295-1ecbedd1fefd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502984, "uuid": "3ef1c46b-e521-4bc5-a78f-8ce3ac4aed5c", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79246905-95f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786499548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499548, "uuid": "c467c0c2-bcf5-4e52-bc30-0b9bfa7971ec", "comment": "Malware payload (Efimer)", "value": "52b62b3845fa3d72b7a81db636fe1633", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499548, "uuid": "ec3a49b0-ae3d-4d46-9a3d-76152aca8017", "comment": "Malware payload (Efimer)", "value": "97c6e06d93c29474c6aec258a9dfa0b2f6c1071b46b8b7dfec3d8e0a1e4a9f09", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499548, "uuid": "b2d41169-ad82-4835-8d43-be596d79817a", "comment": "Malware payload (Efimer)", "value": "5c6ccb150a830fb70b8c3215456275a08f729f24", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499548, "uuid": "4ffd78e6-a690-48ea-829c-11aa0a1e4b86", "comment": "Malware payload (Efimer)", "value": "127299848762ebbbfc4edb8f5b3ab26139903a8d5d117ace60a47b3a466fb8d9a8ca8bde496b77d0534cb52cb74270c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499548, "uuid": "4c82c229-8ce4-4cf3-ada6-dd81585ce691", "value": "T106D6330058D2329FE873CA79B7E046B0685ABC7917F71BFF148D8355ACA70D0687899B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499548, "uuid": "a60e7f48-9117-41db-8d9d-c3a274b2bc68", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499548, "uuid": "1f4d09d7-d8ec-4a8a-bb18-b97c7652c29e", "value": "393216:pM9KWlN1sqQMYDqV4tD7ZXgPGXMCHWUjVcuI3/PGTAI:pMcKsS244tJXgPGXMb8iH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499548, "uuid": "863c98ac-42a7-42cb-8ca5-06d09a93e0ec", "value": 13860876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499548, "uuid": "89b4503c-8eb1-453f-8834-29cd29790ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499548, "uuid": "8499bd88-794b-41f9-bac2-f3d227bb04f7", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d91b9e-9684-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563188, "uuid": "bd6dc615-a9ec-47d7-aa90-f02251498f63", "comment": "Malware payload (Mirai)", "value": "0baf48dbc51da7913993e0e77cff747f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563188, "uuid": "f3ed0404-1f3b-4de2-bd28-d56ad6c2c613", "comment": "Malware payload (Mirai)", "value": "97e5f3961aa9b4b9915df76d888f6ffee14b520871f1cc9ee1be21aed99b8d29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563188, "uuid": "00cbe523-4a1f-4117-a03b-b1c797f34fba", "comment": "Malware payload (Mirai)", "value": "1ea21b748736ebf988bdc0a6dfb74572963f0cd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563188, "uuid": "4ff613fb-50bf-4f88-8377-29233e0ce2b2", "comment": "Malware payload (Mirai)", "value": "732d0a984f0b4e8fde03a68bfe3faaf89cb4c09839ab4bc055f18f090a0a2a12c1dd2480d6f356249c27337532692005", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563188, "uuid": "13393c2f-454b-427b-b21d-546b77d753ad", "value": "T157D30759FD41AF00E5D635FAFA4E028973571B6CE3FE71029E245B2123CAA6B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563188, "uuid": "2fd96835-a28f-403d-918f-e352859b3a6f", "value": "3072:TEMRhTG8YZ2L7/0vNOhVh6YCEaOcnrilSNfYIc5vtu9SidBat1wH1g:TEMRhTHYZ2PkCVUZEaOQrilSNyHuwidz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563188, "uuid": "ae600eaa-c13f-4e46-8f6a-0249cacca2e7", "value": 136928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563188, "uuid": "91700b79-23c9-411a-a03d-bf460d05583e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563188, "uuid": "cfa0de82-bacd-4cc4-a692-672b7b0152dc", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190ae12d-95eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786497239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497239, "uuid": "199a6a7b-02e6-48af-ac18-47007ac48aee", "comment": "Malware payload", "value": "4c2283bff507402ae7c141f9f25a84b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497239, "uuid": "330c2877-e246-4632-93d6-701289bdfc08", "comment": "Malware payload", "value": "98c3a5f5142672e5206dbe7c7858541f215686cf836a11ce729763de21db96f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497239, "uuid": "67e82118-401f-403e-bb21-3281ad18c66f", "comment": "Malware payload", "value": "4c635ab833f1286bb7909dd60fe00c8a5f1b708e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497239, "uuid": "ec6b224a-a420-42ee-9199-03635e8f735a", "comment": "Malware payload", "value": "56873afc5b531116c8d5972fe10b3c2535fb7e559652015caf4e6bb51b0a18771eee5bd04a9898f14f114521d1d61e19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497239, "uuid": "fd19e703-4ece-4921-97e1-e87eea9ad34d", "value": "T1D0C312B0534CA4E66F935DB9A1FD106E22CA6F3C8D1FF05672004924B2D3166367A6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497239, "uuid": "f2acee00-3f30-4d58-a5d7-8d0e3d83b4b9", "value": "3072:zmDppwDk8+0x4UNssD+xe2IHCEh796qhaVasvvTUSi84:zmDpSkwp+4+xGCEW+4Dt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786497239, "uuid": "7e71c568-2c6f-4db9-a524-546670d16e29", "value": 119736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786497239, "uuid": "f8b4bb94-d67e-4bca-a2d2-92e24410b5f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497239, "uuid": "18539af9-c1a0-402b-96e6-dddfb38577af", "value": "98c3a5f5142672e5206dbe7c7858541f215686cf836a11ce729763de21db96f2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda583c2-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "7cc8b65a-4f56-4817-9bcb-45f4c4eaa0a9", "comment": "Malware payload (Mirai)", "value": "6c310f98d314768eb0dfce10e40fef51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "73553245-4e2b-4318-a317-955074e42c59", "comment": "Malware payload (Mirai)", "value": "98d4384e580b531e59db9d17d7317b1a977bb2aa2ead013ec28489f7d27a051a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "6d201968-a985-4943-8881-d5b557091631", "comment": "Malware payload (Mirai)", "value": "e56eaf79d0aed2530b45b782e6134875b596b0b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "5efa51f5-e4c8-49f6-8d31-7980a2eaba87", "comment": "Malware payload (Mirai)", "value": "42d7aff758edc28aeb59b942e60c5bc9055ed06ca8cfd48bfe0245f7130f7dcef6993d8c8b380f563209544c2fdaa864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "ec697dcc-23e5-4e95-a010-e5bfdfd4289e", "value": "T182410BCA6BB25EE8F1A8D13C4B370A3467BD125C03D08249E1ACE2506E9030DE44E7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "8b03c966-f8e4-40f9-947e-c6f208a28e98", "value": "48:LahmX0MI9ewYpu2HYp1qL+jf9lM/2E5Dv/LrAQT6sEVMW:uhmzI8VHY1nvE9vDr6sLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511340, "uuid": "9084e012-643a-4df8-9b59-eee94eb1a364", "value": 2324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511340, "uuid": "2d628fd6-d2e3-4483-889c-17e1a152b27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "7039d4b9-1e29-41b5-82f5-8f68df2d9eab", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de757dad-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539231, "uuid": "5a25c159-828c-4bf4-a543-d1d0b9e0391a", "comment": "Malware payload", "value": "c53d27d48e917b8f05441d4b95410cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539231, "uuid": "b0d7f5fc-1316-4439-9ee6-9967bcd19d7f", "comment": "Malware payload", "value": "994ef2672f21e832acf761ee31976128e1a2f9b833aa590b08d3272cbabfc638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539231, "uuid": "72fe0632-ab6b-478b-82c1-91e3f001f4b8", "comment": "Malware payload", "value": "e8e13be082f20a5722504089137e6addbfc6eadc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539231, "uuid": "7817a8ed-2578-4369-bdfd-c6d459a8a783", "comment": "Malware payload", "value": "f52a08daf26ba3a01b800c8bfb126c091b1cb41c3ea7f8cfe3b802fd8bf82b81e2e5e708f3149df85c46d71c4d7ce308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539231, "uuid": "04fe7b47-ed77-4806-bbe7-ecbc7fb1be3c", "value": "T130A37CCBF30B1450CC658AF00BCB4BED2E2373129E6798E77D1A297918B91DF5A06791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539231, "uuid": "ee0dd959-cdd8-4177-a0ce-9738d53921f0", "value": "1536:HHY2TYHqQGcQx1J/sXNfa+5d3gDT+wg0/LWL:HhTYH1rQAXvd3gDT+wg0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539231, "uuid": "2940e8be-1be5-4d8f-939d-7b9b09e71db8", "value": 99604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539231, "uuid": "2b1107f6-7cea-49db-9475-5adf4e4a8663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539231, "uuid": "d4817d71-c49e-4aed-9823-1599684e7c90", "value": "miron.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a8ea4a-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786522062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522062, "uuid": "c758b1da-4997-4790-93c3-f6ca2b03b0a6", "comment": "Malware payload (PhantomStealer)", "value": "2e6aba6c471e99ca1ff0f16af364772a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522062, "uuid": "3d6d4e70-3220-4e5e-b79f-98754fc52837", "comment": "Malware payload (PhantomStealer)", "value": "996aa6d4e87ac927069807ef1029167b0af80627e851fff81c25344fd474af8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522062, "uuid": "7cbc9cc7-d8b6-475d-a4ee-7661cb41f319", "comment": "Malware payload (PhantomStealer)", "value": "653e571c6df7feed0ad049a9d1a0eefa0aa4b87f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522062, "uuid": "2682e402-ed26-4a04-9640-134eed948e6a", "comment": "Malware payload (PhantomStealer)", "value": "9f241bd78609572bcefebd2688caade7e55f1628d26bb8c248922d0294a4f15510af1685eb3ff58aa3edc8ab9bff02fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522062, "uuid": "786b2576-95e2-48cc-8443-046ee26e50df", "value": "T12B06F7E41329D43371295B2CB136E9A9D84920E318E5DBB9307CB68937A4D4B537CEF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522062, "uuid": "c3437772-bfa3-4743-936b-4256011e5710", "value": "98304:uDj0I74A6n69hW9IqSI7z3GfihKm6m2ZijMPXtzxsc8vycnV1kovjFKwDG8uBwTC:Oj0I7rH/W6qpHpum2ZijMpxB8vycLJl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522062, "uuid": "e778d27c-5aac-4c58-8944-cb21ecab2aa3", "value": 3959758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522062, "uuid": "bb7fc88d-77f1-43f7-854c-02962d0406c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522062, "uuid": "7b746b9b-e434-45a4-89c2-02b248c630a3", "value": "Quote Request_Project_FMD2026_UOS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58b2ba5-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509527, "uuid": "f0ae1460-40df-47a2-8988-4156c721cb6e", "comment": "Malware payload (Vidar)", "value": "89e8137110409d4b4e369118a4c7a759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509527, "uuid": "51a907b4-44ee-4761-bbb2-907aa1e7a3b7", "comment": "Malware payload (Vidar)", "value": "99732f63e949eeffceb1c2a5022e77626a2bee6684dbddd31c759129feb3a5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509527, "uuid": "55419565-2c74-4b9e-ae0b-f700b89c8f37", "comment": "Malware payload (Vidar)", "value": "38242a0fa76e5bff05cce7b54e4c3baca1dec492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509527, "uuid": "427a157d-cec6-4fc4-8225-2c8357061c6b", "comment": "Malware payload (Vidar)", "value": "11c0565bb39d76efb3fefec4e0f74543e88f18947b678639a27225a72315d62864364d9654d8ed8a4c3c442510cf2d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509527, "uuid": "5142f85c-1754-4a8d-b0bf-52bf62c2f841", "value": "T10ED58C07BCA048E9D4AA973289B65192BB35BC494F3223D72D90B7782F73BD09C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509527, "uuid": "46d447d6-4d84-4b64-bc1e-5e7452bc3577", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509527, "uuid": "16a23de5-9022-49e4-94ec-5ffc8167b457", "value": "49152:2+9Ef/dFN/Y1D82p0EoEbhObWtTbYebZ0l7FzXO/G9n5VugybrP:2+wJJC9tnFIFnutbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509527, "uuid": "67863be1-717c-438e-8637-2366db91c753", "value": 2964832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509527, "uuid": "2446edb3-5d41-4f4f-92c8-ad34b169191d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509527, "uuid": "6f52a25c-5a3c-427c-b53b-01d22de9398b", "value": "99732f63e949eeffceb1c2a5022e77626a2bee6684dbddd31c759129feb3a5c0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762ffb16-967c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786559672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559672, "uuid": "ff956cac-0d8d-4ed9-a06e-0037213f7873", "comment": "Malware payload (Mirai)", "value": "e41a54c948224554076745cac98ceaa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559672, "uuid": "1fd637e8-008c-4405-80f3-a74287e7c48b", "comment": "Malware payload (Mirai)", "value": "997f63744ac329f37fec93a32eca77c7a71e2ef7d393398a03912362db63d10a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559672, "uuid": "98740a5d-ba14-41a3-b7a0-0ef740986a6d", "comment": "Malware payload (Mirai)", "value": "eaace9bf1f808ff064ff8baf8d9187a4f44a3b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559672, "uuid": "d1b5e2ac-769e-48b5-acfe-0216a0a6386a", "comment": "Malware payload (Mirai)", "value": "509890b00099c51a7a9ca401965ec1d0b03da2ba021c5866f4c07b5ff1c37783b0ceb2b6867f69ddec129ceb03df6fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559672, "uuid": "d14ab382-ddf3-4b94-b6db-0460902cd3ec", "value": "T10A04194F3710CF61C76DC93009B3CB5666F526522AE28949F32CDE04AE6434DA96FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559672, "uuid": "6d49fef3-320d-49b7-a412-4b103d45fcae", "value": "3072:2OhrGNQmNZZPcglybptAP7mjFlpNF9a21hymApXPWOHAjsy1Ddjn:9ZMiRlpNFTwT+I0soFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786559672, "uuid": "82abd2d5-7937-4211-b6db-d5f1001f943c", "value": 182172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786559672, "uuid": "38ad5e23-fed7-4abc-baa3-3af1481c957d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559672, "uuid": "c03af4a8-810e-4202-9339-0dfa21791712", "value": "b8c3f93152fb40ecd08440d9a0808e6878c921a5ff0d38a2b66f145cc2ca48a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6992f-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493009, "uuid": "d5e931d2-d179-4f73-9963-598ae91030c1", "comment": "Malware payload (Vidar)", "value": "c040c55a9ae26b00b0ab0f6e61e7c73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493009, "uuid": "492b18be-86c9-481e-9618-6dd20875cfc1", "comment": "Malware payload (Vidar)", "value": "99b31974b09a85c7bf6ecd1fadb4611a0dbb39a67fd8156c173eb9ec2a7a226b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493009, "uuid": "01e53bd9-2398-400a-8943-9a7c9adaf03a", "comment": "Malware payload (Vidar)", "value": "0a3b2eb8e558945649d9abb83d9a33889a72fd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493009, "uuid": "265cca6a-b21f-4652-b371-9f1973371a85", "comment": "Malware payload (Vidar)", "value": "116ab983ef6f0a5624bc156dbf6484b38bdcc6ff1654b6692727a78732a98000e4979d21bd44814011f2b430776cdf6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493009, "uuid": "fc00e02d-abb3-4e41-807c-51437ce23500", "value": "T1BBF58D46BFE16EA8C4D6D33168AA03593B7ABC194F3127D32E5066352F723D09936F48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493009, "uuid": "c332b969-bfc2-466e-8184-749c613c17ee", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493009, "uuid": "86c25f71-af5e-40eb-be7a-f668ca612d7c", "value": "49152:RTBNzxTQO+XbCWsDh+vJxcdjlLflqO4Ev5xsHKf7ixf:RTzJWKh+v4hf3JBwKfexf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493009, "uuid": "71ea6008-79c6-4a81-b846-d1b476734838", "value": 3620120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493009, "uuid": "0abbaeff-3207-4ef7-8c76-661fe4b7e332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493009, "uuid": "03ec2347-a3f3-451c-8c4e-69197862d5eb", "value": "99b31974b09a85c7bf6ecd1fadb4611a0dbb39a67fd8156c173eb9ec2a7a226b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088beb19-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498500, "uuid": "ac2fdad0-cc4f-48e9-891a-74fe78a69158", "comment": "Malware payload (Vidar)", "value": "382d1c2f05853b26131790747afdeb9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498500, "uuid": "aa858e40-2c19-4279-890e-9e3e7f9ea605", "comment": "Malware payload (Vidar)", "value": "9a37eea45a4d792638abcca359020013eef8be927baf1b5a7440a8a1b91e9224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498500, "uuid": "b4a401b4-5570-4dc9-ab11-f90a45fe1183", "comment": "Malware payload (Vidar)", "value": "706b2dc55ad09955248558009629644f5dbe0c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498500, "uuid": "f0ec88ab-4809-42b3-9fad-0e276f9c4a30", "comment": "Malware payload (Vidar)", "value": "cb83cfe37cce746376d9606667b04f66d7fdb6bcb6a5414a1a7a7f8b927d5aaeaa5100f45a7d48fd2772999721b0eb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498500, "uuid": "1211f090-f345-4944-8f80-7cdc147d9356", "value": "T194167C076E9045B1C8A5D23A8AB25241B72CBC0F873B37F72D927A757E327D0563AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498500, "uuid": "a0d2f0aa-cf5e-4129-b1f3-76dbf9ed0e13", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498500, "uuid": "d4a5352b-792e-42cc-a13d-2a22370fe643", "value": "49152:lpffMttWSFjTbqKjhofLikJVq0yfwC3WTWBbgGDaM8mIVaRcljEyn8yU80/rfqvT:lpno99rduGz+2opC29C1wUb3YNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498500, "uuid": "32231797-3074-46c4-b142-685ade107cff", "value": 4394336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498500, "uuid": "d6b522c4-e975-4663-8b08-5a54aa454862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498500, "uuid": "a2e392d3-8402-4099-a219-2d820b613d8e", "value": "9a37eea45a4d792638abcca359020013eef8be927baf1b5a7440a8a1b91e9224.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064bd13c-95fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786504939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504939, "uuid": "6376e51e-9e62-4d5f-87f5-6e3ed7ee1d2f", "comment": "Malware payload (RustyStealer)", "value": "9d8769b7f24569f7354e9e02edb7da70", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504939, "uuid": "e5465b7e-c9e7-410d-9bda-e42953eac9dd", "comment": "Malware payload (RustyStealer)", "value": "9ad28b6bfe14bc39c7d39dcd8a14bc8de2bc82440bf987195282cd8da6b01e21", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504939, "uuid": "dfb7de2f-32ed-444a-88bd-ef0849e901df", "comment": "Malware payload (RustyStealer)", "value": "50b31d5497e5ddfc759cbd45e0fe1e3e65206e14", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504939, "uuid": "13ff00e1-ef4e-40b3-9f7b-92d065d7b703", "comment": "Malware payload (RustyStealer)", "value": "6cfbfca315ffb402c9a929b123d69c165c161fd8012b5da9cf7075edf39f32f4069111ab7e77671daddf28edb9ef159d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504939, "uuid": "c681962b-6bf6-40c0-8ac8-c4ba8ae47e27", "value": "T1E6C4A6398932BCD4C34D3630D7641C6B21ED698A63B78E69C6052CBA3EB57A5EF344C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504939, "uuid": "0ae0b532-3677-4d78-beec-9c09aa596b0b", "value": "6aaf61e365e3789434a7b99893c15e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504939, "uuid": "8c095ea2-1c63-48bf-806e-3a42917831ca", "value": "6144:vS/MYsm4CShVTECI08soqv+D3D1T4W79dnjfNhQDAx9vwWUMABm/NjfO75JYZ/jq:6/MYaC61qzVjL/LXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504939, "uuid": "fcddf526-0be7-4e2a-8d03-b4d316ae502a", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504939, "uuid": "630208f2-cc65-49ea-bbec-ace077ae8530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504939, "uuid": "38a5dbbe-8421-4f82-959a-6060a1b21de0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8832ca-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522104, "uuid": "623796d3-95ba-459a-9915-c9c3dee76c95", "comment": "Malware payload (AgentTesla)", "value": "a92c56c9d0e74c89f327b303ca11bc19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522104, "uuid": "64c06062-08fd-4461-ad3a-064d2a2f439b", "comment": "Malware payload (AgentTesla)", "value": "9b13a1e4bd7a99c7095b595e89f365aa9391322e1b077a0be87282dd52acc078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522104, "uuid": "7e2bd9a3-94c2-4e0b-94c5-d6346bed8754", "comment": "Malware payload (AgentTesla)", "value": "c43da19063ccafe4d3bab41040625cb3d19c49e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522104, "uuid": "79174da8-239a-4480-b90e-728755c9f7ae", "comment": "Malware payload (AgentTesla)", "value": "a9008269d0701ef9f2e6e34fbb63df4504bee675e2157bd9ff607afe0acdc2ab11f3108e1cfd7d834ba0301bd7e81598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522104, "uuid": "bdf231d8-3e1b-4239-ba50-68502a12e1e6", "value": "T17DF58241A7A09537733F9B8E653ACD309D0952A317C5CB11386FEB093BAED175318AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522104, "uuid": "fc01807a-f1b4-4ebf-976a-455eb45a50eb", "value": "98304:nC1hmz9O4vg6Xz4feP/YApXHA0iV50ajdwTGTQsLfqBDj6qyHYN7nmiyVhvk8:nCfmUNurpX3o5nbUCqyHYpniVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522104, "uuid": "f7ffde27-5b97-46da-a49a-716f78090458", "value": 3346262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522104, "uuid": "f778583d-ae99-440b-b583-dc4255a7c1e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522104, "uuid": "88b268ab-7055-477c-9208-3ebe44270575", "value": "Evalaute_FQ_6435_STXF_0581 SC23C01KB015_REV.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899d6a7b-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512890, "uuid": "a4350fd4-912b-4fd7-9d17-83fb4ad9d4ba", "comment": "Malware payload", "value": "657971fbe902b8d6cbc166681bb1846a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512890, "uuid": "e72db765-ed21-4f8c-9b22-29de83a1abc9", "comment": "Malware payload", "value": "9b2ef8c3487a2c03bd56c8d8a2c3c5febdd9dce3827d4f3bd07714ea0f643a09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512890, "uuid": "bc7d7c97-466d-4e9d-8f05-abd2f0153e7b", "comment": "Malware payload", "value": "fddefef1e174e939008af04f71267d567d2744a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512890, "uuid": "4a0af3c6-823b-463f-b94b-92206a31bd3d", "comment": "Malware payload", "value": "3b145a7124ea2ce8e0562316a146ed29f6508411d100fd23442eb6a52cdf026227339c7ffaab16c3265871f73732ab9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512890, "uuid": "f6255bf4-1ef7-45b3-bee7-3ff73ca2e97e", "value": "T17CE68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512890, "uuid": "e25def6b-54d0-4e3f-9e11-4cd9319941db", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQY:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512890, "uuid": "602a01f2-1f34-4cf7-b296-576c2accc292", "value": 14090240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512890, "uuid": "9b6452b6-7cbb-4bc1-8136-30f09a8324ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512890, "uuid": "c2fa3e19-c73b-4fd2-ab77-7becc46a3b08", "value": "9b2ef8c3487a2c03bd56c8d8a2c3c5febdd9dce3827d4f3bd07714ea0f643a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eaeaab-9655-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786542754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542754, "uuid": "cde2de2f-e3ac-4668-b409-3a28b4da0193", "comment": "Malware payload (RemusStealer)", "value": "b5a1d2583b06c6f735e0470f8dcd69d6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542754, "uuid": "76744071-f463-4bbc-b04a-5e24be3bc032", "comment": "Malware payload (RemusStealer)", "value": "9b4b2dab3b9591d7202085419b7e8e68edb5b528e30674ee580474501dff9fe5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542754, "uuid": "ce71ae92-5c52-41db-a0c4-2d53d8a51375", "comment": "Malware payload (RemusStealer)", "value": "5e87e131ae7b897577dae8df7ae7802f8a531f03", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542754, "uuid": "43ec943e-78c4-44da-a600-c343c5406ae8", "comment": "Malware payload (RemusStealer)", "value": "457b768ff7d1450d70fb5824bc2f6e921ed50ba5efd5de08f3df9f713378ffb9737b84918df7820bcb66dc6ff14708bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542754, "uuid": "7b888dbf-728a-430f-bb32-7d3d5203b35f", "value": "T173665A17EC5148E5C199A231C8B79252BB70BC885B3227D32FA0BB782F727D1AE75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542754, "uuid": "60fcaf41-b13e-412b-bbea-f4fab975d9fb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542754, "uuid": "4756ebc0-2a56-41d8-aed7-d24a81b9d838", "value": "98304:y7MjO8jV7spS/JkuXH9zhe3AHxtfnr0mXd6E9:y6V7sM/JkuSmV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542754, "uuid": "333731c1-22f7-4f36-8cfa-4e4fe24f690f", "value": 6506864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542754, "uuid": "369854f9-c232-4926-a7ce-8b3107294f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542754, "uuid": "15a2d588-e4d1-4efa-88b6-41fec3be5f34", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5ddeb3-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534908, "uuid": "9ecfe006-8164-40b6-b8e5-719f6a2dde3b", "comment": "Malware payload (Mirai)", "value": "2d349809127e4395d706c4e5987efb02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534908, "uuid": "5cf90767-b719-4def-8359-ebeb2d03762f", "comment": "Malware payload (Mirai)", "value": "9b5cfe07f51b3ae973b63a154755c4c58edb5267c3e17489d17add17795dea67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534908, "uuid": "05ee2619-d9cf-4e4e-9c65-f66d1312b01c", "comment": "Malware payload (Mirai)", "value": "bac67eee688575a5999c408584119eaff3e2fac5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534908, "uuid": "688791a3-ffc0-4e52-a1ae-4c5d2b4ff208", "comment": "Malware payload (Mirai)", "value": "26344102e0eb5c326be893821e7fd675ca3a955dc7aa293f2e8fe6aadf0feb5b0c24598434cb9bb353644a6825b30bac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534908, "uuid": "ede36812-a4ed-4918-b840-a1443a089c4c", "value": "T10DC191D2F931C531709D187A9B89B260BEC7582F0A147C14B88F7E386F2866CA1BC675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534908, "uuid": "9d25f509-9dd4-40f3-97c8-6c44e7e65c01", "value": "96:GZTJCIwlHPRei19pmxLImzpWCDgQ19JZNxh9WqYEt8UUkLJvE:G6TNZnqca9xX9WqFtR7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534908, "uuid": "6f633a1e-72fd-4889-810f-86721f719770", "value": 6035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534908, "uuid": "6292f7a4-d6ae-4029-ab22-a110cad6f6ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534908, "uuid": "dd032b49-46b2-4469-9dd5-40f034664278", "value": "micro.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88842727-9633-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786528350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528350, "uuid": "ef3d5579-467f-478d-91fb-9a54afaca2b3", "comment": "Malware payload (Efimer)", "value": "812abe43796f6b78922fc9228e422465", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528350, "uuid": "c8dc0fd0-1f8f-4ddb-9c98-4d859ec6f0b4", "comment": "Malware payload (Efimer)", "value": "9ba2562b2d7d5dec16a1e8281702d09c79b0ceb0771b727cc542ba843e2d16fd", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528350, "uuid": "ce0b8973-f935-45d1-a2eb-e1b2997f5a73", "comment": "Malware payload (Efimer)", "value": "9f3188fd1dbec2da32cd29be3ccf70cc38cb5a14", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528350, "uuid": "f55007e0-5fca-417b-a7da-0c12f4225ee2", "comment": "Malware payload (Efimer)", "value": "e14e68c27cef2bb094de59c0946840c26e7fead0e7f7ac27f0af2e5ddc02c8b9c81566bb1de500a5977ab0cc7edb2e68", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528350, "uuid": "f9be9022-b8be-4d31-ac40-5bb8f3208cec", "value": "T1C8E633488CC4A18DE6A69638EFE125B0F439FCBA173256CF533CDA957C835E0597824B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528350, "uuid": "894d45e2-bf1c-4b64-a1bf-ea132e47ef6d", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528350, "uuid": "6935c8f0-c2ea-4415-aee4-682e7f1b0e2d", "value": "393216:m9cEKoaPDzch/2VROhxs8J7O8iv47nG/XMCHWUj7cuI3/PGTAI:mi/LzY2iPvJhiiG/XMb84H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786528350, "uuid": "c1591c94-38cc-4ff0-873a-bfa772b91c9d", "value": 13911253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786528350, "uuid": "84992345-5168-468b-9a8f-e8f1b5c96660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528350, "uuid": "dcbb9023-7d0e-417f-b65c-fd6eb17c40d6", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d22c76c-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786512923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512923, "uuid": "bbdfb0fb-6618-4ded-bc57-d855c72ad3fb", "comment": "Malware payload (Vidar)", "value": "81c77db27424d8f51e4157c7af628253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512923, "uuid": "aa49de26-e149-48ea-87bd-20b7bc273ed3", "comment": "Malware payload (Vidar)", "value": "9bb6fa935cc1606308fae4980d5d880cc76db8e96e5b4f73f7278b93d5433f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512923, "uuid": "d0e72caa-c2c8-41fc-8e53-7ac0ec0499eb", "comment": "Malware payload (Vidar)", "value": "40dd8c9615a8e37afc8b44369f554f9c3669fefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512923, "uuid": "942789b6-8c4b-4d8a-a976-bd8a0101f5a2", "comment": "Malware payload (Vidar)", "value": "ff3e6bc5fe97181d897623af51d3f311deb0d8172cc22bde81876207fe34d4aacedaa34671378dee70c2235b034eeee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512923, "uuid": "00f9d1fe-f1d6-49de-9eb9-9f6864d66251", "value": "T156069D077E9199A9C4A6B73658B601857B38BC5D4F3637E72E60B2362F327C18936F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512923, "uuid": "ef7b1c2d-1cff-48b9-b993-79274a9b3f64", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512923, "uuid": "eb16d34f-0c11-4b2e-b2d8-1ee03f1335e7", "value": "49152:ywa2VeTp1fTCSf/QK0FFZnX+9z1rXwsJQRz6TPaIcky5sTHL00KFVyr4hlols1lt:ywVwgRF7nKZd2p5SrUFK4hQ4lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512923, "uuid": "a2eb79c0-6def-4312-89b4-8750bfd1a2a4", "value": 3804224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512923, "uuid": "db583371-c3d3-4482-8805-c6ff1970b633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512923, "uuid": "b235ee60-a367-4570-a487-772b4f20ffa3", "value": "9bb6fa935cc1606308fae4980d5d880cc76db8e96e5b4f73f7278b93d5433f98.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c493a5-9640-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786534063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534063, "uuid": "2dcdabdc-ff0c-498c-be91-361834814f95", "comment": "Malware payload", "value": "c442500d090637466251001bede52db4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534063, "uuid": "86f253df-9825-493c-ac54-709d6ba5e71c", "comment": "Malware payload", "value": "9bd1a2cae75ee7450744a8565b5b53a4336f2888df37b1f6783c3a26ae66d7ac", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534063, "uuid": "a9942302-1bad-440a-8c90-9328244f7ae4", "comment": "Malware payload", "value": "14a1e3c997f0f11ce8ad4e7e1dc8b00470bae61a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534063, "uuid": "0cb55c98-a51a-4188-9ba4-3595be142234", "comment": "Malware payload", "value": "03714016e4df522135df2ee7bd74b8b3b0b498ff0ec76b4907089e5eea7422034c65cc91d7fb14e02747cdcde254dc85", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534063, "uuid": "0eaadde1-fcf8-49e9-a3cd-b08f00d0a616", "value": "T183363B137E6148F9C09AE735C8BB42567A35B84C8B3133D32E50AEB82E717D26E75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534063, "uuid": "df8c845f-f120-4f2f-b3ca-f62b551e7624", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534063, "uuid": "0fcea13a-0a21-42ca-b562-a8b99b898336", "value": "49152:BtOQckzcnTbh4gJzgyOpZYKGPWVUHlXK1WjJ/:BxGT/vVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534063, "uuid": "69cbe9c4-4137-4ce2-8176-3b2c0f3fa5da", "value": 4880248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534063, "uuid": "bb42d4f5-ad63-4115-ade7-23ffedf5b4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534063, "uuid": "c6abf057-0cd5-46a9-afdc-da9fb8ac58c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0f5889-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504062, "uuid": "480a7c59-d63d-4876-bea4-0a005a887c13", "comment": "Malware payload (Vidar)", "value": "0b80b5a4ebab2435075931bdf4edbfc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504062, "uuid": "21f24d58-4a91-42e0-8bfa-cbe3d6e2251d", "comment": "Malware payload (Vidar)", "value": "9c6428f40395efeafd198c15fcbd36d310fe2d6ab73d70c206ec011046ef1809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504062, "uuid": "23c1b2f5-f089-463d-9133-8c4211c4e7c4", "comment": "Malware payload (Vidar)", "value": "7bdb2e49fc92b3e0d21306ea4eb06a2e05888911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504062, "uuid": "0bd26b9d-6953-486e-8012-e0cc3bc0e9e1", "comment": "Malware payload (Vidar)", "value": "1c850b20d5079fcae5fbbe058ac501092d36e593a6ebe15b9b9268f6f3a45ee28fb60cacedecc349646e2e98b9b4f6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504062, "uuid": "77abd347-a619-4788-8ae2-53b3bcfc52ee", "value": "T16E068D0BBED018B8D0AA9731A4EA42557B3DBC5D4F3623E72E50B2762E727D14A35F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504062, "uuid": "2b092d3b-14e3-491c-a7b9-90213a102703", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504062, "uuid": "3ccbd49d-17c9-4b1b-ae22-3ad5f8056355", "value": "49152:A9X2BUcaELaEA3U4RRhVFX28kXvvcbnloYjhedH94tMXQDqO+AnoXjDsaoIxz:A9GhhkFGzsTZO3QDoXDZxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504062, "uuid": "e911f8ed-f80d-4f75-87dc-50f0d54fee66", "value": 3798200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504062, "uuid": "e7dd824f-d979-496a-a2c5-81d6805e8cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504062, "uuid": "e67c6056-442c-49c7-9a95-356692fb0c60", "value": "9c6428f40395efeafd198c15fcbd36d310fe2d6ab73d70c206ec011046ef1809.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c73b92-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574937, "uuid": "e6fe1a5c-d87f-409a-abcd-a2aa72f798c3", "comment": "Malware payload (Mirai)", "value": "e93dcf769aa814e7eda82b271e731d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574937, "uuid": "d227b292-68d2-4bff-a840-d409a3285582", "comment": "Malware payload (Mirai)", "value": "9c719ba3b1cd4a8cf820c5eaea04aae7d0188da53e75f18f9c04c1fbbd3cc97e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574937, "uuid": "b5672eb3-a4b1-44a4-94e6-931bb193a4c8", "comment": "Malware payload (Mirai)", "value": "700dbdb75e2f401432d777eb65705ca35a7a7c32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574937, "uuid": "78a7571a-6fd9-480d-9c27-9eaca2851637", "comment": "Malware payload (Mirai)", "value": "7861e56eb76e4c0ccf528cf3be7b30e081f05d5750c2c6dd2e224a594a9c2f78b21435b600c6ff2e576dc21808a92a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574937, "uuid": "66a38dd0-e6a9-4d6f-bed7-34bac016f382", "value": "T11A234AC4A947EDF8EC1607B5213BF7365BF6F037212CDD8BC39899239953A02960629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574937, "uuid": "596b2882-1774-42ea-8c9d-b7b22276c993", "value": "768:DnrKxZUimqDS4mtQEE5PTrvC0BmIDKSOjO+xEmi6Xa+/xliMezd2Xc:zufVDpmtQH5PTrvC0BmIDuzxEmpayx8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574937, "uuid": "88905c5b-8b9f-461b-9eae-8c851c1d86bd", "value": 45860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574937, "uuid": "9e5d12a5-1d37-4847-8615-aa64d0b4d01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574937, "uuid": "bbc71727-8346-47c2-9cf2-eeeab8b0c1a1", "value": "b59af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4868a4-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503204, "uuid": "471dfa1e-1d55-4f38-a41c-efccb620a8be", "comment": "Malware payload (Mirai)", "value": "6238097210a6d8e36336e98eb35014b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503204, "uuid": "5bc58e82-79a4-4663-9427-abc63e0d6f4f", "comment": "Malware payload (Mirai)", "value": "9ca34a13a9100ca08c5e4f2c236ab388ed482cc0879a9af52ae28b24b6dea57e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503204, "uuid": "bc9d350b-0bb7-4211-9b2f-8f8b66c993e5", "comment": "Malware payload (Mirai)", "value": "43697314e7fb870c5576c1f66d8f751f28de5a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503204, "uuid": "47728dd4-dc41-4660-a376-6e05faee99bc", "comment": "Malware payload (Mirai)", "value": "3f6bf31002bc4dbf1b1b6ed9be91c918e8e8b944d738c1a06207e889ae9344989bb39ea9899397a7626d15d8e68a6540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503204, "uuid": "152bda7b-0dad-4c54-b033-5c2b860856af", "value": "T13EE38D6BB30F2055C42206F417CBBF9D2E3312C24E6BD5E76C69267A2AB65DB1801FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503204, "uuid": "7a5144ba-f418-40b5-bc15-b7f4e7fdb0f4", "value": "3072:TQAH16WiutGPV25H86PdTfyR9QMgeCfzeN5v7EvNq:cKNAP36lrMQUCfz85wvNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503204, "uuid": "935e23dc-a24f-46f7-9468-e79b6aa4e46b", "value": 157212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503204, "uuid": "2df06e7b-0804-4116-869c-e7372452bcb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503204, "uuid": "0c8e7928-9bf2-46d0-8649-fc186c60c426", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4030b468-9699-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786572037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572037, "uuid": "76f599ff-c410-4e20-ad47-7627fad16dbf", "comment": "Malware payload", "value": "cbf4167c8684449858268bf36d2049a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572037, "uuid": "acdb732c-9df9-4ebe-b875-0d1cde4af6c1", "comment": "Malware payload", "value": "9cc1484aaeefb46feb49edf79bd0c0f2a82eadbe630a7c1937bf7c4b0bd87e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572037, "uuid": "ad754223-137f-4b70-901e-2df92647bf03", "comment": "Malware payload", "value": "fd044a41ba47c934bcfba111b61f1a18ca1b4d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572037, "uuid": "95853dd5-efff-4462-94fd-fb5877c97131", "comment": "Malware payload", "value": "ecbbc0d95571bb664e6b74c5e6f474eb857be590075d4d85ba7e90be656af3b988265fb9a3c64760e9f266a8475d8a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572037, "uuid": "3b59e3c3-cc5e-416b-8621-6f93a409c7e2", "value": "T1D9267B07BEA108F9C1AAE33589AB4212BB74BC4D4B3233D32E50AA782F727D15D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572037, "uuid": "fef6201f-22d9-4ccc-9b3a-1e4cd63357ac", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572037, "uuid": "842c32f3-c308-47a5-97a6-2fca242d133b", "value": "49152:yoHVmHat/2n9oeLgDkF+9tRoH0NM18wlX2NhAbcsqZTUaP6jc:yGf489+18wlX2/ocsqZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786572037, "uuid": "fca667ae-f4e0-4ca0-b01c-49f8419c198b", "value": 4612206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786572037, "uuid": "411b0e0b-615c-4df4-9eee-7531c66c09f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572037, "uuid": "e46d5117-80e7-4d57-b60e-6bf4e4e13621", "value": "9cc1484aaeefb46feb49edf79bd0c0f2a82eadbe630a7c1937bf7c4b0bd87e35.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000df7c4-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574936, "uuid": "8108412f-4283-43ee-85d4-36c81d26c95d", "comment": "Malware payload (Mirai)", "value": "530413ffda3e9ff04a66d5af3e4f8ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574936, "uuid": "5014d967-526c-4f30-b36e-13270c53e0e9", "comment": "Malware payload (Mirai)", "value": "9d44d4d051f6aa3fbc95fab0aae818347a602d655fa7f1fba6267e728d7ff2d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574936, "uuid": "3d990bd3-aec7-4427-b61f-b49bc3b82104", "comment": "Malware payload (Mirai)", "value": "2d61924572d0b2b283d61faaa25b8461d8ccfd85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574936, "uuid": "a7c73961-cb23-493c-8006-9d90d3738447", "comment": "Malware payload (Mirai)", "value": "fe0a4d77f273ae6c9772ff49a81184bb3920772cd32a99d932e7ad52918d70982122b09835aeddab8016ee7779070fc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574936, "uuid": "8facc59c-275d-4058-a658-4ca3f7c18ba6", "value": "T15A233D42361C0947D1A62AF0393F67E0D3FFA9A020F4B588291F9B5A8579E771186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574936, "uuid": "36d3944b-8d63-482c-b471-fa7aa0606475", "value": "768:71uHSE37Msvla/1q0LvozQY1bfRXo1+Uottl+heWQR18kXQ8h:71uyCM/1q0LveBLFrrWQj8kAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574936, "uuid": "3bae2d1a-8c6f-494b-8e11-34d2b49cdf39", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574936, "uuid": "d05ff546-06f7-4524-9012-32d2156099bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574936, "uuid": "b8778661-7585-49e8-a8a8-417219361326", "value": "659716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9654a3e5-9679-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786558438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558438, "uuid": "6c2381d3-e54e-4880-8fd3-99daabe2e9eb", "comment": "Malware payload", "value": "39dffdbdd1cdfd93ee47ed072ce99e23", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558438, "uuid": "09c9da63-b451-4fc6-9356-236f1cc6a9ba", "comment": "Malware payload", "value": "9e221f45649bdd5d7fdd77949083b1d37ac34f8cf3cbf91b686edb1c6b2262f6", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558438, "uuid": "6bf0e3f1-6034-4578-80d2-33ebbce0bae2", "comment": "Malware payload", "value": "4cf731db11600769bed47a4b785cfb970654fa4f", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786558438, "uuid": "9b5a1ef0-51c2-4a61-85c7-63e7f5d549ea", "comment": "Malware payload", "value": "2a1050fe6c21ad1d3fc7be6ff607b0fb170ad8065b3ef67f45ac748673e59f37d3eeca57426f52d1cc1d3cc313d13e90", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558438, "uuid": "d77ada3c-b280-4b14-ad85-917d0bb03bef", "value": "T147F42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558438, "uuid": "482b0c0e-1829-4d90-9dcb-575574038d8e", "value": "12288:tU7wAcpxXAIIETE1UWLwJrr1nuwySJPUcyvmByHaRR1L+:tU7RyAOTt9EvPaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786558438, "uuid": "ccae9029-c78d-478d-a0a5-a95bb00b9546", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786558438, "uuid": "0b8656cb-6531-449c-8e92-0795b7dd6061", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786558438, "uuid": "28ec82c5-b895-462e-a81a-aa85e40ab95e", "value": "9e221f45649bdd5d7fdd77949083b1d37ac34f8cf3cbf91b686edb1c6b2262f6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9ed54d-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511335, "uuid": "c4f2ed77-b10c-4c99-9bd8-4566a05ca328", "comment": "Malware payload (Mirai)", "value": "c16aebedb1ef9cc9bb4a984c7c3a4db0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511335, "uuid": "dcb88e83-2692-42d5-9c30-6c67ca5a513f", "comment": "Malware payload (Mirai)", "value": "9e46b2a28eaad61f0f1993365bc757c647bd0fa79150220c3113d7caad30b223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511335, "uuid": "6303c8e2-3207-4280-a0e9-21c9d4dbedc3", "comment": "Malware payload (Mirai)", "value": "5febd6ec0e4cbecbd44aa92067c3832739725926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511335, "uuid": "2c45b5b9-e573-489f-a60e-1a7efdb8e6ce", "comment": "Malware payload (Mirai)", "value": "3239132961eb8f2fbb01895c2c94cb9da2bb0a1f8a788903906f56dbc9f58c8f767badf321243c878d183b0c631d38c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511335, "uuid": "f3633530-b78f-428d-ba81-7daf6127e168", "value": "T132315123EB4078BDDC1789FC91A70569CA6188BC5B2E63067F0739037E5AA81CC46081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511335, "uuid": "2e5ff3e1-bbf7-42ac-82ba-ab5f15ab5d0b", "value": "24:Gbc0vA8mH0OBnlSCQcHbRfaCqZwlM2WT94cq3DtkgkNWNfZz:Gbc0vZmHBnEcHlRqZAfcqJkjwNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511335, "uuid": "56829ba8-e590-4dc7-973d-5fa935015366", "value": 1600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511335, "uuid": "2eda91b5-1987-40c1-842e-b9f5bebfb913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511335, "uuid": "fd8690d3-958c-47a1-b5d6-1199846ada73", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba36055-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502424, "uuid": "3d4cd3c4-e036-49e8-b7d4-49157b34a1d7", "comment": "Malware payload (Mirai)", "value": "59e8ba2b9cd3a06e53e3fb18623fee2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502424, "uuid": "8ee1e297-6b62-43ed-a65f-e789f551d132", "comment": "Malware payload (Mirai)", "value": "9e683655d9bb7f7bc5af246e5d9a19df5b35325e662750b468ded4a3eb842de7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502424, "uuid": "2a047c48-877a-4261-858d-d327d913081b", "comment": "Malware payload (Mirai)", "value": "e4e71ef2cbb7530388088837be3a32de29596202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502424, "uuid": "7da4c106-e4ea-4502-886d-2f6a6999ef15", "comment": "Malware payload (Mirai)", "value": "c7aba410416a8028a0cd721d99a2c2d10f226dbb2b661174a42e6973a6f8808c080ec1e860dc1a68b3b75372214bc3f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502424, "uuid": "f1d0e606-9aeb-446e-a33b-f49206b57518", "value": "T1DC53023859016A31847449FEF18E46AA5CD789C0D0E9B85307569CFCA2E3FF9448EBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502424, "uuid": "6c57a4d3-e73a-4dfe-9dbe-4e5c11c34588", "value": "1536:i/oh0zxtxXuWPnbdq7zuBGsmv3pdPOhQLq:i/XxHXuIn8vuBDqphOhQLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502424, "uuid": "a849b9f8-80f1-46ad-900f-b49e28a9cf61", "value": 65460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502424, "uuid": "43895fab-d089-4dd0-9e84-ad6f57623e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502424, "uuid": "da1408ea-98b7-43c5-96fe-f837b4b1dd04", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a86490-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786498976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498976, "uuid": "5f33b88f-a1fc-440c-bfec-2b1e3ed369f6", "comment": "Malware payload", "value": "a8a83d73a5db2db8ef71a467f8f34657", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498976, "uuid": "d75ebed5-7c66-4b04-af8f-13c495b849a5", "comment": "Malware payload", "value": "9e9094cb5d81ce2c4c6bc13a5e6bb76bdf8883c225c99b6c9f9928b212f1954d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498976, "uuid": "3fe88766-939a-4d91-badb-ee1da872ef3d", "comment": "Malware payload", "value": "1a9c00a321724b7e92bb551c5e63df1d0a908a32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498976, "uuid": "17b6fed2-8e3c-41bd-9dd2-e43594429eb1", "comment": "Malware payload", "value": "c00d8bd500836824b78b9ecbe685911a8bbcf68600f3e1118ed644c38af0858f5fb8f9c457fec1092d3099aabd99b576", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498976, "uuid": "4cda1319-302f-48c4-a9d4-3792c241cd39", "value": "T1DCC27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498976, "uuid": "a680a39a-b4aa-47ae-abc3-d23d919bb493", "value": "768:UKj8vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:UKj8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498976, "uuid": "7c366cf0-115b-455b-b786-0581460ae6e1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498976, "uuid": "5f5808bd-bb9a-4b32-bb3b-79cc40d3490d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498976, "uuid": "c7ffdeb6-7ba8-4f9e-834e-b08d7d56e874", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d87689-95f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503518, "uuid": "3d4a1aee-34c3-4e68-8010-e47551d30d49", "comment": "Malware payload (Mirai)", "value": "9b3f849286d835b8119571625fa2ea74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503518, "uuid": "f2122a47-478a-4931-a11e-d1e27b89cb53", "comment": "Malware payload (Mirai)", "value": "9ec67d8a8d2e0fe0b045cdf0ff06c0bf90a01f959c3b945eebd81b8a33f7f837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503518, "uuid": "68de4a9b-9914-4765-a4a0-f71e7a28c852", "comment": "Malware payload (Mirai)", "value": "85ffa84f2f9b28c4fce39679248ed285836b31f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503518, "uuid": "9a53102d-aa80-4e58-9541-c46d32ffc523", "comment": "Malware payload (Mirai)", "value": "241fb5a331459155e6c7f0eaf94d06536773bbf36de7649a8ffc8f0bd2eb24de0f3cb88695bad2e78f09f65f46b1972f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503518, "uuid": "98fb6fe7-7742-4877-8aab-b66c0e5ccc4d", "value": "T11834D80ABB510FBBD8ABCD3701E81B0628CCA55722A93F357674C528F94A54F4AD3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503518, "uuid": "b864ae62-1000-48b6-8d29-ea7ad0a8c13a", "value": "6144:r/Z4smCCKpuveHfG/DJKdgcBRY9PH63MAh8SE1o+UJtLdl5:rbO/d6gkRYctLr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503518, "uuid": "057dd404-84a5-4dce-b1bd-88a4d5248d3a", "value": 235236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503518, "uuid": "9a42e1f6-1c21-4bd1-b4db-231850b5a0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503518, "uuid": "6d213e6e-9b15-42e1-ac5b-3f74534811e8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c08529-961f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786519650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519650, "uuid": "0f2c4900-5e79-4e50-8dec-35bcd273aae7", "comment": "Malware payload (Vidar)", "value": "3236850647855e13e4adf378c0e48ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519650, "uuid": "1afea323-137c-4228-9472-1c2658cace83", "comment": "Malware payload (Vidar)", "value": "9ed376aa28b2263ccba7fd72473d88e7aa5bcce6f3627993d1d74ffe2f98c11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519650, "uuid": "f3fa4894-2f22-4829-88da-943995055386", "comment": "Malware payload (Vidar)", "value": "322bc5548d6c4dc2548acc90563d4d894f60eb17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519650, "uuid": "87c6c9ed-774c-4330-ad6d-d9865b29eb16", "comment": "Malware payload (Vidar)", "value": "a490837c04c4ea380e5f3473dc0f4224e38e93d5275c5f8be370943ee239a207bc32bb46098a97fb0df035eb44591a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519650, "uuid": "ce39daf0-cde4-44bf-84af-f15e9456d134", "value": "T186368D07BEA189F5C0DAE63185B622917A78BC4D4B3137EB2E606A393F727C05E34754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519650, "uuid": "5cb897e7-21e8-41b7-8a04-d47cad42aee0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519650, "uuid": "279c4f9a-2565-4bc7-9499-8e0a814218f8", "value": "49152:CQbFrmAylB8jxvaua25sMUGSZ1Vg1B0S1E0FGGkRDcvJhYWreA9+vfrky6Knbt:CrR2urf0bu7f3r/pbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786519650, "uuid": "c3ce193a-29a5-4284-bc54-38adc2c08944", "value": 5045736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786519650, "uuid": "078af660-b331-44f5-affa-7ff6d81f18dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519650, "uuid": "744e13bd-d5e7-443e-a021-86bcf839563f", "value": "9ed376aa28b2263ccba7fd72473d88e7aa5bcce6f3627993d1d74ffe2f98c11e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa31af0e-9623-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521534, "uuid": "f97bcce8-3b9a-4781-8c3c-18d61662faf7", "comment": "Malware payload", "value": "5440d567fa893ed47e02be1a1142c923", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521534, "uuid": "558f20b2-f156-4588-a6d7-c6a0caf69271", "comment": "Malware payload", "value": "9ef87247e2c4c21aa91637adb8cd6b35a8dea7a884ee9494e5b5e4afc2dd1d79", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521534, "uuid": "5a83fdc4-de7e-4947-ba55-1a4baf0b80e4", "comment": "Malware payload", "value": "5b9c3480fa641811981b93b5e05f6562b43f1ed1", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521534, "uuid": "2317f5c2-9757-40f8-9b23-3dc1711726af", "comment": "Malware payload", "value": "daa26ab267444157e075025bb6f6e72872f9914d0eda91fa7bab794e3cbffd738618a672e3480bee9c0de1d1ecafa590", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521534, "uuid": "7a1c62e1-c7f0-4bb0-aade-3b8f63637f90", "value": "T178E533116DD41F6EC77C927C704B5A1E22A3BE5C8B2DC4FA2EE635EA1138F701623649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521534, "uuid": "85070f2f-fce8-44b4-8769-9c1685b98496", "value": "24576:ypUHGguNaUgjg+NkTgThiNkKBnv/EX0Aw+6pSg87ragdIhius4Xlgy5HVJ8swuux:jmg6RsOEX0qMT+d1+nhPYDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521534, "uuid": "3c46fca5-d80a-40c3-a5bf-612fd8b8872c", "value": 3029504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521534, "uuid": "d14a0a2f-5df0-4c2e-884d-a34940447868", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521534, "uuid": "60718e13-7091-4b3e-8d68-6e65cab61ae6", "value": "SalesXOrderXAcknowledgementXJulyX2026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff92e83-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512525, "uuid": "99c8b2f7-c55e-4c4f-868a-599503a8bf82", "comment": "Malware payload (Mirai)", "value": "14ba9020955a8365912273b5b34c7be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512525, "uuid": "5360bd67-4758-4966-9a1f-dbad0d98c133", "comment": "Malware payload (Mirai)", "value": "a0129b2ba0b0214e0124c7901b01a8c0b012280a63a192b6c836bde13b2eeab2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512525, "uuid": "ec904edf-3bf3-486a-8969-ea0ee6fa857e", "comment": "Malware payload (Mirai)", "value": "9105a9d081ce98fc345950ce2792be6b55071a12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512525, "uuid": "73959ea0-a4fc-44ef-a3f3-6aa4b340b9f5", "comment": "Malware payload (Mirai)", "value": "09e406ea06bfab7250b3475d7235464496c115dd09ff6f3011f8bfbff19408201444e32e13b69078af4bbfd85beab081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512525, "uuid": "a86891f0-3afb-41b7-87b7-0854ab91d372", "value": "T1FF03D1B061D1BAA1DB742C7398BC92C31B723FBC047970572273832596DF9466E6D28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512525, "uuid": "df1d1fc5-cc5f-453a-8377-4948948164b9", "value": "768:uhbUpgfK/Awti1bRa7sqiS5H9Y0M+D2szokmu8LP9q3UEL+3:uxUpgy4n18BrH+0M+D2sz40LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512525, "uuid": "dd3785ca-ad7a-4f74-9aba-054b5fd6cb22", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512525, "uuid": "c1f9dcf0-99b1-4fe3-8de1-a03ad5b654bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512525, "uuid": "f61c3e59-81b9-46f6-9007-1a8a4a676f79", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c028df7-9686-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563923, "uuid": "945ee73a-1a02-4fe8-b329-977982ace1c5", "comment": "Malware payload (Mirai)", "value": "056aabdbee5d5c7d594efdf96187f375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563923, "uuid": "2886aed3-3fa2-4478-a0bf-91dae8c3647f", "comment": "Malware payload (Mirai)", "value": "a0affe2acd95d7acb4c173c9050328e8e1d6f4fc14c73594fcf97f58001167c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563923, "uuid": "47d9ca08-b8fb-4ce3-9295-584ad2fb629b", "comment": "Malware payload (Mirai)", "value": "64eaffc879e7b69bc10e9704ae732193087da502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563923, "uuid": "4bd352f4-cc9c-46ef-bd22-8c6afe71ef80", "comment": "Malware payload (Mirai)", "value": "643c91eb8281af89526ed3a2dccd4e811315b44de51a49e41b7ddb9c4fa2af43c39b7209bd8f64525359fa2a42415c13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563923, "uuid": "e3d4f479-efbd-4f17-953b-4dec273baa00", "value": "T1DB4302B55A1C7E38F31414B9FBBC41479D5A27E8F2D2752BA371980978F232184B5BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563923, "uuid": "6e14457b-1963-4a23-93ec-5348d8deca10", "value": "1536:7oW9VbGnmWQtRfHmqCSnn32CnMp3rc+AfA:7oW9VamWQtRfHv3juAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563923, "uuid": "576aa63d-9919-4399-8d2b-f9a7ad6c82de", "value": 56412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563923, "uuid": "5731047d-92ed-47d0-8c30-ff098271ce6c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563923, "uuid": "4c26d7bb-7eb9-47a8-a441-b98adc9b22b1", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee28cb-9615-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786515524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515524, "uuid": "819f4daa-4b07-4487-8000-245a70e35bdc", "comment": "Malware payload", "value": "75bef96c972f6e5ac5fd5f34dcd06a6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515524, "uuid": "9458bcbd-f87f-4dae-be5c-8a57fa9df7a1", "comment": "Malware payload", "value": "a11e9782a9c32f1482b92722ee341556688857097f1e59c59f4aa9791d446d3e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515524, "uuid": "ea0ba922-7b4a-43d8-ab3d-7214ebc4a343", "comment": "Malware payload", "value": "ff6706edd05da09e3f3e83156843637278b1bd86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515524, "uuid": "1535f257-49c9-4cdb-b3a6-4ee2e732ee9a", "comment": "Malware payload", "value": "a57db20918766f8eb5f3fbc1baff23108bad4c8d84195f77e5e3d5543cc373816581c80b5f9d14b4a80b8d253261b8be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515524, "uuid": "2663397e-04a0-426a-b80b-910735231d47", "value": "T12CC27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515524, "uuid": "32f9277a-58cd-4505-adc5-75f493279def", "value": "768:28vCB+25j6es8R79FYpMSUpi+20qUpi+20YQX:28l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515524, "uuid": "d1b3b7cf-e057-4400-b7ad-d42766677bb2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515524, "uuid": "d1691c49-beee-4ebd-aa15-9d5494f0ca40", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515524, "uuid": "56c565f2-1a48-4afe-9cd6-90e28cb2bbae", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c26a14-9685-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563666, "uuid": "e49cc6b5-b014-49e0-8fa4-b8fb60b4f33e", "comment": "Malware payload (Mirai)", "value": "b136f37d563db3d2d233a5a93bc6b07b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563666, "uuid": "2664997f-1f59-46ee-9ec9-59e9747ca11a", "comment": "Malware payload (Mirai)", "value": "a1a622d8176e08ddfe5f48285eada49c2a2d779ee064a690f2c525c663497e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563666, "uuid": "99c4af85-3502-4d59-b464-ede5f69e1683", "comment": "Malware payload (Mirai)", "value": "8af3422ce8604252a99e9aedf22d32e71dcc250a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563666, "uuid": "07a63e86-b2c1-4014-a2f2-a591706847fe", "comment": "Malware payload (Mirai)", "value": "57880ecde2146b96c7de630d006145a48673cdb463d114a3fbde425b716e3b45fc7343791fdd4bc90fa2eeb6e98fc64f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563666, "uuid": "854ddb68-7f22-44ec-99d4-141d0fd53466", "value": "T1E90418C7F900EAB6F80AE3374857041AB130B7A204925B776257357FED7E189147BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563666, "uuid": "06e943ae-e693-440c-bce8-41393f03202a", "value": "3072:mbO83g3Y4T6BgKFy/2RcB+rBy7NjDckUL/nVejbi3LQ93GxUqVvisw:b3FERy/ecB+1yNsL/5LQ934hisw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563666, "uuid": "3eac0903-68ef-4ceb-8de4-812867ecf443", "value": 174456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563666, "uuid": "d74121dc-d008-4e0c-9591-aef582a5e746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563666, "uuid": "17237e84-90c5-4f67-af18-6f87c44f32fc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60fbde4-9623-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786521527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521527, "uuid": "97307e9e-4e19-457d-981b-b54e8d9ae37d", "comment": "Malware payload (Vidar)", "value": "dd450cb1b0762f18ac735f2d6ab10a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521527, "uuid": "4bd5f6e1-91cf-490b-973a-9c560ca32055", "comment": "Malware payload (Vidar)", "value": "a296390de23c639a034c11e0a71988ddb23f70c22b6c4f5b9c249e2739242c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521527, "uuid": "ac612eee-349f-44e6-8c80-033dd95401f6", "comment": "Malware payload (Vidar)", "value": "dda9a60a4074fa2fa1c04fb7d38731aee944bde6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521527, "uuid": "68f8e5cb-82d6-4f3a-85b2-104678b2e641", "comment": "Malware payload (Vidar)", "value": "fbab89e55b0ed17a691a71632696f3c25f060dfb2bcd9adcc6c11e96523024c651f9541b218c7b82de8dd195b791eb0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521527, "uuid": "b47ac19e-9d47-4732-a996-43db8b64554a", "value": "T179169D13B89948FAC0E9973988776666BB74B8084B3173E32D51BE752FB23D09D34784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521527, "uuid": "4d0f779a-aae0-4cea-8803-10f24bd46759", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521527, "uuid": "7ef69ee7-8e92-4267-ac1d-a5cec7bd8d0b", "value": "49152:/I1Za8uqK77ZIGCugvTOXb+z3liJcErB9DNudrQK7mjwW:/0Y1TXbQCrB9hulQ8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521527, "uuid": "2fb24a03-d745-4de6-86c5-1193e8f1669a", "value": 4337528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521527, "uuid": "69475b93-d791-4f63-b2b3-2400087327b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521527, "uuid": "8c9b436b-b3be-49f8-b641-6600f5fd0703", "value": "a296390de23c639a034c11e0a71988ddb23f70c22b6c4f5b9c249e2739242c6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453c143c-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786535109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535109, "uuid": "ab5f7964-33b0-4b4d-bdae-e44fb3261d24", "comment": "Malware payload (RemcosRAT)", "value": "4633d64c1b619c268edbff8b0fab669f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535109, "uuid": "94917b11-7e0f-490b-9f80-329c7df8d73e", "comment": "Malware payload (RemcosRAT)", "value": "a332d0013114183c5feef385e24a99330cf86166cbd9b36a80cb316efa32e4f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535109, "uuid": "41fd677e-fd9c-470c-afb2-9139e8ada2b0", "comment": "Malware payload (RemcosRAT)", "value": "8f217d5f07b38a833f066a8146eff2c1c5701112", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535109, "uuid": "8bea08a1-a6ff-42ee-9789-fa25de2c346c", "comment": "Malware payload (RemcosRAT)", "value": "c9e2442fee6a268ff10300bf6956865ac2b0585aedb47fc4a65b3779d095c88608a88dcf2e187411a5232a31e6b9b5ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535109, "uuid": "b2bb5063-ee36-4d73-8665-d5b9616f7863", "value": "T1192629A270155BE57C3F6A2CC69617C4DAAD258F03247B1D37BCC7CC176272A1A8E893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535109, "uuid": "ed19b5b3-2a93-4c94-9d85-ec287a0b45bd", "value": "98304:IzdMSWk8N16j1mqdYdrwEWWc57GBMnIhtzJU+I8ffVi0BmLnSfSdy1pIjo1KZ1NF:hA4rwYc57GBMnYLIsNi0BmjSfp1uKI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535109, "uuid": "04a671b7-6e9a-4f3e-bd18-983d3bb615e4", "value": 4751654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535109, "uuid": "de4d797c-7464-4885-b321-b45d6c7b98c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535109, "uuid": "30e5c196-d3a3-4cf1-8135-0b3722dd4f06", "value": "Pending Required Documents for AuthorizationP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95642490-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493153, "uuid": "4abed99c-ce82-46ed-ad8e-e5ae631e0bf4", "comment": "Malware payload", "value": "f87506ddb1b63fea12e548b8a1d35c23", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493153, "uuid": "213103e3-fa62-489a-aa91-af743b1f5913", "comment": "Malware payload", "value": "a338d68455d166d3964286b5471074bf356f018a2478902a322ce728e75e4444", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493153, "uuid": "0ec95692-7e72-4416-83a6-82bc95a09840", "comment": "Malware payload", "value": "6fe54500de88e0b1b23dda7ca8a0c283a2266485", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493153, "uuid": "63f14095-4e23-4083-9b2b-9e2768ba1346", "comment": "Malware payload", "value": "b97d753d8d6d6f7710d0e0994eed2a31063e93cf42fb91b1ef5f3d1a3329b5927f6da3766c7795ccee3189953796e08a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493153, "uuid": "015689cc-ce12-48f6-95ce-d1537d4bc999", "value": "T1A9F63329E951A985DD1A303739DCE3C1B296B44958A79A1DDB5B278C23EBC34C20CFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493153, "uuid": "ec03b037-1e27-4a5c-b7bc-b4d1259b027a", "value": "393216:VRNPA7Q5Zh9rEiFR8l+MvY3S6407E/BWTRGl9HNQfC5e2iOOH:V7A7+T5EonEYpa/BWTRM9te9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493153, "uuid": "26abb76f-5f98-4551-bc7d-b5cf758e6165", "value": 15512898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493153, "uuid": "e035f9fe-2fa2-498b-a96f-9bd849bcec24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493153, "uuid": "ab3d9ac2-2ee3-427b-a0dd-d4b4b661e72a", "value": "SettingsHandlers_ContentDeliveryManager.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa92e27e-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512650, "uuid": "70839fb4-6489-4e72-b4f6-a1bc98429a9f", "comment": "Malware payload", "value": "588e761a774c66875ce357667799d1e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512650, "uuid": "eb0bbb98-bd66-478c-aa6b-88bc3c6f11e1", "comment": "Malware payload", "value": "a3d0a2a46837fb8fdf5b6da1a74eb8a0736be0f4b7b436e667382920d908f42e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512650, "uuid": "b9c1acf1-7d96-46e9-96bd-18fdfd44790a", "comment": "Malware payload", "value": "82774a0e4f8a167bb8710bb2f371d716275f51b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512650, "uuid": "ecde40f0-c41e-4037-ba30-0b2922d19902", "comment": "Malware payload", "value": "bedc2dafb40a4aa7227b8f01400bb017cea4a8a2bfd2364a44500e27900c9e435bd512c9583cf84edbfdf4dbdef4993b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512650, "uuid": "0e9a18b0-3fd1-4fc3-8666-dcb46064f280", "value": "T1E137CF77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512650, "uuid": "bbf8872e-9a1c-4af3-9cf6-95726429d7e5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512650, "uuid": "99fb98b0-d6fa-426b-8aef-1637f0b3f4db", "value": 22740992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512650, "uuid": "ee9f91ac-2796-40dc-b8f2-1fdc2e2039a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512650, "uuid": "8ae21e01-ee54-45c7-b47c-e46774c75b20", "value": "a3d0a2a46837fb8fdf5b6da1a74eb8a0736be0f4b7b436e667382920d908f42e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3f1acb-9608-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786509698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509698, "uuid": "05994660-e57c-4e04-a6b6-a12ddcfa2c3e", "comment": "Malware payload (AgentTesla)", "value": "55c49eb12a55b3dabf3d6c44ebb054fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509698, "uuid": "a63b70e6-e74b-495d-81d0-9b50cef71c05", "comment": "Malware payload (AgentTesla)", "value": "a3d2ca93fa43d5857b4329ee3372f73480cc685333acfacd7c04be8100048487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509698, "uuid": "961d9743-a008-47c2-9aa7-749c3aa518e5", "comment": "Malware payload (AgentTesla)", "value": "633067aa617eeda2029553e2714e8a9385ec972e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509698, "uuid": "0d1fd40c-7f02-44dd-891b-5ad2301b509b", "comment": "Malware payload (AgentTesla)", "value": "9ce500447f333bc6b23c46060b5554d8d4cacb0b136b6cdb9d5c85d2eff21e097221c565a58747c686b835d11d842596", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509698, "uuid": "f3750192-54f4-43b4-92ca-e7c274292ccf", "value": "T1C835D97DE569BF292EA6F25FC784E4970191A6460B03FEC9907C95E710230F09DF18AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509698, "uuid": "0a4a6272-b4e9-47c3-8ee0-80ef4dcd0c83", "value": "12288:Id7nkCSxz8WxKI7d6MObkYYgITrdl/koGdomxdPOMJPPESn+Qwt5scajNlA1U0NG:IxBSt89Nt6lmfWvSn+oXMMXQYQpTvqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509698, "uuid": "823b3daf-1246-4ee1-aefe-458db20a2f76", "value": 1141112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509698, "uuid": "bd0ce6aa-2d5b-435b-8d77-e7c27c592114", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509698, "uuid": "23ec70bd-842c-4550-a7e5-4b9eef989430", "value": "Dringende Angebotsanfrage GmbH 002361192 doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eab484-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535028, "uuid": "62bccc54-f825-40ed-b6aa-698d155ad975", "comment": "Malware payload (Mirai)", "value": "52aecdeaea3cff71eb0bc3973fd66656", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535028, "uuid": "65821d62-45e6-4a18-9f71-46ce935abe2e", "comment": "Malware payload (Mirai)", "value": "a42f636db9f8822be3f207dbf835e9454de51c214fe06d12a1f34d7b099859f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535028, "uuid": "1a3bf787-6d82-446f-b289-8a1a9696ee9e", "comment": "Malware payload (Mirai)", "value": "b38de47a210368b1d625abb82fccb4a7b5fd0771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535028, "uuid": "3fbdbc43-4fae-475f-8443-06460d44f543", "comment": "Malware payload (Mirai)", "value": "e40853cc834649f1c2fbf2738844fb5e7309c381af6a72337d74898d007a5730e2bc31508b8732e820b82e8235d71dd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535028, "uuid": "36dfd9bf-272b-4e33-9c73-b0fca7e10da7", "value": "T17FD32B17B4C0C0FDC4D9C5748FABB53BD932B16D5238B26B2BC8AB271E49E205E1DA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535028, "uuid": "dfabe364-bcad-4330-9462-761946caae4b", "value": "3072:JE06SfYwD53JTBu8DMtBGd5ZBO589Nr6c0K2E0S1wglzklg1Tys8y:JffYwDBJTk8DMtB7S52pS1bkGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535028, "uuid": "ebc4945f-94cb-4bf3-b569-ce51fa0dcf40", "value": 139192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535028, "uuid": "09af2a9c-b7dd-4632-8213-30af77153a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535028, "uuid": "bcc7ce0d-d034-400f-a8cc-feb28e74a46d", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fab865-9681-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786561819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561819, "uuid": "b3d006d5-d70c-4d2e-9add-b51df072223d", "comment": "Malware payload", "value": "5fabf79eefca7ffb4834ce78263d1d59", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561819, "uuid": "607576a3-6198-44da-b125-27c32d8212b8", "comment": "Malware payload", "value": "a43753b578e5bc6394b6dacdb0993bd2fac9adf939238cbfcb7eebd0556c6dd3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561819, "uuid": "8b88ba5e-c39a-4748-b4be-c7409de31705", "comment": "Malware payload", "value": "c1747786a471e3f1925433e5ffbc6a66edbd70e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561819, "uuid": "bbc9155f-ae8d-47af-a9a8-c300a1549584", "comment": "Malware payload", "value": "66804c792988b1e4736ba95535f8482ece8bde1f24d2fe86c956b646fa7cbd93fc759c6e9114ae763a629fd1addb4c76", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561819, "uuid": "b62c3ec7-d376-4ddf-87f3-d4a0cc2c9016", "value": "T17DD63321C47E08E4D570EF563B4EAE6FD392D8B423EC768320C5421E87A8B35A36197D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561819, "uuid": "a5d54055-4a47-4767-b9f4-95e004eddaf7", "value": "393216:vAhRn3kfF9hhFF+BLS1fuYzBo4Cbjr4Smxz5c:vAhOffFiwuKyb/4S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786561819, "uuid": "cd14c6c4-e833-4e3b-bd7c-267ea00dae42", "value": 13568175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786561819, "uuid": "f33ceb77-7a27-41c6-a0d3-a908ebf4ba99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561819, "uuid": "ca84a0c0-a57e-446a-b0d0-1a65023132ba", "value": "University of Alberta Report.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84246362-9669-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786551535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551535, "uuid": "670c974a-596b-456c-8975-d07f2a0c4e15", "comment": "Malware payload", "value": "6f86856677991a669ba5ebd2ccfc36a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551535, "uuid": "62dee850-c09c-4164-907d-808051c6e752", "comment": "Malware payload", "value": "a44471e167475620ec48123c0cff7acd03588ce17c9f5995f313955e7c7f56dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551535, "uuid": "c0f01185-6714-4a94-b326-b1364d82f54b", "comment": "Malware payload", "value": "b7ab32d5c714930a2cf67521aca4d5739e32b1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551535, "uuid": "373e43da-6786-4e01-aeff-eadeb99ae6d4", "comment": "Malware payload", "value": "e8bde0e96068f90edcdea24f08e7764867296a8564053277e7af626429b2217b92d3c081aab7be4eb53f87458b2f46eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551535, "uuid": "88cb5eb7-62a3-42a1-b2c1-1e6332cad79d", "value": "T1F6D523DABCB768BBE432C3B18F92F5BEF2297B8546604C8739DD49008D529901C36779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551535, "uuid": "52f68a38-5fd7-44da-8457-adc06c33172b", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551535, "uuid": "5b6ae744-c23b-406a-a6fd-6bf97601e63d", "value": "49152:9KgWd2Z7aycBNJfvBb3GZa9VEVfgXDAJmEa8daI5jonzmQ/TDicg:skZ7rUNJfvBb3oagVqDZ4daIhonzmaDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786551535, "uuid": "22ad7e52-d55b-4c64-985c-9e0b198b8ff7", "value": 2989568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786551535, "uuid": "be099dcf-3cc4-4fc3-b19a-3b5c2bcbe160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551535, "uuid": "19eb63db-916c-4454-835a-f87dacbd8e4b", "value": "a44471e167475620ec48123c0cff7acd03588ce17c9f5995f313955e7c7f56dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c99b83-95f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786503515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503515, "uuid": "5f81ce90-9b67-491f-ad97-9a26c274cb70", "comment": "Malware payload", "value": "1a8dc8b82ea0b3670ae175e34017e7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503515, "uuid": "7ae87031-7e77-42db-9dd4-d2cf47da53bc", "comment": "Malware payload", "value": "a571bd3aed290eb2ed071ed8207456975fa2309a9e179ee57512b5647e0364f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503515, "uuid": "889e163a-6b66-414c-8fb5-a4468fd5a349", "comment": "Malware payload", "value": "3ae39ae197f8d8a6e872fbb163a41a694b40781d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503515, "uuid": "c808550b-ec36-4621-a082-940e597dc8b7", "comment": "Malware payload", "value": "9f713beb7d72d589215a2d430391c821e4856ad5fe183e52f77b7761e2d7035068729c95116b6dc3a3c9126d98f9113e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503515, "uuid": "29c09619-a49c-4b33-b2da-067b7f23ef09", "value": "T1F45629779E019874E5D9EA38C977410AA678BCAD877433A32EE06DB02F753D18E35B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503515, "uuid": "a4cd03f4-8e5c-4436-b057-741d53045f15", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503515, "uuid": "fcbe0273-ef25-4260-a524-43ceb2a638df", "value": "98304:F625gYq/LElvWsRIXuJsDnZ5vLJH3rZdf7hhmI1PzsF8gk6hl1TaQjqXgWoIP/By:FPjqBjCM1R8b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503515, "uuid": "8baaacb8-ef80-4595-a363-5cf8712c42f6", "value": 6417080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503515, "uuid": "b6559817-1261-41a7-9852-c1ddb7af192a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503515, "uuid": "5240da60-99e1-42fe-8164-c78546152bee", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7545bb15-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521875, "uuid": "4b607022-93c8-41ad-946c-5b31419b74a2", "comment": "Malware payload (AgentTesla)", "value": "c13dd6050fe9e408b3cc1f40e38b9160", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521875, "uuid": "f1327ace-58d9-48d9-b59f-fd4ce620ac35", "comment": "Malware payload (AgentTesla)", "value": "a58cde622c04af01a3b2f9d4e3ec4ee0bec12357daff9dc6057af93162067d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521875, "uuid": "43651f22-c9e6-4cb5-9e09-521d97137e8d", "comment": "Malware payload (AgentTesla)", "value": "7cb9888d04eefa5032fef2434f84506d2541fc11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521875, "uuid": "ea1e33b8-2118-47ca-aebe-1cd8cb74f2e2", "comment": "Malware payload (AgentTesla)", "value": "034a896e8db94bb31a9905be032646d42f939ba6adbfa04761bb355a3519901188b7c8d0e60a015d177a4d617331a963", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521875, "uuid": "64e57ffd-2c02-4193-b952-7ee2d9477dc0", "value": "T195E5D51012049570FA2D779CF13A6AA00D99A1EF1296EB1D35BC814437E9B17FF6CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521875, "uuid": "7941c337-a157-414c-855f-9a26fa711d2a", "value": "98304:2fZwB/wEOJyaE4JThKe8V7wk1XAtwbP/Ikvyx0drXm8hNWPpFWFn:2fUQyaFTUe8V7BNzosWPq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521875, "uuid": "caa6c2e2-dfe2-4a19-a50f-bd6a7aad1a8e", "value": 3315662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521875, "uuid": "68165845-531e-4128-be7b-76df8dc5933b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521875, "uuid": "9013bb7a-117e-4be1-9866-97022367b9a5", "value": "Request for Quote _26-RFQ.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab423a8-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Heodo)", "timestamp": 1786494987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494987, "uuid": "a33a9f70-91d1-444e-b3f7-20bfec02aa9c", "comment": "Malware payload (Heodo)", "value": "d26d314a27975a600bad471b6c5a705e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494987, "uuid": "b86274f6-96ac-42cb-bd74-75555d4d29bc", "comment": "Malware payload (Heodo)", "value": "a5d5bd497eda2289310c6559d89caaa2013485fd2c19a06b3c03ef507607fdd6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494987, "uuid": "854cfaab-9e55-4e8d-bb9b-0875b79eade7", "comment": "Malware payload (Heodo)", "value": "b4d31fd7e5466573798456e68a94bde3bb0f0ccd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494987, "uuid": "8e2b16ab-0846-4d4a-aefb-f7ffa818f876", "comment": "Malware payload (Heodo)", "value": "fe561309078b32b870dc2fa941e53c417a5080b949ebf4d292c537c69525fa2c1fe74d0405fdf2696a03df3b7cc00ca8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494987, "uuid": "d766b380-9d97-4f23-b9be-152e81878f78", "value": "T141373387C6864CAFFE41D13BA368942E98D761CCBC2A150F0DE66F4D8E1FC1545E6AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494987, "uuid": "631e5b43-b554-4947-8a47-58d1386369ab", "value": "393216:wnLZ4URzIGGWomB1h+bTyhDDOR6MmovuCOypEBFgKndpCU97v8NvWsl/yJJ2FCN:wLK4zWWXBWbTyheNv1vpEjgKXCU97vI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494987, "uuid": "bb59a3c1-48e6-48a2-886c-36ee49d2c645", "value": 22789025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494987, "uuid": "4eb1e2d1-efeb-4080-9a80-449a137f356e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494987, "uuid": "6573375c-babc-4cf5-b8ca-f056f129a432", "value": "Windows.Internal.System.UserProfile.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff84d1c-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786515021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515021, "uuid": "b5cb60e8-fd67-4f2d-beff-ef60b0a6333f", "comment": "Malware payload (Vidar)", "value": "22f293d0d9e9f32fbf1269525a2bd427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515021, "uuid": "ad53ba60-234d-4299-81bc-5bb9c93e0900", "comment": "Malware payload (Vidar)", "value": "a5e57e5a30cad012f4267e792cb3448ecaebc34ab2f1b5f4d086816c01c8c578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515021, "uuid": "0baadc9f-34e9-4f2d-9373-2a642a5ad4aa", "comment": "Malware payload (Vidar)", "value": "3b3fdeb95ab2510f6f047270e5fa2e10a1a77595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515021, "uuid": "121bf508-30ad-493d-b9cb-de1bd5488c51", "comment": "Malware payload (Vidar)", "value": "caa5c45df50ed716948f1b726547d2c25dc788387ea5618b61b91dba42f994d9f4ce67c747c2e4ac232bdf20b1f32104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515021, "uuid": "9c32f65a-0655-4779-ba24-c40d9c5ef15a", "value": "T1EF266A43BC9148FAC0D5A73188A65256BB75BC0C1B3623D32E60BBB82F767D15E72760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515021, "uuid": "63a50a88-07fb-436c-993b-adca50ec04f5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515021, "uuid": "42ad8743-1aca-4b45-89c2-005e11e90617", "value": "49152:wU/1LioSnYFVlGPc2ZZ3eXijuYx6pmGfhNcBCHeFhposVwspcEY:wixYc2ZNeXO6fhcC+FhSlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515021, "uuid": "1cfb854f-f56c-419e-b9af-27cf03b41557", "value": 4529008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515021, "uuid": "28b0c7fe-4b13-4ad9-9204-d1f1d508f982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515021, "uuid": "90808161-b06e-4d98-947f-d1125482e091", "value": "a5e57e5a30cad012f4267e792cb3448ecaebc34ab2f1b5f4d086816c01c8c578.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42450cb1-9677-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786557438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557438, "uuid": "3670d465-ac32-4222-8433-c7b76fd50ed1", "comment": "Malware payload (Vidar)", "value": "62067e4c646ee85cd3a7615be23ba796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557438, "uuid": "e63d4d59-6a1b-4815-8393-64d0f50341c2", "comment": "Malware payload (Vidar)", "value": "a60db5d8f5fdfa89ff2a38c2ecd7b53054465ea5165421fe4fc2f8fd1bbe8f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557438, "uuid": "a695232d-b632-4748-963f-9c6a7a6e095c", "comment": "Malware payload (Vidar)", "value": "6ed1a861ca93250d37e3003eb89fcc3530e659c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557438, "uuid": "5c53889a-6271-4c0b-9a1b-46f0e8bf0dc2", "comment": "Malware payload (Vidar)", "value": "d3bdc68f9edec79d66e0f418652a4b8cabcfd15dafb82196d9920a00602dcf87dabde8e8b960c9bf8f232ac561e4ba65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557438, "uuid": "67de1f47-7fe6-4e26-b7a3-3b3eaa68029d", "value": "T161267B077AA149E9C499D73588BB1251BA70BC4D8B7133D32E60BE782F713E1AD78B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557438, "uuid": "ca03ffd9-cc5c-4eb3-a007-7fb365f44019", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557438, "uuid": "b0278a6b-f90a-4c3a-92c6-80a0172c47f0", "value": "49152:iNXkiC9y2pDM/YWx8ey57N0wRJlzUWOGEka4UDXW5Egi21r/aAxJg1:iSPiYf7lzUWOGFa4UDXW5xhiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786557438, "uuid": "c56b1546-7097-48d2-8e33-3b1e404dca86", "value": 4660064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786557438, "uuid": "58963902-e92f-4e96-b529-0a0853cfbc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557438, "uuid": "8a4f41fd-84d1-4175-9fd2-3bf82812719e", "value": "a60db5d8f5fdfa89ff2a38c2ecd7b53054465ea5165421fe4fc2f8fd1bbe8f26.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699a204c-95fe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786505535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505535, "uuid": "c4eaca18-ddaa-4254-b261-10a0157facbe", "comment": "Malware payload (Mirai)", "value": "c6cb8ebfd358ebf7bb57740671089a14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505535, "uuid": "621672ee-8e23-480d-8cb1-d255bf6a94c5", "comment": "Malware payload (Mirai)", "value": "a6281784d9606660763c33ed8196431c84f9cb44f2c1e9da172bc95fa08d1899", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505535, "uuid": "87e253d1-f4a2-4196-b912-6ca3ddfb01b6", "comment": "Malware payload (Mirai)", "value": "bac5ed6e4ca5e7d3e4f4c912edf0a0f31f06a0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505535, "uuid": "a2d88f96-a484-48eb-b8c9-64ea3eaa2236", "comment": "Malware payload (Mirai)", "value": "cffbe19f09cefa1a0680b5c568c46d0f777a83b058527c19b7dde83aa3a9120cf2494d4b9ec833645e6d68fbc8566b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505535, "uuid": "ce9352d6-9a22-4720-804e-bb30d5c63fca", "value": "T1C323F1A6897E8B44D02F55B4248E7ADD0840859828DD37D1BEC8F81BD5FBFA41A0D1FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505535, "uuid": "e219b3f5-eb8b-4e12-bfcc-d3def125b283", "value": "1536:/jswv+5gfmNjki/wR5dMcfHPEopwysaWztAcxnouy8HyRp:TBmpBy5dMcfvEflaWGUoutqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505535, "uuid": "5154888a-1ba0-40e4-a458-63ea586fbc11", "value": 49440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505535, "uuid": "c43ade1f-ee36-4460-9d37-d624f94a17e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505535, "uuid": "9ae928ba-7c2b-49f7-8a09-52aef59cd7e3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c48ca1-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507703, "uuid": "34bf21fc-1db8-4d7b-9c57-09c62f4d4ce7", "comment": "Malware payload (Vidar)", "value": "f8c9a1475fd00ddd2313a375d949bd5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507703, "uuid": "c90ce0c0-c470-4198-b865-fe974dfdb668", "comment": "Malware payload (Vidar)", "value": "a65817e195fcd10747c660a095477db65d317dcf1123c4a66b5b911765522f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507703, "uuid": "60647d58-3096-4bcf-a71d-32f692349322", "comment": "Malware payload (Vidar)", "value": "c4c30892e9c6c612a45e1c76314f253c881f74e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507703, "uuid": "f079ec4c-0e8e-49da-b8d6-ad5079d9339d", "comment": "Malware payload (Vidar)", "value": "a473fe4dbaea02159d4f89b5d5b39d36b2dcf2cf202d784ee272795cc733e728bc679c182976a7e2ced03c7064d75fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507703, "uuid": "e2159999-7174-42ab-8506-c7c71a4d7f40", "value": "T1F5266B47BC9148F9C0D5A33188B75256BB75BC4C1B3223D32E60ABB82E763D15E76B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507703, "uuid": "576ace4a-60e9-490f-9ae2-29aa59362b21", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507703, "uuid": "e11feb9d-5567-458d-bab9-2cea7fa768c6", "value": "49152:De+MfzPOLJ+mJ5DBIj4Qqfb86ZXgA6prriIvHQCMmqla0q2V+ncaRFRXNbzO9ds/:DW659l1UrK5mqTq2VWzO9dQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507703, "uuid": "e6c438bf-ca49-4ec3-b93f-1db2caafe55c", "value": 4523376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507703, "uuid": "8bffc080-a11b-4ee4-be62-b344eac98420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507703, "uuid": "028380bc-31f8-44e0-80d1-4ea81e1a0875", "value": "a65817e195fcd10747c660a095477db65d317dcf1123c4a66b5b911765522f73.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f29e0f-9612-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786513951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513951, "uuid": "63a25998-744a-4cea-b3d1-af7f6ababbe3", "comment": "Malware payload (Efimer)", "value": "1e84b9aeebe223c59876380b8f27663a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513951, "uuid": "2b76d5a6-d28a-4ff2-b72c-a472a58e8548", "comment": "Malware payload (Efimer)", "value": "a664c20de906022ed15084333d29baef039bb1b3a9eef796c64b9f304a2c8035", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513951, "uuid": "d884a0ed-a725-4b8e-a223-277c3ad43dd1", "comment": "Malware payload (Efimer)", "value": "017435042a3734499c3bac9c93e52590e9c0e2ff", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513951, "uuid": "e7de33a0-d93c-417d-b1fd-bb18c5d9f0c5", "comment": "Malware payload (Efimer)", "value": "1a919bf840aa99a3dd342a0b4325f182276f1e27de345683fb4a4716c74dc30f36394197d6718f50df9d4374c3b8253b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513951, "uuid": "0b56e8eb-1482-4ac4-bed2-b8d836febb13", "value": "T1F6E6338E2CD2A24ED6F7857077F03FA0509874796B3843EB53ADC761AD873D09A78462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513951, "uuid": "5989c908-9d7f-4b1f-b106-33486078fff8", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513951, "uuid": "f46a3387-18bc-438a-a999-ae3ffb9b7bfc", "value": "393216:0hXjdA5Jwurqvr2Kx0vYWCXMCHWUjXcuI3/PGTAI:0hXZA77rqdxwCXMb8sH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513951, "uuid": "d950f080-73c0-44d9-ae2d-6288b4a11e5c", "value": 13896766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513951, "uuid": "df985fac-1479-4640-9ef7-98e3ac6b2b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513951, "uuid": "02a4b407-026a-486a-a294-b221d3a5ca39", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238e5602-962f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786526462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526462, "uuid": "d6055533-c16e-42b7-9d2e-f4d3bdf77b65", "comment": "Malware payload", "value": "f17b0a941d9f453712b9df1b1693a2aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526462, "uuid": "cbcd24b6-54ad-479e-8126-60a2bc9578b3", "comment": "Malware payload", "value": "a66e3e3a3698d69e3c67c0ef7cd2c9f62f18a05e2bd3a633f08321a0ea71fc6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526462, "uuid": "38fbcfda-6955-4ecf-948c-aa2826b62763", "comment": "Malware payload", "value": "e597e7e355823a4830b3c1af19b0598062592b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526462, "uuid": "b790519a-df00-46bd-8ff5-32e02847309e", "comment": "Malware payload", "value": "5e10015269c28afffdfb0388de612090ffec22e4db95740b40c5a2d1e4159f50b6b7d6f522fca331ff529f27b9a42d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526462, "uuid": "212a2313-4123-4137-91ba-1371be02cafb", "value": "T140366A13AD8184F5C199D731C8B75656BA34BC0D8B3123E32E50BAB82F327D29E76794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526462, "uuid": "88503609-88c6-44fd-a031-f2d8e5d9e485", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526462, "uuid": "a2f34f7d-bc5f-4d04-a3d7-c52d78bf3b64", "value": "49152:YPLQfPSdlaZRSISbXItkpuwS8f8SCvSS9Y7yP40ynirWCpRfdoV+a1+0bK54sy:YM4I7wS809P1YsWv+odbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786526462, "uuid": "13c67617-0758-4df4-90c4-d0b823075dad", "value": 4927360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786526462, "uuid": "22fbaec8-729b-40b9-8c10-fe6dc5e3e2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526462, "uuid": "b4c8d1e9-4ae4-41dd-b0b8-a8f39bd660de", "value": "a66e3e3a3698d69e3c67c0ef7cd2c9f62f18a05e2bd3a633f08321a0ea71fc6d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9d3235-9645-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786535876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535876, "uuid": "e12715ae-7e2a-4308-b304-62ca754d8c7e", "comment": "Malware payload (Vidar)", "value": "7ff7a5fc37d5ec7cf6d9a302fef16935", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535876, "uuid": "75ca09d5-a97c-41a2-a83a-0a2df32ba97f", "comment": "Malware payload (Vidar)", "value": "a6c2a5383814d42e4e8fe5194093a903b26720a9f1cbbdc7858702f3c913750a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535876, "uuid": "d666c75a-463f-45da-acc7-fbd7c291867b", "comment": "Malware payload (Vidar)", "value": "910b0f472542cf41cc025fd40ea2382f57ee2328", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535876, "uuid": "f843146b-83c1-460f-a0c5-af361eccee3e", "comment": "Malware payload (Vidar)", "value": "293c281ec0d9abb12ebc93901229e2a53924aab46728718098f9fc899d8fcd774761e1287e23e632e05e6bd4b8853d58", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535876, "uuid": "35d59992-f7bc-4c25-8948-20ac4f6cec9f", "value": "T180467D17BE9549F9C09AE73588B7121A7A30BC4D8B3133D32E60AEB82E317D16E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535876, "uuid": "fe12d826-a559-4c91-a90a-af39047b2a98", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535876, "uuid": "370d5cfa-9993-4918-b92b-9bc93aee5cd1", "value": "49152:ACZyDRI2F4RsiH4lJrbG8YnjuolaiwL3PHuIwsNHRkF8PWJJ/D:AhV4OQkr/eiPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535876, "uuid": "ad1e0102-e646-4745-9e44-58157823bc96", "value": 5697904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535876, "uuid": "e2168eb2-5dce-4a7a-ad58-4bad3a572c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535876, "uuid": "c659b1ed-4bbf-41db-be63-1aa6266a58b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e2155c-9636-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786529632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529632, "uuid": "e3eb4102-c504-4016-9b01-d0d66d14cc6b", "comment": "Malware payload", "value": "ebef8285d039b83a238b7871065bba96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529632, "uuid": "bc28968b-b06f-42b3-8428-df60352d7ba6", "comment": "Malware payload", "value": "a6d07ee837cb4028afcd1e98c32a7f5f373b7b135d008ed99a6773bc34030f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529632, "uuid": "781e9b90-16b4-4cc7-9b38-5feb13392963", "comment": "Malware payload", "value": "1285df674d3119f282814c042cb33a6893740178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529632, "uuid": "fdbc3964-86b7-497b-9e34-de0670d994d9", "comment": "Malware payload", "value": "6bee83b7690f26e34abf8df5634461993fe535790622e5323e6e28056a1fd6b88acca97f45cbfe8c8ddeb79471b520d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529632, "uuid": "9bdd2af7-b4fe-41ac-b789-688b62619c77", "value": "T188D523D236F61EB4D827C3B28F52E46DB16D7B504BA48E17B6CC2D10AE13168683B375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529632, "uuid": "c3487217-2c01-48eb-8622-5dc2872c7e26", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529632, "uuid": "813ec896-2318-49fa-b6ae-280419c5a1f8", "value": "49152:/z1Qyqm/YyvudNjLnYubtrn+n7hueGmT9ryHW0bc8JahCo1dj7VjUDl3:r0mHGrjLnD5dlmhMbcLd1d6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786529632, "uuid": "58791eeb-8b92-4506-98a5-c93986eecaa9", "value": 2906624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786529632, "uuid": "d5aef131-3b10-4466-af33-8bb9877f9e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529632, "uuid": "76fdc66e-7112-42bd-833a-c9cacc42a773", "value": "a6d07ee837cb4028afcd1e98c32a7f5f373b7b135d008ed99a6773bc34030f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb34df7-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786515019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515019, "uuid": "3d3c28db-9e0d-4b68-ba07-dfc21ccc7cc3", "comment": "Malware payload (Vidar)", "value": "98dae1e323b9fd9d21bca7dcc735444d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515019, "uuid": "5f8a150d-3a31-4e31-b7c5-43c36137ddbb", "comment": "Malware payload (Vidar)", "value": "a7048132a36eb057926831ba711c0884617688a95ce8fb28445e9fcc8a0cc201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515019, "uuid": "59addcb6-bcf9-4ca2-85d4-65412b6ee7c1", "comment": "Malware payload (Vidar)", "value": "0567c62bb5f1f993fc5f13c61e081b8db685ccdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515019, "uuid": "b6f6a278-dff0-4c22-bbe2-0dbeefd779bd", "comment": "Malware payload (Vidar)", "value": "00ef6b464ecd882483b6b8e8512e6bfcca1647c43c841b1135fe5df57bd9fd4bd97c74be315dfb92fc7318d2cf66e35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515019, "uuid": "797fccde-1552-4dec-b4b6-c9f7f55a0297", "value": "T146567D13A9A195B9D0A0FB3085BB4366B6297C4CC73537D31E70AE782F22BC29D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515019, "uuid": "751e6d7c-d1dd-44ee-a08f-4d832a8137f9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515019, "uuid": "f54af395-a6ad-4922-9970-ac31475589ec", "value": "49152:HmLrvXVKs76ztVCPlCr/UD1aky+EC3WyRqcPBZa4RBfM0H6WPrW3w+LICW:HWGwQ3ky+EC3EcPfzBfM0H6ireXMCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515019, "uuid": "cd6a91c8-af00-4d41-af16-57557a12dc9e", "value": 5916536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515019, "uuid": "f193b818-1013-4b16-b865-e47b992404db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515019, "uuid": "4636a558-406a-4990-b66d-faadc4431bbb", "value": "a7048132a36eb057926831ba711c0884617688a95ce8fb28445e9fcc8a0cc201.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0602542e-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574946, "uuid": "155a62da-1908-40d7-b63d-016468f46bc0", "comment": "Malware payload (Mirai)", "value": "7a4ff1180c94cb3fdb654dffe8e0a8f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574946, "uuid": "d528f4ad-063b-4c50-9ec5-ccbe53ac26c5", "comment": "Malware payload (Mirai)", "value": "a75a98641037e42abb4c543d90e81dafdae3b27e90972b705a2e9242a5bee123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574946, "uuid": "6129b84d-392f-4dab-bc3a-0e7ce8736b0b", "comment": "Malware payload (Mirai)", "value": "0b9d90367fac224fa9ad29ef1f35cb8e22e776a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574946, "uuid": "f3339690-9ffe-464e-9b10-704ab4dac5e0", "comment": "Malware payload (Mirai)", "value": "8151a20a2634bf7ac8835a70f37019bcfb3f0389ba2471270f15f7ed7f42d9a1e37922b629691e02681b44aa515787af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574946, "uuid": "a0c8b879-4d56-4564-98e8-4ae774453da5", "value": "T1C163830ABF210FB7EC6BCC3749E51B46359C640B21A93B3A7934D818F60B65B59F3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574946, "uuid": "f8ddca6f-6a2a-4804-88f5-b4c9d6d5b4b4", "value": "768:ijdCpewyFRfBrqH7HDXzFtIxCxseI5mVeqe32eCg4lDx0h00Xiqkr25/q0N:4dCpewORCPhMHXK7u2Zwud25iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574946, "uuid": "dab2ff45-13fe-4af7-9284-39d1b6ead259", "value": 68632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574946, "uuid": "63976b9d-aa4d-44d6-bd65-b9eaee971e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574946, "uuid": "0563bc09-050e-49ff-a749-395dcd6079fb", "value": "085175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ded898-966a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786551991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551991, "uuid": "d3758b86-e8fc-4d99-b26b-4914ee9befd9", "comment": "Malware payload (Vidar)", "value": "c06e0f433a7f143bffe0e1591e3a62ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551991, "uuid": "0ee86b51-4d26-4f8c-a3de-db67d1a65a40", "comment": "Malware payload (Vidar)", "value": "a7c488a8491dbe9dc2869ea788e486e8edbaec1ca934c717af399556ddceb7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551991, "uuid": "4e64a900-b525-485e-9b60-f2ddda283865", "comment": "Malware payload (Vidar)", "value": "18a57a0072318706eecca70441f2214880e86fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551991, "uuid": "6be8423c-2689-45c2-ae88-a643cdff2081", "comment": "Malware payload (Vidar)", "value": "7f0703fb36a3f2ffa890f067794eb09b01474a3f17719accad98fb16d496219007496ac67f2ea0b4d199d303b3056a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551991, "uuid": "1394cb64-5267-4082-8338-9cf37ffac959", "value": "T16EE66B17BE5148E9C0A9E73189B752667A30B84D8B3133D32E616FB82F727D16E35B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551991, "uuid": "1033a0a6-8d65-4859-bb32-0275dcb5a4c3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551991, "uuid": "d4ce3681-8072-4526-9d88-e7843f8767b3", "value": "49152:EDcgIqmoIocERVPsUUc4yPQK4tFxJp2aPWQ27XLlmJ9W+J/:E4oc92M52a+Q27XUJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786551991, "uuid": "2ead785f-663e-4621-b655-7dadcf472813", "value": 15140216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786551991, "uuid": "2f0fc09c-9c1f-416f-a738-c304f02e98d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551991, "uuid": "dd98751f-e7fd-4e3f-843b-1450929fc9c3", "value": "a7c488a8491dbe9dc2869ea788e486e8edbaec1ca934c717af399556ddceb7bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72148ea-95f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786501907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501907, "uuid": "e1ecb5cc-3d80-4b6c-8c29-fc4a2ecef3bd", "comment": "Malware payload (Mirai)", "value": "c144e1c2ffb67865c7d16a3f72d85784", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501907, "uuid": "527f8269-9c2f-48b4-be5a-bb0c409250c0", "comment": "Malware payload (Mirai)", "value": "a7fee620e24fadf8042fa7cab43301d0cb3c49fb29d8184c7b2649b565a197d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501907, "uuid": "95b1be00-8c90-4431-af5a-8676d381b3a3", "comment": "Malware payload (Mirai)", "value": "fdae5179475d498b0d0601a69928b99da2109788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501907, "uuid": "215ae46e-2f72-4118-89d4-a1e4b096a5e0", "comment": "Malware payload (Mirai)", "value": "2db5584604e6fa5007b8117409f84b9883d863bbb4e19d76c03cb1b4f29f317c6c2252f4f3cb761c8ccc3ce943ce61c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501907, "uuid": "f5122476-454c-41de-b466-0056a54d013c", "value": "T1F174CF76F5477E2CF0BD9DB7833A3916B1A7E0914A42FCEE1142F737D92B1660610AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501907, "uuid": "fb8136cf-e3b8-4513-a04c-cd59873d79fc", "value": "3072:gB3ijrzug9AcNBFhikfYuEP7qJ2fhov//a64vRmw/j8YW9vK1Z5Owg7YISPUp+Cm:jvKg9ziPucGoaN4cqluiPUrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786501907, "uuid": "2a7aefcf-c075-4d60-86ed-71eb4442d4a4", "value": 346532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786501907, "uuid": "33892967-96cf-40a1-adb6-7b9ad5f1fec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501907, "uuid": "52eb28c8-735c-4720-828e-726da83d3954", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd57ca3-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786520036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520036, "uuid": "7f63b1f5-b9c1-44b7-991e-cfc50fe686b6", "comment": "Malware payload (PureLogsStealer)", "value": "58082a5543e9a04a66a49097c4da851b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520036, "uuid": "302fd76c-7c15-41f1-8cf4-11f048f358dc", "comment": "Malware payload (PureLogsStealer)", "value": "a83a0ea185e95684a202963b7f4acb40e4e148d670ef149aff96853dc46e16c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520036, "uuid": "1fe5c98d-5df7-4659-a2a8-126e0691d8b1", "comment": "Malware payload (PureLogsStealer)", "value": "41ad155598fd9acb0d8c4b72ce9056b48ef9c3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520036, "uuid": "c70b2d14-32ed-411a-93ab-130e527435ab", "comment": "Malware payload (PureLogsStealer)", "value": "07ef1bd16f4b7c63dd33c6478533c59881a02884240ec384a985c069360a11e3ddb8d63b0bae29d18b59da0f38122224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520036, "uuid": "cfde6ca6-fb48-4d99-83a2-4897ca35e59f", "value": "T1CA7523642315DE01C9624BF49D31EBB81BF56E90AA21D3178DFA7DE7B83A7086C052C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520036, "uuid": "cbb95478-ed75-4b49-baea-34faa0a36a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520036, "uuid": "fbc4caf9-a81f-4271-b8dc-0424b65042f1", "value": "49152:ADeIVGK1N58ed04Zk6U5PZ4cuLXbl5HmLyAtlQVU92V:aeIVhyy6Z4LLZxmWYlQVUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520036, "uuid": "70dcab0c-f5e7-4ad7-bf01-d278a4660181", "value": 1674240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520036, "uuid": "c1cbb30a-7172-44fc-b85a-9d9976299344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520036, "uuid": "63e6343a-9d11-45e4-a58a-f1f991800579", "value": "EDO-SJD2616SHO105.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507ca4fd-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786564763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564763, "uuid": "bf004a43-682d-44bb-94e0-7c0b22238507", "comment": "Malware payload (Vidar)", "value": "2c21b927783a1fdb594bbd97bfa73e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564763, "uuid": "f513b50a-b31d-425f-8f96-cc363b566a3e", "comment": "Malware payload (Vidar)", "value": "a8620d1c22e73e102661e1e152d156ad668f33e100cdb5f49bb4f817bbc6079c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564763, "uuid": "f0f16f2b-6739-4e27-b425-8bc2cf55282d", "comment": "Malware payload (Vidar)", "value": "19c08d49951079ac4d6d63f460c0a9ba6097a8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564763, "uuid": "0c1cc940-8f7b-4f64-8ae0-799fb53c9e44", "comment": "Malware payload (Vidar)", "value": "d4d38aaeb14ed17054265bb9ff6d2a25e272dc44d6b235433f5e7898b626123e6016d279e888245dc4aafeb967ee34b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564763, "uuid": "30afa59c-49d8-4aae-a070-e00ace56ec68", "value": "T1D2565A17ECA158E9C1DAA23189B79252BB717C485B3223D72FA0B7782F727C06D78750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564763, "uuid": "5fb353ed-d5d1-43fe-9805-2289b492749a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564763, "uuid": "f7df37ac-6781-4d37-aa10-756480925458", "value": "49152:XLT8rHrz1qJMTaKKMqpKIuoqwtY9B+vsqBgcqAevQZhUHZjhco5ub5xBBeMKcK91:XCEsIhtq+vBtAMhwhcwub53MEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564763, "uuid": "73476ca4-55d4-4bb7-beab-a6d929dc01d6", "value": 5959024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564763, "uuid": "be5513e2-b408-439f-b9f4-d7fef209f406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564763, "uuid": "ba384041-1be2-4d3a-acdd-f9b3c7c0e80a", "value": "a8620d1c22e73e102661e1e152d156ad668f33e100cdb5f49bb4f817bbc6079c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d3e964-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "3ac4e4ce-e47d-4fdb-b4c4-89ad663b3590", "comment": "Malware payload (Vidar)", "value": "0e34168d76e3242205e85f7d4cef6b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "940bcc62-ce62-4cf2-bf80-715153708a4c", "comment": "Malware payload (Vidar)", "value": "a8664ed5c458be8b3a42d74273f16e6311bbf9b2a307896a5074c505cb085090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "0452b537-d9fb-427c-a261-39ad38415e0b", "comment": "Malware payload (Vidar)", "value": "9108d1ecd23e6a96497c221a10387a316aaeb1a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511360, "uuid": "cc3819e1-0bbe-4c6c-8802-cf3db94a0a19", "comment": "Malware payload (Vidar)", "value": "66c45ec10e43fbc2db2f3cc2d3658f16c8feb8e68c3488d4067bdf1627deab7ff989609b7044ba35a0e087068d3ad952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "42150f6a-28b5-4475-afa2-cda32d110a41", "value": "T10CE57B1B7CE149EDC8AAA3394CB612867A71BC494F7623D32E50B6383F726D26C35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "595cf45f-f091-45c6-9003-b08148f922c4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "f7eb7524-46b8-4ea2-aa02-1c602ee39092", "value": "24576:ISrW65SN5H0ihHJNLHUdIaakxW+5NNeBh+Tc7rPQU6cvmkxoEnRezrg5xClv8tx0:ISr95c5UKHJtH8VjXO+wKQw4Ul64Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511360, "uuid": "e41738dc-8c84-4d15-9dc5-e397857cb696", "value": 3046256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511360, "uuid": "276def71-2fd8-4a15-835e-43c7fafa696e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511360, "uuid": "9fc1cf97-c766-4b84-8ad2-10d079bb83f7", "value": "a8664ed5c458be8b3a42d74273f16e6311bbf9b2a307896a5074c505cb085090.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a20b92-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786522817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522817, "uuid": "4a43e954-ae18-41f0-a74c-20cb37cf67e6", "comment": "Malware payload (XWorm)", "value": "35291c454e167e04b69917a25b379dad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522817, "uuid": "c8e92c11-4a2a-4981-8f7b-a19c428e4fd8", "comment": "Malware payload (XWorm)", "value": "a9b9cc2353486e2dffd166145f5ea3de476181a99946e3143bd985d7b27fc731", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522817, "uuid": "f9b02aca-9132-4032-8d42-77831eff0c11", "comment": "Malware payload (XWorm)", "value": "7476f68f016788974df83666ecd3d48779c36e96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522817, "uuid": "a635ecd6-50b3-40ac-97cf-28e57b35dc7c", "comment": "Malware payload (XWorm)", "value": "3101c7d73347b9674d3305ba1f8d3b5a2f7f3d8100823f22b0de085fa4a550e458e07c4aad73eec5abe61c7260c53e3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522817, "uuid": "75515958-4c95-48bd-b8e1-89d94a91cf0a", "value": "T1EFA5E6011785AC32B33A675C9236D9F09A0A611329C6DF1A307DB2587B6CD1BA75CEF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522817, "uuid": "3523fb76-81ef-4239-ad7b-5a8b765dc168", "value": "49152:GiQ/IEeeS41GEU+XfCnluPJeyLrGINLHyaASWkEntX+UJK3GMUG91Xwv2:C/aeS4odQ0luPoyLrGQyaLWkUXTQGMUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522817, "uuid": "387c1bb6-8bfd-4389-85df-e20e88c652b3", "value": 2268198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522817, "uuid": "ab7c1fc7-8d27-48be-9b75-81f62ac92a17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522817, "uuid": "186d2291-926f-47bf-8694-adfe7ba84de2", "value": "Letter of demand 11-Aug-2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bd78d8-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786523349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523349, "uuid": "e63397fe-4168-4b14-8803-1d996646c640", "comment": "Malware payload (Vidar)", "value": "ede81706758ec87fb93848ae702a1f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523349, "uuid": "6e42aea0-1c38-4ff1-a4ab-858aced62ae5", "comment": "Malware payload (Vidar)", "value": "aac28ced09009cba25fbb4580061a69c7c023c823128b67436d67ea5f2fd8c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523349, "uuid": "ccb63a55-c5ca-40b9-bc14-655f84179e68", "comment": "Malware payload (Vidar)", "value": "3f5e6f145e861340e19c12fe97adb8ec39d463b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523349, "uuid": "097d3b44-66e1-49dc-a80a-74beedb55db1", "comment": "Malware payload (Vidar)", "value": "99ba4c8716bbdf7bd1fa701246ebc01cf3dda9cd50d5efbb9fd0f65c68587a3b4c10b7c8678d3538e96cac4d34ce739d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523349, "uuid": "c3c8cac9-cebb-456c-814e-98b4c8783297", "value": "T14D067B0BBDA448E9C09AE735C9B681927735BC0C4B3123D72E64BA782FB67C16E75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523349, "uuid": "f1a1ad5f-cef7-41eb-a5b0-a888b20ecaba", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523349, "uuid": "7f0c7dbf-8dab-42fe-aea0-aec18c66c5d2", "value": "49152:2fXCWpzPtf5zv6CkoaaeU0lav+QRROFN2YBhbBU9fg:26wwNimcop9BUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523349, "uuid": "0a6b8f5b-8867-412c-9a74-4e8797e04fa1", "value": 4008296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523349, "uuid": "727f1a58-ee31-4bc8-82a2-ce9673322744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523349, "uuid": "1069a51b-c7dc-48a0-8487-f1aa1148cac5", "value": "aac28ced09009cba25fbb4580061a69c7c023c823128b67436d67ea5f2fd8c80.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955b2e68-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786520211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520211, "uuid": "f3db4ec1-520b-4c52-9a0e-b250036ceadf", "comment": "Malware payload (SalatStealer)", "value": "baa11e01313ba4da42f8071d7162ab29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520211, "uuid": "445e9006-dd01-4563-93ff-9682c5b421c4", "comment": "Malware payload (SalatStealer)", "value": "ab0cbf4455b5a2a3e392f006bcaf4a4b23aa3628d047c6698ca3b7bdd173f6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520211, "uuid": "3227a1e9-c457-4433-a1de-401b3639dcdf", "comment": "Malware payload (SalatStealer)", "value": "b144a8f4742d9702d41936b78a1163bc7500b1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520211, "uuid": "cf5df8ab-371a-4425-b543-afc2f1e8eed8", "comment": "Malware payload (SalatStealer)", "value": "134dda5fbc8a6f64139ec8d32e988e01d9572a7bb59a0d9b0f9d2ba18c3a3690aec658205aa9f571f288d8cf8bf67b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520211, "uuid": "758996c5-57e7-4b28-99eb-7f345f34bb09", "value": "T163C65B01FA8B65F6E9035831415BB27F23315D048B28DBDBEB583F2AFC776A1183A645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520211, "uuid": "ae2265f9-ac46-4e91-979a-28e35ae2f42b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520211, "uuid": "7662c12f-3472-4d37-96e1-e4cf014ca2e6", "value": "49152:TFZwcF5o6mAGZHNvdFnoDSmmTWH/UEvDAqRWgQlwdU3+ARRXpTLDAfKDZ3WyjouF:pFm6mAe0DSxS/1QVRXp/ZlY4kDEkR/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520211, "uuid": "f1d2fe90-5d95-4838-8677-9d0b48df42a7", "value": 12543488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520211, "uuid": "86be2495-4833-440c-bf68-da728f39591a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520211, "uuid": "3b6d22d2-1ca3-4b69-aa45-7a784174d2ec", "value": "d7318dbc11b8fcd1af10b2a5d2b1c69b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b5cb92-966f-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786554276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554276, "uuid": "a2def5cd-dfb4-4444-b1fd-1db2c9749d75", "comment": "Malware payload (a310Logger)", "value": "8f4f4e7d72041d6cd7e8f99b061843c1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554276, "uuid": "775f3582-90cc-4375-8e71-b2055020e878", "comment": "Malware payload (a310Logger)", "value": "ab35b275e57f84b05a653a92303f751ceb8ca9065a0022bc2a8081b50445dd97", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554276, "uuid": "57ab9282-c85f-427a-bd59-4b1ba297719e", "comment": "Malware payload (a310Logger)", "value": "a5497d8c4dacfb785457f699d1e27193f8fe9dfc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786554276, "uuid": "77c9ace6-b9dd-4ed7-b121-d0d094fa12eb", "comment": "Malware payload (a310Logger)", "value": "922c7ed7ceeaa8d88039971f8d3b092d7528f7ec64ada6ab2b80b39074a2779219920c34156b0d6feb12a4a2e725b0e4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554276, "uuid": "09e0e77c-5f06-45eb-ae88-5815573d53c9", "value": "T1714533BD4CE46115FAEE955F72BE5EB34C02A22B4C1E57A6E5EFE1D2A0C4804B8C5D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554276, "uuid": "c1d52dde-11c4-4f18-a80e-af9a9ba5eae5", "value": "24576:MVAK7aylWPCapt2VnWaaZA3nTxbdFldHou7MVVM9qbcE9dvVwV/9FPucm6k:WAK7FI6Q2VnDaZA3TdldHoAFE9dVwbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786554276, "uuid": "32fcf625-53c4-4f99-bc6c-28a9520421ac", "value": 1176269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786554276, "uuid": "5f2cdad8-90c4-4b73-936c-b50bcfc303b1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786554276, "uuid": "4fa3ea45-535d-4cae-87a1-91410bed093a", "value": "DEKNOT 3.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b88ee18-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535012, "uuid": "f6394aae-30b9-4250-8a63-15a574c5d308", "comment": "Malware payload (Mirai)", "value": "cab341e7db869e768d2051ac9a8c88a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535012, "uuid": "0326b2ef-109e-4625-8f61-4c506ffebd8c", "comment": "Malware payload (Mirai)", "value": "ab69676fb97d55a763cccd20b70bd1701edf3a22aca36ad42ce154e666a13539", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535012, "uuid": "34e382a3-d0bf-4bed-8078-19283c09541d", "comment": "Malware payload (Mirai)", "value": "73a7bcd7cae5141ea2c0eba9b23935397a09ae13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535012, "uuid": "e444e386-3184-4b50-b56d-ec3e41e461ed", "comment": "Malware payload (Mirai)", "value": "3d34c11b9e7b9ee8c2a2779f7bbf4cd9c2ee8a56351dc9c72ffcce200dc9c023ec17d622e0b6b9db4437bc9516edc5dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535012, "uuid": "fdd31d3d-568d-4b0a-a029-c96361e6c367", "value": "T17263F855BC818B15D5E822BFFA2E018D33636768E3EE7112D9111F1477CAA2F0E77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535012, "uuid": "b3e8e2d5-e0a2-4eb4-adee-bfd71035488e", "value": "1536:BNnHfODdn/wk8jebU6RTpt5lBjvPKF8vTL4dJV+ctylpn+iVfqM:bODdIkGebjhbpKF8vH4dJdyVfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535012, "uuid": "21f22ca5-83ed-488b-8e5d-cf25401ba04b", "value": 71172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535012, "uuid": "20ef4115-eece-493d-9613-7634090f98d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535012, "uuid": "7c634dff-369b-4a55-9548-b55d240587a6", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e5ef5c-95ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786499249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499249, "uuid": "1c55ba6c-6fd9-4f05-af41-5caad897de50", "comment": "Malware payload (Mirai)", "value": "fc748742a3b44e254afc12aba5093157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499249, "uuid": "1d13f1e5-1e75-433a-8d44-59bc4f601fb8", "comment": "Malware payload (Mirai)", "value": "ab849c8883fdfa4fab650d3f1ae76db47d4facbaca1a5a97d1e6d6d0512961d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499249, "uuid": "24ac3e86-4214-4ed6-a05d-62b77fe57d1b", "comment": "Malware payload (Mirai)", "value": "91186d4b883c67d987da953c7fb08667e25429eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786499249, "uuid": "7a22e278-c08a-4ba7-a4dc-0d587f90ab2e", "comment": "Malware payload (Mirai)", "value": "515e73565a3dfbd17a6534b29ddfd73183c2eaf28fc88c654375753ac10af978dfd9fb556a1fd12d61bc0c10f5d2ab88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499249, "uuid": "f158cde2-f511-414a-b70b-5e0b3814bdbc", "value": "T1E613F1A7C058CF54D22E503B354FA2DADE85D80D6178CC1FAFE4B1608EA6FB5E118386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499249, "uuid": "5ad68ec7-e97b-455e-a76d-d0000e6bd7b7", "value": "768:EUSDMhUqrcByFX9GnWehr/yaKiYm4Tvdkvf7MCzDgH+JFKAe6QAf3tEiEnbcuyD0:fyBy9AnWSr/ysB4TvdSjMAo+JFKB6Htc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786499249, "uuid": "9ac84701-e005-4be7-aaea-b58443a07f83", "value": 43464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786499249, "uuid": "cc8ea430-77e1-454e-bcbc-4e383e42223d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786499249, "uuid": "e46ca919-421b-4bbc-8a89-2fea691e9245", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018877d8-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574938, "uuid": "7e8bae3f-0d6b-4b53-8e8b-e8fc848b2bcc", "comment": "Malware payload (Mirai)", "value": "94616e9e1bcfe15409d598b2f03cec63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574938, "uuid": "76c622a2-d2d4-40dd-8084-cc4e74f3e163", "comment": "Malware payload (Mirai)", "value": "abda6887930f4e2e1047b39adf23bbf8bdee9e15c7e2101245bb690be7d80488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574938, "uuid": "0c30fcf5-83fd-48a5-aeee-4de1f841ad7b", "comment": "Malware payload (Mirai)", "value": "8079652d1192a3029c4333dcfb907cf647f00b13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574938, "uuid": "2cf8d2cd-c42d-4637-84a0-d6f573392a6e", "comment": "Malware payload (Mirai)", "value": "3c2aea2222b4e210e2abf764d71e68d68faba6376024b1e02cda583def64e44cfead94ea5e87bb72834ead8a2332d981", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574938, "uuid": "b5ed0351-c480-48a0-8815-f682210d25c4", "value": "T1DD333A2179392A17C4D0B87A61F74768B2F5474F25A8CB1E7E730E4EFF20690A117AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574938, "uuid": "b439473d-82a6-474c-aca3-db9002d691e4", "value": "1536:K17qMS5ZuIYB8lB7u25aqUvqAy3Qh0tYy:533wsRW0yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574938, "uuid": "a868f2f3-f09f-4475-831e-335b0540560b", "value": 54596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574938, "uuid": "5b6bf14a-e432-40a0-896b-13175088defb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574938, "uuid": "f2c37a30-7c2a-433e-a485-77ca66259b60", "value": "126678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b74f9d-9689-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786565116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565116, "uuid": "9d146ac7-661a-444a-9471-a19ac318c282", "comment": "Malware payload (Mirai)", "value": "896d6a1b70f8e321657274858717dd5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565116, "uuid": "7c1d7c45-98af-4907-aa11-eb51b5b4d92b", "comment": "Malware payload (Mirai)", "value": "ac5b3f3e20bf74fb25ed3caa8856deb61f8e44d691b955402421621a50801c7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565116, "uuid": "f9686b65-07b4-4cd5-8a9c-6141ca500729", "comment": "Malware payload (Mirai)", "value": "b1c099645c67945ef65595aad96c963f983aabbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565116, "uuid": "fd519d52-6e3b-41d7-a08b-c58be2124d51", "comment": "Malware payload (Mirai)", "value": "d5062c93f3e6f76847b0d580a7395749be74b405665ce1804db78fe152182786092e6c47855f5fd3fab25c7e232668e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565116, "uuid": "9478af62-9bd6-468a-b367-73164f2c608d", "value": "T1D2D34A63CC796E58D624D5B1B0358BB86B93A524918B1FFE14B7C2748043ECEF6493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565116, "uuid": "b2801860-2f0a-4cf8-b246-238ad81cdde5", "value": "3072:KkyQgSgr55IBZ8FrQTdHp1lx2Wj2VTK88JHYjYY:U5Xr5uB2FrkXjj2888KjYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786565116, "uuid": "61db52b6-cfea-43a8-bdda-b0391f4b8567", "value": 132632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786565116, "uuid": "8ff81ce8-be96-4715-be8f-9e7198e9ddc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565116, "uuid": "59785389-116c-43e5-ad07-4f5fb59ac27f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54501f1-9618-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786516882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516882, "uuid": "3237c439-784a-48b5-b294-5f4fcfbfe2c7", "comment": "Malware payload (Vidar)", "value": "a9e16613460691f6f90df472a375f824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516882, "uuid": "32f52a13-c2a5-42f1-a629-3c39a2d63f3f", "comment": "Malware payload (Vidar)", "value": "acb5edae54f3bdb81ea6dba7940e436b6af0cb441d25c7b9710646da779be436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516882, "uuid": "a824acaf-0b66-44fb-b15c-15a2381520a3", "comment": "Malware payload (Vidar)", "value": "f315be75ffb29ae21c01ae9eaff3c746d44a9a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516882, "uuid": "41f013aa-76af-4518-8a41-4e4a76cb0480", "comment": "Malware payload (Vidar)", "value": "91ae0f4e7059ae6def2294d0e8ccfaeec444ab81e209626fe8e1949b57f831adb4341e29be6c5b87b993f4798ae0bd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516882, "uuid": "8eaa67f8-0612-4b60-b149-cb1ab4af0682", "value": "T157266B47BD9148FAC0E5A33188B76256BB71BC4C1B3123D32E60AAB82F767D15E72714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516882, "uuid": "c76faa2c-22e0-4e14-b0f9-694bcab322ad", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516882, "uuid": "ef3a1bf9-b77a-425f-ac73-10a001c0e185", "value": "49152:Ew1ALhGCX6V9sZbO0x7QXZPnBin4xbJgNCCF1ImxwdsV3qGc8b:E3lZbYXdkAgNCgbxOa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516882, "uuid": "6c85313c-8246-4a53-ad0d-d5f68fe80a81", "value": 4522360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516882, "uuid": "c80cc224-eb07-451b-a7ae-ac364eec988c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516882, "uuid": "eb33a1e9-dab4-4a9f-b8aa-07612b0340e7", "value": "acb5edae54f3bdb81ea6dba7940e436b6af0cb441d25c7b9710646da779be436.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856fa34d-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502145, "uuid": "686f2547-7e34-45bb-9075-ae97d22259a6", "comment": "Malware payload (Vidar)", "value": "c993304c951a6ff894cd5204300cba94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502145, "uuid": "70d62840-2d44-42e5-b7fd-e5f16543b33a", "comment": "Malware payload (Vidar)", "value": "ad36e9e4f0bcf8860fe600947bf9eac7baa1b05829f735e1145dbf9e8d1776de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502145, "uuid": "e908b074-c72b-4148-ae15-6c83defa91a0", "comment": "Malware payload (Vidar)", "value": "efd6a39b46f7dd015d1504921f8606da0bb9a885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502145, "uuid": "2d922788-b4ff-4ff7-84f3-036c088cee28", "comment": "Malware payload (Vidar)", "value": "594d424b8d342f09810163235e17fa95932bf28e8714ad077a2b12391cbb8936ffb78e6f10517ba4e6743d4a76e08d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502145, "uuid": "ad104488-cc91-4270-87fb-626814a981d2", "value": "T15CF58C07BCD548E6C0AE923688B3459A7B75BC090B3227D32E60B7782F727D05D75BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502145, "uuid": "85a13934-fecc-43f1-b569-0479fede44a5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502145, "uuid": "9593ec50-a7f4-4210-ab26-1c2daca5e612", "value": "49152:TbvJ+9b+gN7AIgAHw3ibkUPWAmAWchSVsQT0VdcRqTB9mYE/l:T0/b5/ktoeRMqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502145, "uuid": "ee20a868-1bc2-49e0-8ad0-ae6d5f827c32", "value": 3477888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502145, "uuid": "7dd8accd-a304-4cab-a249-bd3b92da2c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502145, "uuid": "f2d6d7af-7c8f-4d44-80a1-e06e8b7cb1b7", "value": "ad36e9e4f0bcf8860fe600947bf9eac7baa1b05829f735e1145dbf9e8d1776de.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016eb3de-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511373, "uuid": "52b2329a-5ae1-4a97-96ed-bbc9fb0e6430", "comment": "Malware payload (Mirai)", "value": "a03dcd87c14ae69bb10db810229bb2dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511373, "uuid": "1ba8befc-748c-499b-ba5b-c8394f85c56a", "comment": "Malware payload (Mirai)", "value": "ade6226797c3550d9b297bb82e28fe2b857978dfd7bbeefa8c2b4acbdcd9f966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511373, "uuid": "1c9c29b8-4297-48f4-b62d-8eac5243da14", "comment": "Malware payload (Mirai)", "value": "9d4442adcf34070be7b80e1f18ee7d0f7aada1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511373, "uuid": "8d4a7bd8-87dc-4be3-bbec-2465251d561a", "comment": "Malware payload (Mirai)", "value": "0c20c37708afaa3299854bcb131d4e12edb0746e7ee2fcbcc57bfde9c7972f8f1cd42ea634e22d7d98c178b3224ebf5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511373, "uuid": "f92c06f5-bb1d-4819-9173-bc753fc66c32", "value": "T1B1D3D64A6B240EA3E84ACD7F0075C73465CC663B11E87B3B6E70D85BFA0A26B4DD7854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511373, "uuid": "a7c8727c-2b2e-4457-9ed0-efabcd805dd6", "value": "3072:dWTcILRhgIAVSkYX1vGr9Sn1IGJvyevefePes+:dAcILR3T9GrwnuEvy8McR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511373, "uuid": "4b64eb98-c5ec-4587-a74e-7bf8706b9a96", "value": 134780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511373, "uuid": "76431af0-52f0-4288-a51f-6e6adcd6f0a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511373, "uuid": "6b3c1143-55b7-4b74-89c3-cc57e7c58ecd", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69b3b0c-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522844, "uuid": "0d7cee6a-d070-4032-880d-2a1c62861747", "comment": "Malware payload (AgentTesla)", "value": "070a4fc68168d6706f3f18a8aeb2e7bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522844, "uuid": "32f6346f-c892-476f-ac4e-9b935d4c4917", "comment": "Malware payload (AgentTesla)", "value": "ae674065b6777e8c091397a4e53bfe796fdb4c9536502ed6223ec912a70e0bb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522844, "uuid": "a98c8ffd-ea28-45aa-ac7b-1cfe8efa0d24", "comment": "Malware payload (AgentTesla)", "value": "fb7ca5d62c99a15f3b366c0e9d4e07285d0e6919", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522844, "uuid": "be5c9c0e-2a74-4cd9-891e-dedf3f4e4805", "comment": "Malware payload (AgentTesla)", "value": "69b93a837753510e259fffeba47f18c3b3ab592d27ec109c7ce67dfc54afa1d95d540f9545c6978abfe8e66dc64b4e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522844, "uuid": "74e4ea7a-48be-4816-9f8f-eb20a51d70c5", "value": "T197E5C5181304AD78FA7D5B1CD23ADB12071910E7AA9AEB5DB97DA1B43761B0333CC5E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522844, "uuid": "e9174a8d-49bf-481b-9e96-08005ff5ce04", "value": "98304:IM9stiARJQsVocFK1A77XophcX5RigSDkCy0xB1SMPqltO/grgU:/r1A7bocX5RdZmJqlo/PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522844, "uuid": "c7eb0566-4d52-4a6e-b506-777f526d9281", "value": 3315662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522844, "uuid": "254029e2-e572-42e8-b2f9-ddd9da13fa46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522844, "uuid": "d19515ba-8415-414c-82d0-71994eaa6341", "value": "Terms and Conditions.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a935ea3c-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522821, "uuid": "78457285-427c-4411-8f52-a5d622c649d6", "comment": "Malware payload (AgentTesla)", "value": "d12560989753e285a8729eac54f48f86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522821, "uuid": "142f77c4-3b4a-4a56-a99a-3de71a90d6fc", "comment": "Malware payload (AgentTesla)", "value": "ae681a8ca6270248c8e1555e0cf07400de4d342fa6f3e66eec443f81b44df0ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522821, "uuid": "72a01f48-a310-406c-aa61-2284b97b5322", "comment": "Malware payload (AgentTesla)", "value": "9ab2fdf2e1fbb13ab60c7b4dd22becc81b055de2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522821, "uuid": "5df79f26-6311-4065-8e43-1fd97a2fb20f", "comment": "Malware payload (AgentTesla)", "value": "fca2a759aeb0b70d1a296b9da408be1b2e9969722cad2db2839ae6d99abac088c312bdfe0302e2a055b2c6e51705f2e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522821, "uuid": "5cfaf9ed-0000-4857-b3a4-a5d8c4a50857", "value": "T11F076B5CDE2E00F4B9D7AE063D7CEA2CD11B62C60172244FB72A8DD35932D72A9958F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522821, "uuid": "a3908031-b94f-4d5f-bea8-b49917b7c971", "value": "1536:u9ip94TEN2HAHTgATfVA14AiLpnR0lFutaAgia+ACunHNiMDNsafyiIklAQgl2Wh:AXxP6r0DymozdQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522821, "uuid": "00735a66-79c7-4b16-997b-c4bdb45269e9", "value": 17902756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522821, "uuid": "0b0fa3c6-b342-423a-aa93-12b72ebbc568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522821, "uuid": "d40d452f-7e64-49ef-ad90-f4ecabe062e0", "value": "transferencia-98758.00002.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4180bd7c-9699-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786572039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572039, "uuid": "8c0de71d-08a2-4b23-b4a5-44c6ab5689ad", "comment": "Malware payload", "value": "380bd9d291ceddb3592d5afaf72f425b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572039, "uuid": "138e9ba7-e92c-4d01-83fa-f6db9cdaab75", "comment": "Malware payload", "value": "af60ac5b44bd1e03ee564d33c1da963db85b4f73b05f6820a8f2a57c4e73efd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572039, "uuid": "e8382076-db4a-4a5c-8c30-0a27a542fa55", "comment": "Malware payload", "value": "9fee2ddadc31cd71ca887f0caf1a15e9eabb45d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786572039, "uuid": "5ef24f2d-0a24-4b0b-bbc8-1d78a9bf5334", "comment": "Malware payload", "value": "95cd18dd6705cc00466459e08a4b8634e7930da3ed0a55ba6690d7d23fbb371cdfde3fdef4330e4af322755b5aa949d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572039, "uuid": "36cfa8a5-4bd9-4b3d-a4b5-823663a915d2", "value": "T14D568B13EC9109E5C19AE23189A79252BB74BC495B3223D32FA0B7783F727C0AE75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572039, "uuid": "f36880e9-740c-486d-b56e-19762518da42", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572039, "uuid": "00405567-7afa-4999-a67d-ec82fecfdeaa", "value": "49152:X5IFiliFwzHYi7GD5X3yiJ78BWm5UTGEa9xyAdWvLTLC2JQEUBe8KcK9KlESxEaW:XGEsXiiN8sbjaOcWvLTLCUyJEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786572039, "uuid": "d83c5c96-0b63-42c2-885e-caaf35f72c50", "value": 6411632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786572039, "uuid": "858171fb-683e-4b5e-a986-acdf7218de33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786572039, "uuid": "8210dfe3-e142-49a3-bfbc-4a8bdb33ec7a", "value": "af60ac5b44bd1e03ee564d33c1da963db85b4f73b05f6820a8f2a57c4e73efd4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41081bc7-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493011, "uuid": "5cc70473-fbc4-44e9-908d-a25abedb7169", "comment": "Malware payload (Vidar)", "value": "c49f2f109e1fed3cccb31a11f9526eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493011, "uuid": "c5236eed-928f-4240-bef1-a907a2c32ac0", "comment": "Malware payload (Vidar)", "value": "af6c49b1a8102e677b316bcd1b1f86ad5597fe0383a78b683c1c815eb930b871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493011, "uuid": "a83ed8a6-74d3-48c6-9e86-2ebee11d50cb", "comment": "Malware payload (Vidar)", "value": "d028383281fc05d966bb057d877e30277428c6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493011, "uuid": "a8c82b77-050a-40d2-8899-6e9fbba3bab2", "comment": "Malware payload (Vidar)", "value": "f621623328bca5b92d91394f166304d4daddc1c7d0a3869c721a85da713807cb6f8697489c4e19a6f33bb39bbed57041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493011, "uuid": "ca844df5-dbff-4e29-b0a6-4647e1883023", "value": "T1D9666B07BFA158B8C095EB34447A4241BAB4BC8C9734B3B32D92AD796F193D2197DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493011, "uuid": "ec6cdd0d-7820-44e9-be24-e6bd89157e53", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493011, "uuid": "7c7db33b-b676-4d21-ae63-3fb31f723652", "value": "49152:WrCdJz6jY8fSvhVT+1iLSVEXeChAXy09efOJQrKFu5aLTncn8ZTcmmZV0Usil1Z6:Wu9e1iAE73E0Kg9vsKRlgLvY9pPwLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493011, "uuid": "ee3bca2e-4d2d-49ba-8b0c-5d7755980111", "value": 6719648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493011, "uuid": "c1f9b124-6128-4bb9-9637-e0b3ff835fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493011, "uuid": "7cccdce2-ca96-4c08-89ad-29c235dc3655", "value": "af6c49b1a8102e677b316bcd1b1f86ad5597fe0383a78b683c1c815eb930b871.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddc0d59-969d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786573859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573859, "uuid": "b0165d01-b527-4f8c-bf16-470db94bd173", "comment": "Malware payload (Vidar)", "value": "7dc7769dd69352fcc6f47d640cf78c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573859, "uuid": "c1b27da0-c3cd-4da5-9cdb-a81e0a1e5993", "comment": "Malware payload (Vidar)", "value": "afc9662bbe72c2171342431d5f13ea9ce5cd3b61006524061061399628b5970d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573859, "uuid": "7215a258-3c40-485d-8e70-b856b449933f", "comment": "Malware payload (Vidar)", "value": "d7daf7212610cff6e413e018c12355cc109dc5c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573859, "uuid": "431811c5-2402-453b-b99e-16956b466e1a", "comment": "Malware payload (Vidar)", "value": "149134317d9420390ee3242f8d203bc2d194aea09cb00a760dfc9d01d16f4521f2bd9fa10c594b7a379f403193064a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573859, "uuid": "53cc3e2b-2d30-4cc5-a8b4-f1b0b76ce0b4", "value": "T1C1267B07BEA108F9C1AAE33589AB4212BB74BC4D4B3233D32E50AA782F727D15D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573859, "uuid": "40c47a6f-1efb-4511-8b60-407c82e57c39", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573859, "uuid": "56d60419-4167-40ae-83ff-25b14d3342b1", "value": "49152:yoHVmHat/2n9oeLgDkF+9tRoH0NM18wlX2NhAbcsqZTUaP6jc:yGf489+18wlX2/ocsqZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573859, "uuid": "95238a90-fae2-4099-a383-b39c72685c27", "value": 4612608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573859, "uuid": "1aaa56bf-7660-4971-a7d0-a0fd5ef82b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573859, "uuid": "3caf9ed1-02e2-461b-80a4-caf23caa4acb", "value": "afc9662bbe72c2171342431d5f13ea9ce5cd3b61006524061061399628b5970d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa50e1e6-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786522823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522823, "uuid": "6e264f8e-5ba2-44ae-a7fb-cee3ca672c28", "comment": "Malware payload", "value": "6de8223dca02644a3b7207a0dfefb223", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522823, "uuid": "59bb4e08-f3ab-4221-992b-3ea120970b86", "comment": "Malware payload", "value": "b1ceacae210829b7ea75349deaec10a7fb0a9a75cbe223dc01ccea1593865b2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522823, "uuid": "eb6f5bdf-d54d-452d-b927-519b52483a91", "comment": "Malware payload", "value": "2997bcf7dd98ef4c3ffba11457c4dbac7b7a6527", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522823, "uuid": "90061e80-f647-416e-ba78-be9fbb9ed8b4", "comment": "Malware payload", "value": "d2ba887afda8a9ceb2b02506a013c141900ac19d658e9f706758131cfcef8d1824e053c36bdc89385e21f6f534a5767b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522823, "uuid": "37273a0c-90e1-46d2-b356-df6f7814f02d", "value": "T1E3F1325A72470CB611E718FE057793DA3A787A036605D8746C8C1CA33BEEC31437AE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522823, "uuid": "fa340343-da28-4041-b3e2-2c4dcd40d7a6", "value": "192:pxGI8vm5eYQVN6Rw2aWAiY9Nk/wt6yNCBNB4fRrpGw8zjzdjyaMnnnPEHWUkd/:Qm5eYQVN6Rw2aWAiY9Nk/wt6yNCBNB4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522823, "uuid": "793c3532-c3dd-4fe3-be09-007624ea8ac4", "value": 7477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522823, "uuid": "b22ea89d-1aa8-4176-a292-e1c5179b66af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522823, "uuid": "86640cc6-762c-4296-9876-096dc7b4b3b8", "value": "app.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03308e1d-9695-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786570217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570217, "uuid": "c6797f41-73bc-47df-b7f4-7b30f4e3146f", "comment": "Malware payload (Vidar)", "value": "b1e6fe5bfba717dd0423048c79f83cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570217, "uuid": "3b2a315b-6c89-41a9-9632-aad600404df9", "comment": "Malware payload (Vidar)", "value": "b218bc6125777b170bbefe4f0e761c94232d8ca6ae4ce9cb7b40124a72ba2cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570217, "uuid": "5955cb14-ceb5-4b62-8ade-44b5ad3738fc", "comment": "Malware payload (Vidar)", "value": "73ce4ca45d072aaf298d1668c407dee63249d06a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786570217, "uuid": "5b341256-f48e-4382-a922-560c1e3e05e9", "comment": "Malware payload (Vidar)", "value": "03cd2866bb8c069f2fac8351f6568192d0501454355c66637eb92a15b472a5d642aae04f66e335d4626098dca8159a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570217, "uuid": "efa0f665-d068-4f2a-ab43-b17e3d06bb31", "value": "T15C567C13EC9219E9C1DAA63189678253BB71BC884B3223D72FA0B7782F727D06D75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570217, "uuid": "e30e0159-e2b3-4a2d-9909-ac43ed082a4f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570217, "uuid": "542e35b7-fbde-4b01-ae9a-22a150dc4701", "value": "49152:88vBAeiWm9NggDOjt1s9LqEPc2Unj98Q2smsj/GOrVEiWi3kBeVKcK9Ke4UEa5Er:8SAPuU9+Ek2Ej9usV/GQVudlEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786570217, "uuid": "39968b7c-0da6-4035-8c27-85620c3b81ba", "value": 6262640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786570217, "uuid": "e460c0a9-98cb-45c1-8428-2fb470e49d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786570217, "uuid": "cb457298-a4a8-41d1-bffc-4cc0f17124ed", "value": "b218bc6125777b170bbefe4f0e761c94232d8ca6ae4ce9cb7b40124a72ba2cb4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04ad362-9697-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786571447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571447, "uuid": "2ecd7d6d-8d76-4aab-966e-af17aabc73a1", "comment": "Malware payload", "value": "6cf5eb2f3d384f27394889efee17ddd8", "object_relation": "md5", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571447, "uuid": "a7aeb5c7-b106-442d-885e-73467d321426", "comment": "Malware payload", "value": "b38fda4a414a530a9ffeb9ecf6b1ef05453cd1d62033efc8f89b1d307af3552b", "object_relation": "sha256", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571447, "uuid": "1b10a8b7-8b77-4878-8e03-4c3a2dd551f3", "comment": "Malware payload", "value": "3af37cece00250ebb06456a5b6050bb0cf386adf", "object_relation": "sha1", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571447, "uuid": "486f40cc-cb37-477a-aeb0-3b036b06ec73", "comment": "Malware payload", "value": "66ee22bd616e28e7081ad18e84e59f7bf2570f2d496632cbd97435963032bd85ec02292e719a1e567e0cc4137056e726", "object_relation": "sha3-384", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571447, "uuid": "769c34be-b95c-4f17-b426-2bf7df4637d7", "value": "T1176321041FD11229D7F2CB3A6CF6B62196B3F440E6B18F6E319E50680F93A01A965F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571447, "uuid": "ca09e806-e7a5-44aa-a461-723ed27f9e60", "value": "48:5OMvBGCecjqpuf4c0yNK5UTbWJePjWgI3aQ:5gCecu8fDY5/JiWg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786571447, "uuid": "3e626c1e-b8b9-4b32-bbdb-07021bc83316", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786571447, "uuid": "c54b407a-dc02-4c27-963b-089a9132ef86", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571447, "uuid": "9ab1c991-f7c5-4138-a9ff-5cfc00a6af9f", "value": "Schet_Akt_1842_v2.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4461121-968d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786567158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567158, "uuid": "eeec6929-a46b-4fbb-8874-c6f0a54cf431", "comment": "Malware payload (Mirai)", "value": "2d199d140244c616d5059887c10dc8d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567158, "uuid": "d0b949f7-f8db-4bf1-8e19-382a5e90449e", "comment": "Malware payload (Mirai)", "value": "b3a39b3cc853d62505eaf57f5d9480f8396dc7a3888846a09fb277e797551182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567158, "uuid": "0a5a0323-f8ca-413f-8668-e16107ec2016", "comment": "Malware payload (Mirai)", "value": "cf8e711e5ad0e5d1a93ea7eb106a644b3e9a7788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786567158, "uuid": "dde5cd80-a5a5-4416-b53d-02eb04ede0ba", "comment": "Malware payload (Mirai)", "value": "60ccb6e8c242c00a85e3e1fd7dd99f70dfbed0df01ead4f241cb0e6a768d6af45faa7b3118e8c7855db98d30a0c8ba65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567158, "uuid": "ae06a3c3-06ec-47b3-8986-4dab0ee9a5d8", "value": "T1D3A35CC9F783E0F0ED4609B1116BB77E8634DE226124DE5ADB94FD769C32602A21E71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567158, "uuid": "b3d17bd2-79c8-4a11-ac0b-1b13e3975432", "value": "1536:Ywt5W/aaSFg7LyghBP/atLvh3mUs31sgmo9mIv7N9doyqzFtNV/Er:Y8T6LZhZ/atLO+c97Jq1V/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786567158, "uuid": "2187308f-80f9-4c4e-9129-7d8f08fc4fd4", "value": 99068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786567158, "uuid": "97efaa4a-42e0-4bc1-a63d-ab7488d4af6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786567158, "uuid": "7d2e6ba8-e0fe-4062-b2b7-bdb77f6b1ca4", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e0478e-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512595, "uuid": "b4b2b580-165a-4932-a5df-15efeb7a0c6e", "comment": "Malware payload (Mirai)", "value": "9ab79fa3448eacc54c98c4abc7405a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512595, "uuid": "6919c901-9ec7-42f7-a747-16b7f59e2049", "comment": "Malware payload (Mirai)", "value": "b400315019799eb287b72b494841ad497a55a1a2c9fc4848d9093d23bfab7a31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512595, "uuid": "318a7923-18fa-47dd-ace7-ae540c1d91c5", "comment": "Malware payload (Mirai)", "value": "e41d9c90dde01e5bf8b3dd5c5fad7c5631a0b1d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512595, "uuid": "6465553f-77f1-4e49-b866-de6ed3131883", "comment": "Malware payload (Mirai)", "value": "384423f5a695b19ceeeff40d650c3fb585e12f4dfc36f32d45f347a47655a0a692d4143ae5c2b0059a666f2c6a80f4ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512595, "uuid": "ea397989-7816-4899-b0d0-3bc8a834cf82", "value": "T1EE631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512595, "uuid": "1eea36c4-4133-4da5-b40d-fc36fd104e58", "value": "1536:XGBQnw68oqNi5Igzb/GIw+D3ohyaRdWViEs/hX:XGBBa5L31w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512595, "uuid": "d5e3e424-6121-407a-ae3f-75207f22a093", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512595, "uuid": "8b193c06-bebb-4598-a412-e3a52c2f6420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512595, "uuid": "adc5ee1a-25e4-4489-a540-1f55a16a4118", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44760283-9601-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786506761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786506761, "uuid": "d65695a2-17dd-404f-b6cc-7c07fd8b9540", "comment": "Malware payload (Efimer)", "value": "a80b168e8c58817e8a6bc21d0beab517", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786506761, "uuid": "936fb6a6-ab94-4735-8fb2-f22a0873d3f5", "comment": "Malware payload (Efimer)", "value": "b47388d22151e585b1df5daaa085c7bce422fb4741090c54138eb74e847e80a6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786506761, "uuid": "79105afe-b3d3-4401-b27b-7baf85ab5905", "comment": "Malware payload (Efimer)", "value": "c1fb2aba9826930dfc6614c289add82675bde5e6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786506761, "uuid": "ed35e368-1824-41a1-afb4-77afd7a31dc6", "comment": "Malware payload (Efimer)", "value": "67fd7e033998df6a18be246bc8ee5f1346f350d6ad26f30d869562253c76f92b8531ad40e08ce48b92a92c8ca161221b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786506761, "uuid": "bec0a17b-2b64-4946-9ef6-cb440475ec8c", "value": "T11DD633861DC2731EDAF39A39F9F019A4E03DB1718B7345EF23658B121CA71E46C7942A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786506761, "uuid": "20b799d1-0dd6-45e7-9924-1c5036b55daf", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786506761, "uuid": "e42550a6-68ce-4e71-9f29-f97d647858c0", "value": "393216:/U9iiLSd1jqTYDvBUL+B2k86fYXMCHWUjtcuI3/PGTAI:/3i61jtDvqL+BXlfYXMb8aH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786506761, "uuid": "5c0e141f-1518-466b-ba2b-0220e12d833c", "value": 13842511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786506761, "uuid": "30bd54ad-4a57-4426-b56f-8c676108791e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786506761, "uuid": "c085834d-cca3-46a9-9c66-4fdeaeb0451d", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d5a48b-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1786520178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520178, "uuid": "5a91975e-6b45-434f-9b10-ed8deea5aaa7", "comment": "Malware payload (GCleaner)", "value": "70a1588593816c6b10d1de3ed58d43cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520178, "uuid": "04e6ebfb-19c9-4550-98ce-bc4589859082", "comment": "Malware payload (GCleaner)", "value": "b4a7ddf60dea8767a93ea802ee13d39de4b2ac0ce9e1c4895d21235dd07130d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520178, "uuid": "d4125dd0-927f-4b05-b250-467dff9a1548", "comment": "Malware payload (GCleaner)", "value": "aa8337e0f927d381f9d0a1b108c5a7e0cc9e5a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520178, "uuid": "bd67734f-409f-4ead-8269-b6f1da792223", "comment": "Malware payload (GCleaner)", "value": "c18a7229392c6177b943d077de846079c6ca8a775d35d4e57abf33a7fa0bc26badf8f742ec87992d27ecfadc40798bac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520178, "uuid": "95f523f6-e3ea-4795-8d75-e90872a28b49", "value": "T1AB5515243AFE502AF1B3EF759BE47496DA6FB7733B07645E1090038A4A13A41DEC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520178, "uuid": "d6920747-8107-4deb-804c-d23fe6dfd96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520178, "uuid": "89df84ce-f69b-42a0-81e4-356961675a4f", "value": "24576:lSiSdl5VWDWg26xdFo9L0hlxcdNYw1sl1G:lZSJVWDsMy9QhwdN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520178, "uuid": "1654d06a-cf2d-4f4a-8c31-058bfabce1c0", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520178, "uuid": "31f84d5e-9016-40a8-a350-7252fc5afaa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520178, "uuid": "f93df3db-8152-49ea-9a15-863513cf7a89", "value": "70a1588593816c6b10d1de3ed58d43cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f054523-9686-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786563794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563794, "uuid": "52b53b0b-d2ae-456b-940a-908e65c1b0c4", "comment": "Malware payload (Mirai)", "value": "956c3f1254f00a5c37cb04138370f11f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563794, "uuid": "bc2e27e2-9835-4d07-8026-733932ba7d7e", "comment": "Malware payload (Mirai)", "value": "b4b2583a0831b9c39d59e5294ff6d450062c62e6350f878ad3fe8f956945e8c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563794, "uuid": "1d0adee8-2755-41ad-b0a4-0ee84021a0f7", "comment": "Malware payload (Mirai)", "value": "c403dd43ee1514bc312947ae0c72a9debc9f0f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786563794, "uuid": "c34cdd48-a2a6-4a28-b014-fb6f7ff53ea1", "comment": "Malware payload (Mirai)", "value": "7c68380dd02fe50095883a39a35352125b7b0849d4016498bf9e83e8970e7def1ebe59e8418e68b4a69ad09abb63b9b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563794, "uuid": "11242bbf-26c0-4f20-9bd8-437fc4375486", "value": "T1896302783EA53B4DD5A16971F0531262EB350A98B3431887786CBA438F053FD59CBBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563794, "uuid": "f37adcaa-1335-4f14-a502-641198ef82a2", "value": "1536:r2EMXV4spfMA4NSX2q4nXp5nBtaVdlHFbSALTxCPvJpPlpwV1c9z:r2lvMFNq14nXp5BtavNlPLTxehdl+V1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786563794, "uuid": "324059d3-5e35-4435-9b03-c4fc2529693e", "value": 72624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786563794, "uuid": "ae608a4c-e53e-4faf-8e21-32ff35bf3b48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786563794, "uuid": "58af8cb0-a51c-4535-99ac-fa34b4c3ea19", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f7c578-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786509075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509075, "uuid": "880bc915-8f15-4411-a891-d3a29b590a96", "comment": "Malware payload", "value": "e44b38b2d2e4eae21b39874d13190667", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509075, "uuid": "1c60164c-6938-4327-a05d-a48e78774af0", "comment": "Malware payload", "value": "b52c8506301726fa42fe831df459869e807e5178e5e3522ac060825a2398631b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509075, "uuid": "3f14f35a-f42e-4643-bf70-84bc5e8a198d", "comment": "Malware payload", "value": "3a3327f1a2f896ca7620feb3f9291e9f035efe04", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509075, "uuid": "59718472-2379-4790-aebe-3a02301894dd", "comment": "Malware payload", "value": "e0a5f30deffe17f280d4a8aed0ad00fe94aabdcd4a159a80c892afed25917a71854f6401c0340b5d0a038e943fdfe782", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509075, "uuid": "22f7577e-e096-43af-9c28-76594195b849", "value": "T1A68733F54BEB6408DE0ABFFB03C5A61090EFB6704709605D466B670B316B1EE4B1DCA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509075, "uuid": "88a64567-266e-4278-88f8-17a8d5c5122e", "value": "786432:7QpXSbqgy7wgRS3KGW2qTSP5+2EGvUMqNJiqgeyah0QN2PLr88QEQSx/Ayo:78ipyMgCKxtTV23cMqv9gXaqQNyLrQCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509075, "uuid": "43301cd1-6f45-4220-a451-de90388e31b6", "value": 37469200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509075, "uuid": "804c6127-efc1-45f0-96b9-242782d642cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509075, "uuid": "e4d0e42d-2658-4111-b72a-0afec890f133", "value": "Windows.UI.Input.Inking.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d636c4-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500322, "uuid": "773f3658-f00e-4078-ab4b-15739ad3867c", "comment": "Malware payload (Vidar)", "value": "2ee8cd2b3d1f6d691835f3f113acb60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500322, "uuid": "9bcd9541-4a2e-4dcd-8b04-98e48e8b16b3", "comment": "Malware payload (Vidar)", "value": "b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500322, "uuid": "83849579-8e09-46f9-868d-fb38a7fdc3a9", "comment": "Malware payload (Vidar)", "value": "931f8e9d325c41876cf700f68cddadeb517ef102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500322, "uuid": "e6655173-2b90-4ecc-aa72-ed545baf7c95", "comment": "Malware payload (Vidar)", "value": "010a9fef821616446d106fdabca342a72cff28ab6a8c75e7d12537cb7e1af61fdc00bfbf9c0e7e4568d42a9667c75574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500322, "uuid": "3ec0f62e-ecbc-4c3b-a72b-23cba88f328f", "value": "T155565B07BF5218B4C098EB35847A4295BA74BC8C8734B3B72D92AD786F293D1593DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500322, "uuid": "d384e420-5ad8-417f-89b1-7c5e7fc5ba8f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500322, "uuid": "3f01c5f9-73c1-44e4-ba4e-ab8877edacb2", "value": "49152:x4abbQ70M924Lioyw8qfN20XS2tEb2uq2Mi212c2cF2Vf2Ek2AI2oY2S2WWZIRMF:xz2iop8qHMWc0oAQYrSQj3e5px7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500322, "uuid": "4db4b886-7585-4872-b2df-1f893b4e8223", "value": 6378144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500322, "uuid": "34744eb0-5c12-4add-a843-65713735dcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500322, "uuid": "a4387594-5601-41c2-8aaa-0b8c42380266", "value": "b53cda93234482a8c2369722b4e7b43fcf08fc4a60662343ea6d40dfd570f148.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2866db3b-967d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786559971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559971, "uuid": "e1a96700-beb8-466c-95f6-29b84a802071", "comment": "Malware payload (Mirai)", "value": "37e78a6c9f77a4d17cef3028342e5edc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559971, "uuid": "de810a1b-5337-410b-940d-44753b4cf583", "comment": "Malware payload (Mirai)", "value": "b53ec7962041720c29f54d290734e6a8fe1e619753814de356b202251f9bbc3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559971, "uuid": "d2311adf-8e79-490c-8a27-0fbf7ed80ffd", "comment": "Malware payload (Mirai)", "value": "b9d1522f4dc4692ce5f7294cc36b8341d049df6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559971, "uuid": "99360738-dd67-4b30-92a8-65f1a0ae6d17", "comment": "Malware payload (Mirai)", "value": "e322719c3153884f6dfe77f58a15ebb52e11b34083cddd2c9829e02dbdb0ea4e8556e92574bd8b89bb81245e8fababcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559971, "uuid": "62ff948f-fa4c-4b04-a3cd-0bded05e230c", "value": "T18EC319A9F880DE52C6D52676FB5E418C33231778C3DA7105CE109E35FBEBD5A0E2A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559971, "uuid": "d05d1473-17fd-46e6-a788-91f1756974e0", "value": "3072:k8UWljtkimUjqI61hcYEEUjTisJOOvL1IlPUvz5NIFxNZZuzf1Dl:kLwjrFShcYEEUjTisY+LeBUvINwz95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786559971, "uuid": "e2f77da9-5588-4110-ad99-0f1bd1de880a", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786559971, "uuid": "eb66c343-73fd-4336-8f15-35f67639eba9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559971, "uuid": "663371dd-971c-42c1-8e38-996e7d099914", "value": "15b63033ff22fae18a6fec5e1c5744b84c0f59dd204520b37bd899c887d6b8aa.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee273122-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "48dd83ff-2266-4baa-a6aa-847191e50ec8", "comment": "Malware payload (Vidar)", "value": "52250e007686601a8058a81495045d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "a005c6b8-1118-4393-b5e0-5c7d1f8bd6c6", "comment": "Malware payload (Vidar)", "value": "b56178afabae918546daa871cef4e5d735c5a3f6d55ab99057d4399da3524007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "fc48e755-6ab0-4ece-932b-d862e08fefaa", "comment": "Malware payload (Vidar)", "value": "2cf644e26dcaaaee054b69254b88558758d958ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511340, "uuid": "2b7c87f9-5d98-45b7-8c74-7b528bb3adcc", "comment": "Malware payload (Vidar)", "value": "7014897e34a094096aa85bf8bef49b405d09a9f618e7c20016ab989d3485ae0a54ec2b6879058c99ccaa3f2435e8644a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "9acf8f2c-4b7b-40a3-8308-5af1fb63ad34", "value": "T1FA267B03BB94C5BCF0AF933589636256BAB0B849473173E31E90EB752E7A3D05A71744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "f831f14d-473f-40fc-a31b-dc67a509a3fc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "7fcbd7d2-d839-4381-88e4-f491275c0fde", "value": "98304:mztYKSv8/gDecCZ/s+KKOdDIIjUy0xnTcHCZ2:mh/SvCRlR6IIjZ0hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511340, "uuid": "f3cfc2b5-db5c-46f0-a9e1-8fb1abccd91c", "value": 4657152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511340, "uuid": "8dd663c9-ba26-4350-a6ac-7d9a1594b8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511340, "uuid": "cfe0c83d-3e3d-44f9-aac9-57fc694ff979", "value": "b56178afabae918546daa871cef4e5d735c5a3f6d55ab99057d4399da3524007.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b18b55-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574949, "uuid": "cf5de36a-2705-4f35-93cf-6f29ed8bbc4e", "comment": "Malware payload (Mirai)", "value": "b4dd7c86ed52e9af1f0ecc8fcd27f100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574949, "uuid": "ae416fba-3e4c-4af6-8d06-00b575c024ba", "comment": "Malware payload (Mirai)", "value": "b595ef9ca4756a07bc83027a943009cb947d03c4c261a3e4cc3bec467b43c203", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574949, "uuid": "62ee1ffd-a242-40c8-aa0f-b2b5d35e8d2f", "comment": "Malware payload (Mirai)", "value": "d6f0f4430e73254482e8057f60b4649f040c3ff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574949, "uuid": "fe9aff01-5372-48c0-b3c0-3b6666fc897f", "comment": "Malware payload (Mirai)", "value": "f7e3b5a85aa60473bb8d77e1eb62b4a07ef5d01094dcf90091d9491262f00946f0defeed59524afbacb132fbd347ca29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574949, "uuid": "be199e45-39ea-4039-ac34-d2564a0d6716", "value": "T11C13F881BC929A26C6E4237AFA6E52CD336177A8C2DF3617CC215F407B8951F0D7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574949, "uuid": "42d19d56-4a06-47c4-a058-c39c3464495a", "value": "768:FCsBGLm5TEDXJJRVYPCVUQkhBZtbg3XIlwquk0hLpMq6TUCpm3e+4r8ov+W5PNp:cVm5oTEYU4FqubUB6e+COWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574949, "uuid": "50d15c45-3b66-494c-8e17-1d6eda79aeb7", "value": 44744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574949, "uuid": "b57836ee-9e98-46e1-a388-95337f2ca040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574949, "uuid": "2e0f5ddc-f9ba-4e2b-9183-548720233a1f", "value": "2778ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9394c-9677-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786557440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557440, "uuid": "f7cd3520-43f8-4e47-9d88-f00ab8efbe5d", "comment": "Malware payload", "value": "27282c96362e5c4a21e6e79af92f24b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557440, "uuid": "01554efe-3779-464a-9307-4959cb539947", "comment": "Malware payload", "value": "b5afa42a5ea1542401969fbc10227f636ce56a20990dfbf2cf266c0a8a9074aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557440, "uuid": "12b159f9-1c1f-44e5-9c9e-8d83bdb1c56c", "comment": "Malware payload", "value": "f694c238b707fd05e1a073ec3b5905f7443d4b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557440, "uuid": "bc7fe9f7-c265-4700-ac5a-4b990e7a4c2b", "comment": "Malware payload", "value": "8d8e5b5b39fbfb621f8468441827a150b766148dea03f3dcef402c3ee45ac22b40928dccceb9eaf23faf7b0efe20a046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557440, "uuid": "558ed572-33cb-441a-aa49-531ecaebfc2a", "value": "T184466C17BE9048F9C4AAE730887B56257A74B84D8B3133D32E616EB82F323D16E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557440, "uuid": "c6df1327-ae61-4968-a3f0-b405e9f89760", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557440, "uuid": "deccd33f-a3ea-4ab1-a009-6593926cfcb7", "value": "49152:U7djL1ZUKAOehVTUOUgxy9jC0PqwAJysiDQ/01ue4WyJ/P:UdGOHQSrPPAWDHR4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786557440, "uuid": "0714ae45-c9ee-4674-932c-6aeeab9f04e1", "value": 5704544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786557440, "uuid": "eee0fe1e-8d10-4500-b5aa-2664acf9e30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557440, "uuid": "ae4254f5-61ed-4f94-a457-a78a3aba7d17", "value": "b5afa42a5ea1542401969fbc10227f636ce56a20990dfbf2cf266c0a8a9074aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ed8e62-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786515055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515055, "uuid": "b2fa5c7b-9d3a-4bf3-953c-5d45667126e3", "comment": "Malware payload (PureLogsStealer)", "value": "b03101e840749fea73d3119cdeed8d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515055, "uuid": "d3eaf8f9-b5f1-408f-8eb2-eb84b5bb17c5", "comment": "Malware payload (PureLogsStealer)", "value": "b77026879f04bcb5090933292303e6213b9ffb75d0921cac5d8bf5feb9c37191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515055, "uuid": "32c97eb7-0077-4108-8dd5-10f776ad9cb1", "comment": "Malware payload (PureLogsStealer)", "value": "a4318b4871de9f5901f6a9f9b71959e9b47c47cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515055, "uuid": "7e1eac44-c5fe-4c9b-8828-90d07ed89334", "comment": "Malware payload (PureLogsStealer)", "value": "cb10c91012fc339400499c62f9c1e6ff0959eceeb56d271bd3022003a0b3745c25b2dc67b404c628b1b101bd4d072d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515055, "uuid": "a2b0be6d-b758-4fd4-bb3f-946a11e0d70e", "value": "T1A305BF3B32964E21C24A5373C1C7490087AA968736ABE70B75C513D61D473FEEE4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515055, "uuid": "8b468c92-ba1a-4081-9c42-44109fe0c9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515055, "uuid": "9ad9002b-c846-48c1-85ba-73cb55445abd", "value": "12288:taz4kUDIYkYwwxlPyZVCSufhO+wLByKPPWY7epHYWjZSi9DPvd2U:BhwsFJh1E0KP15i9DPvd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515055, "uuid": "d2202fbb-e23e-4d0b-b525-dcf5b6385bbd", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515055, "uuid": "9ca16ad3-0a5b-4e37-abf8-b0e59ba14633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515055, "uuid": "6edaa226-dfbc-40e0-b40d-9b9e7c302ec6", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c12e3e-961b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786517829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517829, "uuid": "f2bd855e-db03-4757-ae63-8b9e742da363", "comment": "Malware payload (Vidar)", "value": "ee4dbcf84c507d46442237c6bd6b8dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517829, "uuid": "c364820b-5e68-47c9-8f70-5416d6899556", "comment": "Malware payload (Vidar)", "value": "b7b25004c3bb772500619d0c0c499fa4a138f714bb9dfede4fb5c684051fd3a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517829, "uuid": "ec46fd73-6a2b-4094-8ba2-675f064da37a", "comment": "Malware payload (Vidar)", "value": "6f7d95ddb2bdc7a26af4ee3914473e5eaf3342d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517829, "uuid": "8d84ef5b-6b84-495f-997a-b45fe09a574e", "comment": "Malware payload (Vidar)", "value": "4a148195767c9ef4da00201de5443fcfd7d80daf9936f0fff03b69ff4f249752ab99f11f624c5c4ac65f53ee18ecb0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517829, "uuid": "ff22cdd8-2f0a-4dd4-955a-437b582a7d1a", "value": "T10E766B0B7F210974C499E6B4C4B643167A787C9C8730B3A71DA1ADB86F223D19E79B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517829, "uuid": "e7021f6f-5109-4e6f-9c19-d89c4d0faf60", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517829, "uuid": "64107b9c-51b8-495d-966b-63fb99850c03", "value": "49152:EdFLcdj3wY8MPd1PGBR9xfiLogIonHt30jXXdGCIJ16Dg7LIpMIfL1blWGFcJ3AG:Efc6L97yog98px7ecKmmCWHrEgnqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517829, "uuid": "7b25177f-0be9-43e3-aa7a-da9d92caaecc", "value": 7363888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517829, "uuid": "f9d80b2e-4a6f-40c9-8a3b-70ce5ce8b615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517829, "uuid": "f9ce7c01-c865-48b1-a90d-2b83d2814215", "value": "b7b25004c3bb772500619d0c0c499fa4a138f714bb9dfede4fb5c684051fd3a6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd7f5e5-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786523067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523067, "uuid": "11203967-aa9c-4e45-8caf-9e17a5600c3f", "comment": "Malware payload (PureLogsStealer)", "value": "b5ae077240af0a7eeb3e3363f226b4f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523067, "uuid": "428c6f63-bfd5-48c7-897d-bdb3267e6db6", "comment": "Malware payload (PureLogsStealer)", "value": "b7bafd42988e30f994178c6a7bdcea40c77e6b33c995e868be8fcbb2efb277e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523067, "uuid": "7b6e7766-7274-482c-80ea-93acf92a23ce", "comment": "Malware payload (PureLogsStealer)", "value": "854cb66808f7f74c08dc1f5d7b4fab5904146b8c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523067, "uuid": "ad456be0-eb63-4eee-9e3f-dc4f7115386d", "comment": "Malware payload (PureLogsStealer)", "value": "e6dc575d8e7e70818096105bdfde3bce2cdce1b2977e3f61fc081b5b94a35a4c07cdddf56b72b31db44a0bbcbcd8513d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523067, "uuid": "4e03f837-6cdf-4b7f-8bdb-f8fab34c3019", "value": "T10ED5C9B0FCDC74E057D6E56FE396C83D2A221AEA1C6FBA14018F53521FA2651EF82447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523067, "uuid": "2cb67c05-0474-46fc-878b-3f074f099e7d", "value": "24576:W5iXx+hPRocs53bjYJ60CXLrfYvW8AIzjjM9vlCmxLGA4xarriMCa62esj:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523067, "uuid": "6c16bf08-c92a-4983-90ea-45ae04d62a56", "value": 2770236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523067, "uuid": "77460f04-4f22-4d7d-a96c-f66b7fa3513c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523067, "uuid": "de5e806e-0b03-4996-b35e-33a462d446e8", "value": "Shipping_Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4110f607-9677-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786557436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557436, "uuid": "f089a37d-2e75-4135-bb56-fae70dc2b141", "comment": "Malware payload", "value": "c0e737b4c472582b7dc6729d9db3de85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557436, "uuid": "9eb84e62-f054-4784-ad1b-cdb412413040", "comment": "Malware payload", "value": "b7dad702cf80e7a6811b17c1fbc36d077cba1c44d5cdd997bd316cbedb65b1c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557436, "uuid": "4866a138-6031-4d2f-9956-c82631657bba", "comment": "Malware payload", "value": "aeec84d155d315742879dff3dfad74fc90329130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557436, "uuid": "33fa42ed-dfeb-448f-89ae-cb336d879ef3", "comment": "Malware payload", "value": "03e9ddba07299b4beaaee24b4c29f920e0e5138aa57a81492841d89be2c2bfc7948df0aca6be241429790999a8d7f65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557436, "uuid": "6c104b07-191f-456a-ab21-a37f9779c5cd", "value": "T160567C17ECA148E5C0DAA33189AB9252BB717C485B3223D32FA0B7782F767D06D78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557436, "uuid": "7e5644c8-320f-4676-8647-a1ceafaf5993", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557436, "uuid": "cfa5cbb0-9c78-4f94-835d-f656bacc3f78", "value": "49152:7NP9NFI3tnzpoQj/BG7T7yC50OB2KgxBnfb8Ep194Gcu7yyJ30wTBehKcK9KOIen:7X0CTeCSO8xBfbDp1iGcu7B/XEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786557436, "uuid": "ee35283d-ec02-4676-83d2-ff540d4796b3", "value": 6407536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786557436, "uuid": "a86ef906-78d6-487e-a1cd-c1cf3618fee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557436, "uuid": "76120656-30f7-4137-8ee8-348b0573e7c8", "value": "b7dad702cf80e7a6811b17c1fbc36d077cba1c44d5cdd997bd316cbedb65b1c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aad4fab-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786523226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523226, "uuid": "10f4da39-2a82-4bc4-9f02-c346df8a0864", "comment": "Malware payload (Formbook)", "value": "32621d8b0e417df985000b31837b53c2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523226, "uuid": "d417d524-a5d6-4f35-8490-2dbdfcb8d2f3", "comment": "Malware payload (Formbook)", "value": "b82e00c9e57909378b04b615745cb75f8694698d841ec7bae656ab2c0cb7bda8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523226, "uuid": "d35bbe6d-ce3f-4562-ac7b-29bc01f5dc46", "comment": "Malware payload (Formbook)", "value": "3144fedf1fd48c3b6ba880da45d1a7c4235f9704", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523226, "uuid": "df2a7f33-379e-475f-92f4-ba797b1e1847", "comment": "Malware payload (Formbook)", "value": "47c28229ab8302b98529cd23bc64ae989f3a5c714ea2d2d5a77c028db78a2c246687802af943fe6f82f7c6d24b238d10", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523226, "uuid": "9a158f93-1d1c-4c54-93e3-130b14173d78", "value": "T11E72333AF908DFF40B2E11D0418B7D0660996756B53A4DECE4D6C5987F2AB008F9B8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523226, "uuid": "704b8163-a98b-4d8c-81e8-0a4434f93261", "value": "192:6AAT527gkgtX9AGYH0sO8mOJwtsq83s9yHzzqAreEusBzb5F00r5lUn5+VRMProv:RgLtXfYH0sO8mOJwtyX7rTfBPFT7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523226, "uuid": "5507b4dd-3418-40d0-bd83-47c154352639", "value": 16450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523226, "uuid": "82bae742-1118-41a7-b99b-fd575db83a60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523226, "uuid": "c6688ed2-57c0-4aac-90c6-5c70b17aa541", "value": "New_Booking_859_26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3dffcf-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786522858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522858, "uuid": "b05a806e-5cc5-4366-b9ce-7e1014124bbb", "comment": "Malware payload (VIPKeylogger)", "value": "86a41b10d8bbbe913971d1f96969aa89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522858, "uuid": "24c4b336-d455-430d-82fc-b6a3e8e20530", "comment": "Malware payload (VIPKeylogger)", "value": "b83ca3fef7a5e125beed91a3ecc3f9fc1f9d7220e59cf67879e90f4906893465", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522858, "uuid": "1b3ee4d3-e786-49db-b4cd-767a18cf4973", "comment": "Malware payload (VIPKeylogger)", "value": "96e4c53b93781b4dae8b3a960930760396c75e3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522858, "uuid": "ffeb8ec5-bc7f-4a4e-b578-a45c9217ab83", "comment": "Malware payload (VIPKeylogger)", "value": "6ca7f708f258d7aff215903d7cd37e5890d97d2ce4c3aa404d3ca7824b0676d2b6b6ecba2d0331e079ac30d5f3569dff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522858, "uuid": "7a809b36-a5e9-49e1-8466-f14625973993", "value": "T1FF059D5314AB67B0BBAD4FEA276F7C8831E570337CC5338C91659C696AAF581B13C809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522858, "uuid": "1fa8ea5f-6dfa-4ff6-9a1a-8039084927be", "value": "12288:X5vV/58Si6gnD/TahGofNXNEzgmyDcGwM9ctGDAuTuErGQWMr1i/w9PHv:Fp54XDEGC5azV0D9c4EuTydMrQ/gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522858, "uuid": "baa88f74-40ce-45fc-9ed2-cb3a07f207e8", "value": 852257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522858, "uuid": "36d2a680-122a-439f-9eca-b4d4fb221374", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522858, "uuid": "3b187465-d303-4413-a60a-3307cafa34fb", "value": "CONSULTA DE COMPRA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44146fbf-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500318, "uuid": "262f09e2-90ba-4a83-ae66-1490dd05a036", "comment": "Malware payload (Vidar)", "value": "b99dc756e37ffcc3eff6eb5d77b0c2bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500318, "uuid": "0cc37490-db12-4dde-bfc9-8cfc04a7b2dc", "comment": "Malware payload (Vidar)", "value": "b8430c0a28c5e9fa15d843bcc665e7e87d248d3960b84925bea5f96cc082e1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500318, "uuid": "31a941a8-2933-4191-8976-cf4de67676c3", "comment": "Malware payload (Vidar)", "value": "4e2ed5351353cc1297235497d2ed254b944409da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500318, "uuid": "019e3963-e769-48fc-8917-18f37dd808c1", "comment": "Malware payload (Vidar)", "value": "ab4a1d48f0e29b5cacd51c5f45e26baa6dfa1125eb6b3a97588ecceb76cf2cba37e4384c4d2feddc6942c5a809c6f6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500318, "uuid": "9ed6f3a1-8407-417a-88df-f6477219a31d", "value": "T16D563907BB901878C495FA35887A5686BA78BC8CC734F3B32D91AD786F193D15938B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500318, "uuid": "c41cbb6d-de92-4c3b-9ab9-9fb769b871f7", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500318, "uuid": "90a433b6-1372-48aa-8111-7a8309f4356b", "value": "49152:2FesT0CTsG9+egORunKJMW/WXKgedSsJfi553XrYJsowMcBHaRkBM/akDUf6Kpmd:2fkORrJMtScEvKpxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500318, "uuid": "e3521d7c-45b9-4493-9072-610c8666e805", "value": 6372576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500318, "uuid": "fb540f34-51b3-4362-8d48-fd5d44a91caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500318, "uuid": "2394d5c4-1238-4b31-848f-2c3039085030", "value": "b8430c0a28c5e9fa15d843bcc665e7e87d248d3960b84925bea5f96cc082e1af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a78a92-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539237, "uuid": "7c2a6167-7462-423e-8707-e1723343cc63", "comment": "Malware payload", "value": "604369a2b165afe786200fe70851caba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539237, "uuid": "d6ae6053-52c3-4785-99fa-903e30c2683b", "comment": "Malware payload", "value": "b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539237, "uuid": "bde8cf0c-5703-4a8a-a46d-1cf71fc2a3a8", "comment": "Malware payload", "value": "ed4f591c740d04d733f847bb52dd3a40b0ac0c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539237, "uuid": "49a5f89b-5a3d-4722-8e91-043fb12004da", "comment": "Malware payload", "value": "7c634d8fc884f85c5047461e379693e10738b8f7567495bd1b36c117c9cdca72d8011673a0177c461b1e94e236cf5e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539237, "uuid": "8ec75ceb-6700-49d6-b824-4445ecc9df36", "value": "T12C63290AB35364FCC42AC1B442EBA737EA73F86606316F7F5364D2312E24D906E2DA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539237, "uuid": "ea58d0fd-94c3-4865-b306-b75e5d41978c", "value": "91d8be4f49246c5818d6b02af88b4166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539237, "uuid": "12b4a7ec-6794-4598-a193-2031ebfa7a31", "value": "1536:uRbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:uRLnaFHnmwcxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539237, "uuid": "f8d16c8d-6bbf-4a00-bf00-8b080d5d928a", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539237, "uuid": "fbfdcab1-1e42-4fea-a9a8-1840c4ff395b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539237, "uuid": "2001b19f-642c-4278-a229-444f3ceb2d06", "value": "b84cbf98c30f0bb7e1dcac097afa31756fbbc148aebe7e1feb534ede89398b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6153899d-9629-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786523989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523989, "uuid": "c17acb63-8546-4db6-a948-fb7c543a5ba1", "comment": "Malware payload", "value": "fb23889ab9ee3e55728a1e912aec4cbe", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523989, "uuid": "efb280f8-da86-462c-8139-b3d3252ab48f", "comment": "Malware payload", "value": "b87caf1be3de637e3e0a11b18d34ffeda7ef46f44e43d77f39c99c60772f9b42", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523989, "uuid": "b947e2d2-1987-4a1b-9203-7ce018404073", "comment": "Malware payload", "value": "ac14b8fb33188389ae6eeebb5c89cd6dc73892a4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523989, "uuid": "19790b6d-086b-472b-90ce-b440ace4419a", "comment": "Malware payload", "value": "4de8de3fbd70e174a288cd487f5d1506d2766581c18b8d9196b9cb3ad8f5ec0681b275b48aa19574cc120f0dbcd7320b", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523989, "uuid": "f9afcc73-2777-4128-ab26-63a78cac6c0b", "value": "T1A175CFB87F562D857E1D8226CEC3ADF8379A1E12699694DE40D2A6C20163370FD13CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523989, "uuid": "e3378e6e-8268-4d25-84f7-a2a1c8bdcee8", "value": "24576:RAAKR7oFgx2bSRp0Ovo4zNhBza1/UPeb/2b4E9KiUPZPpsxRdFj6vR5WOFzaXmC7:2H7WWg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523989, "uuid": "c12054a3-006a-48ce-873e-ebc5445ddda1", "value": 1607684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523989, "uuid": "26d0a7f6-2f8a-49f3-bf3f-9e944c04126d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523989, "uuid": "026c5670-55f4-4c29-91b6-5571bb4bcd09", "value": "Austrian Exhibition Experts GmbH_3971574.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e31859-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520245, "uuid": "4c214acc-0aaf-4d39-830f-3c1c7cf8ee11", "comment": "Malware payload", "value": "897cb084996039a8732bcdf4f8043cda", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520245, "uuid": "42f37e39-bf38-4ec9-8fa7-328e7390c32a", "comment": "Malware payload", "value": "b886360844748c3190ce13d70bf195060158f700d4d7c796252e511463dd8439", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520245, "uuid": "11d80202-ef87-45c2-8e2a-20c2a4b2b8ff", "comment": "Malware payload", "value": "6f513ed7ad48084f1315975f2dfa4d4300da447c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520245, "uuid": "d939f004-48b0-49d5-8654-9bf1e07626c3", "comment": "Malware payload", "value": "e62b9cccd2009541b81619bce52dc71ed7c2169de1f8c47c645044f357cba7c88e4dadc5e21116e28e579f534c42b295", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520245, "uuid": "fe9e5da4-d4a4-410e-94ec-bf9e90e91218", "value": "T12893F119D2B7F826C7AAB8F8D31C5BF1920E5902408235472D54B84C6B4337F6B9D7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520245, "uuid": "927705ef-8216-4db2-a012-83dfde46a0c8", "value": "1536:rPACXR5O0MjO/oRUzu08sn1QNOquYsBfVDcyY54J1vCom04:UK5OeoRUzZ8sn131xnY54J1vUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520245, "uuid": "4b56f936-fb1a-4db8-9341-f74c6a6ab7fc", "value": 90755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520245, "uuid": "2c357740-4112-4bf2-b1d0-14cd709c8aa8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520245, "uuid": "e4a4e0e7-81a8-407c-8b83-ba10a5cea3d9", "value": "2027 5.2L S650 R05 ECM C14919060 08112026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600fc45c-967c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786559635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559635, "uuid": "6786cc21-77b3-455c-8688-c0395a7cf1d1", "comment": "Malware payload (Mirai)", "value": "b28ef880f0b7d360d47179cfce5ebddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559635, "uuid": "36195b72-7e18-4ef2-bb3a-ac4c0e76b670", "comment": "Malware payload (Mirai)", "value": "b8c3f93152fb40ecd08440d9a0808e6878c921a5ff0d38a2b66f145cc2ca48a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559635, "uuid": "ef65d624-55d6-4431-8810-120b5801facb", "comment": "Malware payload (Mirai)", "value": "190ace6e0010a008d450cc9060207aa2c44fe42e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786559635, "uuid": "68ac2c6a-e8a5-4124-bd32-36a3bcafa5f4", "comment": "Malware payload (Mirai)", "value": "7d49144adc1468f2ad47a33476000ba190096ba971d1f808f593cfd6a2800057ad0527443eb93a49c9d7b61408298411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559635, "uuid": "9ad911d0-2ec3-4be3-a7cf-0cd843adfe8f", "value": "T1B78302C489F11593FDE7802A9E2D1A43FF298A0A36F9524FBF9019BC194A55C2F1C727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559635, "uuid": "ba6516f5-8527-49c0-b8f9-b4c90623acfd", "value": "1536:XWscYFR48qSpGKYM2RtKNWC3RRpvqPNOnfjuJQ/8/KsCbjsxhXTCJqsTyeQzN:XWGFWfSpGTuNWChRF2NOL23gjsz+JqsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786559635, "uuid": "2fb87fd0-bbdd-4746-84a0-8f52e34821f3", "value": 83936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786559635, "uuid": "fe43076b-2bd7-49bb-9087-b2d7d78e913e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786559635, "uuid": "1e981a94-903c-4237-9675-ee910ecb1371", "value": "b8c3f93152fb40ecd08440d9a0808e6878c921a5ff0d38a2b66f145cc2ca48a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6a1f65-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511341, "uuid": "3182f34c-b190-4422-8977-066ef971a9a0", "comment": "Malware payload (Mirai)", "value": "22bcb096aff763882dfc3243053d034c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511341, "uuid": "77ab445b-2f92-4bb6-8fc6-aadff32a593f", "comment": "Malware payload (Mirai)", "value": "b8e0db3ea4f1c268fa39f1d678bba2551cf11db7aabc748f6ab2b050db79837a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511341, "uuid": "c83d5f2b-003e-4987-ae78-abac17042142", "comment": "Malware payload (Mirai)", "value": "0b9f3514fc4a7549c80c118650afd177c4d5c02b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511341, "uuid": "8c9233ea-8b79-4f53-a5cc-e567a95ab4ba", "comment": "Malware payload (Mirai)", "value": "bde83e2803b4ab5265a81b47a3453453608bfb347e8998e097b62ca540e94189addfcd473c7c73a6740a6c904334260b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511341, "uuid": "278c6e5a-d319-4010-8f44-f59e2feeca9f", "value": "T1C241305A6FC00B27DC3ADC36469E2B6136CC842E71AA17416234ED20B83FA1197D3CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511341, "uuid": "a9263b30-6035-49d0-92bd-2c16aa355eb1", "value": "48:oVzIvyG8uDqabgOc9S0TfSzWveaDnGnkdXY3Mk:6Iz8umabg/9xfSgeaDnGwMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511341, "uuid": "dc031735-2ebd-4ca3-b581-865ff8045f92", "value": 2372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511341, "uuid": "db926dcc-e51e-4c6b-91bb-aeb5dfe7ede7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511341, "uuid": "8a3ffdad-903f-4218-9e93-4b7efabde8c8", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13dc90b-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786539182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539182, "uuid": "bb89bb3d-dc51-4bf7-86e7-d397e6e7458d", "comment": "Malware payload (Vidar)", "value": "afb439a19b3c800faea70c8797740383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539182, "uuid": "01e7d8f4-6804-480a-a8f8-cb09f35f9686", "comment": "Malware payload (Vidar)", "value": "b900aff98870685bd058645762047bd21fbf2088581994ad7b565c0c1fb6d7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539182, "uuid": "b4d03b4b-07d7-49d4-8ff9-835f255e0f68", "comment": "Malware payload (Vidar)", "value": "b620cee120806c351f14006e1a9e7ef0d7952712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539182, "uuid": "c37ddf14-5899-4b57-86c5-7e15992c1db1", "comment": "Malware payload (Vidar)", "value": "9aed20b4ac286e36ac2572b1edea57670372ca2ee33abb5ee50d72d3c2216156d0e7912e474f2d55304f53cee3a9f517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539182, "uuid": "0f49fe66-eb1c-453d-a9da-ff70e1fb7220", "value": "T17F466B07AE9049F9C09AE731C9BB46567630B84D8B3133D72E50AEB82F317D1AE75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539182, "uuid": "1df49a21-5b80-4221-80a3-56f423fbf68e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539182, "uuid": "573bb0d2-5645-4cb2-adb0-4c0782bfa5d2", "value": "49152:IS7gy7d5iyMS0SpZFZN/0Cv/U5WnO+qXrHHtgcYiKHvzigWVJ/L+/:IV1XS3mqqXr76bigp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539182, "uuid": "5f5f3873-3a7c-4a47-8731-b939d3e8bae3", "value": 5554040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539182, "uuid": "78fa3fff-5b4f-4e41-9427-4bfa2500727e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539182, "uuid": "e43d0492-aad3-42ab-a309-c318701c2167", "value": "b900aff98870685bd058645762047bd21fbf2088581994ad7b565c0c1fb6d7bb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f268a187-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511348, "uuid": "d24e40ed-6b44-448a-a009-3003aeabddbe", "comment": "Malware payload (Mirai)", "value": "2f1fba5a7da4345fa3036ab6758b79f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511348, "uuid": "4983436a-b56c-469d-8981-3dcdc091e768", "comment": "Malware payload (Mirai)", "value": "b918ca89c0a1d706056f1060248f984fba9af5d3a66069c11c9535273c1a46ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511348, "uuid": "fa82c5be-3261-4b29-b43d-3c24dc876085", "comment": "Malware payload (Mirai)", "value": "04567a142b83967de742eb874fc9c30cb5dc828f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511348, "uuid": "07bd23d6-17cb-4db9-97cd-60401af4b85d", "comment": "Malware payload (Mirai)", "value": "ff3b91f8021e88513561ca335711aad9bf0073571e37c3e2feb1191de60588869b2d9f2c37770051cbe0d74d71f48271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511348, "uuid": "81583747-9201-4280-92b9-269aef0456dc", "value": "T1AAA3490177484B47E5A64EF4283F2BE4C3EFEE8011F4F6886A0ED6464271E73655AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511348, "uuid": "f6447a36-6191-401b-92f6-b8439b699b8d", "value": "1536:PevxwXJ5a530mJT+XtdIU95itEx1sVmr6qI0pvpYt79vPNya:GG5PaNUfY4rBp8793Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511348, "uuid": "4198e313-ed98-42c4-a097-73116c4f42b5", "value": 99568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511348, "uuid": "f1b77494-5bae-4535-a2e3-3deede461269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511348, "uuid": "1841029c-1665-4e6b-88ef-9c846d265b66", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb59ffae-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786509215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509215, "uuid": "cb6d6c66-33cb-4833-852b-dcd00a7aefc2", "comment": "Malware payload", "value": "c80432d1b6ab77abd00b66498194d27d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509215, "uuid": "ccddb813-8010-4058-ab26-0e6bd570eeb6", "comment": "Malware payload", "value": "b92cc476061283450cd8118167238c5b5a7591bd022c3d26f8570d50d0459d3e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509215, "uuid": "9569fa6b-3b76-4c06-86a2-027fcfb27a8b", "comment": "Malware payload", "value": "76f0cd171a2a0a913f328444dc7f5b09444af7f3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509215, "uuid": "6743bc50-935a-4f01-b12b-6d7f77b27d4d", "comment": "Malware payload", "value": "151bcb8bc77851f0b00822a6452d39ab156566d0f5a9c1ef887ac8eef352c3fcc44e1dbcdb5d369e8972ffc3d3e0f0b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509215, "uuid": "60162213-200f-4332-a9c0-d42015375dbe", "value": "T1195733F7C2E69B54F63FC0F1A2987608FD92EFF246243A424EB43259398A34476B5354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509215, "uuid": "63cd968b-4c56-4428-b839-ccff9e72429a", "value": "393216:fNdcLV7nbWff9385Cbi77k/LbNtaV+LL+uAx+r77V/q5juZ4a/8aEiJdq:8LBiX9380TbnKur/Apubnve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509215, "uuid": "7ba690f7-4590-4d7a-b50c-c20c3b0d1bd5", "value": 27046285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509215, "uuid": "7603c873-ac51-4a1a-b6c8-7c19a98760f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509215, "uuid": "777d5810-d939-4487-b320-861bd0ab9657", "value": "wsdchngr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0616a68-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786522001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522001, "uuid": "bbf8d987-faad-4eee-9fc8-cf9d1668f643", "comment": "Malware payload (Formbook)", "value": "18569f002547e05c44e96847e3cc9c5e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522001, "uuid": "a5dea7f1-fa60-49dc-9b78-a244bbe78c5a", "comment": "Malware payload (Formbook)", "value": "b93c700ae326c52d8f07acb28ce7105b601be93d9b3fae9f29f538232b6bb1d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522001, "uuid": "c2ce1f09-4667-40df-a4ae-e9aa89344102", "comment": "Malware payload (Formbook)", "value": "a8b7a6909ea816f3ee69985ed4fdb663accd9d3f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522001, "uuid": "e3ad512f-f52d-476e-a39e-6caf35722515", "comment": "Malware payload (Formbook)", "value": "2c856de2642b72187d6f789531441e2c401ee927a71bb3830bd0f9a90c0c07dc9ae8614bc6d468abbec8716e477bbb40", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522001, "uuid": "f2ed2ed3-404b-489d-a78c-05092e59f755", "value": "T127E32F8459D329444333677FAA2A9CD5EB660B7700444B07B8BCA480AFF0F5AD9F1DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522001, "uuid": "a777c28a-aac4-4530-9cf1-c5fd309e7458", "value": "1536:KtPnuo89rgmr/xTMMqUXZY2VPgV4W8iQ9I/6MFwBn/iXLL3ZvChHUNWcPR+6CDbq:IZ89Umr/xlB1NuIE/58ct3kVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522001, "uuid": "c5546f0e-bc22-4d33-85ef-26db7e989dbd", "value": 148065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522001, "uuid": "68c86845-6fd0-472c-94be-909e337b2f4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522001, "uuid": "54a00706-afcd-41f1-81ed-776c1150d560", "value": "MokkiHub-Company-Profile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df57e488-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "47ec6360-a5cc-4d71-82b7-f389fe67f26c", "comment": "Malware payload", "value": "74b4a66afdaaab5ccc7622bde5d3decd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "7f6872cf-6e06-4860-b01d-adcfd3d7676d", "comment": "Malware payload", "value": "b9956521c3fb26cfb49791e6c3b29faae02ab8ac12314c2207f4f1301534df90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "8367e6e5-19ce-4693-a74b-9f251f650ba5", "comment": "Malware payload", "value": "c7c07ccc9693197efcb3431eba5c87a74c8da639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539233, "uuid": "e3a7d8a4-fcb4-4acf-9a44-69ba89fbabc5", "comment": "Malware payload", "value": "7700c44b73f6b165032e8555b944b23011fc2239f8cef9e7f7176d0fdcfac7897d81dd14571f9166dfa6204eab7a4f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "d4de14d2-68f5-4d13-8fd0-f2053aac3e81", "value": "T1DC63290AB35364FCC42AC1B442EBA737EA73F86606316F7F5364D2312E24D906E2DA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "caaa177a-5e14-4e25-b233-300e5759c9cc", "value": "91d8be4f49246c5818d6b02af88b4166", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "08e10c26-c774-4c32-b866-6258b8787659", "value": "1536:0RbPvnj4oJLe9AeEgvGRP38HjbmJhEbWg6Hg6IW:0RLnaFHnmwcxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539233, "uuid": "b757bb78-3942-4abb-85bf-2b121fb24c6e", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539233, "uuid": "cefbe286-49fd-4f0e-b79f-4aa3b32bac96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539233, "uuid": "9487ec91-d47f-4ca5-a997-f9dfae55a787", "value": "b9956521c3fb26cfb49791e6c3b29faae02ab8ac12314c2207f4f1301534df90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dca3c86-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786556088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556088, "uuid": "99b1c14c-0618-4026-84b0-d2ffcc82bc33", "comment": "Malware payload", "value": "ee53614db0057a9da4b47c3c0dce3879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556088, "uuid": "a7eec35c-1650-4660-8ff8-5e00854a2eab", "comment": "Malware payload", "value": "b9dbfe6ba4f333c82f877fae8dee2b4dbb9931d90c04adcd67503198a6444ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556088, "uuid": "60a96fb1-18a1-4d18-9715-4f4c140757f0", "comment": "Malware payload", "value": "bebabe04eb8447cba47b6c38aa1c4b1e223f0c86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556088, "uuid": "abc0f341-62bb-48fd-9bf9-68d13e8422b0", "comment": "Malware payload", "value": "95d74eb91d93bb5a87eca0fe0fe2927a3dd6502ce365b6688803d6995b430e93720a9c0bd8b744ad6a4d4bda7039fbd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556088, "uuid": "e67eda2c-4429-4312-96b8-32b63c669ffc", "value": "T120140A01B8104B57C5C32BBABB9F439D3B375B1897DB3301AA25BEB42F8679C5E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556088, "uuid": "e4fc1371-cf4b-48f9-af90-1803f4ee4c09", "value": "3072:mKj8ddNvtw6nrMLE/sndSERGSsk2mWvkBGYRvZ2s4aG/2+LwD:+dVtw6rMw0n/RGSbWvkBGYRvZ2s4aG/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556088, "uuid": "39849238-273b-4389-8a60-61e9ccd48b77", "value": 192474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556088, "uuid": "6f46f434-469f-445c-84d9-39c6da26c14c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556088, "uuid": "8ec3a82b-eddd-4391-a8da-dd46998e4764", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20af414-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512582, "uuid": "0fc6a2b1-ae4c-44b3-acc6-262f270bdf4d", "comment": "Malware payload (Mirai)", "value": "2e986e713c96bb0168c5a39a89605b34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512582, "uuid": "ae40a438-c835-4178-85ac-15486b22e187", "comment": "Malware payload (Mirai)", "value": "b9f231efc3bda5b62f15a03ea48f84b610e766024e247cf6bf0250644b261503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512582, "uuid": "8146e515-dba0-4d61-a4ae-7b886b007109", "comment": "Malware payload (Mirai)", "value": "81c017842b2e8f7cac61ef0c228d3f829caadefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512582, "uuid": "f00b3724-9d02-4d9b-a3f9-d3dca9b77ac7", "comment": "Malware payload (Mirai)", "value": "a9ff2f836d71752d139b93d2b11cd943b0e84b99633159e20fec102a0aca01bbbcaedf3df6b6f9937996c280f2b75899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512582, "uuid": "4692ba7d-fb75-4790-829b-9d66a98d8880", "value": "T1A8633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512582, "uuid": "36460ff3-d944-4601-90b3-e3dc5d3d8b2d", "value": "1536:9yJWBrmSTKrF7TqGwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04Ox7TqK1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512582, "uuid": "8aed9ced-4767-4cc5-8801-5811d647b642", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512582, "uuid": "dd7b3e1a-d98b-489b-b11f-d51b60d037a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512582, "uuid": "cd5fecff-be4d-40b6-b9e1-dd071a920595", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c306b3f-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786521940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521940, "uuid": "40df526c-78be-4738-88e7-de925fdc0212", "comment": "Malware payload (XWorm)", "value": "8a1b97bdd370f3474549c2ea2c6c105d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521940, "uuid": "6428452d-042e-44b6-ab5b-d39797dd9ed8", "comment": "Malware payload (XWorm)", "value": "ba83558b7f966c94c3b25ad97f092173e02a1a0c620bde8fc1257a2580895011", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521940, "uuid": "a38a0a6c-0b33-424e-9a8d-a63a69bbaf61", "comment": "Malware payload (XWorm)", "value": "090f827468b6dc479bdaf7b74fd700b336ce6882", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521940, "uuid": "b621ead8-7e76-47eb-a8cb-d01009cc0249", "comment": "Malware payload (XWorm)", "value": "1a31feaba87656c052835d39537b6e6ffc79a72dab41576f86978ff4690641c37dddf53a2996f6dea541293a161c3767", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521940, "uuid": "aceaee55-421f-488b-bcbe-9120063eef60", "value": "T14AC550405608D871752F5B2CD036E63A6A19A1C310E4FB1F35FC8688BBE9B93539CDE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521940, "uuid": "372365c5-a349-4819-bfda-856541589ee2", "value": "49152:Efrk1b3iICYDzqGOsGAzlSL2Jqi0EaE7bF5EXnSixpHQvD3E3zuuU:6rk1b3iICYDzqGOsGApSLFDE7nEXSivA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521940, "uuid": "b9f1482e-ab5a-4bc8-b248-bc5de60d1c3f", "value": 2594422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521940, "uuid": "cfb84d2a-8c63-4de3-b61a-9508b2da5847", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521940, "uuid": "3904a567-86b3-4d13-9bcf-9d5d29a0a01b", "value": "CamScanner 11-08-2026 12.29.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d395d32-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502427, "uuid": "b58e2534-08ef-49d0-8e19-63fda139d49d", "comment": "Malware payload (Mirai)", "value": "1becdfe11e5aa0182e41c9b9555c03c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502427, "uuid": "2800577c-6a81-4ff0-9c07-505f4f729096", "comment": "Malware payload (Mirai)", "value": "bad4f48c884eddb98d4db505fbfa0dec3c8bf331b4914c613754fea60256b165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502427, "uuid": "ac760746-0284-417d-bbf2-d74a9bff97fa", "comment": "Malware payload (Mirai)", "value": "048b77ffdb378af5ca58cd23d62dcc2a70b879e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502427, "uuid": "c90148b2-93d2-45a9-a8bf-283ea43f7e4f", "comment": "Malware payload (Mirai)", "value": "3cb10ae1c2c7ec16817db5741f03fefd9ed58679a89e916f1c14f25ad12d5dd767ea69472e63f344bda51b2be8b8092c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502427, "uuid": "bf7d6bad-e1e9-4df9-a3fb-7bad15d78716", "value": "T1C383020B4813B5E5CDC1A93AE2DC19DF730BDF3C649165911BB94A9C3E4D38AAFB8085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502427, "uuid": "1dcdf296-4845-45ed-8623-5eb70a45be44", "value": "1536:dlb3TtO821Z3CCyOOrLTUOPuQxOOo/S0LB0t/Ee/9q97+q3kNU:dJ5I1JCjTUOPCt/tLi/EiIYNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502427, "uuid": "6d241cfe-c884-4c95-8306-491e597bdd7f", "value": 81136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502427, "uuid": "588d916b-997c-40e2-bd52-38db2c7db036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502427, "uuid": "2d1f4e6d-098a-4260-a029-9183ecb4d019", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163445a9-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786538895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786538895, "uuid": "c245f12b-4791-4917-9ad5-3668e6772484", "comment": "Malware payload (Formbook)", "value": "9cd3101160696b4581ace3a75f0d928f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786538895, "uuid": "89bed867-7d24-4880-bb1c-fd1834f1a6f2", "comment": "Malware payload (Formbook)", "value": "bb036570b24bde4cb134dfbcdced716d2f5ec1337e7139a8fe08da1b37c06a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786538895, "uuid": "f710a484-a7a3-4ba6-8071-fe98f00dcf70", "comment": "Malware payload (Formbook)", "value": "a2ebb5ec5c320b6da4e9748cc91bf93e9219438a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786538895, "uuid": "d3e54f98-72a5-4969-88a5-87307cacb209", "comment": "Malware payload (Formbook)", "value": "94d05548a8943356da190533b93bbffbb638b3581d8f10f5bfe1664cdf206608c4c2f48f89adaf1e3939607cad1ce136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786538895, "uuid": "f0d372b1-123b-48fb-b812-f94de70be066", "value": "T1F13512942355DE06D8535BF55970E7F407F89EE4A910C3078EFABEEBB83AB4518182C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786538895, "uuid": "2011cd16-fd4e-44b7-ad10-03a2c3283280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786538895, "uuid": "d4af624c-c136-4ff8-afec-954034715ab3", "value": "24576:mtRGRIaA+twTq/AJm4hTfRQe8SAEYu4ojjL3mRm+XwBx0//:mt6M+twTCAXNRQvSdV40L4vXL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786538895, "uuid": "f3dc0e79-141f-4a77-b6fe-62386c5154a4", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786538895, "uuid": "f215a166-d0ec-4a19-9fb6-36363db833e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786538895, "uuid": "fac0e77a-1819-4d4f-96a4-4533762a2e5f", "value": "CPGdQhrk0tr7B9h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65059ee1-9616-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515835, "uuid": "3023fb03-f5b0-45ad-9ab3-fdf5687754ac", "comment": "Malware payload (Mirai)", "value": "9a42a51e4b1c3a061c5f79812b406ea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515835, "uuid": "e302a18a-2efb-4c7f-947d-03341ebff9ad", "comment": "Malware payload (Mirai)", "value": "bb3530aa35cdb3b0cca1b06c74aa766b36f75fb4820366949ebaa12ea9dd6acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515835, "uuid": "901bcbdd-6ccc-401b-8dab-73233e7c8817", "comment": "Malware payload (Mirai)", "value": "0871d079a94f9758201ba1b309428c5fc377e3a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515835, "uuid": "032f47bd-3a69-4d68-89f7-189dc56ebdec", "comment": "Malware payload (Mirai)", "value": "8385c8805b407842040b3c9ceca16417de7c1be66146c9d20afaeac8cf10c624768cb702e4256b586c6be618d1329983", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515835, "uuid": "a1d03a3c-51fa-4c49-aa5b-8845778ab94e", "value": "T183F45C02BF805FEBC4AFCE30496EC35711DDD98696C1A62A71F84B8CBA5D75A0BD3448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515835, "uuid": "066c17bb-610e-4a3a-b1ab-81107e129178", "value": "12288:USnIZPtSXtLzKKrnSrDYLBpJrTeyLTDTAP9gKLmDxdu/gtiiFf7rehMvoPT0dObG:trivNNoiyEpmodWokIkVjEI/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515835, "uuid": "09d54f8d-ce68-4c54-9ff9-6f7510c58fa7", "value": 775060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515835, "uuid": "fa4bedeb-4e41-4dc1-abda-8fe754404ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515835, "uuid": "38311543-3229-4b85-8ad8-1e556acb088f", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1962dd29-95f4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786501105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501105, "uuid": "f4a902fb-a4ad-405d-88f5-e857afb3fc10", "comment": "Malware payload (Mirai)", "value": "82c9b40ee7623fd586b2765f22e0543e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501105, "uuid": "899fbed5-6010-4bbd-84b1-1814fb06739d", "comment": "Malware payload (Mirai)", "value": "bb5c1edcefe73120769c5e8ac1f518641c99eb07e1789e12ab54434c9e98973b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501105, "uuid": "d7b1b006-da43-4c82-9b1b-397ea48ce26e", "comment": "Malware payload (Mirai)", "value": "10f1674a1136caf7aa381a4426ed1f65a60f3d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786501105, "uuid": "500a31a1-dcda-4d87-989e-b509542d72d6", "comment": "Malware payload (Mirai)", "value": "193f55b030d8ab08e2d298fcb9cf0dc25205ea46a01df98a302983becdcd7f7eabd3ae966939352e961b5680af8d021a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501105, "uuid": "4a33ce36-2267-4959-9f40-c4d6a01894ab", "value": "T17D94B291A4104ADBCE1088BB7B2C8F7463922C71C36B0F7D5D568559A28F8CBF5CABD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501105, "uuid": "e3db2592-abb0-4fc2-932d-556549434176", "value": "6144:VRYgBizQqBrVDnzY7jd9hg4LxneQx+k6W/her91KWHa2P:VRYgwz5BrVDnUV9XeO+RW/her9FHaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786501105, "uuid": "7f71d863-9b1b-424f-abdc-1552698e91b9", "value": 437256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786501105, "uuid": "ba2d4d1e-cab9-4169-bb42-6377dc134fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786501105, "uuid": "8e029b22-6690-4176-9997-2630731f8dc8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3635bd31-9625-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786522199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522199, "uuid": "d9889846-cd06-48a6-853b-8c82f2e7edf4", "comment": "Malware payload (Vidar)", "value": "e7323a323da3fcc4acc5c997c14e18ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522199, "uuid": "bf6cd59f-ffa7-40f6-9794-5ad08ff8f219", "comment": "Malware payload (Vidar)", "value": "bbc8291cac107236e91252435bd604577004a6e9e041772e08d28398ee0e6ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522199, "uuid": "516f19ad-8871-4fb9-8215-9876c85c0f9b", "comment": "Malware payload (Vidar)", "value": "b281be86388368af09f5bea82fd32a030478be90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522199, "uuid": "4048dd78-9f02-4460-8464-7a6896a935f8", "comment": "Malware payload (Vidar)", "value": "01c77ff5fe6b31c46dd0f1005d173d02e9581af70ff86599e67122ceefe12820c1d4574307343e6901c0dda41298832f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522199, "uuid": "9af4a95c-e17f-4f01-a923-023fa351611a", "value": "T1B0267B43ADA14579D499E236897643447739B80B1B3A33EF2E626E753EF3BC04939B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522199, "uuid": "9b3b6926-7137-4a72-ad5a-e9b93b457a4f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522199, "uuid": "2c6aa422-cad1-49c7-9661-6228bd6f2295", "value": "49152:WslvVFn1qoAm/R/yBqRSq0No1LnoLLrcHTLFWnBQ7340noWG+elST8QPOMBPK1K9:WS1XgcYI9BUlS7PMIYzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522199, "uuid": "16974d6d-d015-4557-bbbc-5f0180e16386", "value": 4751936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522199, "uuid": "28b801a9-034d-41a8-a85a-576dac677d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522199, "uuid": "2f6f3094-97e6-4979-9b9a-df20a221c183", "value": "bbc8291cac107236e91252435bd604577004a6e9e041772e08d28398ee0e6ac1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280000f4-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521745, "uuid": "cb93fcbc-82e0-4955-a9c4-d5ac530a1052", "comment": "Malware payload (AgentTesla)", "value": "c995c59ff0911e82b1dbc13dd7f41fd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521745, "uuid": "27f924dc-ef5b-41f7-ad25-8370aa9f92e6", "comment": "Malware payload (AgentTesla)", "value": "bbce8175dc57fa73075356592bb990303c91172c3dd16c6f700db9dd7f1f94dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521745, "uuid": "6a8bd51a-a4c0-474b-8057-d9178c923b53", "comment": "Malware payload (AgentTesla)", "value": "8cad20f3e2048157bf846f141532d52cd8f87c4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521745, "uuid": "b5a7f2c0-890f-4769-9b09-d4bc061dcea7", "comment": "Malware payload (AgentTesla)", "value": "1b671440caba21a6d71fc099cb9d7fe661b05c2e32c08b9fe3d2d9825b0e6cd179ece73a7c325e29d5add120fcf274bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521745, "uuid": "74b07998-1e09-46f0-aa79-5f3dae0545d0", "value": "T14FF57361D7C092B2B3605B9C813799B0A72D5CB316C7DB9D32ACC20677ACE075359AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521745, "uuid": "ad309fa5-e23b-4644-87d7-40359c836cde", "value": "98304:AYm8z1x8OVe7Dv8oGChQAUCW9WTZ14VkAOKzFWBBhS4MwlVwagsxOPU:AYm81WOkkoBsC8WTP+kAuhxxgsxOPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521745, "uuid": "5f3e38e8-546f-45aa-bdab-5dde34027270", "value": 3344454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521745, "uuid": "2bf95935-b039-46a4-a148-4a1d808e5f37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521745, "uuid": "4d84c12b-ce1a-4b2c-b1c7-cd0e0fe706e8", "value": "RFQ58206.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86538083-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494845, "uuid": "42999e26-08f9-4c02-8c19-ab540ec37697", "comment": "Malware payload (Vidar)", "value": "9eda5859bd77f9fe1dc39cec96dcecec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494845, "uuid": "47ed7c9f-5764-4bca-92b2-1c037b36689e", "comment": "Malware payload (Vidar)", "value": "bbf4b40be130ef821968942b27184f6f70c1faecce7a5f4e9aa25eac8d9b47ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494845, "uuid": "d658961d-3e96-46b1-b379-b166152ecb38", "comment": "Malware payload (Vidar)", "value": "2a221d2c643904d2a67ba1a41a860639c899dfff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494845, "uuid": "7dabc650-b9e4-4df7-85fe-2e89e9ed494d", "comment": "Malware payload (Vidar)", "value": "587e761e70b6f8c956b8f06711389cc03239927a69a9f4cfb8724c9ce27ed4eecb7672aeb98535d116973d3f2f40eb14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494845, "uuid": "a4146cd7-99cf-478c-b112-2abd6ab375ed", "value": "T1AD964B175B514C79C4A8E730C4B74A2BBA60787D8334B3A70E62AE786F217C16D39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494845, "uuid": "3a169131-85bf-468f-8947-fa3e321051f8", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494845, "uuid": "567e14ef-9184-473d-b973-ddb246bbb470", "value": "49152:gLdDcwhscOPuk3tC0Aknpi9LvIRTFtzM7n4h9N/hv8NPLx/xQxNdjrvq0prfJXWb:g+Xm7yKWzbxS7OSAbn/0t4KsJhXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494845, "uuid": "25ace6a7-e442-4e64-8081-7eea68a08e8c", "value": 8885256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494845, "uuid": "64f8a9ff-a650-410f-ab01-b20b17974000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494845, "uuid": "851d8022-ec2c-479f-9635-312e416a7fc8", "value": "bbf4b40be130ef821968942b27184f6f70c1faecce7a5f4e9aa25eac8d9b47ea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6148a22-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522037, "uuid": "d8fd42af-1126-4692-9c8b-59746ac58c9d", "comment": "Malware payload (AgentTesla)", "value": "1e4bddbc9014a874c27462a53c1a42c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522037, "uuid": "3b931272-fc57-4344-ae62-9d2f066248a6", "comment": "Malware payload (AgentTesla)", "value": "be7118a60741e093af97715c421ec3c548aa9314d9db82e07c703cc373c6eead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522037, "uuid": "c77273e8-a4cc-4d77-92c8-4d7c0ebe9334", "comment": "Malware payload (AgentTesla)", "value": "1af426b2bb7fa2d3365665fc39f362ceae33e555", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522037, "uuid": "82873f0f-4769-4918-84a7-b0db9cbb2fa8", "comment": "Malware payload (AgentTesla)", "value": "00ea5c4ffee45837f7c53b0448cb727f214c4f2b7de629e36f548da5b7922574ad3904f5ed62bd9a16ecaac5484e5dfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522037, "uuid": "c7bdc2ba-e861-4dd5-a5af-72b87a049c55", "value": "T1CAA509EA324E3A66A4023356584516A80E67D4242FF3FEC4F8EE0BE4561F2DD3581D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522037, "uuid": "c5eebeeb-e51a-499c-a239-4e930129eff0", "value": "24576:BrN+SvEBEwGg4eIEQB5jTf3MNQWEWMrQp:BrNn+Gg4MQB5jb3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522037, "uuid": "b9552330-435e-4070-b715-33eb7ec3e834", "value": 2137135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522037, "uuid": "938c8644-61a8-48af-a77d-b9c46ca9502a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522037, "uuid": "e272a1fb-e624-4686-9391-25a61d51e17a", "value": "VESSEL PARTICULARS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0185c7e8-9663-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786548739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548739, "uuid": "ff707c53-0972-42ce-b77a-8e772af7c619", "comment": "Malware payload (ValleyRAT)", "value": "fc32ba360c83cb910870ecdbaf088b3b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548739, "uuid": "a2f7484a-5efe-4dff-81e8-0fe9823603bf", "comment": "Malware payload (ValleyRAT)", "value": "be7d04f3bbca91674206a22fdedc0d4874a62ffe0dd164e98de6d3cb065a57bf", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548739, "uuid": "33bc4274-0e2c-4777-8568-097bbe339736", "comment": "Malware payload (ValleyRAT)", "value": "b4342dc4a7a101ba2bde5bdf692911bb22b6ee46", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786548739, "uuid": "52fb3baf-51c3-4c34-b8c0-88f4153a1b37", "comment": "Malware payload (ValleyRAT)", "value": "be11109526836d6bce435e21035dea29ffeaf10314ac0113ade0b60afa2ee415978aab97288f89717ddd38ba0f5d742c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548739, "uuid": "96fb8e1b-5a98-403f-8b52-d66fc6d83586", "value": "T102183323F78BAA39E41E4BB745F3C66424FB6A51B5227C30C6B4848CEE650746D3E706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548739, "uuid": "fb5129b1-8954-45c3-a8ac-f62b85d2f631", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548739, "uuid": "689a094a-2b94-4be6-8202-f6afd4b0c172", "value": "1572864:EqaFFwmsQbwgrNYg1znSUSGUOUsDAgpzAAKXNoOBp66hRiN5Wn4Ttt6XmAm:jfawUaCyrOUcpEAEWSwAs5W4TD6Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786548739, "uuid": "82fb043f-cf0c-4b02-b7d0-eaa365874363", "value": 85294504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786548739, "uuid": "34b8e4fd-4c16-403e-b414-88e684daddd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786548739, "uuid": "e10ed17c-c067-44bc-9482-f22d64b0f187", "value": "BraveBrowserSetup-BRV002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c4ff67-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786574942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574942, "uuid": "8624be07-0fd2-44a6-ad84-eb581264e966", "comment": "Malware payload (Mirai)", "value": "db2e8aa26d8d625d934d2011e492a938", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574942, "uuid": "dc4553fe-e579-4bfe-a8ca-562aa4aa93b3", "comment": "Malware payload (Mirai)", "value": "bf0aabf517685756f16b22f4b1907113a1cd160fa7b5ee384cb554b42b311841", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574942, "uuid": "4ffff4f0-ddac-446c-8949-b904ec90a085", "comment": "Malware payload (Mirai)", "value": "87a7b0368697ba112498f54ef0d413449181d7e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786574942, "uuid": "b54cbd10-e380-4da3-9b14-b4d430023938", "comment": "Malware payload (Mirai)", "value": "0db916e635ec99643b1b571d9a7d63fc7a68426c4446ede78101d54c35559ab063e0c6f79958fab267167db5b1168442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574942, "uuid": "4ad8494e-7731-4ac6-9d2d-a2dcbc817df1", "value": "T132330713B98180FCC08AC2740B7FB53AD43775BE0239B2A97FD8FA166A86E211E1D545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574942, "uuid": "af717fef-cdaa-4e67-9bbc-18a1356c5666", "value": "768:FP7iHSUqwdNtcBLl/I5wlmNZHqvYtWFMEA5gQjDwIcUjdWZP:J2qwdjcBLlQ5wlmnHqeWFUCYkka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786574942, "uuid": "e4c07b1f-bafc-4c25-99d3-ed9ee8149e88", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786574942, "uuid": "a495f7b2-9b50-446e-ab51-83317763ba67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786574942, "uuid": "08696ffe-dec8-48a5-b594-53cbf22813dd", "value": "068f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef292c97-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511342, "uuid": "13191a14-80f2-401b-9b55-7c315f35cc36", "comment": "Malware payload (Mirai)", "value": "309e9e9ec97d8c92d8b32fe4418d7ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511342, "uuid": "06e3e409-69e7-49c4-a515-a8edd3b1cbec", "comment": "Malware payload (Mirai)", "value": "bf4373cb99e00c66b6926c009462df36f1a105fd2483794c371f88bf893274c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511342, "uuid": "c11675bd-3124-470f-8773-3e856db7ffd7", "comment": "Malware payload (Mirai)", "value": "29a1e942f4452f910de32559e7ecba7a07517b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511342, "uuid": "dd2086a5-8499-4af4-8ed3-083cb3b27930", "comment": "Malware payload (Mirai)", "value": "9a9b573bcb00c1fe43d098972911ff489e6b215812faa5878319e9ebc0d1cf886b32854968cd4f33e5ac046ec001766a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511342, "uuid": "a5a03491-c193-4f89-a771-88ebf12f4a54", "value": "T143514256BA59C47EF43AF77E9A0301023072B389C0132B339FB7B8669C371989536947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511342, "uuid": "b7713433-a429-409c-85a4-ed9fef71ad0f", "value": "48:RpK+YTUF66TbbgkdRi8gc9UbAZKS2olfzr82El4QoiuQfQl4TFG1NT+:BYm6CZmbgF2olfzr82EWQoixIl4TcD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511342, "uuid": "89a7cdcd-4124-4c97-99c4-ebb3f07a4d9f", "value": 2860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511342, "uuid": "55a04fdb-9561-4715-822a-dc500549d373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511342, "uuid": "eb880e68-59ea-45e2-857f-8b78fa0aabda", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70320d9b-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786514995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514995, "uuid": "d71501a3-b926-4457-8cbf-8eb32626f8d8", "comment": "Malware payload (AgentTesla)", "value": "639d228cb466e2e75662ff24536129fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514995, "uuid": "27129189-3f5c-4ad7-975e-5a98d223cead", "comment": "Malware payload (AgentTesla)", "value": "bf6eb18ad8b1f477668a2e5a4a19774d194e6dab26e46197c9884a3d5e1020a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514995, "uuid": "92fd2d6e-af34-4700-8c32-d69bb7d61b7d", "comment": "Malware payload (AgentTesla)", "value": "1b6f99a868df636cdfcaf5fd826eddd79e3209ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514995, "uuid": "1f3c4e01-c5c2-4958-bded-69f60fd1ea64", "comment": "Malware payload (AgentTesla)", "value": "f0da88d36d1d453918abd192152bf5c2df517320b4f57e82e3bad54594fc7c69ad76a9d8634c7eb2129fb951d62edb83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514995, "uuid": "f55e6eaa-9dce-4614-a9c8-415f080daae7", "value": "T12BE58212A3046976BA3D4B2CC2776D28994962D713D4EF1EB5BC660C7BB2A27134C4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514995, "uuid": "5b997214-9efa-44bc-b529-7e11c7a25af7", "value": "98304:3UNZG+6PgrQ2ZkXk2QcxB0qSLOLrjkGu/bu8alW6gFkw/QY65/CJh4vsKWlEI:3UNZX6grpuBQcxB0qSLejcFalW6gtkC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514995, "uuid": "a3dace72-e3ee-42dc-9cfc-56c331ac4fb4", "value": 3317478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514995, "uuid": "584a0374-6091-4aa6-bdaf-4af0e555fb35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514995, "uuid": "ae8c623a-4b34-403d-8352-b54983ff3e17", "value": "JUL SOA 15,340.61 usd - 25008S 06WLUS1NC CMAU3178562.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed06eb3f-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511339, "uuid": "5ccccf0d-1dca-4b1b-9372-dd8f2e252a3c", "comment": "Malware payload (Vidar)", "value": "56d5c918136e6c55dd13fababf8d7cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511339, "uuid": "ab06891d-91d2-424c-bc48-e94f961dd393", "comment": "Malware payload (Vidar)", "value": "bfb2f8066b380d622b3b9ce884cf8be789a3ff3dc48409ce13afc522e032ae86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511339, "uuid": "36e5f9d3-1b19-4857-80c3-9c9df3c0d8c9", "comment": "Malware payload (Vidar)", "value": "fe0591d386048bbb3453ea90e0a8ecfde733ba1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511339, "uuid": "5ff574cc-a4a6-4732-9e0d-a59b0c56ba2a", "comment": "Malware payload (Vidar)", "value": "6e381c63677f63746c4e7dd9c6f13a4c38029ff634ca204b2c7c5fd13d73a6c89823d1b53f82e25518a96cbfbdbee179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511339, "uuid": "9c0e0e72-9d01-4851-b8e8-e1798a90a7ef", "value": "T1E1267D03B9A058B9E096DF3684B66166B6B1B80C4B3233E76E50FB7D2F363D05A70754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511339, "uuid": "1464d7b7-58fc-4d90-acc5-348c023355dd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511339, "uuid": "c89cded7-9dfb-40aa-8c67-01d53964bbf6", "value": "49152:usrGgL1+LMbT1hXjoeNXH8QzQw8HRSWdKwfPkqEsNiUpJKDcpHMIFm:u16bjJv8xSiKwf8gNiUjKDFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511339, "uuid": "6ff1ad3d-d5d0-455c-9f32-33cab0e72546", "value": 4829184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511339, "uuid": "00940dbd-1a44-4afd-ad92-721f651970c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511339, "uuid": "37daea84-b8ee-42a2-b61b-100bc77f8119", "value": "bfb2f8066b380d622b3b9ce884cf8be789a3ff3dc48409ce13afc522e032ae86.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15a70b5-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786522056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522056, "uuid": "d63d011c-6151-4380-9224-48e5e713232b", "comment": "Malware payload", "value": "3c9169a2c798b0e10a0633e63c5a1e9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522056, "uuid": "8fc7fe95-e49b-4368-b124-a33c57520611", "comment": "Malware payload", "value": "bfb8ea5fc2f94cf64c157d80a67830fab2159631ea0e031654be10582e24b53e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522056, "uuid": "7cd49e0b-558c-44d0-b61b-19a1ece1ea68", "comment": "Malware payload", "value": "bbe59c683c9fd801b10e5dbdd3fd995d6b65b742", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522056, "uuid": "a684b5b9-9ccd-408e-9da3-e06bc6a6fc1d", "comment": "Malware payload", "value": "b314aa77faddcc2f533c64b50a2666e123f911b4abc56831fa77630af68bc449efafa6404df7f77fde5c137c4b22f692", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522056, "uuid": "7a1b47c9-8dc5-4e94-95d9-398b42b10696", "value": "T1E576C5E134EF18A79E1AB369A11A57540B3FB2394B42B6E510CB37C8161F8DF25E085F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522056, "uuid": "a7e89238-f2b7-4032-ae9b-0db79ffe534b", "value": "49152:d5aeLfOs0LfIpMF6SJg5T+V/VtE3DLIzzDaTKqKmiyGFRZXNVQtPGDHZ5w76GNGb:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522056, "uuid": "b9fb953d-5890-48d8-be01-c05c0c4c71c6", "value": 7783923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522056, "uuid": "0c89f693-9387-4779-8935-56732173c9ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522056, "uuid": "36899743-4e90-4efe-af67-05ff23decbac", "value": "PO 0582604.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6f3347-9633-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786528358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528358, "uuid": "8f0b1bb4-799a-4f7c-b247-b4df7c051705", "comment": "Malware payload (RemusStealer)", "value": "fa8a033af2e630fa87b00d0f3c8060bf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528358, "uuid": "6ab3447a-92c3-43f1-ab51-8f0cb11072a7", "comment": "Malware payload (RemusStealer)", "value": "bfce5b0c71ef1e46a4c6974182bb8c4ab955478ba216ab1a182593c41d9bd73b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528358, "uuid": "2bd2cb5b-7265-4c25-8450-f8a2d31440b4", "comment": "Malware payload (RemusStealer)", "value": "00c2e7d99c933104d0f0c54858127128b6e0411b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528358, "uuid": "21629a52-9a56-41d1-9fb8-fcec1e805c6b", "comment": "Malware payload (RemusStealer)", "value": "5496b434769886d9394909721e31bcba87fb7ca094913a68f758a66d5b842d8a8e35b925d8649db56bcfe8928193b75f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528358, "uuid": "f8d7dfa0-4dfc-41dc-a00b-522e9eb4e493", "value": "T1B6C623161BD105B4E4B647B498E78ADB96317CE64AB0D6DF3398B68E0F33581D23270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528358, "uuid": "153fc92c-40db-4d6f-b5d7-fbdd62878811", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528358, "uuid": "8c25b029-f2ba-4b66-aa15-c7ea06d0f2d8", "value": "24576:8hfwoTm/a+jFlpQ5YUz8q3T9eYMyAQskI2aI1DNBhtLAayGGe/s:GU/HnpsYqjsYE0I2vNLtLd9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786528358, "uuid": "adbc3e37-000d-4867-a202-bbcf7aef3a4f", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786528358, "uuid": "80dddf7d-57c7-4e56-afa9-8800c1c4bb2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528358, "uuid": "e2a67757-2d5a-45ce-9272-f9829139b0b5", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519ec1f3-9688-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786564765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564765, "uuid": "14a07dfe-429e-46df-9318-041d396efb26", "comment": "Malware payload (Vidar)", "value": "cc299d617d21f9824a8349e7e7ca4f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564765, "uuid": "12352be1-3798-4a49-97e9-0f90b1251a23", "comment": "Malware payload (Vidar)", "value": "c0d979e8aef7db84784944f45c67d9c052b5b053ca09d152a0e4621605755b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564765, "uuid": "6da5c648-f3b6-4817-af9f-fa1112892209", "comment": "Malware payload (Vidar)", "value": "e9fa1f17850f521f5468291c4e45f3ccc1930e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786564765, "uuid": "41c5a863-abe9-44ac-868a-246de139c26c", "comment": "Malware payload (Vidar)", "value": "03837fd0dc4d85b5aefeff26aaf8c86df15325a27bc26b502f0ad3d5e5a541f52d68fb800151f1fec73323bb253cd569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564765, "uuid": "7df774da-16e1-4585-b31e-ac73210eba3c", "value": "T119567C13FCA119E9C19AA33588678252BB757C885B3223D72FA0B7782F727C06D78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564765, "uuid": "4757daf0-72cc-4cdc-bc83-242d98dede4d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564765, "uuid": "95f4c894-c58b-46db-972b-c2cb72b63916", "value": "49152:/ooUkbXy8gdAFkRSEs1MeAnrSSbgkP5Rnb29YXT65EDBeJKcK9KefVEa5Ero6:/xRhzMvnmSZnbsu65EDvEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786564765, "uuid": "57146de8-22cc-4da8-a13d-922b53d30333", "value": 6258544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786564765, "uuid": "5af46538-8415-4c89-8492-2c176060e673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786564765, "uuid": "e91810eb-e82a-46a5-89ca-f3caa8aa22a9", "value": "c0d979e8aef7db84784944f45c67d9c052b5b053ca09d152a0e4621605755b3e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ac8767-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786522795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522795, "uuid": "8bd47f1f-c7c5-45f6-810e-d1e716c39fe6", "comment": "Malware payload (AsyncRAT)", "value": "4175eff0ee048e1192b388279b8e07df", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522795, "uuid": "4eaa86f0-7bb1-45c6-906c-b67ba9c9de2c", "comment": "Malware payload (AsyncRAT)", "value": "c10a452ab742b8d8828ee5be406676a1069d54b69fbb122b91f855419f563eae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522795, "uuid": "01507832-4674-4583-bd8d-d3b79d0ca6de", "comment": "Malware payload (AsyncRAT)", "value": "655fd207c5654da35ade28dcb6aee2979ccffba8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522795, "uuid": "cbbb6680-52db-4bbd-8d28-cd26c8c19306", "comment": "Malware payload (AsyncRAT)", "value": "95f0978c2dafa198565fa2a87a24d8890d6ed9fb361fd4f115731bcd3b38cd19ea56f835c9399c37842e0d752a1d65e9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522795, "uuid": "d0f3d1bd-0374-4895-86d1-94dcf2228382", "value": "T1C035A056A52927486C30258CEC8572C9BA104D2B7623FF3C7A7C65CBC5586DEF22FDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522795, "uuid": "a9803416-3cc6-4da9-813e-c3b41ae7c7a7", "value": "768:uWFQ0xPxAeeUlQ2FsvFWRAQOFUvxP9PPRwRPvPRFUvPRTOPv/yvPFUPP/WRvFQAL:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522795, "uuid": "21f4b65f-a8dc-44ba-b859-240116c3394a", "value": 1153564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522795, "uuid": "f44668e6-626c-4de2-88b3-cce32b4ab60c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522795, "uuid": "d429706a-466e-4d77-b3a9-19bf5c8ff63e", "value": "Orden de Compra _QO994446788.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422b9788-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493013, "uuid": "40b5ef55-948a-4231-aaee-f7fdef0d3d8f", "comment": "Malware payload (Vidar)", "value": "e270973d2d20b01d7506c90e0c1f604f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493013, "uuid": "b15ec4ca-4cdf-408b-9131-c30d8d0c04c5", "comment": "Malware payload (Vidar)", "value": "c1701188408e47515e4b1defd672f1263ec99cd4e691426ea960a67dd40eed0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493013, "uuid": "b1e7b939-ab9f-4229-995d-605a34bfb06b", "comment": "Malware payload (Vidar)", "value": "de67521b0b92acca3c7051e6a714c0c776618efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493013, "uuid": "55516d6c-fe5a-4fc0-ba53-2963aebe6c4a", "comment": "Malware payload (Vidar)", "value": "47379a780ff357b305ce9555128602bbb09497d0ebd5810021b7ba65f41adc4a951a79bd9a0cbb4bcfc0a97ef79f9edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493013, "uuid": "41237f01-1cf3-4e51-af93-b0df33fdabc2", "value": "T1E2367C577E8048E5C0AAE731C8BB6596B670B84D8B3133D72E616E782F323C19E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493013, "uuid": "0ab2ba67-bdfe-4d8d-8a91-3038dc485cc0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493013, "uuid": "13cfffa8-aef9-4b5c-8938-972098c66e9b", "value": "49152:yU+zUKa8u4kVJDb5XG4ap3WoCjDOTw2ZjPz+Ai3GC0WFWkQges+WzNY+L8kwi+3D:yYf9hajPz2n0Rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493013, "uuid": "e3cbd84b-ade7-45dc-a59d-de91bf68e236", "value": 4982616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493013, "uuid": "24b22e3f-130b-411d-a42a-50da1c5eccbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493013, "uuid": "f5552d96-403e-40c5-8d16-19f4f431ac18", "value": "c1701188408e47515e4b1defd672f1263ec99cd4e691426ea960a67dd40eed0e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98309600-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511626, "uuid": "666faadc-fd7f-41d3-9fb1-0e121c2aa530", "comment": "Malware payload (Mirai)", "value": "98f5dd1ad9be7740c391def2aec34fc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511626, "uuid": "6d8c53b6-70e1-4a5e-bf3b-368557626380", "comment": "Malware payload (Mirai)", "value": "c1bc342ee5c97787f469d398ef0ec64c59edaf275fbbfbe7a5633f238e83a3ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511626, "uuid": "1829ffdf-476b-4303-872a-9ac5fb78b14e", "comment": "Malware payload (Mirai)", "value": "d8e503f03e491e6dae5440d71b289c9d40fbf937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511626, "uuid": "b1581916-08ba-464e-b7b5-be01951256cc", "comment": "Malware payload (Mirai)", "value": "bdd024ac399a2d573b41b54db8617d33f877d87db7b44d4bf414ee531ab0c7c53fe9360ba7f61d09d4be50d9b8f9e439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511626, "uuid": "54ec9a17-8378-4081-93bb-e4dd9901c569", "value": "T1CFB327C6A79D95B2C8450BF1F01DABB9F5339DA7C04FEE8AC3E9C02089D1E12955F168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511626, "uuid": "2e4248a0-2067-4bce-9a8a-5daff60e1bf3", "value": "1536:xO/BB0RoOkVCJAeXGY1I41Ror/iWevJiUMEomyQ+dxdpkU:xO/BGRXkwCIb1D/yiWeRiUMEomkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511626, "uuid": "f1a1c1dc-5237-4115-8c09-def04d3e1550", "value": 115764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511626, "uuid": "f33b3237-4bfa-4383-93c2-8120c1eaf790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511626, "uuid": "7ba1ec30-9234-45f3-9642-57aade85f6ca", "value": "c1bc342ee5c97787f469d398ef0ec64c59edaf275fbbfbe7a5633f238e83a3ea.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d02419-9666-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786550176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550176, "uuid": "615c07b9-39a7-440e-987f-fa81127905b8", "comment": "Malware payload (Vidar)", "value": "91e5de084aeca34f565954ce04ad466a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550176, "uuid": "8c03369b-12ec-4e3c-a851-c055e570d3b8", "comment": "Malware payload (Vidar)", "value": "c226c486d54ee56197ad84bcac9a8cc5d3e7c54cb5ee7b7c4bd4dfb339b9b77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550176, "uuid": "65cd5847-463b-4ab2-be18-e47caffa1f2b", "comment": "Malware payload (Vidar)", "value": "907b730253d92a06b2483c74b19ac639c16a282c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786550176, "uuid": "7ea7764d-22a2-4f65-baf3-5266eb8f2385", "comment": "Malware payload (Vidar)", "value": "aaf7aa3886f3427c0dfc1364f4d66f30f02ac8019e34fadaa15e9b87ab9f7162e70f1085a26eb720ae3febef201b6f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550176, "uuid": "860aee8f-1cbb-4993-b4fa-dcc5bc7b207d", "value": "T125567B13FC9108E9C19AA23189A79253BB717C995B3227D32F90B7782F727C06E79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550176, "uuid": "b7ee36d5-92bb-4aae-ac6d-3864b02db9eb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550176, "uuid": "281c0538-00b9-4101-9bb2-827e3b5f0413", "value": "49152:v9IWqRlVZE7Zl7Rx5ZSKHWBjg/GGnofs+xcoA8nU+mcILcq9zVC/0j8OnJ1VyugF:vKViRZ9HijyoR7Ug+cqv5PVCMsEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786550176, "uuid": "f42cbb82-7507-40fe-9801-d176e258af54", "value": 6266744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786550176, "uuid": "083005f3-fd54-4462-b23e-cbfcb3e8f6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786550176, "uuid": "6f30a1cc-67d8-41d3-822a-fc50859165f1", "value": "c226c486d54ee56197ad84bcac9a8cc5d3e7c54cb5ee7b7c4bd4dfb339b9b77b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65007ec-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786535272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535272, "uuid": "ce311b9f-efb6-4944-9602-a7b44a7adefc", "comment": "Malware payload", "value": "94fe2f9625332d7e5e75ffdb64f788c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535272, "uuid": "7e91122d-2f68-4e33-8cdc-c7be960541b0", "comment": "Malware payload", "value": "c2bf14ac72156961d49aeaf44857aca592fd1cc5b32790266f5e097d1b58f79a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535272, "uuid": "0295c517-4339-4669-bde2-fe3ba3fb0e67", "comment": "Malware payload", "value": "235632d849bf737d09f1de6007f0720ef07d7c08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535272, "uuid": "e66a13e5-57d6-440f-a22a-395dca06c433", "comment": "Malware payload", "value": "4bd8591f9326559675aafa5a02ed2de1f20034c019759c3e5614a00cc16c7f95273bee10e8ac4465aa809e73b0e70d3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535272, "uuid": "7a2236d8-55e1-4718-90c0-7931f74cff7d", "value": "T150841659F880DB6186C539BAFB1D52AC730707B9D3EA71058E254B3037EB86B0F3A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535272, "uuid": "c5bc800a-3126-4a4d-a3fb-35469ad7ef66", "value": "6144:SgfxJt4R8FQWl423gFJqqGeBADyv/KqinUVVaDTui39fyNapFF1jHHdDPhKNj+WR:Nfx34RWjzgsj0hiuaDh15bzpoj+UZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535272, "uuid": "34509e6b-a1b0-4212-8231-a86f2f5f356f", "value": 401008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535272, "uuid": "75bde3fe-7715-42c4-9ec3-f088ff0b4d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535272, "uuid": "c3c47131-e0e0-446c-ba1e-ca6b154d3346", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bb5d1c-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1786522733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522733, "uuid": "c689f1f6-e481-4605-b558-b15f777c1f2f", "comment": "Malware payload (DonutLoader)", "value": "641a768256b4e6b34a0537ef4fca922d", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522733, "uuid": "138b2d2b-086c-4b8f-8b02-450ccb093282", "comment": "Malware payload (DonutLoader)", "value": "c32805b1b784ca74d11592f8ffe833e68ec28a6727786b99767d09dd4e2d8e46", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522733, "uuid": "e404aae6-54e8-4b96-abb6-dd698ecf3c00", "comment": "Malware payload (DonutLoader)", "value": "f5eb411425b6782e1c82b21416d6c2d51cd1a97d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522733, "uuid": "9c096470-c265-49a1-9c97-9f14efe174b9", "comment": "Malware payload (DonutLoader)", "value": "1cc24c2e12b49151266c7d100c4bcac0414d6f0d1048ac2b51f3e0ed71e40aa17fb9925ed9e6e4bcb0847bb766c27340", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522733, "uuid": "371a7495-51ef-4088-bcb2-d188def19951", "value": "T1E7F5C772A01559E9F93E771EC25F6A000FAD299B3364E91F3E7C0944BF6272A11CE493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522733, "uuid": "68f52474-13bb-455d-ab93-77edb002fdd3", "value": "98304:ZFuOojyBFjvx0KQ4Ul3279N+hF5SO365gL3cZRmZZsK:Z1FL694U49N+hi5ggZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522733, "uuid": "9f8b1932-43b7-454a-a167-35a4f383e4ef", "value": 3457654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522733, "uuid": "bb5212ae-75b2-4ea7-a324-59d414f49c77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522733, "uuid": "7d83c095-872c-415a-87c2-c4623b20efb7", "value": "SOA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f647f7af-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "a3a1d0fb-7ce7-4029-b6c4-aede6e067983", "comment": "Malware payload (Mirai)", "value": "1cf212738d6b7712faae0c49fce0a298", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "b60a0f5d-73ab-4454-a0b0-bea593751833", "comment": "Malware payload (Mirai)", "value": "c32ba3b5f562be2e32dc4556fecde6f5e040767d80be676bf7c74d53365cc2fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "763b2ba8-103a-4120-a88d-725ad9281ef7", "comment": "Malware payload (Mirai)", "value": "3a41149e097d68d8b953fecd83898c6ea31fe838", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534976, "uuid": "153e8184-b00b-4b7a-86b0-b75ea6a17559", "comment": "Malware payload (Mirai)", "value": "44ea1a4bbac7cd2883a9e52ee91e87893dd6a9aeeae82890164d863190664bae653d83f03fd1b3599961b8be1d85b5b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "b0f0298f-8e69-4c49-9ea0-4aafe1344964", "value": "T112D2E17A93A3D075C3914875BCB58A07A5A4477DC47D70A73528D31802DB6C0AAECF8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "9aeafd62-7ef3-4de3-81f1-e888908e0a3a", "value": "768:XWQnVfQWFtZAV4+wOwInpn8Q+Zx0/r2ptzwA19q3UELy6:XlnuWFNQT2ptnIL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534976, "uuid": "ac190480-ce83-49b4-b59c-88e6d9bfba5f", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534976, "uuid": "610f0553-ca23-4cf2-9361-b473d1966191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534976, "uuid": "d8781348-fb0b-46fb-a5ee-876a2ddad3cb", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ea0a7d-962b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786525077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786525077, "uuid": "543e84e4-ccca-4d04-8290-f734744908f7", "comment": "Malware payload (ValleyRAT)", "value": "7e7c478b6016828d9bf035079574fdc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786525077, "uuid": "e82a7a63-62d8-44f1-b7e7-5e28415803de", "comment": "Malware payload (ValleyRAT)", "value": "c37867e844f570179d9aaa3e417149223c847e6bc9d58ab4997d03a3c66882a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786525077, "uuid": "f40f0fd0-0b90-4f39-8adf-a8803582e888", "comment": "Malware payload (ValleyRAT)", "value": "3a06411733349a44886b515e228c68ab28583809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786525077, "uuid": "305c9c12-8304-44a5-b458-610bade9d618", "comment": "Malware payload (ValleyRAT)", "value": "0673681ba6ccd4cc16d9f7e6211eb4201afaf599797a506d43888b77b3fc553670f10ed038f7ad31fa24af663a7a608b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786525077, "uuid": "f3c45d40-777a-455c-bbe7-980c8337d86c", "value": "T1B7974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786525077, "uuid": "c50557e9-75b0-49d0-9d9f-efb87bb33463", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786525077, "uuid": "642feeed-2c55-4c77-8e13-3a26ddfeac36", "value": "49152:AJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntm:Au/9nmHZLxG80DuKA3XAD8ntZfh6fgCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786525077, "uuid": "cc286e84-0021-4f67-8e03-4de78a0f329f", "value": 42629632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786525077, "uuid": "22c13b78-e46e-4055-91db-477f688baf49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786525077, "uuid": "4a477802-43c1-43e9-aa39-2134ebf11a37", "value": "install_c0b006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41b4f8b-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786522866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522866, "uuid": "96e32b94-c611-4e32-a9a4-683f257093ec", "comment": "Malware payload (VIPKeylogger)", "value": "5bdac921d30493fe5fc83f84d26a4951", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522866, "uuid": "d053ddb0-f541-4923-b499-b41806e65b1d", "comment": "Malware payload (VIPKeylogger)", "value": "c38504907acc99dc44931580d1d7d99e282bd02d1e4179a77115205090de1362", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522866, "uuid": "37046025-0bc2-4949-b41b-45ba99a1de19", "comment": "Malware payload (VIPKeylogger)", "value": "b58d97a214e364f37e601db78a577ecd226c825c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522866, "uuid": "92c50f2d-ee4a-4fcc-a3b7-0537c8ac0b62", "comment": "Malware payload (VIPKeylogger)", "value": "d68524970fe8b52c86f15707f7135ac4e05a54d2103905e8ab5d01641655997dfdb65aa394e5d17a5969bd7f0d6e9893", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522866, "uuid": "d96ef024-467e-4dff-91ea-30d5ce3a5e48", "value": "T172F582411740A532B322EB7C85BAC930AD0DA1E7A5D9DB05B06CD26C3B3CDD77359AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522866, "uuid": "d02697f4-b629-4d49-81ef-7f6ed31c3aa0", "value": "98304:ReznnD4t6dcvMhim4lsadPxMDd6p/TrV1KYmvIKiw/XkPci5kNuzilfyb4/:kznD4Iuv3idM/KywEl6Nhd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522866, "uuid": "ccca1ebf-f415-44a2-a73f-a4c49870e32d", "value": 3459142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522866, "uuid": "eff50d05-fd5b-46f3-bfbf-752e6e6a71ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522866, "uuid": "e4b7666f-791b-47a6-95d8-6a6f2ed7f3fc", "value": "vmtsqzef.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6397bc1d-961b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786517980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517980, "uuid": "69210b85-1890-4204-a54b-5f1f082a58d2", "comment": "Malware payload (Mirai)", "value": "9e4185ef7ffc1e89d0e088e16f022099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517980, "uuid": "74c25027-a807-4aa4-8472-7d819e0030e6", "comment": "Malware payload (Mirai)", "value": "c3880adeb8224d9fb1924ff69698f433fb182a12e2ba0ccfc8d011194e4fa774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517980, "uuid": "23365ca5-c447-48a8-ae4c-db9ff9fb0875", "comment": "Malware payload (Mirai)", "value": "26db8994c1d8032c65c4d80d57071a7ca30b5fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517980, "uuid": "c033eea5-212f-4ca4-a904-129437507bb4", "comment": "Malware payload (Mirai)", "value": "387d0c9dea00c317a425910cc0512d12b410b3f34ddb057af8d43cc78373d17fc57a013c6520ad4e5f2af841ee8a4b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517980, "uuid": "4e29dd8d-7d29-4784-8504-1adcba5be195", "value": "T1F424970E6E228F7EF269873447F79E259B5D23C623E1D641D1ACD2101E6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517980, "uuid": "21e4c3de-0d5a-40c4-806a-af72766bc9e4", "value": "6144:uRNjBiLEFDd6OnGPfl8/e39TR5kOTw/fLO:6BiIFDd6OnWX9+fLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517980, "uuid": "ddddf617-7f39-4c1a-a64c-e79d2ae092f3", "value": 227068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517980, "uuid": "3ef3a97e-bd1d-462f-9a1b-79b307fe6451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517980, "uuid": "a68d1d8a-15ca-4cae-abf4-d65c884fd02d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c4291d-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503200, "uuid": "a8b4b102-ca31-4bea-a6f3-04d66110126b", "comment": "Malware payload (Mirai)", "value": "00e6114eeb482411970568fda986deb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503200, "uuid": "635b3e59-a6bb-4cbf-9ecd-7276c426a5f6", "comment": "Malware payload (Mirai)", "value": "c391b6a62a44001982eb46e69da8d969a9de4e2164e67964bd99f5783e2381c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503200, "uuid": "a0fd692f-0723-48cf-bcdc-a87b4f6b40dd", "comment": "Malware payload (Mirai)", "value": "c59484ac4afe3f01ef208d07fc675c0450c226f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503200, "uuid": "dfaafc3d-ca5a-4f3f-b5b3-832c0aca2696", "comment": "Malware payload (Mirai)", "value": "756f815b856a8c8356bab95c2a0936f7faa6044d76eda0fac17f15c27b29eb5709f8a8d255b745c1b22de9d26b883aef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503200, "uuid": "576c8ff0-38c4-48e8-bde8-79a67d306265", "value": "T1ABE37B72E8262E68C165E474B034BF795F6395D582835FAB65B7C2B04043DCDF908BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503200, "uuid": "db1f3d60-f11d-44b4-9762-c4d36eb1b109", "value": "3072:zue03q0tp+vXeYPM/X+e6acKomTWXLmsYH8vm:zVAHX/X+YRCXtYcvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503200, "uuid": "eb57ac7d-c906-4762-8365-142ecdc8d198", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503200, "uuid": "1516dab1-cb75-4659-aee1-4593abd31fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503200, "uuid": "f00168dd-7ced-43c9-a215-e407091ea1a8", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7124fb88-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522727, "uuid": "ed658c8e-9362-47f2-9e56-84f7c86404e5", "comment": "Malware payload (AgentTesla)", "value": "e86ed4f64310bdd809d057c9d81d96fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522727, "uuid": "303a6a45-8a2a-4121-b798-b511d1b99d8f", "comment": "Malware payload (AgentTesla)", "value": "c3aa1d3ffe66344c1ba4995ca9329616eaf253bae7d7aa536ada39d2a070ba39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522727, "uuid": "0d08b490-9933-4a5c-a338-c043e6dba732", "comment": "Malware payload (AgentTesla)", "value": "8cb55d2f291af788f0d40deffe9e1fc16d73ffef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522727, "uuid": "719f4762-1347-4dfd-a828-1c373f6e9ab8", "comment": "Malware payload (AgentTesla)", "value": "2fad22fdd9bd689e06fd2bbd25cf9a50fc6f0654b8bef3c22b1ea2e91441b690fe397a98716845fc47c53ac3f8cb6009", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522727, "uuid": "e6543181-67bd-48b2-bcf5-d83a75f0677b", "value": "T1E8F56F6816048C7271AE572CC8F6AB704909A9831099FF5F307CB60ABF75F176B49DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522727, "uuid": "a0f3e665-6945-491f-a214-4abf799d4317", "value": "98304:dHdMrZYaGNmhtBeGkoss1R3xVzZtomiNoIM9bcRf+tjx1+rh+ffl5JMK:Ny7D9t5zpi1wffl52K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522727, "uuid": "1ac51708-64af-4495-b8fe-bfede390fdc6", "value": 3326246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522727, "uuid": "54751c5f-6e64-48ab-af68-cb050d7c92f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522727, "uuid": "34b63b21-9899-4b0b-b7f2-5eabb83c31ee", "value": "12 AUG 2026 REQUEST ESD.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4852344c-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500325, "uuid": "67bcbcdd-47da-4006-889d-9995f363b5b1", "comment": "Malware payload (Vidar)", "value": "da36e5356b11f58b7c8588a4d7d57b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500325, "uuid": "8092862c-b24b-4d06-a5bd-53c10d3e7a30", "comment": "Malware payload (Vidar)", "value": "c3bb2ed2e9082d896d46c00a900e5dd07591a44dbe4cf5c6581c3d86a10df6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500325, "uuid": "2ff8452e-6e2c-42d1-a3ca-1c03b3164d8c", "comment": "Malware payload (Vidar)", "value": "297025b132da5ea66f02daec205198640df8c9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500325, "uuid": "59f92cbf-0244-4619-9243-ba33d434d5ad", "comment": "Malware payload (Vidar)", "value": "8944e67ef06de35fe5f42c0cd432dda16034a06dc4b4d778ed81180e9ec8a4362cac680511f559d808014fd345c07b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500325, "uuid": "9402d14a-a0a0-4a06-ae4c-7d6124385837", "value": "T1A9566C13AD95897EC0A5EB3685B682037629BC4C873133D32E71AE783F267D25E35B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500325, "uuid": "f4cf630c-b12e-46dd-888f-438346cc6353", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500325, "uuid": "d1fdd4ad-225a-4972-a50c-f72e9acc92d3", "value": "49152:F3wRn7KZkmf8VHHBykpspavQAkBJ59gfGK6Kl2RnGNmDRJm1qaPs:FANpMBr4HQLV6qaPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500325, "uuid": "4469a3e2-165e-48d2-ac49-cac0de13bcbe", "value": 5911224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500325, "uuid": "2eed0584-f8c3-4d61-acb6-1e157e9e46a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500325, "uuid": "56426ba4-ae2f-490e-b3a3-31fadc7431ab", "value": "c3bb2ed2e9082d896d46c00a900e5dd07591a44dbe4cf5c6581c3d86a10df6a9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd15dcc-9618-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786516846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516846, "uuid": "4d636e58-b79a-4944-a2d8-29d01a01d0fc", "comment": "Malware payload (Vidar)", "value": "291478270cfbc4c66b38ccfcc394b48c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516846, "uuid": "816c8606-5787-4383-8709-cf11f79122de", "comment": "Malware payload (Vidar)", "value": "c455c4186d3bc4e56bbca3bfa9d8d8900b15376102f9b201bab7997df3ac1d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516846, "uuid": "56e8e0f9-614d-438c-9f39-efaf36ab034a", "comment": "Malware payload (Vidar)", "value": "6aa09edff8804e224eb28918f9a29cc473999681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516846, "uuid": "3fc71790-9801-4f93-91ab-286d6df4fdf5", "comment": "Malware payload (Vidar)", "value": "b6ecbfacadceafe90afe2ec18c030b2ef7f0d0d31f9f232281c62cc3c40f2144ef3fef87e6f3afc3314a7fb8f2fe7f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516846, "uuid": "3ffee2a0-3f1d-43e9-adae-e4bb7c13f915", "value": "T1A5267C077A9509E9C4A9D735C8BB1225BA70BC0C8B3133E72E507AB82F723D19D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516846, "uuid": "184e23b8-7f60-4e14-bed5-e760d16e2e80", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516846, "uuid": "cc4a079a-9ad6-45e5-833d-70da4aee0646", "value": "49152:y5+cxlUysUMClxpV4mHh3R4NVgmJTU/Ie1Kfyexkgu7:ylZlbKWJ/afjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516846, "uuid": "4b3c2473-744a-44f4-a61e-c694f8df9a13", "value": 4524392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516846, "uuid": "e2a973a2-c8bd-414b-9267-d3348c937314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516846, "uuid": "bf911a30-694a-4337-bd16-b2f37aea63ea", "value": "c455c4186d3bc4e56bbca3bfa9d8d8900b15376102f9b201bab7997df3ac1d6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7966f8fa-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507709, "uuid": "4fa6b0f8-998d-4f8a-b447-0777a5efe4b9", "comment": "Malware payload (Vidar)", "value": "c47bc35c5156c22e8fd944390145f3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507709, "uuid": "49c7b2dc-8f2b-4c64-81dc-d5db6f10c5d5", "comment": "Malware payload (Vidar)", "value": "c480d70249e7bf29bf86a39d58045a134cdc9dafd21a01fddace4fc69c64f840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507709, "uuid": "75a68ea8-4d9d-4f02-b7ba-a0c48b1e431a", "comment": "Malware payload (Vidar)", "value": "45955ae6fb1ea88032c3b79281b893b627d86c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507709, "uuid": "4c1b5526-2021-4dd5-a42c-ec0b68a0b9ee", "comment": "Malware payload (Vidar)", "value": "6eb171292ef1f9f67c5311e675055b639f583e8af31da0fd009bd3cbf89f0ababf89b4a257463d13b8d76b059b25235f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507709, "uuid": "68e44158-9bbe-4331-809d-1e75f3df304d", "value": "T179167B13AC9189FAC099A735C9B75252B624BC0C5B3233DB2E60BEB82F727D06D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507709, "uuid": "2856a091-0ad0-413b-b0dc-25661f32a2d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507709, "uuid": "032c4c1d-54e1-4a1d-9173-df9a3a9469a1", "value": "49152:Lp5g8IpMTCfw5vLUk8XCiUeY9uwgP0xPs5sriGcMRwX:L8XwGyhe0hxPs7zVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507709, "uuid": "592939cb-ce99-4a14-a5cb-025597267e0a", "value": 4195680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507709, "uuid": "54fd7312-26a8-4ab6-89b6-08b0f6a57a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507709, "uuid": "54d5e7e0-7956-4033-bba8-209dcad7c78b", "value": "c480d70249e7bf29bf86a39d58045a134cdc9dafd21a01fddace4fc69c64f840.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486f134e-9614-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786514928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514928, "uuid": "39cf0582-0438-4141-a45a-710f84b694d0", "comment": "Malware payload (Mirai)", "value": "f862aefb2a298ab96db4ed61b30bc58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514928, "uuid": "3c5344e7-9a6e-4f5a-9234-4397fadc5100", "comment": "Malware payload (Mirai)", "value": "c491efb952e59c9af2f68a88325265beb002d57e9b94875e152ce6ec5833f8f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514928, "uuid": "a848c755-f867-425e-a479-909ac72add8d", "comment": "Malware payload (Mirai)", "value": "a5d66aa53aa80a481fa616d2722d94280904498e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514928, "uuid": "235e666c-4bc1-4390-98c1-9f04008946cb", "comment": "Malware payload (Mirai)", "value": "e55ef5a018268ae9165d25235efe885bf147c603ca9402517f0e5271dccaab1819be418dd0778d6d79c3ecfd9b47a95a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514928, "uuid": "fcf87d79-a958-49cf-bec6-c0c7d48c9991", "value": "T148B2C02515171DF1C3F4453B3C6CCB6AB6D2097483EB376131A242A61F9449E8AEE74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514928, "uuid": "f42a0fd8-0f09-4b1f-99b0-01fd4107a883", "value": "384:vrPk8WhogEXai3+KU8WmSUoJGJYvbLy5pwtBFu4JUgSiAD+kI+JpAwhymdGUop5P:vrVhg9i3PdBoJG8beoUWM+kjs3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514928, "uuid": "347c6bc8-d2dd-4c54-b0ca-56b727719f6c", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514928, "uuid": "f71e6db1-6bb2-4485-a2e1-cebec18d9570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514928, "uuid": "c3439190-653f-4c7b-bf72-b291a707882b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697f3b53-9633-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786528298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528298, "uuid": "55216e5e-9900-40b1-b4ad-84599c83334a", "comment": "Malware payload", "value": "590ff0e67fcb774eb049994c9f5b48eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528298, "uuid": "9e81b92f-a8c5-4ea1-8ffb-2699aabaa9a6", "comment": "Malware payload", "value": "c5a7a655fd20c44359ad02d28c6bc5a6c0bc9037084780541eeef4691450a9cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528298, "uuid": "06892838-cd65-4a60-b7fb-5f0e940cf30e", "comment": "Malware payload", "value": "f89adec04cb9d0ebc36de5323ae6def6492b7634", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786528298, "uuid": "b9a329e9-bbca-4b43-b97f-c768c9155b31", "comment": "Malware payload", "value": "eee1e984b7015a5990a910f9fb912d64f0e309e8f55fafeb3d78477be2a7a366c1811aa4d8fe90ca41026016078c0108", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528298, "uuid": "c431a820-9088-456a-a851-4875e4059586", "value": "T17231449E00151A322103D98D72A3358D728DA4F72DDFD7D4AD890DAA82887DCF664F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528298, "uuid": "3111019d-2df4-4355-8d89-021dc924cd16", "value": "12:UCNi6CNWkIZNWK6NWiFdF4G5r6r8wq6ARnRJI6JQFLjHr6jXaYaVpwDi6D0wGNIp:nS8k7Xt/5QFvMF+pjw73IEWAW3hbJfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786528298, "uuid": "01a8e5b8-7b4a-4e05-8b5d-5139d3cc4d07", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786528298, "uuid": "2e75ece0-1c49-43c0-8ed0-7b139649030f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786528298, "uuid": "771876bc-adea-4a36-b2b3-7083cbfcb5e9", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f22a30-95eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786497532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497532, "uuid": "e6a49bf7-f844-48a6-b37c-a90c94ecd513", "comment": "Malware payload", "value": "b93773f9b9095ee65825af3993f9fbfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497532, "uuid": "c1544753-0c76-4359-a263-b9b3afa9b526", "comment": "Malware payload", "value": "c5dd9e8c0208ef12b84edbb57362e2a07c5c0bf94b581036411dfa55962b6129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497532, "uuid": "b720d7c0-e2cc-42e7-89b1-89d332a6b4aa", "comment": "Malware payload", "value": "5285863411f46cb73e4239428f30485e46dcfc34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497532, "uuid": "ada0a90a-5afc-44f3-aa01-d71b03925956", "comment": "Malware payload", "value": "3e8952e6c2391027cd9aac15532188bcdf623f0b6fb3b47808d8e083475c3818259463e990e04e842b7063040d0ff888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497532, "uuid": "430105a6-0c33-4574-9879-bab27c27b312", "value": "T1BAD312E388FEEDF8D8348176256077A6DA0B7946A5315F5F00B703EA15CB20A7A40F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497532, "uuid": "57007cdd-1d30-4eda-a71b-bb9da8f2de79", "value": "3072:btsxPD3fh/NQS3ygOJqxxj3C+YpQW3WhoHKmOG:bt6TiJcj3C+YpQW3WhoHKmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786497532, "uuid": "d2df52ef-f8d1-4b5f-b269-8392443f96e7", "value": 134100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786497532, "uuid": "6240ebe2-60d8-4131-a7bd-47fbabfc1dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497532, "uuid": "65445aa8-cb14-4deb-bfbd-3b1fe7e94b2e", "value": "c5dd9e8c0208ef12b84edbb57362e2a07c5c0bf94b581036411dfa55962b6129.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47830d2a-95e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493452, "uuid": "34d020ee-46b1-4a76-bf94-1e0e03200eda", "comment": "Malware payload", "value": "05c66d6a617caaf9f46dea5100cbee1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493452, "uuid": "61f951b3-60b2-45c9-9add-4bb023bf8581", "comment": "Malware payload", "value": "c6c7871a42450de0143f735c5932824025cf97c2f2f3e91e3b148f3a81a9d6b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493452, "uuid": "07e07e4f-a57c-49c4-83a5-e300d8fd3069", "comment": "Malware payload", "value": "231d8a43ceb213a78a488d2332bc0d1deedcf120", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493452, "uuid": "c4875439-2086-445d-af5d-d91dd9efd31f", "comment": "Malware payload", "value": "6c4d1a2fd77221133add20c159c7762c82e956689acec2f21228ba3beadfd0b1b095b04c6dbfc76fc42ea3a4fbfee399", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493452, "uuid": "8f7897b9-007a-47c5-8cad-cb0caf439993", "value": "T1E7673386573D67F9A95B1B3B433C2E0E204B0AAD8D70D3B93681661871AB3813F74776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493452, "uuid": "d1c4e45a-3e60-4140-b755-d4ad326584ee", "value": "786432:G3oPd7tpqHKASj3idJ3AxC/nPacpoH4uFpoQNTH:G3o1mqfj3oJsCHagoH4ELJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493452, "uuid": "7612b7ce-efa3-47a4-a063-60e6228132d4", "value": 32546405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493452, "uuid": "12309c18-de34-4b7e-95f1-68bc805d6776", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493452, "uuid": "a5257be5-9974-4ea3-a7cf-9c40fc33fa2b", "value": "userenv.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4db1e74-963e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786533202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786533202, "uuid": "28427a76-6da1-4259-9faa-111cb446c717", "comment": "Malware payload (AsyncRAT)", "value": "47e22518ce2d2cead31849af777e4027", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786533202, "uuid": "8333c9dc-11c3-4933-9150-299ddf8db5a0", "comment": "Malware payload (AsyncRAT)", "value": "c7a9ed85f2352d7473dbb61391b94aa1538aa883972415c6a7a62e9b5eeba1f6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786533202, "uuid": "12d1731f-d8d0-4d0a-8636-49c737b2bf8b", "comment": "Malware payload (AsyncRAT)", "value": "83a336ac8a33648adcd60969e91b59da62103359", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786533202, "uuid": "d1721af0-b1a0-48c8-b3c4-ca6965addfb7", "comment": "Malware payload (AsyncRAT)", "value": "fa758f04c1b10d4c3538b2e26791b96310e3a870404eb3eb4531b945ddbd1f80ebb3206deac3d570e5ae418a52a7c54d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786533202, "uuid": "9ddc4390-9ff7-4dd5-b52e-f2602cbb79ab", "value": "T163452BE323FE718666143B5AD40E99084B6EC53E1982B6C1B0DE47E4872F4965BC0DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786533202, "uuid": "347953aa-efc8-4045-835f-9bf59c0e5f3d", "value": "24576:m3EJGXwtnyeJE2liz4Ly+6k03EJGXwtnyeJE2liz4Ly+6v:wKxjl6PKxjl6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786533202, "uuid": "c7879202-45ba-42a3-96f5-ed3e7b1aafd2", "value": 1259497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786533202, "uuid": "59a0d2b2-55aa-4904-a391-c2f664658216", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786533202, "uuid": "55d4edf0-ab98-43e1-994d-33358196cd26", "value": "LOA-AD-142026944-7K.Rivera.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63ee312-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786522870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522870, "uuid": "ac201ba8-af56-4b5c-a2b7-7eff379f2ea1", "comment": "Malware payload (DarkCloud)", "value": "45ae817d18381310ff331d9ac56a7971", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522870, "uuid": "88c6eeae-4ea3-4597-916a-6e2ac82e5c88", "comment": "Malware payload (DarkCloud)", "value": "c7bcff0dfe5c93d1f9bde81c22586c4dca5b295cffea816bdd0b5824522e6b5d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522870, "uuid": "767f9e02-8169-469a-8b4f-ae25dd740727", "comment": "Malware payload (DarkCloud)", "value": "8cded5524a891b41f236634e82357b36c5b93cee", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522870, "uuid": "0dd53479-05c8-4b56-be9b-634b9c81ad2a", "comment": "Malware payload (DarkCloud)", "value": "a6d8224e1df7590822d31cecc6f84adb2f37aceb3267013c82035a87b13407122493c7be05a26bb696c450b117203778", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522870, "uuid": "d9117f81-872b-4663-b328-53d95364774c", "value": "T13B3576AFB78A1C1CB6862C7FCB4B51B45AB8894E4630654CAE6D4DC8B353C944B31DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522870, "uuid": "eb63f447-8fea-4726-884c-b90f19c86a4d", "value": "3072:iDmDXDrchDUzJDjDLz/zvchDjDrchDUzvchDVD6chD+chDjDqDLz/zJDqDUz/zJ7:dqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522870, "uuid": "7ac71dba-0abe-4b67-a534-9e84a07bb5cd", "value": 1107808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522870, "uuid": "e511c88f-03b8-42a3-85aa-6cc7ef2c4bc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522870, "uuid": "1b9af3a0-bb9d-44fc-ab9e-2d1e2e17540f", "value": "Datos_Bancarios_ZencoExports.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b8cf29-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786522765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522765, "uuid": "f64dd24c-baa1-4a0a-9cde-d449a98d1b97", "comment": "Malware payload (AgentTesla)", "value": "9a3c325f2aaed787d3998ecae4238002", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522765, "uuid": "581d33b5-7646-4524-8ffb-00dbc5d4950d", "comment": "Malware payload (AgentTesla)", "value": "c83e87ea829d00529365ae850274a20534e62879d8adffeb1903362b7bb2661d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522765, "uuid": "836b78ee-2889-4e3e-bec6-de7c3763538d", "comment": "Malware payload (AgentTesla)", "value": "9aef38dcb578e1e5648689a7bef29901e97843a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522765, "uuid": "7c2fdc0f-57d7-41ad-8660-d000279c1f83", "comment": "Malware payload (AgentTesla)", "value": "4d92c815717c3d3f442ef91aae0c4f3552d2c9c47f5cbf38f8c453dbb91ff3cacf801094417fd8970ac5f802549f1fdb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522765, "uuid": "0827e582-ed24-4d17-87e6-efed40d64d77", "value": "T173E5834093479675723DAB9EC6B695306A0B10C3B0C5DF2E356CA214F718E3B670EADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522765, "uuid": "ab598a8c-3a93-4868-8f74-51562a6e1b86", "value": "98304:MW4uT4+F6lAU1om3voLnfJpzwr7Fp6GRheFGPkKq9RkjstGn:auSlAU1o77f4r7j6GR8FGPkKq9DGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522765, "uuid": "07a2d964-03df-4805-a7c4-c8d000c4e2bf", "value": 3317478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522765, "uuid": "9792c45f-6dfc-4cce-8694-bd0cd2291cb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522765, "uuid": "ede53ddb-0d9c-4961-bae2-ddfa402a40f5", "value": "Purchase_order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6e1ce0-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502426, "uuid": "6dc32d4e-ab19-41ff-a905-db42a2a0a399", "comment": "Malware payload (Mirai)", "value": "2b68b73f32ee01549f31154ffd851970", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502426, "uuid": "4bf5e45c-bf30-4186-9986-1c79838c5504", "comment": "Malware payload (Mirai)", "value": "c90bb2d7835e0978738ee925c44880218e258aefc126f3f11bd364ce52312bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502426, "uuid": "c191d09d-cf2b-471d-8d32-6423ee8f6696", "comment": "Malware payload (Mirai)", "value": "1180708f761d37fb6c08febb47d9ec74e196e07a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502426, "uuid": "4a54e459-7682-45c8-a0da-1a850fbdb609", "comment": "Malware payload (Mirai)", "value": "3f1889cbec332ce194d86de7312dcdf958f7eb344d0e7909a0cb1f8ad1c6e6cb4fcf3cb48ea72bdb2ec61aae9a331b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502426, "uuid": "d67c7e33-54ac-4d3a-abe3-d8520e563649", "value": "T10E43F2262EB1F371D57DE8282E74C1EA97E2027CD74D38692229C1E523D1F4799E250F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502426, "uuid": "05089b0a-3087-4fc5-a617-ede98f6ba4b2", "value": "768:noqfcu/w/oaGzssiIexqZquQs5L62Pc8wU5oIowtUa3nOjU9hpWt24DWwuOaeovN:o/WwgJssix+qbp2PolfwtDXWhKOaB8zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502426, "uuid": "cf00dde4-6ad3-419e-aa8a-35a43f8ebb77", "value": 60104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502426, "uuid": "185828ab-4724-4f0a-8b09-ca47d16a26a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502426, "uuid": "105bdbd1-aeb5-4e47-84e4-9257321cd969", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfaf732-967f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786561132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561132, "uuid": "39537f27-4374-45e8-8124-bb4863798a8e", "comment": "Malware payload", "value": "9abad0f02325035034365353804e035e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561132, "uuid": "03823628-b756-408a-971f-e92d91b1e5c8", "comment": "Malware payload", "value": "c91aec7eea473d54f6f4bdfd15e4f5e1f7e4f72740cbfd92364dfdf4fca75bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561132, "uuid": "62b7d7c6-42f9-4fa2-8a67-dbc48bf46ed2", "comment": "Malware payload", "value": "8458da0d8ed5cf2b521712a5e6915ba48dd04c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786561132, "uuid": "725f0466-ce29-42de-8d17-cfd7500c004e", "comment": "Malware payload", "value": "20c3be64d4dfe5d728224a52c460b944659f14c4a6d2fe6b46338347b6bbdb414c91c71ef58f2facbb41604da1a6ed23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561132, "uuid": "a0c6870d-38d6-474e-806a-50eeb63052c9", "value": "T10E267B07BEA108F9C1AAE33589AB4212BB74BC4D4B3233D32E50AA782F727D15D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561132, "uuid": "45b442d9-8dd6-4012-9635-3edec1f62085", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561132, "uuid": "b77fd80e-28e9-47fb-8150-5a99d5838601", "value": "49152:yoHVmHat/2n9oeLgDkF+9tRoH0NM18wlX2NhAbcsqZTUaP6jcn:yGf489+18wlX2/ocsqZPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786561132, "uuid": "66665743-3d7e-41ae-bdde-ffdd40019ddf", "value": 4612200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786561132, "uuid": "2f753a93-0ea6-478f-a4e1-2a3b1721dc89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786561132, "uuid": "22955f44-1525-4135-b74e-7d5d890d95e1", "value": "c91aec7eea473d54f6f4bdfd15e4f5e1f7e4f72740cbfd92364dfdf4fca75bd6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b4cd9d-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509531, "uuid": "f182419d-5a3e-4972-8b56-1542ad849df0", "comment": "Malware payload (Vidar)", "value": "f240fcd6045c4ed504dc40ca77e4ed1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509531, "uuid": "eeabf04d-59c0-4a05-9192-1a040bf5d2ab", "comment": "Malware payload (Vidar)", "value": "c9fd6c006c7833acb5417db9a98823bd6e7836339a8485b8e0a9f6e156793530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509531, "uuid": "9d0b5063-b4e2-4d52-bcc3-c40db128134d", "comment": "Malware payload (Vidar)", "value": "d576cfdc5172c81978fc5a3c764b9af0b3aa8ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509531, "uuid": "950ffa53-ca20-4331-b311-5dac3f8a72a2", "comment": "Malware payload (Vidar)", "value": "e0904bbb1d7465fd16188c471fe2829ecb66c679e0dbfed797818d49bfefcd62cafc2717e7943ea19934dfa15cee5094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509531, "uuid": "00ba81c4-13f5-4d1e-aa59-c80d307915a1", "value": "T1CFE57A0B7CE0ADEBC4A9923288765292BA61BF454B3273E71E50B2742F337D48D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509531, "uuid": "64d755e9-3736-418b-9065-938ec86f677f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509531, "uuid": "622f13b3-541c-4e4a-ac25-a2516a498b40", "value": "49152:tWahbVUIbIflj6t5CWL23unmYSQwOq+RMannxD:tWmzE3unmYSQdqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509531, "uuid": "35281164-5534-4547-b74c-938973c171e1", "value": 3155304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509531, "uuid": "2b4f5046-0e53-4cd1-ac69-d06bd516ec65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509531, "uuid": "871cacaf-5714-4cc3-bc79-5d73db43c7c6", "value": "c9fd6c006c7833acb5417db9a98823bd6e7836339a8485b8e0a9f6e156793530.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37550d1a-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505880, "uuid": "cfabd64a-1da0-4a10-bfa3-f43c3e1a1bfa", "comment": "Malware payload (Vidar)", "value": "e0c8055d7614d54fbd58c39fec94bfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505880, "uuid": "bd0a8e07-f7ec-4298-ab3c-9334a7ba8a6e", "comment": "Malware payload (Vidar)", "value": "ca69ffee2100206195db76e46b62110ac0c24f00b4a6a747f3cdf23f7349e3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505880, "uuid": "a44a3e00-481a-48be-97d0-6507bc169adc", "comment": "Malware payload (Vidar)", "value": "6e0b578df775a68eb99ec013b51f79500a185fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505880, "uuid": "aadbced3-1e98-46b0-8ac5-d553a545e196", "comment": "Malware payload (Vidar)", "value": "4073a9b274486749748b448f42564983a81897f681395d3a6ff184cbc9fa6c235ab6eac108c73bae3010a24e1eac5f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505880, "uuid": "7ee51932-7801-4cc2-8738-ecd59a309764", "value": "T1D9E57B0B7CA149E9C4A9A33789B252927B75FC490B3223C72E8076783F727E14D79794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505880, "uuid": "25eff0dd-377f-4716-ba9f-d8ad42916977", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505880, "uuid": "96d7f11e-9887-4526-becb-563036230aba", "value": "49152:1nmHcbvLhh2SfGu8qvs99cG96rWKqzV6tarsg2:1mEt8qnRrWdzVUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505880, "uuid": "af418ca6-d02b-46ee-b63d-ff4bbf3f7926", "value": 3021664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505880, "uuid": "25be96ff-2d82-49d4-814b-49b0405e1cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505880, "uuid": "45abb3d2-d47c-44fe-bc3d-dbfc2783a926", "value": "ca69ffee2100206195db76e46b62110ac0c24f00b4a6a747f3cdf23f7349e3f6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04a3135-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786539234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539234, "uuid": "2a31d37a-866f-4e97-8af9-c51964ea560e", "comment": "Malware payload (Mirai)", "value": "f4ea80ef31eaf0b5c8aebd57e53bb8e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539234, "uuid": "ce27202b-1815-4be2-ae7c-f4b48e9afc4b", "comment": "Malware payload (Mirai)", "value": "ca93431a830b141f45a3a0dbd6190389f209f8eaebba8c6b7ed93481943264c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539234, "uuid": "a1019c6c-d59a-44ad-9a32-07683fdd4652", "comment": "Malware payload (Mirai)", "value": "ec2ccee64b64eb39dd45c826b1f696b2e713d016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539234, "uuid": "5a565dfd-7f68-4de5-a975-306f3d61325d", "comment": "Malware payload (Mirai)", "value": "b9d30a9ce332740c94f61273798c93df293b581d919fa15091275bea2a43258c42cd742d9a63bb3c10fdbe6273d9ae99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539234, "uuid": "0c9f43c2-5847-42da-a189-fcbca4a694f7", "value": "T1B0B35B73C82A6F98D618D5B8F5718F781B53A950814B1FBE5AA3C2B94043D9CF6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539234, "uuid": "a048c5d2-826f-4ed6-9f07-368b707918ac", "value": "1536:iJBzYytAwt6VSBYdx7TKC7LiZcgO9iW2U0PmlKaiF4n+ebzrQF7G:iJdYytAPdx7W4iZcrsWp4msa3UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539234, "uuid": "1a2cd54b-3c0f-44fa-99e7-059c247a3fb2", "value": 117348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539234, "uuid": "9f5aa108-a895-4461-bc06-12ea21072e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539234, "uuid": "06d86b1c-95e3-4905-b1ec-bb536125bf1b", "value": "miron.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22ccc71-9660-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786547801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786547801, "uuid": "c0ed6fd1-1615-4373-9884-2865508ea70f", "comment": "Malware payload (Mirai)", "value": "43fd51efaef065b3aaff617a593956e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786547801, "uuid": "0210dab3-803f-403e-9639-10d8747539f4", "comment": "Malware payload (Mirai)", "value": "caa12a4a7996b0101c252cef5092846cc8ecfce380115800af0d4e038bc46856", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786547801, "uuid": "f971415c-ea8e-47e0-9946-de44e6829892", "comment": "Malware payload (Mirai)", "value": "e70760dc77904b68d792c6b10dfa28d0b74c71ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786547801, "uuid": "30424554-2a8d-4679-bc1d-203f78b549bf", "comment": "Malware payload (Mirai)", "value": "2308e98f38dca964b30dbf3db109672b9bfad136bf06011730d218d00292e6284ad2f7233cf48bb9c8a6b9437028d403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786547801, "uuid": "70c0c603-4b51-42e9-bfe4-49480ef46e43", "value": "T174E30845FC458F17CAC366BBFB4E428C7B2A1758D3EE720399256F21279B85B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786547801, "uuid": "b1f2984f-14a9-4eaf-98eb-51218acfbf63", "value": "3072:Dc3HGGusTi+AheoayAmYAmwT8pZdrXGu5Taf55AHEd:Dc3HGGuBB7DYAmwuZBGM2f55rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786547801, "uuid": "5338d7e3-c43e-4f64-bc1f-08708a5955cb", "value": 145976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786547801, "uuid": "a224890c-0175-4a20-ace8-f9c019c2a232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786547801, "uuid": "02db24e2-c6aa-499d-9d4a-dd28211db54f", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b81296a-9644-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786535549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535549, "uuid": "4a2414c7-342f-4857-a698-3d40a1645f3b", "comment": "Malware payload", "value": "d5dda9e656d5915991ff36eddeb45de7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535549, "uuid": "2cf97c39-467d-459c-8793-74a06c5ca320", "comment": "Malware payload", "value": "cab88d241cae8ea133ae5d115fe4b5d6ebb257095802c3c32a61d81f6e8c5a76", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535549, "uuid": "85af29a0-2379-4118-a30c-3b4e0d450a71", "comment": "Malware payload", "value": "b92a563becb9366cf9ba356ad4b30f71b0b09cba", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535549, "uuid": "53853264-b27b-4a52-9bf6-b2feba6c6c24", "comment": "Malware payload", "value": "c36f79bdea38eb014ee6c40001532c3b10dcb51eab42c57e9adeca9a9424eb0f56e40233318c3fe3afdf5cc8049da559", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535549, "uuid": "6c9eb70a-4867-4f46-874c-60b33d4982fa", "value": "T1D6E6330888D0F28DD5BE5539F7EA2279E41970281B3665DF6B9D8B523CC33E48D3849B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535549, "uuid": "4d813993-cba7-4121-846c-0464e5d9d190", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535549, "uuid": "63f6105d-a5eb-46c3-9070-0382d5d503f7", "value": "393216:DOGVuS6bvuIVeV0y61uXMCHWUjWcuI3/PGTAI:DOvTjy61uXMb8rH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535549, "uuid": "94405f49-adf2-4ff0-b0e0-ddd1341ae52d", "value": 13876438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535549, "uuid": "7c4fac3f-cb52-4e5c-ad71-f42fb4514372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535549, "uuid": "2a30779b-e2d9-4bfd-908c-aae01cc8d61b", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386c173a-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505882, "uuid": "5d4d4ad7-b119-4b24-a4cb-859f3a217f91", "comment": "Malware payload (Vidar)", "value": "954a464ea9f549bb6b8d981bf74975a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505882, "uuid": "80fc1ff8-12ca-4cc5-a0f9-f552e1969917", "comment": "Malware payload (Vidar)", "value": "caf81d3443e34f121fc641ac93d9d6e68e12ed08e365a222000ed1d81aa52bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505882, "uuid": "de60a2cd-8d15-47d0-ac4b-43573b690242", "comment": "Malware payload (Vidar)", "value": "66fb5130e6f32a59681a051c294f81fa1fde783f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505882, "uuid": "aff70284-a1ed-4992-b25d-cd083b2a2d11", "comment": "Malware payload (Vidar)", "value": "091db2a62653b5644970bd456e9696229af7ca36c1ec7647c7340a0c46f7d58b7a5247134b012d92daf58ba80a273930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505882, "uuid": "10e76625-d8c9-43b5-b38a-876f83bf7a29", "value": "T113168D0BBCA00DB5D48A533699A14145BB39FC9B8B3337D32E50B67A2E367C1AD39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505882, "uuid": "b1e5ab72-c00b-423f-90ba-8f646dfdca3a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505882, "uuid": "799a6dcd-c04f-451c-bb00-70273b6cfb82", "value": "98304:wpDv22MUH8NXru9uk7Zl71ErCm95qL2kmrbmYRktzh4rj:wpDeFU6Xrugk7Zl71ErP95qakmrbmYRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505882, "uuid": "a6a4b815-0ab7-437a-a540-271ae2a3b65b", "value": 4250624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505882, "uuid": "8494f2ea-c991-475f-8ebf-234c530398bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505882, "uuid": "80bf4dc5-898b-4455-86d1-4edaa272fdc6", "value": "caf81d3443e34f121fc641ac93d9d6e68e12ed08e365a222000ed1d81aa52bbd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f26e4f-9690-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786568398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568398, "uuid": "294708a1-401e-4831-9cac-6e6ff39f7bbd", "comment": "Malware payload", "value": "8ef82d7bb436b700b32fb0cb0e3b64df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568398, "uuid": "6c7f934e-e529-4881-82fd-f11f8bef05b1", "comment": "Malware payload", "value": "cb68c082c22d3f2751ded48b1fa24d079ef1378bb7352353634b2ccb6985c44e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568398, "uuid": "ce7a571e-8d30-4b1e-b171-3460158785ea", "comment": "Malware payload", "value": "9e3fcc975bf699ab362838794c21211b4c6129de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786568398, "uuid": "d5f4dc9b-1b37-4534-88f4-8da7aa6ced4c", "comment": "Malware payload", "value": "9ebc3685fac4e47b6a6c7d162ed4d37fed2db0e90d409381ae9ca4caa2c047fad9799e7025b4f86d5c3a3712b38d2ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568398, "uuid": "c3d1b3f9-5849-4374-b52f-c04e6da4c4f8", "value": "T1FE866B07EA529DB6C4A6E63185A64247AB74BC3C873263D31EB1B2783F767E05E34314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568398, "uuid": "85077a28-3303-4648-b97a-da3b01ddff6c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568398, "uuid": "6405b1c2-f8e9-4359-8195-9ed7035ff474", "value": "196608:CKLyXZS7gvPKLjpqQ7mNuaQWDzc1rO7M8+mkOUpEE9IBrdAL+NFv5EAoHr:CKLZ7gvPKLjpqQ7mNuaQAzc1rO7M8+mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786568398, "uuid": "77d75364-9679-4642-900a-aef3f2950176", "value": 8260560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786568398, "uuid": "e64cd883-d05d-482f-900b-e2aed412eca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786568398, "uuid": "b1875925-a5fb-49ef-ac14-1c35f29c54f7", "value": "cb68c082c22d3f2751ded48b1fa24d079ef1378bb7352353634b2ccb6985c44e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd20d08d-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504064, "uuid": "35e32941-f441-4b65-bfd4-d82434ce9bef", "comment": "Malware payload (Vidar)", "value": "b3535c8aaa4310bbe3acbf490e37bdaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504064, "uuid": "b3c57f13-f9fb-40e3-b09b-cb1d08dfa418", "comment": "Malware payload (Vidar)", "value": "cb6df19146b3247b93780ae8f3085138929717500ec5a3e14cca1e313f244962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504064, "uuid": "46767c90-3ede-4aa0-bbb5-36d9d51f7f14", "comment": "Malware payload (Vidar)", "value": "03a24df10b84c92335bfdc441508801580ac8419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504064, "uuid": "6ec7ce8d-3978-45ab-980d-134bf696dd8c", "comment": "Malware payload (Vidar)", "value": "65acb35024d21ebf6468e1c977e8f79412f8de1cea26c451477912839df14117e0b8fb0c3a0b5a505bad62510f4d1a6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504064, "uuid": "efca485d-d834-4574-9e6c-cdbb28105d50", "value": "T10306AD0BBD905975C4D9A33594BA02417B3DBC6A8B3233D32DA0E67A2F323D18D76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504064, "uuid": "84b0dc41-fd2f-474b-934d-5e2c495f4ba4", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504064, "uuid": "491f6ef7-4049-4bda-a051-5b9a03444202", "value": "49152:uIVy5AeD5ZimHc5VjtpE0NPOkFoUIwsdxR:uIspc5VjtOumk6UIw+xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504064, "uuid": "bcec95d7-edd8-4036-a69c-dbdd5aaf7959", "value": 3737256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504064, "uuid": "4f899dc4-909f-4dc9-bb2b-a7d88e2d6cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504064, "uuid": "7015256e-91ca-401a-8559-c1d6c4b98a4a", "value": "cb6df19146b3247b93780ae8f3085138929717500ec5a3e14cca1e313f244962.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a171641-967e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786560565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560565, "uuid": "4331742f-543d-4f7c-9c4b-5a4216e2f251", "comment": "Malware payload (Mirai)", "value": "51148b4c46e6d4d6231e5b085a5c3a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560565, "uuid": "b078f443-bd79-4584-8100-d194f98d0b5a", "comment": "Malware payload (Mirai)", "value": "cb938eeafd41a95adefbe4711e0ed136cca6f5704b5d4727ecaf6a0933bcde42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560565, "uuid": "becf8dd3-d590-42fe-a594-dff5b7899b61", "comment": "Malware payload (Mirai)", "value": "1b2ed0bf298a06efc92961fe0d6beefe121b9d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786560565, "uuid": "f157f323-7bb1-42bd-a9cb-85bcb18cb177", "comment": "Malware payload (Mirai)", "value": "4feb135c9ff3b83de582bc7d037f05d53f656bd709d45f82648af51c5eba1e02d755f0df913ad8fed0d73c40412a2fe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560565, "uuid": "3c18fcdb-96ab-47b0-9149-133e00abd97d", "value": "T1AE530291C7568AA4FAB66ABA0F76C07D63B4483F3231D1C241915F58EC13B307D59ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560565, "uuid": "3d583b47-0de2-4500-a1d1-ec3dfadcbce5", "value": "1536:zfK62fqkCJq7RFHEuYANGIf/26vHFw4u+qgw0re:Fh7qttrNGXIlw4u+qgwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786560565, "uuid": "f28c811b-353a-4db1-9018-aca8bebe5c2f", "value": 65532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786560565, "uuid": "c08abd2d-3b54-45b7-af1a-0c98bd8c0531", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786560565, "uuid": "1455a444-8206-4efb-b5b5-3fc953f8eba5", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f835947b-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "37003e25-5f74-42d7-90db-78a2c8e1e46f", "comment": "Malware payload (Mirai)", "value": "348a3d258562acee2b8ee303cd915433", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "be4db63f-ebf1-4785-a8df-7f3019d211bd", "comment": "Malware payload (Mirai)", "value": "cb9c5a44de04796ec2bcf12a7d2251cbb43e9a833773b5a5eeecf2a65851b9b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "4112c670-cea4-4c0d-b8cd-65ffc06f4304", "comment": "Malware payload (Mirai)", "value": "5d6e23a783c93dac2123883130faaea81beccb7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "eb96747f-6ced-4f75-b130-2a8aef108750", "comment": "Malware payload (Mirai)", "value": "37a10596fb9d346cc9ad01e8d5953deb0ad9568938e33e1f1e1ccb636e9061674b7519ff744f9f0c2c1ee25f884676b6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "5ef9bb45-9b13-44a0-8eaf-45bbc3dc21c8", "value": "T13333F1388B0001FAD65A56BD4DBF8FE04AE60FD4D50BAC499765FE818EAA3EC1503DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "d380f5b5-a970-4df5-be39-0b91bbe33822", "value": "1536:NMQCePsf6a7y3F8T9KN9MhOPP3FIwV9fVJuTA:N6IsSae3FVHoOPP3bVBVQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534980, "uuid": "c50e35d4-c4f8-46d3-b354-747a57529e54", "value": 51284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534980, "uuid": "5218f041-383a-444a-8e57-deeffc8e0cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "2b5907fa-3fa0-4563-89ad-aa5ddcc78945", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37bc7ee-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512584, "uuid": "a1a4a411-9b51-4c21-a8ca-eb7b6148d209", "comment": "Malware payload (Mirai)", "value": "66578d9033052c4f830a97c5b1231c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512584, "uuid": "8a3c9a7f-ce3e-42ef-aa14-465b4ddf0c5d", "comment": "Malware payload (Mirai)", "value": "cba7ed56223b23067524ea25b19cabbb9d709d8065ca47ab6b881451b48dd5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512584, "uuid": "19aa4b53-2156-4a3d-adb1-e2cd9e68c4c0", "comment": "Malware payload (Mirai)", "value": "482fcd9661e7122cc1beeb304a0c0262cde0b38e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512584, "uuid": "099f72d7-5a49-477b-911d-7d7ed3bfcf6b", "comment": "Malware payload (Mirai)", "value": "f1f9947605419fe150f1fe6dac11781bebda68c745d15bc9f18c2a62477f1edec4fde626c4517854d06521d15543eff0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512584, "uuid": "2a24240f-e458-473c-9bec-f889e5e0750f", "value": "T16E732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512584, "uuid": "33443f39-094f-4186-a0a1-e9973a645880", "value": "1536:86dz9MTC0XU66EeGpT5brAMjztPz+Sbjt+UvAs/hY:86dS6EnTrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512584, "uuid": "99d0bca5-cd0b-4381-b00c-2011d46bb739", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512584, "uuid": "eb714e7c-c58a-45e3-b19d-5cc7a0b96cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512584, "uuid": "2dc55a64-34f9-4d72-885f-b9ceb0b01707", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604f5aac-95ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786496929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496929, "uuid": "8dde0d49-a999-4ca5-8cc0-f3635e16caab", "comment": "Malware payload (SalatStealer)", "value": "ab086467dfac61d025686ffe13917b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496929, "uuid": "871fbfcb-b841-4bb0-bc0c-17206d98022b", "comment": "Malware payload (SalatStealer)", "value": "cbc9a1a22f5cef93269bf47f2cb52c566dc95bc536a62ece27cbea006d6c63f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496929, "uuid": "a5de6b66-565a-4a7e-8cc0-406a1ee28c59", "comment": "Malware payload (SalatStealer)", "value": "3fc4ab319007dc0b36c832073b6f20d23464de7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496929, "uuid": "b05d332d-40de-4c8b-8eb2-c0bda411455a", "comment": "Malware payload (SalatStealer)", "value": "caaa5451ef0ebddc1db7c0e27d07e8e48700cfddf5d9347b3333da48c97ab8465a09dfd2e41438ee83f28b82001f77e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496929, "uuid": "2a417f56-5095-4dcd-8edd-74fbd600ec1a", "value": "T157749F19F7A414F9D667C57CC9524906EB72BC124760EBCF23A04A972F236E09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496929, "uuid": "a91e37db-c508-4b2c-bc67-2f1e23baa4a3", "value": "f60a2674d3a7b81ede413bee880e7e3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496929, "uuid": "7e9ec1ae-530e-4c0e-be92-cb501f741657", "value": "6144:YtjeQjoWjJK5pGtYAEfzgsb0/0MJgllOeuN:mc0UpGtGs10MJaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496929, "uuid": "0f36462e-07ed-4730-ade8-493c2715b570", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496929, "uuid": "a544a4fe-5cb4-48eb-8742-1ac8f2382750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496929, "uuid": "ffa9f2cf-052d-465e-9dc1-4b109c729590", "value": "MM2DUPE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c1c91c-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520022, "uuid": "792fd792-9dce-4822-96ae-e66503763962", "comment": "Malware payload", "value": "98b1da42a84f725180f021dbf1556b2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520022, "uuid": "e51c39f7-ba72-4c77-82fa-ce9f4e18903a", "comment": "Malware payload", "value": "cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520022, "uuid": "c2d28c79-05a4-40e5-8dbe-a19e501e6e6c", "comment": "Malware payload", "value": "c1a650ab0cb47a6ba6b4b3dd70e344db4aeeb859", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520022, "uuid": "1e34804c-fe7f-4b40-85bc-106ea119cebe", "comment": "Malware payload", "value": "215e006d210c6952871f25a0168a18e34dc1d8d035bfbeeeb849e2b8ecd09dcb614f2dd203aecfc6752649f37bd4285a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520022, "uuid": "39f46937-b98a-4bbc-a677-3dc54ea84000", "value": "T1A33123AB01105A311202DDAE7367354CB69DA6FB2D8FC3D4DC080DE9924C2DCF261B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520022, "uuid": "4aa5a6b7-9432-4728-9d1e-5fd27ad11c15", "value": "12:U2L62PLNjlO6ylF/6FfJ9FBQB66r6iOwE36EH0i60qUCCetbcgZDai6aNdEEJZWK:JvJdUdsccsLEEJZWVJrcSKaJwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520022, "uuid": "1a054326-e503-4f26-931e-6936fcd4d9c9", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520022, "uuid": "782b0dbc-f2ae-423d-bdc2-824aeedee9fe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520022, "uuid": "9c6731ac-09bf-48a9-b836-c2d487888698", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d737685-9675-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786556651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556651, "uuid": "b39638c8-fee5-47c8-a3df-bce9c0b9aef9", "comment": "Malware payload", "value": "6587fc1ca7b2c93e3fec87344f5b9b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556651, "uuid": "ce88c227-a75a-4eff-9753-cc513cff621b", "comment": "Malware payload", "value": "cd1dcfe992c4a4df8e5cb406d298c118e1f81ed9d3eebdc116e4bce9dc544367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556651, "uuid": "4ae82332-17f6-4941-af5e-aed3f76b118e", "comment": "Malware payload", "value": "63673787306dedf5a48c41ba55531f7cf0ebfbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556651, "uuid": "77aa5efe-01a0-479e-9818-d68df6d2f63e", "comment": "Malware payload", "value": "af09d2087955aeaa7263b6e03b247b14d82628f46fcf845c1a0569399cd3009ed380f88bcac6a737eb25f1a3894cba34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556651, "uuid": "cddecb3a-7c05-4286-8b39-9e6c1d6e4c6a", "value": "T1EA35298332DB5CA6DD932B7910DBA3396735FE708B6A8B674124D2327D136C26D1E780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556651, "uuid": "080c2234-8bd7-45e6-9d3a-31a49d0102b6", "value": "241833d9f3a566b747fde068be089d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556651, "uuid": "31fc83b7-c56f-40d4-a6af-d2f3e03c5400", "value": "12288:xZDq+cPeO6scEVS0xhypR+Q7tr7pFPSH16f5QFX50josaonh:x19cPX1xYH+QTy50josaonh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556651, "uuid": "6b449d8d-3947-4098-8cda-9b3e36e02379", "value": 1147498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556651, "uuid": "0cef38b6-8465-4cb7-9829-7719c73914ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556651, "uuid": "a1e8dd79-192f-4b59-9b66-bd34f16fa269", "value": "cd1dcfe992c4a4df8e5cb406d298c118e1f81ed9d3eebdc116e4bce9dc544367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479e37e9-968a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786565607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565607, "uuid": "45eb7577-c159-48c6-9437-f94fa97a43ef", "comment": "Malware payload (Mirai)", "value": "adfbf87ad3f04374eba549a79abb1698", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565607, "uuid": "f894ec75-c267-4314-b042-4276c4fc36b0", "comment": "Malware payload (Mirai)", "value": "cd69aa2c38616f4f759476e47d98a5d1d0d761d193d73360e309d255fd327985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565607, "uuid": "2ae8d185-7058-46f5-8ce1-c6006292fdf0", "comment": "Malware payload (Mirai)", "value": "e71df12b525e3b556562c310c87d144c0c6b1149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786565607, "uuid": "99d72555-8783-439c-939d-f8b790ed3a62", "comment": "Malware payload (Mirai)", "value": "087228f26873e0626d2d53d618c87738d371b6d33d8d0af90f38d6de41d205b1072258a770a71368b8520d30ed1f3e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565607, "uuid": "1f3893c5-b554-4918-8443-60e74ece18f2", "value": "T15E145BA5BA0F6C42F1C2D3F9DE8C83F17E1735E3C67689B1781213ADCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565607, "uuid": "97eb572c-4c8c-44ae-a576-c6096c3f8bcd", "value": "3072:n7OOQhHies3QaARCFk0RSfwGXH7zWsdNfJ2EMTa3Fnoq:n7QhH5s3QaARCa0RhGX7zx52Ednoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786565607, "uuid": "1155f546-5768-4d29-9f59-6737e3ff8f29", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786565607, "uuid": "4db1c396-a63b-4b88-a5f5-58e5dc1d0b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786565607, "uuid": "fd856a77-1e67-496f-94d2-750777af84fc", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df815ef-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521890, "uuid": "87806070-79c1-432c-ad9a-53c9929fd3d9", "comment": "Malware payload (AgentTesla)", "value": "43c671174e325152d6514317be49181e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521890, "uuid": "bbc5d7f0-65f6-4eb9-bfbd-879b597db291", "comment": "Malware payload (AgentTesla)", "value": "cd80f4c36a395ae636332270f79eb3e9acc94cc1778bfc55422a7da4ae1dbe69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521890, "uuid": "d790f815-a525-4f50-bfde-ab7e845b426c", "comment": "Malware payload (AgentTesla)", "value": "405f9bd26a0298cfbaf696c78b91defca0f98986", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521890, "uuid": "e157021d-a6e6-40c4-9aaa-804c713929f3", "comment": "Malware payload (AgentTesla)", "value": "75f38a65a7502df40398c1824b7c21d2fc47fe9b197d5082f9a9696e5b5d967725931f379e20ba77b17aaa78512ab94d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521890, "uuid": "6efea5aa-4704-45cf-930b-dfa73e41506e", "value": "T100F5D5A610A0B745FA6A85A94E0F1F444A2EF2C3EB54DCC7372C45ED1F14BC12968BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521890, "uuid": "bf76f2ee-f361-4acf-8719-e718fe3f4f52", "value": "98304:G5eiF3FdluA2RmpQi/NURAzXq02LOnvf6GGasQzRQ/WkeBin9:AdLuRmHe/0/vfjL7q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521890, "uuid": "4659e2e3-1b83-4262-8fb3-256e38557772", "value": 3346262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521890, "uuid": "94c41322-274d-4432-ab77-32804f173faa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521890, "uuid": "de2ac48d-c9be-4ebc-9452-f68b22aa7aab", "value": "Purchase Order - BHPO26-2790 pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ffe840-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512587, "uuid": "3c0dccb1-c9b1-452f-8e4e-e063d553fbc6", "comment": "Malware payload (Mirai)", "value": "f0bf66e3a97ad95ceef3c0dbc55c9ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512587, "uuid": "37b66f46-a02f-4f8f-81a1-74c0d4177d1e", "comment": "Malware payload (Mirai)", "value": "ce8493d6cd76206df8a66045986a1ea2ec66df83d8bd3c6f13399ae81dc590f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512587, "uuid": "c26764c3-af01-4ee6-a12d-b34a4b9da564", "comment": "Malware payload (Mirai)", "value": "1b848c28b3c9a4256d32551a1fdb4336a7253c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512587, "uuid": "d0e1c948-ef12-4906-a807-70bf147b7e85", "comment": "Malware payload (Mirai)", "value": "ece7886cfdba1c2d98b136555eda92d9a5b7eae196c3535ddd28be527179889d0dbea08ff9c7a65609a03ef2280a080b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512587, "uuid": "abbb4ae3-2037-4494-b007-8acc10d1ad8e", "value": "T1A9831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512587, "uuid": "af9b95dd-3df7-48d9-b60f-daa7baa382d1", "value": "1536:ijna/CzPC7fG7rnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Mm+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512587, "uuid": "20457b8f-3dc1-4735-8753-e4406b19421b", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512587, "uuid": "aab008e2-7155-44dd-9581-f165bfbff63c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512587, "uuid": "f53425f3-5608-4efd-9ad0-824295cf35f7", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84960ee2-95eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786497419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497419, "uuid": "161955c9-3a4a-4928-b67a-2d17d5706d07", "comment": "Malware payload (RemusStealer)", "value": "7c4561ad60b9f8c69fcab6fbc05959e0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497419, "uuid": "76c9962a-cd4f-4b3a-9191-bb1e799672c1", "comment": "Malware payload (RemusStealer)", "value": "cea846a93d72c55d3a36191e995d89a8b6774f4b5de22680685b87f8c07d0d5e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497419, "uuid": "ed497394-c1ed-42e1-825a-9971ca9bf73f", "comment": "Malware payload (RemusStealer)", "value": "c07bf0a128ae2444f896747ffe0fc0a56c0dcae1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497419, "uuid": "eed3a942-cfb6-4003-b1cb-6f94d087b4e7", "comment": "Malware payload (RemusStealer)", "value": "b254fec208500fc2cabcc10570572fc7ebf548ced22f905e3ad270f90cfb24ff60dde502adf9133238546bcfe81b45d2", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497419, "uuid": "6edbf8da-6ed2-48e2-90a9-15ff1784b741", "value": "T1E9264917AD6104F5C1D9E334C8BB8216BB74BC484B3533E32EA0AA782E767D15E39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497419, "uuid": "53c1f211-1e53-4d04-b7c7-41add4c49b68", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497419, "uuid": "c6f05cd2-e4cf-4b65-8039-0d6a993b9fb5", "value": "49152:2YjYecj/y+nSKpywKwFcmafEMyRnG4HEjhTD0e+c5:2LKqIfakPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786497419, "uuid": "c6c3a157-e906-49a3-a270-045cd17e39ae", "value": 4554088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786497419, "uuid": "9c1234f4-b7eb-4e09-b661-cd2391eaee35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497419, "uuid": "7eb3c751-b94b-48ff-91eb-93766c625dc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8641ca-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494834, "uuid": "27fdc599-4205-47c2-879c-d4a7703db114", "comment": "Malware payload (Vidar)", "value": "07cdf5e3cdf9e54c413a18f1e8a9ce38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494834, "uuid": "b91055ed-6ead-40fc-a574-c6a03c59915b", "comment": "Malware payload (Vidar)", "value": "cef34fc38128bee9d3f3ff85632fa9acdda27c841e75093c66c87b4759a3ee41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494834, "uuid": "2a5bbf14-36ec-44a9-a7b5-b7e62ca011af", "comment": "Malware payload (Vidar)", "value": "1796c39fdf186a78bad0752e590e3f092cc8d9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494834, "uuid": "9bc2e8a6-03d3-4dbe-811d-04b2caac6d7a", "comment": "Malware payload (Vidar)", "value": "4874aef7858f5e9290d92004a5a0dbce279431810044ba90691c53d4607f133f8d29320ca68424e95cfd901c1b3b4da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494834, "uuid": "9339f10c-55a6-48dc-9fd3-e1fd76e717fe", "value": "T158267B03BE9548F9C0A5E73589774252BA74BC4C9B3133D32E60AAB82F763C06D79B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494834, "uuid": "03a945c8-e00c-48a3-af52-ab518ebacd92", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494834, "uuid": "110966c5-4337-490a-bffb-f3f3d96fbfe0", "value": "49152:B1GdbSeRnOAkp04Y7k9VCxZS5fxwB08twdvVNPRbAtyT:BYa041n1gm8edtPbTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494834, "uuid": "f1ee872d-9194-4299-b5d4-f6f2f3a66fb2", "value": 4720496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494834, "uuid": "aab2a60b-528b-4d47-9cc1-76c0f2db7726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494834, "uuid": "4b196c59-ef85-492e-85d0-c9c67c7942ed", "value": "cef34fc38128bee9d3f3ff85632fa9acdda27c841e75093c66c87b4759a3ee41.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48d8aa7-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493232, "uuid": "e1fd7a15-7c28-4f52-84a8-553ea3103fbe", "comment": "Malware payload", "value": "7b89e93517629017990304a970db251b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493232, "uuid": "c7e71a7c-7387-49c7-8287-dd7560332c29", "comment": "Malware payload", "value": "cf1ae9ca1d4a009ccdf7a3d2112019b9b577d55a75b992b2f050570a15d6e05c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493232, "uuid": "484ee7b5-0665-44ee-9465-6e1988955181", "comment": "Malware payload", "value": "9c25d452bfe063bda5279e8acc5f7d4eca2af1ea", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493232, "uuid": "715b7bed-34cb-4324-b544-2c6be7518159", "comment": "Malware payload", "value": "e0123090950127f22aeedde699eeca191f7152da02f6832699b311c28e466878b8ba99f18dd93ed48186d71e832c7de0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493232, "uuid": "76dfdce5-a159-43c3-8782-4033d6b8ea94", "value": "T1C137332AF0914901CD27E3B2479EA680B3F3DA426DB209627E7D1EE73C708D56395B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493232, "uuid": "218f7e81-cb75-48c9-950c-0a501e66a628", "value": "393216:ubG0BaqJAzdoX8+qUqrnsy2QiO/dmwi8LnKshR/fDaEaSj7QTud0Dj6/CXvnJu17:uSwaOAyX2UqrnsbQiO/O8j3hND1aSHBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493232, "uuid": "1fce633c-848b-4820-b52b-fb273ab51079", "value": 23792084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493232, "uuid": "0370e4fb-ab4b-4bb0-a1d7-819c6f42e44d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493232, "uuid": "24b78426-a949-4350-ae6a-2784bdddaa81", "value": "SmiEngine.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5d423e-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502159, "uuid": "49a5b4bd-fb2e-4e0d-980d-131a7667d832", "comment": "Malware payload (Vidar)", "value": "b917b58a2119b802960e7efff7e4f521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502159, "uuid": "cf779a70-d038-4e95-95c5-be6e711fa4d6", "comment": "Malware payload (Vidar)", "value": "cf5bb941c7345be0e4066363b3b9f1a7ccf821f3b925881986cd097e71d319e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502159, "uuid": "6c020422-f372-433f-912c-c0234b0a2be9", "comment": "Malware payload (Vidar)", "value": "6fada042f8de85e27a731a6995088ba12073b61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502159, "uuid": "423f0d15-71ba-4d06-9554-53eb377de8da", "comment": "Malware payload (Vidar)", "value": "e59a5e5b3fd3df31c4eca553b8d80c4e1a6c4253a9e0facbd9f3b632c53c4e7d680eb40a243356515fb3f2d54f0018ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502159, "uuid": "6db2bede-2143-49c4-9cd3-8ccffb5e7c29", "value": "T10D069D0BBD9089B5D099733248B652417B3CFC5A8B3A33DB1E51BA792E727D25D39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502159, "uuid": "ac03591e-8ef1-470b-9dfe-fb1b0d39f8cc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502159, "uuid": "082d57c2-8088-40a7-8346-87d7aa80b348", "value": "49152:sK4h7N4yTuy8Oq9wjeoLNftU2MdhTnzf7517eVGH0dTlx4:sKklXq9C9ed5kUmJx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502159, "uuid": "9a669983-1d88-4cf1-b0e2-5377c17bf2de", "value": 3834448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502159, "uuid": "175013f9-f511-485b-bb12-50edd8deba59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502159, "uuid": "17b21729-f2eb-4af1-8186-ebcde93a7493", "value": "cf5bb941c7345be0e4066363b3b9f1a7ccf821f3b925881986cd097e71d319e7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d53ba4-969c-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786573437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573437, "uuid": "6cf5358c-d15d-4381-ae98-452dbd784c86", "comment": "Malware payload (CoinMiner)", "value": "f8ae197268f46a6e5b443532aef82c52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573437, "uuid": "78baed0a-c861-488f-b0f9-14e013be45e2", "comment": "Malware payload (CoinMiner)", "value": "d0294a7caf27f11e40af507cafa5627b65b5096b5cf9926a31d5cba0993fc1da", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573437, "uuid": "c93fc603-aa6c-4898-92ad-89531d5f6374", "comment": "Malware payload (CoinMiner)", "value": "31ab8fe40bb4f1d8f069ae2494b6c8050f954037", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573437, "uuid": "4c877017-b94b-405e-95fa-a478eaac4255", "comment": "Malware payload (CoinMiner)", "value": "5c7c339212b623f30297001baa7de5567cb94134d674ab0a42b671ba6bc6519fecb4e50e48253f7652594ae034f9a289", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573437, "uuid": "546769ef-a007-4b73-b694-1416aa5407f8", "value": "T1073633D62DD241B6C49AC7F8825326FDF13B3F4449617E5FBACC2A044AA6A08853D7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573437, "uuid": "477a09fb-f53e-40b1-94e5-595bd4365269", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573437, "uuid": "17038f98-1109-490c-91dc-f926ce222ecb", "value": "98304:jgwqmLds22oRmNglYOIUz+yLx2SyxLvaYNb8drpISrwWDsz:j6022NqW9B+yLxXyx1Nb8FlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573437, "uuid": "2f5c4f54-1f4e-4af4-b405-2e4428864360", "value": 5219328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573437, "uuid": "7a5c14df-025e-4a7b-83ad-2028d60c48bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573437, "uuid": "4f8c9c2f-7c8d-4b63-9711-ac721a10fc71", "value": "d0294a7caf27f11e40af507cafa5627b65b5096b5cf9926a31d5cba0993fc1da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9bbc98-9611-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513947, "uuid": "b8f2cb74-d5d8-4a07-adb7-fd7aca153441", "comment": "Malware payload (Vidar)", "value": "74bfc2510a175a6b8da22aa473d57713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513947, "uuid": "59627f43-bef2-41af-8e38-faf14eea1245", "comment": "Malware payload (Vidar)", "value": "d09dc67d4f9aa40df7d6a5d71b73a2f519e4c4188d2016a51943799eafd28599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513947, "uuid": "13486170-62b7-44d9-ae69-824c3bf2c366", "comment": "Malware payload (Vidar)", "value": "f902599ec30dbc1cdea1bdd9fd2dc5c31f72672c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513947, "uuid": "e270d56d-f164-4f0d-bfc2-c01ae0842fbf", "comment": "Malware payload (Vidar)", "value": "b64a6051bd5392ad44f3a8399ef67e4c08df0ce14c4b121790406985bb7a3e3dd55788d29fc23d2c5665310b905c5568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513947, "uuid": "ed67cf2e-4159-4170-96e3-0f9d01541844", "value": "T1F5E5AD47BCA149F6C469627289B362A27B75BC485F3233C72E50B2382F72BD05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513947, "uuid": "cf7a8f8b-f4a3-4282-967c-1d615c403765", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513947, "uuid": "5bd7191d-e0b7-4ce1-9185-2b3e6623e339", "value": "49152:caXiXHCNej6kqXWyPPXCrXACXsc4rJqNoUCAQZdiBS7b:caUrqWyPPXCrBXsc4rJqNoUCAQZdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513947, "uuid": "c018c165-bfd7-4471-a482-5d18212d739c", "value": 3163504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513947, "uuid": "04a0152d-6d96-4b2f-84ef-6b2724a7122c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513947, "uuid": "8600cfe9-8ec8-4bf6-859c-0a518fa1dd62", "value": "d09dc67d4f9aa40df7d6a5d71b73a2f519e4c4188d2016a51943799eafd28599.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c16ffb-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512992, "uuid": "6294b7c2-50c0-481a-8ba1-edf28afecf65", "comment": "Malware payload", "value": "badf3d9a8c3f743e4fd1bfbf8ec48e8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512992, "uuid": "91bcb93b-95af-4d63-9cd9-cd8493bbfccb", "comment": "Malware payload", "value": "d19deb758dff3796bc025446c3adf690b2c20a535328a697f3c04ea2319a2535", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512992, "uuid": "391adffb-c224-4cce-858d-1802db4bc419", "comment": "Malware payload", "value": "f4e38cb133d8f1661975b1543a663a924f157e9b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512992, "uuid": "081d3618-bf20-4068-8dbb-ab329cfb0527", "comment": "Malware payload", "value": "aca2d3f252614a08ecb2ea6a3a1a9d8245619cbef996bd315aa1b994439892889f2a33d5ac64e3639d51d628a44708e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512992, "uuid": "732c9a8e-58f0-4629-8a59-3c9ea5821b19", "value": "T18A27BE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512992, "uuid": "0cac9275-8e67-4b17-8a4e-b0c2191e0bb0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQz:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512992, "uuid": "54bcbe0d-7a30-4088-a50c-41012f339aa4", "value": 20480000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512992, "uuid": "ec404605-e055-4844-8fcc-4298e68c873d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512992, "uuid": "e128f5e1-4773-4534-9759-f48801b99d09", "value": "d19deb758dff3796bc025446c3adf690b2c20a535328a697f3c04ea2319a2535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f78550-9620-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786520316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520316, "uuid": "d82b5a98-0bc6-4a6a-846d-84dfa23874d0", "comment": "Malware payload", "value": "c61765c363f2a755ab42b9bf8cd11113", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520316, "uuid": "52d5dab5-d1f2-45b9-93eb-3a984177697b", "comment": "Malware payload", "value": "d203942fd7e34a9b93d0d431b4a47448447ab821a8c00d69808b2af774cfffce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520316, "uuid": "bf8dc245-1ad1-44cd-80af-31573abe6e80", "comment": "Malware payload", "value": "69a8080284efabe86fb3827a46336736ab40dc89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520316, "uuid": "4df97975-61bf-47e0-975a-7a37f5ab5923", "comment": "Malware payload", "value": "611f3c1568f3a346c949f62de1b04b8503915e641179fc9759097368f9ada601e278dafef0cd8353de062318dcc4bf84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520316, "uuid": "70d3effc-71ff-48c5-9cd1-936d7168becd", "value": "T17E236C6516857C14AE98C4365C7F2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520316, "uuid": "539aadbe-ad5e-4447-9111-d44c23711fc8", "value": "768:mr9NyXsZztCD9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:QHusZtcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520316, "uuid": "fae4eb42-7a44-4ff7-b736-4df406a1f0e2", "value": 50031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520316, "uuid": "8b2d7958-2586-4f7a-b27b-2e50cabd1f09", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520316, "uuid": "cc436c59-1303-4c3d-a4aa-91c5d8760640", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00970697-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498486, "uuid": "7f5d2375-0354-4572-a2fb-b78adb32060a", "comment": "Malware payload (Vidar)", "value": "aa2a3671a579f85a4f133e59992ad5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498486, "uuid": "c7561f3f-bc15-4362-bf1c-e0267a9b5a4e", "comment": "Malware payload (Vidar)", "value": "d2133a2a00bc7f25331d795316cf3b7b9ed3f36003897e99ed5cd5c56d669dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498486, "uuid": "526f1163-e9b3-4b75-b81e-1b61f6ccb867", "comment": "Malware payload (Vidar)", "value": "0ea61be0d24c025f349c66f0e20d285bce107911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498486, "uuid": "eed31706-c4af-42a8-92ee-f39aacd38b53", "comment": "Malware payload (Vidar)", "value": "56787305761e05631960b5df30963f1a0b665215fb833302a10da59c80b9a527c0f7a255fdf1bf5fbe64b59196e9541e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498486, "uuid": "40110870-8f06-4aa3-a519-7b9b8e13adff", "value": "T1D8566B07BF6165B4C494EB34843A4246BAB4BC8C8B34B3F71D51AE786F5A3E14978B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498486, "uuid": "7e85b720-9fff-40b8-8110-7282056035da", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498486, "uuid": "5a56edc9-0b78-40c5-bc2c-6530f78f6a3e", "value": "49152:Jqiq8GPGyk0wGzKCr77cMEO1aQ4MRO5ZaOXR3or44LWtOITk2Lpn5qzEOkxg:J09r7QMEOAMMZa254LWfTPLTDxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498486, "uuid": "a139b85e-fc7e-4cac-9edd-08709c8fcc8b", "value": 6374096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498486, "uuid": "ed1fe20b-0d5a-4b7d-924b-71e8e01e677b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498486, "uuid": "62bb90d0-5117-4fd4-90f8-83d1f0a5351e", "value": "d2133a2a00bc7f25331d795316cf3b7b9ed3f36003897e99ed5cd5c56d669dad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a073af-962b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786524750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524750, "uuid": "e57ab831-5ebf-4959-86e6-62ce36274c44", "comment": "Malware payload (Efimer)", "value": "02f09837cac9cb0310729ab1a84f35d9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524750, "uuid": "258deff6-7809-4644-8fad-1ebc2873a819", "comment": "Malware payload (Efimer)", "value": "d2529ba4c3d2d629ab45b5b155c1a6c897ee46cef51531f281a4f97c820690f3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524750, "uuid": "fad13f3b-6ee9-4d1d-99d5-7ee2db8eba2c", "comment": "Malware payload (Efimer)", "value": "a78750ed454dae47f2a5112421da8c3826543daa", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524750, "uuid": "d86b23f9-dfbf-4d84-9fa8-95f0d137a1ff", "comment": "Malware payload (Efimer)", "value": "737dda0bec57774ae8062a9481bd87c2c875fa9f66c3f8ad66171f8ccfe51831a70e1356aab19c30f8a41732791b665b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524750, "uuid": "d9163e19-2890-4ec2-879c-d080de3b38b4", "value": "T18BE6330858D052DDD9A291B07AF026DEA42CB0B92771C7EB5F59C265AAC32F07D384DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524750, "uuid": "9b430f7d-7313-4548-ba46-442f3f2009ee", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524750, "uuid": "80df5a62-802b-4484-bf95-f1bfe13ac5ca", "value": "393216:uNmtmkFAHeV1f+TSTdLC5qK8WOXMCHWUjocuI3/PGTAI:uNmueD+TSJLNWOXMb8dH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524750, "uuid": "fcbaf3d9-1470-4202-b46a-2d0de11b860b", "value": 13886347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524750, "uuid": "f8fd564a-f5ff-4dca-a2c3-39eb5137da22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524750, "uuid": "e6367df2-0511-4074-9a6f-cbc95c12803a", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ad139-9683-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786562889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562889, "uuid": "7c3903c5-5f15-4f40-b509-0b1c75bff3e1", "comment": "Malware payload (Mirai)", "value": "fbfa28f3afe2a5b47a93df218286c457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562889, "uuid": "cb94c51b-c7f5-480b-aa96-d89d7e7f5871", "comment": "Malware payload (Mirai)", "value": "d255d939c7ffde66cc8e22dba91fdf403b91536b12f404d1f6bc417a7776a9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562889, "uuid": "a477adeb-ea3f-4794-9ec6-919a7b03f3d1", "comment": "Malware payload (Mirai)", "value": "a0f6371f808fafbc825ea46d50979fd7306d11ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786562889, "uuid": "9873eef6-ebfa-4393-90b2-741a9d27ee96", "comment": "Malware payload (Mirai)", "value": "900c6fb4267789198225216813d0066f6e7faf315e30904fdf7d7f4a7725b9e62cd2a85cd5d5b85f4317f09776b0987f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562889, "uuid": "9f21c63e-34dd-4cfc-ba62-d72fc5cc8e96", "value": "T19D430121E1C2FDA0EAF0A071E13E4163B56D0279B6AB3B66751DD713D1E27B31EE410A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562889, "uuid": "c300ef9e-56d8-43be-93a8-a7e61762716d", "value": "1536:PwOu2ho5tTqvPdq7XQBAW6Mk4p7jrP+lU/aniCjfEH:Pbho55qvkX0AWhDLP++xU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786562889, "uuid": "b85d1218-02df-4757-a823-88f248e39001", "value": 55252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786562889, "uuid": "c48eb09e-a4b7-49dd-a59a-0b0428bccaa0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786562889, "uuid": "1f2c68d4-b115-494e-bd20-408a04b1fa92", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc7bf5-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786521802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521802, "uuid": "d9ddcce4-3bd8-4acd-9d2e-dc24de781515", "comment": "Malware payload (Formbook)", "value": "bc9e77821661c80199a81661b127979a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521802, "uuid": "49ccfbbe-beeb-4c97-a8f0-ca4d503c207d", "comment": "Malware payload (Formbook)", "value": "d26dc74cf790d8b80f03ee0d94eb11cea8074bcbe70a2f97952f4945f180448f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521802, "uuid": "f64e1544-76b6-473a-8178-1b8465f5c5d6", "comment": "Malware payload (Formbook)", "value": "b3dd9abab094028aacbb3c0bb21ce62c0a6faabc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521802, "uuid": "444265db-a7f6-4fc1-9ba2-04d4ab071f78", "comment": "Malware payload (Formbook)", "value": "a4b427bdc0ce2f023ece789bc4af2f9a6c6eebc036b8ea4fa650beed07862dd817b961ed1950f91476fea8c14ffe304d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521802, "uuid": "ce36218e-fb3b-4a1f-b187-034439036f82", "value": "T1CA25B0B131568D79C86C48FEA65EB12761DD7E2911409C6FAB32E111FCFA7839CEC068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521802, "uuid": "fb12bf18-e38d-4e63-98a6-64467c05d294", "value": "12288:qhHIvFbvKe64l8nbbbXn7e8s+fs9X3r1LjF4al45NvPQOLmmik4GveamUJ:WI3pknjS9L1NJl4nMk4VJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521802, "uuid": "f2d02cff-99ef-4c5f-80f2-31dbd7592941", "value": 981008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521802, "uuid": "2bd064ec-94fb-4c30-a769-1c2717621084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521802, "uuid": "5eb85206-02c9-4273-9961-cfc9a21ce87e", "value": "103_FTX26222VADLV_4416371107.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2f6775-969d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786573723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573723, "uuid": "b14c6b3c-7e05-46f3-87ec-4e5548a2d2ed", "comment": "Malware payload", "value": "ef4c9e9473853e02e7056c338d535388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573723, "uuid": "5ff4bdfd-dce7-4c7b-8257-d27f58e3439a", "comment": "Malware payload", "value": "d2a74301bdf3c50d57a5a08aacf69b26fdf32fe9a8a4dd299a3d73125ce4f73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573723, "uuid": "dd70edd5-354a-4878-b14a-5fc4931c3482", "comment": "Malware payload", "value": "279a06088b51a4c42009c0ae09720ceb96e2387a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786573723, "uuid": "7e42b53f-4ee4-433a-9249-7653a4db9e04", "comment": "Malware payload", "value": "af1514ff8a7b40764188645633e44546f87623281adcaceb3c6a06cad2380d503cd9d03634bb900773a88217cc6fec95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573723, "uuid": "2f0dd2af-b6fd-4a44-9ff1-3f5f80d43dfc", "value": "T19006BE07BCA009F6D0AAA33688B366617B71BC044B3627D72EA1B7382F367D05C75725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573723, "uuid": "e4032999-fe5c-4c2b-81a4-23525d4e651a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573723, "uuid": "3751a8b2-6f26-4fd9-a74d-1ae631342744", "value": "49152:Ry8G7L5ss+nkxGe3ocsPLHOab1ARcNTZp1/6yr7N+qaS2CCZWTT:RyP7ww3pa5hlZiyrI9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786573723, "uuid": "12a69e53-8643-4996-87e3-db49920b9359", "value": 3704192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786573723, "uuid": "df06f10c-af34-4a45-b017-2bece1f324ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786573723, "uuid": "7cb4cb48-4e0c-433c-a13c-62fcc9c362cc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac8355a-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786503201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503201, "uuid": "5739490b-87ef-4ba2-8eba-ccb8ed163dfe", "comment": "Malware payload", "value": "a89928369ce1200e8133f16232b180d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503201, "uuid": "7c2b954e-05dd-4f60-a62d-955a4945184a", "comment": "Malware payload", "value": "d2ae3982f07f89253b21d45321e97f57b4b81c78164c2504b2578958ca186362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503201, "uuid": "9b0a62f6-c6a8-4af3-9132-2acf4a21a5ff", "comment": "Malware payload", "value": "c5a4bf59b653f0cb871956fe46ff074f3c08fe6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503201, "uuid": "8d7148db-aea7-4e5f-9729-20c7c5b8753f", "comment": "Malware payload", "value": "36dec179ddd63dcc470dc6c7f3b11ffaafbd8aeab9d1fd0de6a9fb82dc5171c1b7b70ac428190ff8d8c741cf0fb4da6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503201, "uuid": "1ddd94c6-98cf-4924-bf14-f607ccdc1e7a", "value": "T117C31223CABD5F2393E019603D9B46028133B6A4A0EFE51E54314FD827C50A93EE697F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503201, "uuid": "a424972f-9abc-45cd-9df2-f6c29f60ea4a", "value": "3072:N1bXPQy+JVYzbc60HdMWIFGxqKNOfisC+HrX5EvHqmm0VutT:HPQygVd60HKow/C4KvH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503201, "uuid": "222d3d5a-957a-4594-9359-8fa118d2bab7", "value": 120608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503201, "uuid": "9765eb0a-b0b9-4921-8224-a2c1c4af1888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503201, "uuid": "d8433c9a-5322-4ef3-9b0e-0421542ec280", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c8d26d-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521933, "uuid": "708b1cea-dd34-4ae4-8c4e-0bd8cdbeb80b", "comment": "Malware payload (AgentTesla)", "value": "0548525daba147ea664b01111f6bd6ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521933, "uuid": "d53ceb25-81f1-47d6-8c95-f3bd2e2737eb", "comment": "Malware payload (AgentTesla)", "value": "d2d45f990ec7970125cccce6480b636c884bf3c9efd257148bae4a83d7ed3279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521933, "uuid": "ef758747-da94-49d9-890d-09b8499c6fa4", "comment": "Malware payload (AgentTesla)", "value": "48db0b41eb31bc9b2edb8eafb4450eb0a61ac334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521933, "uuid": "164ffc3d-a9cf-427b-a81b-4b6334efcc99", "comment": "Malware payload (AgentTesla)", "value": "0fd369e4fed323bf41b49d7d433e8bf6beb14c329026e80fbb95ed877eb4e9acd7b3da21e26a11cf99cf1d2b679da5bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521933, "uuid": "8a489968-e2b7-442b-8a1e-9cfb6df4a4c2", "value": "T13DF5405813C1DBB273315B5C863A9F22A9095087A0D9CF26717EC31ABB2CD276359BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521933, "uuid": "82f6dd6f-e28d-489d-a93b-84df80baa037", "value": "98304:NL3WPwPhfFRWajfnx8sFHql/hS0xcYRQDh8L7f+Uos1L:d3CSTnOfQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521933, "uuid": "c9bc3928-9673-478b-a80c-d57003657b89", "value": 3346262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521933, "uuid": "5b86a39a-2297-4050-8fbe-8a8f4d1d7166", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521933, "uuid": "57b7e459-3b88-460b-b9ed-29708cefcf0b", "value": "RFQ 00081126.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d6db3b-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786521770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521770, "uuid": "1610a122-cef5-41a5-b7f2-357a5c985590", "comment": "Malware payload (XWorm)", "value": "f69387deab1c6d031f39c00ca03b8c16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521770, "uuid": "f989ba50-922e-4f63-b6c9-6e6761d6787c", "comment": "Malware payload (XWorm)", "value": "d336908f579d5f518e0659909a3bf711b30c0e0921c2fc8d87f8d1b10a50caa7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521770, "uuid": "920be86c-93b2-48c4-9f4b-c901a206bf29", "comment": "Malware payload (XWorm)", "value": "713eb00f8501e70e27a821a42fbb9bb32bdc960f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521770, "uuid": "0c9426c7-0902-4511-a951-76113799c5d7", "comment": "Malware payload (XWorm)", "value": "97b65cd56b77b2d55bff5a59a3d79aef452d881ac6b0b5884c3ecfe64a4cb9373c508dbe3e58133a09ac53e175a174ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521770, "uuid": "f0700230-3b11-40c2-913e-0d1d2c72600a", "value": "T127B73CA98FCA0B19DABD2FB8CF115938B78000CD6E9B281FB1F441E19B75574196B8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521770, "uuid": "a5f6b1be-1670-43ef-b37e-88be5ec5f703", "value": "768:LdCNZrurGvDZDFDJ5eZZdLSZyUNnZxJsZeZZZExZZWlMUhhAfEtsdgCcmg6DRZZo:mZu/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521770, "uuid": "a0aa95c2-4add-465f-8ba9-e498f1ab5fff", "value": 50899477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521770, "uuid": "1c7a53cd-4138-47ea-a21b-0abd43ea3049", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521770, "uuid": "240a2fd9-370a-417b-85bd-ebb625f31934", "value": "p.o.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e47df1-95e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786493722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493722, "uuid": "b573e12e-e6ca-4303-a230-e5a8a6bb1b75", "comment": "Malware payload", "value": "f87283a3b6057d0fa29e6a259cb6e72b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493722, "uuid": "65f47798-30d3-4a31-b8fa-a3de1af792e6", "comment": "Malware payload", "value": "d370718dd3c6e334344a54675c32b975f24346240fef0bba071577ca02f485a6", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493722, "uuid": "26372dea-b49b-4e7d-9e57-65844bc73b68", "comment": "Malware payload", "value": "57331efdb6afd876aa5078a510ff96e9654a4693", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493722, "uuid": "40bd57c8-ca00-41cb-8f84-e2aa13d0c5c7", "comment": "Malware payload", "value": "0ccf868d0ac0fcc8021209c6e2d7a36118bc55089e83888583ce333eb95a68f879f75190460c84ad0ec614e1411c9fa6", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "certificadoativo2026-com", "colour": "#C09571", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493722, "uuid": "98752a98-70d2-4ebe-999a-558b8c963bcb", "value": "T1E5E4230421C7707CD86EADB631CF0B6BA3118708DB43A76A4AD258A7FF727068F4955E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493722, "uuid": "192fa7bb-b2a9-4fe2-be78-6be377d44f3a", "value": "12288:LWnLNqzAnvLr0DrZ6kuwL7IA75Zhz4fWdr6O2PBQ2vSTDCyElqcyqTFKp:6NPvvErZ6kr7x75ZhzQpR5VaTDCZyqTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493722, "uuid": "2cc493f2-d594-476b-89e2-c6ab443b92ca", "value": 663746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493722, "uuid": "5c0c8e70-dd06-4d9e-b37b-47e15d72a938", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493722, "uuid": "3e0c722d-36e5-48cb-9754-b28f2fea9865", "value": "ptk.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd200def-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511366, "uuid": "ae40395d-da09-4a59-bf8a-c4dcc84c8500", "comment": "Malware payload (Mirai)", "value": "e30fbf8866bf6af217ef255dbc44ce5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511366, "uuid": "b9cb6e66-8a61-4358-89b2-4c857ba82b51", "comment": "Malware payload (Mirai)", "value": "d4706a23c4a04469635f0299903b9e545deb5fc5d79b3e6ab6b9ecce0a921c00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511366, "uuid": "e4e3944d-b12b-4fd5-8058-6d13a5241075", "comment": "Malware payload (Mirai)", "value": "250891f9877aaa5496f1832c8a1fd7f0f3838a4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511366, "uuid": "959523dd-6ef4-4307-8822-c85b0eb8d875", "comment": "Malware payload (Mirai)", "value": "eba952c3efea3dcccc51428ce21d6877faa9db3a1670966b9fb521f48cc700c783c04028608cfdfb3323d5172b3ad24f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511366, "uuid": "19843cd0-54db-421f-b644-f1a745f9c5a4", "value": "T17EC33AC1ABE004D6D4DCC47669A3032AA27E97972470D927BCA30D4CBF266607717BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511366, "uuid": "5e82b78b-6f40-49d4-99b1-f6da28e1c3f4", "value": "1536:BKYg1UBA7UzOXWEUvKl/T4J32kpK47etq3nGVxZLKjcaCkcksU8f:BnYcEUvCT4AkE47zkfCcaCkcksU8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511366, "uuid": "0ce79dcb-46bb-4035-83b7-678966fba56b", "value": 126700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511366, "uuid": "9b97911c-f88b-4182-8800-fb8dd3cd1e6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511366, "uuid": "f177bf3c-97b5-4b4d-b7a0-74f620138619", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bbce6b-9618-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786516886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516886, "uuid": "e3275475-8c2e-4768-b346-348157a32b12", "comment": "Malware payload (Vidar)", "value": "dedb5ff5853dd865c02f14e698144a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516886, "uuid": "5033bf8a-aa4b-40db-8614-ab7aa17d8c12", "comment": "Malware payload (Vidar)", "value": "d4fbe4404c277bc058068e55d393688b135ad89a18e128a3300e478f020032fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516886, "uuid": "3be76709-6e74-4172-9eb9-9d777b08031a", "comment": "Malware payload (Vidar)", "value": "3f4add7b4655797b65a5fbc03199bbf4ed17f928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516886, "uuid": "3140fde8-d35c-462e-8467-e0af350c59d5", "comment": "Malware payload (Vidar)", "value": "506130eea4e5c81251dcf9edf58bcf61dd7e5ee6b29b6a9c3e200e5748622df43504680f894168729958571da8f3ec2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516886, "uuid": "d28edc20-94e8-45be-b588-22be2ff982cb", "value": "T16F266B43BC9148FAC0D5A33188B75256BB71BC0C1B3623D32E60ABB82E767D15E76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516886, "uuid": "4a00fe74-e7ea-4b68-9b78-4294f3593372", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516886, "uuid": "49dc4034-4f3a-4e5f-8f7a-a7a1e6fa7ee8", "value": "49152:sZAIchcl4iFVfT1jeyffsczo/nlK3kg7EzB8kJrXR7AisVR2FcBu:sjRfT1SPlKUeKB8kJrBci0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516886, "uuid": "c0a1d1d3-5734-425d-b27a-c3836d019057", "value": 4528000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516886, "uuid": "ef40764e-85e2-423d-95eb-52f6520004e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516886, "uuid": "b1ca9c58-407d-4b31-9961-2d26258e7af9", "value": "d4fbe4404c277bc058068e55d393688b135ad89a18e128a3300e478f020032fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aadd59-9613-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786514552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514552, "uuid": "fe931243-2345-4c9b-bef5-d2a07faf355c", "comment": "Malware payload (Vidar)", "value": "f2536902e1aa6038a1ba0da46036fe2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514552, "uuid": "1b041219-a06b-4af5-a7cd-17a443e992ca", "comment": "Malware payload (Vidar)", "value": "d506288b76b34497fe3e54d3bf479c25acfaf5e6d44e74a0d56e0079090654c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514552, "uuid": "7e0243f1-767e-4775-a490-4e9493cd33e7", "comment": "Malware payload (Vidar)", "value": "b50f35671649572eb3aaf13510fbc692491e2316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786514552, "uuid": "7f00f56b-ff94-4ea1-b8b0-8da02b7f53aa", "comment": "Malware payload (Vidar)", "value": "920b0e04bb25fac325fd5cb8115d1dd3c0067f7e59d19ab2302246e69d2899e831276a2d4c0bedde458529c731698ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514552, "uuid": "c19b3cb4-10f7-487e-ad57-2778f55d2373", "value": "T133266A47BC914CFAC0E5A33188B75256BB71BC481B3523D32E60ABB82E767D15E36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514552, "uuid": "dccf9516-bcd2-4a4f-802b-599da8f5125e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514552, "uuid": "e7150a51-39ed-4263-a945-55e6eb70e186", "value": "49152:yHNIcn7FsI+sJ2SZgtuWxhqr94ubDymrD/NNHYL8suosVSdJ6c/t:yXh2S9trbpNHg8gHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786514552, "uuid": "bbce723c-20ef-4660-acbe-f29847dcb05a", "value": 4523376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786514552, "uuid": "df1b178d-b3b7-4952-8e3a-1881a40ef5d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786514552, "uuid": "6276e6db-3a38-44ab-bbce-2a811f093dbc", "value": "d506288b76b34497fe3e54d3bf479c25acfaf5e6d44e74a0d56e0079090654c7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf27c61-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511367, "uuid": "b77ea14b-475c-4db8-acbc-261f2242f88c", "comment": "Malware payload (Mirai)", "value": "0d5cbea67a3ab81c5fb40f61adf5143c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511367, "uuid": "08217f94-ce0e-4563-ab67-cc2b3e9567bb", "comment": "Malware payload (Mirai)", "value": "d5cba9661330ec7f84d45dc29ea80b46d172f39c043264f714ddc2c1b126a682", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511367, "uuid": "d82a24d1-6ae0-4e7c-9f08-20d182bd1650", "comment": "Malware payload (Mirai)", "value": "3133e470bf098de42c4ddbfce7f290f99315a1fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511367, "uuid": "75e7b34c-be1d-4674-80d1-de0baaf15416", "comment": "Malware payload (Mirai)", "value": "2acb9198fb6aabac9a9299424a1a62fb117ec6ae196eb0185a961607b83f084d4555df0c00c8320b481ad166a3b8acbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511367, "uuid": "77cd98d8-17da-4cc4-a830-8fa804903b03", "value": "T1A3B32BCD6542FAB0DC0B09F56C255BB0D736E0A2F06FDBAB93FD852184322B49907679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511367, "uuid": "c4fed7f9-cc49-4fe6-85f9-e50943fc652f", "value": "1536:N4WG7V4sjsVkhV9Q34FAzmkr/iWevJiUME0Qs4jg76d:N4WGZ4IvP9QIC62iWeRiUME0z4c76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511367, "uuid": "c9221e40-3ac6-4699-b1b9-6533a702df48", "value": 113620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511367, "uuid": "37a5a4de-5140-4b63-a0f0-3f93c3c9bd0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511367, "uuid": "c7cf6b4a-9074-4ce6-a201-2b06c15c11c5", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6922ef2-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511677, "uuid": "514ce4da-ff96-45f8-af6a-203d453415c7", "comment": "Malware payload (Mirai)", "value": "89bdbeed1abbff981572583c9c0ef1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511677, "uuid": "490a1d2b-09c4-4361-9977-30ad5391404c", "comment": "Malware payload (Mirai)", "value": "d5e3b5b272e76ec71e09e8e41940d06dfa09c01a6d1ab8edab6b4c0d8257760c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511677, "uuid": "e7884da3-2dbe-4f88-adad-9cb9f66f158b", "comment": "Malware payload (Mirai)", "value": "f00213c5b3808bad804d66a855202fd03e17a0f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511677, "uuid": "6d02c18d-bd3f-465f-953a-9eeb94598e8d", "comment": "Malware payload (Mirai)", "value": "1a683737767a293fe1a36da506476435f22deaf4fc8ba20d23658845f4af2724d48ec8ac55497efc5b7cf6624f5bc940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511677, "uuid": "d8b7f09e-2e9c-4505-ab1a-324158b06e99", "value": "T1D4214422E5C5F833D63104BAA1565F5B176489D5681FFF07CA214802EC386D6D5212A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511677, "uuid": "1447694b-01ee-46bb-ac20-e4e7035bab10", "value": "24:Fl1DH5ZdW3+YZsE96YZ5ZXwDp7ZvaaQZeGPrkruQC8bnWwi5c9NfJyp:f1dZM3hsE995ZX4pVvaazerYHC8bnWwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511677, "uuid": "2e528b66-3159-418b-9ccd-51fb1ca8fa63", "value": 1388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511677, "uuid": "887316fb-bc27-4888-b1c6-db3432f9877c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511677, "uuid": "5dc007cc-159c-4c8e-983a-389c572aad98", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f872b8f2-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "36e976d4-095a-4061-8295-a1c4f5abde5d", "comment": "Malware payload (Mirai)", "value": "079c06905b07eae14e9f48d17af7b283", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "fbeb5841-483a-4ec8-84eb-808a1a31307e", "comment": "Malware payload (Mirai)", "value": "d700571b75a3126ffd00c3ae8eae567e58f77a0619d18d2d27c59ebd7006e486", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "ef476df8-5793-40ff-80df-2edd58ed298f", "comment": "Malware payload (Mirai)", "value": "c9a3af911e1a14a6b8ebcc26ae6bcc4c27982ae1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534980, "uuid": "12787179-60d0-4842-b7d6-9f10b6d68acf", "comment": "Malware payload (Mirai)", "value": "a08bbcbe10fcb6ee0e83ea71f3dd4c323de551bc27b198e2c4abc3005428473859ff456ad58cb92a25bbc2e7e5838ffd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "7a430751-c736-484c-9035-2f602271d184", "value": "T1CC33F1B7A23EF5F9C0745A3E653C9308FC3E287893245E7B85F5BAFDB8A04164540A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "c2f7f576-6455-49f4-acbb-9e22c4e4668c", "value": "1536:80HOKScOPLoZSk8CvNGxHQ17rvnluLUCs7FJcs3:RO9fPySkBvNPluL5Y3cs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534980, "uuid": "afc0e311-59d1-4192-bb0f-318c1498e7a8", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534980, "uuid": "6f26f7ea-9000-4d2e-a7e8-eb557312d8d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534980, "uuid": "3e86dd58-d496-4374-a12e-96002036df0d", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fe668f-9619-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786517209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517209, "uuid": "72613323-6f65-4ccc-8833-9d01a6d390b2", "comment": "Malware payload (CoinMiner)", "value": "930c535ed969629516953ca2c7d1d264", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517209, "uuid": "1bb3f0dd-8153-4b45-91b5-07564299cb0c", "comment": "Malware payload (CoinMiner)", "value": "d737e784c37b41148f63aea98ad05ee2cab0195fa33da506b626c9c3e2a2130b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517209, "uuid": "2d27f4e9-c760-46c1-987d-50a6c97927cd", "comment": "Malware payload (CoinMiner)", "value": "55039028d3adaa70c62f7c90a4fd399fdafb9597", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517209, "uuid": "09f6a8b7-1057-42d4-88ad-78e88e38d423", "comment": "Malware payload (CoinMiner)", "value": "f5634d6f40dcf367ed5a2d5b4a0e16711e9cf936f10439da58e33e851c140764d1cfe43ef146ce72e9b178b508a7f739", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517209, "uuid": "2ce0f7cf-c3d8-4e2f-8bf4-47ec91b40e91", "value": "T1EBF284E2BAE759B1402D8668CE42958A720D2B17890C3D55F17D39243FB836CF271B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517209, "uuid": "5e768e00-768f-4ab1-b1dd-4b283d0bd373", "value": "768:6lszZ4S83HY+ZQilquOgnL+BcL088ddl1ZcDjDPhJjoOk84LHvEe:6PYVuO6UwGHZcDPPhpoN84r8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517209, "uuid": "060f5b20-9f07-4543-abbe-34f025bc878c", "value": 34234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517209, "uuid": "1a51cb4d-326f-43f5-a93d-c73fbb09e2de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517209, "uuid": "37ee6679-52c2-484b-a905-fc3141491294", "value": "ok.dec.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f53961d-961f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786519664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519664, "uuid": "2885c9cb-6869-486f-b1fb-ae24a0d70513", "comment": "Malware payload (Vidar)", "value": "dae850441bbae54486beb48d43db17f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519664, "uuid": "84e587dd-8bc5-4ef4-8d4a-bbd9544026e3", "comment": "Malware payload (Vidar)", "value": "d76b7ea21ef2b421945234bf5b7c19deef9925ced2716678ae66026a67f352c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519664, "uuid": "7d9c9a3f-23f3-46fa-a8cd-884ff1eafcfd", "comment": "Malware payload (Vidar)", "value": "f40d4494dfda63639bed94bf4d5f98d2d5ce5c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786519664, "uuid": "a8e374f6-2490-4852-b7e9-96c1a571dafa", "comment": "Malware payload (Vidar)", "value": "9081bce1f01a9e529740e89950a987984d107025bf4dc8c4f627d2190b1e7d96f6c2194f15e6d8ffe8d84ffbb4e30ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519664, "uuid": "5e8775a1-2aa2-49ae-9b5a-f35463b753c5", "value": "T11DD66B43BD9148FAC0D6A33188A75256BB31BC0D1B3623D32E60ABB42F767D15E36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519664, "uuid": "b4179765-66bd-48d0-a742-1a946f4e4a76", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519664, "uuid": "cd010f2d-448e-4cc9-b594-2dfb54faff14", "value": "49152:JBS49cfCsY6g6EdOWJSH3LBufR6MxY7YlBDsV4Dc9cIi:JJd65XQoMBfDxDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786519664, "uuid": "959f2eaa-56c7-4b38-be6c-476e05731598", "value": 12911464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786519664, "uuid": "bb4de3f7-b599-4f50-8858-ad6f9c834b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786519664, "uuid": "6fd02c5e-18ce-434e-8815-c65eea15a14f", "value": "d76b7ea21ef2b421945234bf5b7c19deef9925ced2716678ae66026a67f352c5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba2fc60-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496653, "uuid": "9662c96c-40c7-40f5-85b0-8f09fbd56bac", "comment": "Malware payload (Vidar)", "value": "484fa3c9b8ffaae0dda78b8635485477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496653, "uuid": "d63993b4-e91c-429f-abe2-7445e5da83ab", "comment": "Malware payload (Vidar)", "value": "d84030d162793a2e0a87c3b11b5b997332b80ec53d2f12c309339cb290131f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496653, "uuid": "36b58fc5-9e6f-4d60-b7e7-2749683065ca", "comment": "Malware payload (Vidar)", "value": "a6a7faa13eb59c9259b3f1d08b89b6211a4aa7b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496653, "uuid": "5ff8f5c0-c1db-4618-996b-c06392f12844", "comment": "Malware payload (Vidar)", "value": "846143edf910e7b799ee030f288c14493cc1e1787501ebf8bf9f1e42e4261a0590b46c7ef4f497dc2bd7043f59364243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496653, "uuid": "3f96f249-20a3-4111-b595-b264e1b10af5", "value": "T165366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496653, "uuid": "93cfb77f-8d1e-4797-82b8-3e492c96ed35", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496653, "uuid": "583ba7c7-3105-40ad-a2c1-11163faf1a90", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaS:uc3XND1aJrCOkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496653, "uuid": "5b66ac5e-491d-42b1-a891-2d5a7f363000", "value": 5003867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496653, "uuid": "8923698e-7e71-46cd-b1b6-4f4c5465f513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496653, "uuid": "b87f413a-789e-4004-948a-a92769bd62b9", "value": "d84030d162793a2e0a87c3b11b5b997332b80ec53d2f12c309339cb290131f2d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1574887a-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786494656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494656, "uuid": "d0a56ada-e829-40dd-a151-16e9c1b4bc2c", "comment": "Malware payload", "value": "5d57a21f772104640a6300551b99c82c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494656, "uuid": "c6192bfd-4c3d-4081-ac97-ad54a106707a", "comment": "Malware payload", "value": "d852a2a105a6aaafdf2292580eea27dbfd16e248d7df4f3177b0086291cae60e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494656, "uuid": "30717401-e0c1-424b-8c30-cce4aab75ceb", "comment": "Malware payload", "value": "f704b8e1bd27e07ab99fbbae55b5cb11be6cf2a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494656, "uuid": "b3e85584-e7c1-4e3f-a206-ebb038a76500", "comment": "Malware payload", "value": "131001ac229534327565b7664ca1c6e0519e29081f09891a250c00e0222b0ac827c32fa817e1772de547a74f03e9a6e5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494656, "uuid": "0930bdd0-6ab1-456a-be1b-628874cd8662", "value": "T1E837331DCD3BA584EC0732B21A662E215437D6DB0AB48875FF950C6D3CDEFA06B56C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494656, "uuid": "e94c3ff9-c24d-4588-ae12-4388f6f4376b", "value": "393216:DAaWRHqyGtldD3hn8KQWSbrnDafgHNEzK2jFejzU9YhKaMDnyrBhsvQ3vnXso:MaGqnDdVn83P3nDaJW2pejJrtBhsvKEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494656, "uuid": "b2e6029f-c3d3-4dcc-88b6-6565bc90f81e", "value": 24251670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494656, "uuid": "b8042669-a598-4d11-8361-c158686f242c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494656, "uuid": "6440edb9-74c4-4489-af47-6fbdc73bc205", "value": "VscMgrPS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90004026-960f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786512900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512900, "uuid": "d8abf450-3ac4-4831-bd4f-5cd69370e3d2", "comment": "Malware payload", "value": "1051db31cf8011a1d98b4068abf90aa6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512900, "uuid": "a76fc454-72f5-418b-8829-e8e4cc78c324", "comment": "Malware payload", "value": "d92f51db8b2df9ebac3c18e3691eddf473e8064742d46987077d72e570e74b6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512900, "uuid": "ca8363b2-4c1e-4ee6-aaf2-a21a4d3664c2", "comment": "Malware payload", "value": "fbb35e3f9dd0bf850effba07c1065dd6abad8947", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512900, "uuid": "312ae0f6-3f3d-438a-9a08-10af4b9236f9", "comment": "Malware payload", "value": "959fad70cfa0d7a9ab31eae60ead857a25ac668319e73b4e788dbe293f74f2be877239868fafe306ada848e7fa0de280", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512900, "uuid": "3c389e93-4aca-4841-8ae3-19265de88b55", "value": "T12C17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512900, "uuid": "917490ec-52c8-4ee9-bcba-ab3bb20624fd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512900, "uuid": "5fce374d-7ab5-41cc-ab99-8aa934b92eef", "value": 20250624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512900, "uuid": "402d0889-685d-4127-8fd6-3bfc1a1c35c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512900, "uuid": "509ac715-f8e2-4ebb-a0e7-57d93687d9e5", "value": "d92f51db8b2df9ebac3c18e3691eddf473e8064742d46987077d72e570e74b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cedf8f-962a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786524287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524287, "uuid": "99302b45-5182-489c-83e2-d43ac654a4e4", "comment": "Malware payload", "value": "a5ee47e2d1de0f09dfbfc9ba24406dcd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524287, "uuid": "131cff83-ac56-4a76-9390-c92738737b3f", "comment": "Malware payload", "value": "d96d2abf45049a58fb6831ce1653c244801f9b2e6a77cb25025bf65b3af55b83", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524287, "uuid": "2bb68fc8-5c19-4d38-af90-df7ae7396921", "comment": "Malware payload", "value": "9802c86da56d6b94af34bd4e7fbc91b2e4bb8e64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524287, "uuid": "c722b6f0-6ab1-407d-a42d-349873767482", "comment": "Malware payload", "value": "7de05889ba77c8ac23b0c415135643e1d7fd27bb503fb34a3979d89f436b1b645f16f6436bd43eda0ee9e9f2dd99dd8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524287, "uuid": "1bb6ec39-9d84-4b1e-ba8d-20fd0b543da9", "value": "T190A4632DECA79627785001A0D2D18641B13FEC8E1F9EE2502AAE68DD93B71D41E53DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524287, "uuid": "99759b02-71c8-4114-9207-7d726bcf3968", "value": "6144:9zkB/44B09anxC6rYfSUA90ts/rhlOE4y+nYfaD/x6BlCjIP:qy420xYGdlyN6BluW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524287, "uuid": "4c231386-800a-46e7-ae40-e6c1731ecb8c", "value": 486146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524287, "uuid": "f28a792c-1575-4bbf-9097-0f6eb9a3ee58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524287, "uuid": "e50ad965-d822-4848-bca2-6ec614826a22", "value": "RFQ-2026-00806_Supply.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aa7ff4-9612-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513948, "uuid": "78a5c9db-b844-432d-9072-474246205a23", "comment": "Malware payload (Vidar)", "value": "9a67c9b6e5615f6a2fd61a4fe735ecaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513948, "uuid": "02efcaed-7b56-4fb2-ad09-c68bb8151a8c", "comment": "Malware payload (Vidar)", "value": "d9a1b16e3fc0d328c3d1b79e8fb8ff1dd15846577856506dcb025fb88171e439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513948, "uuid": "53e2ea6b-d22e-4dba-98d7-49148320b0fa", "comment": "Malware payload (Vidar)", "value": "131dc47a166732bfa1995ddc8e481885fea011fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513948, "uuid": "d5bbd227-7539-4fad-928f-2eed48ae8bc8", "comment": "Malware payload (Vidar)", "value": "e7410dd7a7ee1130be8c2a946eda44c19105fbd5058fb472bd8a98354328b07be97019f64dd34a75dd82f6873f0136bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513948, "uuid": "c0d29fb8-c104-49f0-949a-f227aa5b3784", "value": "T14FE57C47ACD009F9D4AE633289BA51927B74BC450B3627D72F40B3782E76BE0AC79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513948, "uuid": "ad879418-1cf5-4b09-abdf-aff5ccd37bbb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513948, "uuid": "c8919205-9304-41de-a74a-19c205c1957f", "value": "49152:IGQiQunWuPTN2uaqEpzp/sUB9k51ltSjbfZ8p/bAgg:IGerkwp/sUB9k9t8bu/bA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513948, "uuid": "70c22747-d768-4a9e-9c63-bdae818526db", "value": 3031912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513948, "uuid": "f55fcd3e-8fa1-41d9-988a-dfab9677448b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513948, "uuid": "5ee1cc1c-75cc-4645-99ce-db1c4c562a92", "value": "d9a1b16e3fc0d328c3d1b79e8fb8ff1dd15846577856506dcb025fb88171e439.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ab013e-95ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786498488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498488, "uuid": "9a99586d-0dbc-4644-89a6-47e1d2876bd1", "comment": "Malware payload (Vidar)", "value": "f5dee0e5910844e961eb4b2eadf83df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498488, "uuid": "8c29e65d-8388-4ee5-af19-e4acff104883", "comment": "Malware payload (Vidar)", "value": "d9a5009fa613140dbcb9d185278cc6c9d4a34984979a1414c5a9c3dc786c6874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498488, "uuid": "67b4b743-d5c2-4ea3-a467-d139cc4c7c04", "comment": "Malware payload (Vidar)", "value": "e696bdcbaabb21ead59eed34e4f558dbbae9ecbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498488, "uuid": "ff5b91dd-ff82-4367-9b09-75fb0f3890e1", "comment": "Malware payload (Vidar)", "value": "836016188a2b3586f077a5163870f7c0bbbb4fcb3dcd4878671bf95dfc13694fc2b8644a9c2ff7662868cb7f312f6c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498488, "uuid": "91a344d4-075c-46ec-95c8-2e6d4bd6a871", "value": "T163165A037E9448F5C0A9E73188AB5252B674BC4D8B3173E72E50BA782F763D1AD79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498488, "uuid": "def23efb-c83d-4ba3-a54c-e3de9f5b2130", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498488, "uuid": "81f4b364-7fce-40df-828c-d73f64437c8f", "value": "49152:0qTipsMDWkwuvo1oHFcx3W/ebI8Q6RpVUWxgtgEIYiMQpN+oxcY5Si:0rd18oHk3WGTByBNwN+of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498488, "uuid": "6edee3b0-cb45-4021-b41f-98c1d4f2409e", "value": 4404608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498488, "uuid": "fd3b6e4e-8b57-4f73-8756-94eed56911c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498488, "uuid": "9901e3f1-48a8-4af8-ad19-a66fea91618c", "value": "d9a5009fa613140dbcb9d185278cc6c9d4a34984979a1414c5a9c3dc786c6874.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba54e7a-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507712, "uuid": "14340a2f-6cca-4356-b26b-817041fe0b85", "comment": "Malware payload (Vidar)", "value": "cfee3ef154667d22299db2cf0e6e8f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507712, "uuid": "609372fa-5214-4bc6-a079-1413260eee7c", "comment": "Malware payload (Vidar)", "value": "dad6eef7282e870027c65af61f7389e12288667efc28625deda908fc08da382c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507712, "uuid": "71526227-7f39-410f-ae41-48b8adc0fa0e", "comment": "Malware payload (Vidar)", "value": "9fdc93ae90c77a3db83de9355beb0a5670dc5a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507712, "uuid": "1b20cf35-359e-4e36-8e95-b111ea24b43a", "comment": "Malware payload (Vidar)", "value": "383fcb57fce46b7947930d4be58da1fb7aff0b1082aca5afb41f98b273012bcf11332590858aa0467ecbb5554483c2b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507712, "uuid": "a138f33a-2d60-4260-a4c6-751c420d80a8", "value": "T174567D13B9A599B9C0A0E73184BA834276297C4CC33577E31F31AE792F267D29E35790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507712, "uuid": "09f5545d-6a15-4849-a31a-c9b736fb4e04", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507712, "uuid": "a0882dea-42bb-422b-8da3-8013cf62e50d", "value": "49152:54/3GkZJSVwtsqZ/+j6o/zk2N4V1JsOohbnw/8J3sEZdap+wfCK6K1M:5sxWfq0bw/E3tZdacskK1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507712, "uuid": "b9a277a4-c7d2-4042-823b-2152eb52125d", "value": 5921216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507712, "uuid": "b100c056-3408-478c-9709-9e4769ef354d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507712, "uuid": "67454e6b-2299-4383-a1c2-62277a53b515", "value": "dad6eef7282e870027c65af61f7389e12288667efc28625deda908fc08da382c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bc07d7-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "b03a263b-2f06-4918-8d41-f49aacb4fb9b", "comment": "Malware payload (Vidar)", "value": "8d657dfd97113c1e4dd3a5d5a9c8c6b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "42f4f37d-942a-4087-9f02-16517f9e3de0", "comment": "Malware payload (Vidar)", "value": "daf0fc05e9868757403adcaac9c9ad7420c0b03f7a8682cc2de218691c80ae94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "7e9a8a00-7ac7-4d5f-8ca9-e76ff6ba7f20", "comment": "Malware payload (Vidar)", "value": "fad3f3014767b09a89b7d10babcfade38626d645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511358, "uuid": "34645382-e018-42d1-80cb-0a1ea8046788", "comment": "Malware payload (Vidar)", "value": "932ca0d8d6c47fb42128eeddb3f3b40e43dae94d02d5b49ac65830b648af5273f073224218a4e56fe4f9f1986b64c6d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "a6aea9ee-7acf-47d9-8d74-96439a38cb58", "value": "T1DDD57C0A7DD048E9D8AA93328CB64296BB74BC454F3223D32E45B7783E36BD19C39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "41ddbcac-035d-44da-9d34-477e29f21597", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "0f5984f1-7b8d-4c13-97c2-b0b14983bc41", "value": "49152:uRMPLgfjzJr6vE23LxkJyhnsJH/OIOJ4X:uRSK6ftjaOI6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511358, "uuid": "b049956d-5e3e-4303-8db4-236d207602d2", "value": 2978656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511358, "uuid": "5f76f8c0-594f-42d8-9ff2-f086490e8771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511358, "uuid": "eed48f0e-a610-47ed-8205-3112751947b2", "value": "daf0fc05e9868757403adcaac9c9ad7420c0b03f7a8682cc2de218691c80ae94.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e7c04-95f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786500662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500662, "uuid": "21d12f06-64d4-4408-a6d7-13ada31c2eaf", "comment": "Malware payload (Mirai)", "value": "fce157045fc2296db8a7083775b71d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500662, "uuid": "65d2f6e6-6734-4bc5-b953-b278c886b5d7", "comment": "Malware payload (Mirai)", "value": "db0395da3759cdb7998ca6ea997a0480fc15b04a0faa3d1bef59672552bbfd68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500662, "uuid": "3a223cb7-2fe4-45ee-8247-5bb70e81717f", "comment": "Malware payload (Mirai)", "value": "985153ebdb664cfb4ce2d37322c0afeb60a0e823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500662, "uuid": "42479684-f713-4fd6-8014-9006601142d8", "comment": "Malware payload (Mirai)", "value": "98382e1d795fd275303a69a4cb4012973e02690a67fb7175acfd0f37aea4f26001a83d04eeb76d252b9307661f856fc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500662, "uuid": "1649d567-d978-44ad-8fb8-84f724b13146", "value": "T1C6E30946F8819B15D5D651BEFE0E128E33231B7CE3DE73029D245B307B8A8AB0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500662, "uuid": "e7f885ba-0faf-40b2-9b92-1ac64b13dd4e", "value": "3072:nIe39cc7MUfPxJyf3ras2n82LEqNci3mNYfJOq:/3uMryfbajn8CN74YfJOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500662, "uuid": "6d6d15ab-4f22-44ff-881b-fe880730302f", "value": 157192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500662, "uuid": "db3a4ed1-57da-486c-a6e3-400f49221cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500662, "uuid": "4c3a1a66-071e-4fd4-ac16-0ce724eb1acb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56eefa4-9693-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786569657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569657, "uuid": "32bf1e02-01f8-48d2-941f-f2ba5c7f5764", "comment": "Malware payload (Mirai)", "value": "aba834f454985151bf015d673fcdd056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569657, "uuid": "fcb06bdf-7bee-407e-ba95-94d8888fac2d", "comment": "Malware payload (Mirai)", "value": "db16dd04af5c8c11941a314ddf0810a153e4f95e95477dadc9f6f35acf34c629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569657, "uuid": "3c8ee743-6c38-4da7-9447-ebb9a9a18b8d", "comment": "Malware payload (Mirai)", "value": "9811782a93ef4d70472562ddc751536e05c4bc3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786569657, "uuid": "dfc380a6-dbb4-43a1-9e57-50a526a108b1", "comment": "Malware payload (Mirai)", "value": "763731bdae96e7652113d8b0c93dd807f738183a051b87f8ff21eae42a0c7c75bf697543eb72cce7664ac2bb1164d498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569657, "uuid": "f187d050-3683-48ec-9021-dd4647f13475", "value": "T149E31945FD458F17C6C326BBFB4E428C7B261768D3EE710389256F60379B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569657, "uuid": "c5bca24f-1930-4fa3-b1e1-78654c009ea8", "value": "3072:nRe39nzVoceUWEEGuJQwfIwnnoi+2O4IdZllDZchCKUSMVPHy:Re39nzVNwLKwfIwnJ+/4MdqhCKUSAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786569657, "uuid": "5813cd18-12ac-4f90-bbe8-0aa9cbef59d9", "value": 148856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786569657, "uuid": "d6aec791-c8cd-446b-97f5-88c5d13418a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786569657, "uuid": "8a5a08e2-5cf6-4f50-b658-2b3b40664757", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f1e35f-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507704, "uuid": "21c42e6e-3d51-4a04-b5d9-eedd7a732f76", "comment": "Malware payload (Vidar)", "value": "026cb64a22896b8dedda15d09743ef85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507704, "uuid": "a0f5901e-2db7-40b2-a9fb-82ac1764dba1", "comment": "Malware payload (Vidar)", "value": "db82d2e981b520a41d5b37fba7923eb3f10f4f9cec14cfb15578735cafed7fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507704, "uuid": "e6394bce-98e7-4a16-afc1-0b5344ce11fd", "comment": "Malware payload (Vidar)", "value": "4f9921b0c3dee76fd6208433735ec1047273da12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507704, "uuid": "2fe491a5-6c1a-4d43-80a1-4a3b247a3ef5", "comment": "Malware payload (Vidar)", "value": "1610440b6fad4a462b093535deb246ff77c9a7798445554adb3beefd6faf6bb64b8f73190a91663a8a873790c662c7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507704, "uuid": "a6770ca9-5da5-4d34-831b-d3f7cce7f783", "value": "T135666B43AD915469C0A9EB3489BA431A7728BC5C873133E32E31BE797F257D64E38B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507704, "uuid": "37431338-70ef-42c4-af66-06089424ad0f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507704, "uuid": "ac657b79-f714-4326-9cf5-5e0db99036e3", "value": "49152:pBj0V9rqyhSGkwHKpwlY09dY+dyecix2P9LdVkC/ZjIAL7XIsDmaso82:pivkwqeTtd3x6UuN82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507704, "uuid": "ed8a7b59-756a-4392-9027-3060fab5084a", "value": 6568976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507704, "uuid": "c389f0f0-c425-4bf7-ab35-aa4ccb2c6548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507704, "uuid": "c39b7748-83c2-443f-a72b-066c50bde9c2", "value": "db82d2e981b520a41d5b37fba7923eb3f10f4f9cec14cfb15578735cafed7fa6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63498128-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1786502088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502088, "uuid": "ff1dc2af-ddd2-4e2f-ad52-51e85da783ff", "comment": "Malware payload (RedLineStealer)", "value": "c3ee58b231cffa28101542dff1ab07e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502088, "uuid": "ff59650c-4cda-43bf-b8ca-1b738fcb3ff5", "comment": "Malware payload (RedLineStealer)", "value": "dc14f1e442332012b8c078d6117cb6bde38c51d59aa82778ecf563bbe4e0e8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502088, "uuid": "2a2cbc2a-da89-411d-ba2a-5f1651682649", "comment": "Malware payload (RedLineStealer)", "value": "611ec1bd5f0886d076a71da1093e3330985df8f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502088, "uuid": "7cafb7e0-4141-4d74-a255-e38c7157a903", "comment": "Malware payload (RedLineStealer)", "value": "9b2cff68c462e11c96e15059d90aad0d10bd920b10d4c7796f5190c5903ae23b04e6a0060d7a0b780e13239738521e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502088, "uuid": "fdf8e8ca-bcf8-49ef-9d5a-b3a56c523356", "value": "T1F91633E5D3A2325CD82FCD363A544A07FA485041AB063BBF2A6F5DEB06DC0AEDF15581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502088, "uuid": "1fc93dc3-24c6-47b0-adaf-b66786b041bd", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502088, "uuid": "28ef3168-5ea2-4852-b460-ffd063c687f3", "value": "98304:cz0O0n6vgwMKoyQ0M1LRC3dcf9JtSZhBTOiOxXXU:dxKF2183O9JkZHOi+nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502088, "uuid": "6925293e-0b65-4a97-8d4f-6f1bc9919e8a", "value": 4167168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502088, "uuid": "ecc28f48-c581-47a6-af16-59de5558ecf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502088, "uuid": "98e555f3-25f5-4650-a868-2fe621623a18", "value": "Roblox Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1950da-962a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786524655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524655, "uuid": "4e6a3c2c-58c0-4e6b-8399-f6982e947c8b", "comment": "Malware payload (Vidar)", "value": "2b577b0a40bcf78b4a2605c75121f64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524655, "uuid": "e248e0b4-22f4-43f5-87f9-de7b509f78ff", "comment": "Malware payload (Vidar)", "value": "dc2a55970c4869ff637026397c60874733a4c59900e49a33f09de6b4793c136e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524655, "uuid": "8fbdadd8-4b66-486e-8f34-d9a2d14393e8", "comment": "Malware payload (Vidar)", "value": "e20c498cfff49764c225a756110de954feb98b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524655, "uuid": "e242ee03-18b6-4594-9981-83afcb7dfd93", "comment": "Malware payload (Vidar)", "value": "7719fd4fa7793db41f8fea2bd88bca602b3749a4735620efccdee8349c4cb399f075ccb1f48ac9e30a587f681cf01e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524655, "uuid": "6efcf6be-637f-4113-889c-740863bfe1f7", "value": "T197568E07BE9115A5C06DDA36897642027738FC4F8B36B3E71EA6A6307F263D11E39B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524655, "uuid": "56d1276b-20ce-437a-8570-33e631aa79b3", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524655, "uuid": "c639cfe8-4d99-4928-9541-48f6d7ffc087", "value": "49152:F0l+ry7N4ciNf1tdwKLUuwS3ODe2d34c4SVl+1mbswV8+kmnSRqgwRBIgBIaPyus:Fz91PLufjnT/z24laY5Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524655, "uuid": "aecc9304-d812-4b0c-ac16-31714097e5df", "value": 6270064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524655, "uuid": "afd6ab31-3fd0-44e5-9cc0-84298a5f58c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524655, "uuid": "bbafc50e-6e95-47ba-8131-cf55a7af7a12", "value": "dc2a55970c4869ff637026397c60874733a4c59900e49a33f09de6b4793c136e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcd2eb1-95fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786504522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504522, "uuid": "8450a435-19b0-424d-8c05-f6aeb2dab7fe", "comment": "Malware payload", "value": "eb24af0594e1865bad0a2551b0a927e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504522, "uuid": "8f942c42-0548-4949-8bb7-67ccabf9dec0", "comment": "Malware payload", "value": "dc4a18a63af8a3dffb52f60e93e229fa8bf3fef9e5f8cab98e0e0748adf13842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504522, "uuid": "966f978a-f3f2-457a-b861-692c0b5c0916", "comment": "Malware payload", "value": "4836adda9225f19c18efd329988c92de6fc75740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504522, "uuid": "d68169cb-8db0-47b2-b32a-d82aaff584de", "comment": "Malware payload", "value": "b92579e727a7cd5318a81156711be5bf9cded7445f475d4b78d872262d084a595c4667e3dfb67c11479700408b8da6a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504522, "uuid": "6b339cb0-d85b-406e-a11f-27896b48bc4e", "value": "T110C31289D8905F83FA5BD4E91E8CDA8373B6FA13B47286E41AD1CF24C92C5134115BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504522, "uuid": "b4347f93-cf6d-4811-b9c8-213320fdc59e", "value": "3072:Q9wxrzc1JU3TyI2vMEsM4xG1f3pymoH9g6wKd6oF4u+qgw2u7:PzcbyTHAMJHw3pyhmy6A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504522, "uuid": "cbed98b7-4049-4c7f-9568-1d8c89e7ad1c", "value": 121304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504522, "uuid": "587aa1f9-bde6-4d8b-b453-e426cd50c8e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504522, "uuid": "337008d3-6152-44ef-b43f-b3df43fb48d2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13c5885-962a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786524660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524660, "uuid": "c03c6b2a-8be8-4c5e-9ea1-22ed1b818026", "comment": "Malware payload", "value": "ceaeb4be3e0b72ff4ab2e28b4c5a4603", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SecurerCrypter", "colour": "#60F931", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524660, "uuid": "c521bbac-3b97-4ee6-bf5e-18e17101da1d", "comment": "Malware payload", "value": "dcbe81222efa09f001d9abf5c3fd9688e8189679917cc6e1d99fa6529fd07f07", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SecurerCrypter", "colour": "#60F931", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524660, "uuid": "704e5521-b014-4acd-aa8f-1593257ba64f", "comment": "Malware payload", "value": "1f83c5e10844e7c4d478c13a00a4eacf17bdedbb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SecurerCrypter", "colour": "#60F931", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786524660, "uuid": "67a19348-bb8b-41d5-88a1-22f8a0211116", "comment": "Malware payload", "value": "0d6464fd8343d8deed4f6ecd6928a40d53ec484d7b460b71db809c56efbc7c3fd25a5f0afc628c803c27f19ef10d8787", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SecurerCrypter", "colour": "#60F931", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524660, "uuid": "e5975655-dc5a-4f6a-be63-de5c2fc1a755", "value": "T1CCD61233B28A753DE06A1B364AB6A110543B7E61AD128D1ADEF464ACCF3D1703D3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524660, "uuid": "561f91bf-f26d-4111-b85e-eda3dd692347", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524660, "uuid": "534aa4c3-6506-40c8-8d7b-dff8557dc8c7", "value": "98304:MoJJq2blHuihz2r6yz6c9dE/E1B8sfGVaqKtTd1/5lJyPZqPxx374V:vVbpuihyG+C/E1PuVaqKtJ1xy0xL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786524660, "uuid": "b4b03bef-b7cc-4165-a16a-ea4a8b1a0358", "value": 13617216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786524660, "uuid": "88361dc7-3d23-4b42-a9c2-2ec25e43b88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786524660, "uuid": "ad3cada6-25da-40e7-9457-7e3eeef4109c", "value": "dcbe81222efa09f001d9abf5c3fd9688e8189679917cc6e1d99fa6529fd07f07.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85579c6-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511331, "uuid": "32b0399a-885f-44c5-ac87-35c810b10031", "comment": "Malware payload (Mirai)", "value": "9a6613645e4bc76816d830da2e56fc60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511331, "uuid": "b8a34c64-1f12-4811-8ae4-f77bfee2cf76", "comment": "Malware payload (Mirai)", "value": "dd35a9e909ac9359da47c01473fd8dbe01ae4c02a17cb607fccf76902dc3c9e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511331, "uuid": "1f988803-6f3c-411b-9790-8812a44d20bd", "comment": "Malware payload (Mirai)", "value": "fc4c3b839b60bb702d5a301cb23e809d69c789a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511331, "uuid": "729edbdc-0167-4356-943b-9de2317e9da9", "comment": "Malware payload (Mirai)", "value": "78854e346463f692244146b84a682a013d4367e5e2e9811d80c5d42eaae6745c09cad1a29e82f9e69ed77a3175571852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511331, "uuid": "acd8358c-c1bc-429a-ae85-d0d731bb76fa", "value": "T15FB3491169395D2BD0D4917A22F7C721F2F6234D20B4CA2D3E760F8EBF60690764B6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511331, "uuid": "ad4d6caa-27f1-4136-81e7-b348f73278f3", "value": "1536:0U+FXZCz+hMIDAObj6wG852ZXSDdMKj/btlWT0oay35F58tXm04:aFJbNbj6wG42ZWdZZlWTP3lyJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511331, "uuid": "ccf11b08-2cbe-4c6c-b933-54d87a7d4724", "value": 108868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511331, "uuid": "51a45f59-83d3-4dce-92ba-c4f25f185c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511331, "uuid": "88874f4d-fbcb-4e2d-ac7e-098bd5981d7a", "value": "bot.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82c7f0c-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786500566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500566, "uuid": "32423b7b-89db-478d-aeb9-98476c76f702", "comment": "Malware payload", "value": "903cccb97f570df4ac9a782cfb50578e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500566, "uuid": "dd82e1b5-76ff-4373-9d66-f881f7600edf", "comment": "Malware payload", "value": "de3f3a426136416f1338a5d6639258273c922e37b126b25ff0b983d030bd036a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500566, "uuid": "fd9938fd-3e0d-4fec-96b8-c0cf26407cf2", "comment": "Malware payload", "value": "bc2b9d758bfe87ec308b5bddc741c68ec6eee8f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500566, "uuid": "0bbb8e8b-2160-4955-94ba-0bd15af5cb54", "comment": "Malware payload", "value": "72a0cd1ec203fb8f5ce85a9d5a7635bdb6df383f7bf09f15c48a5b7f85220fd5abab1b5949da51d2a36df8fca8653580", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500566, "uuid": "cb5423d0-c6f9-43a9-a1e2-a3dbf3ea974d", "value": "T163236D661A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500566, "uuid": "c99ae2dc-e3a0-4fe4-a39c-467b82e4ec1f", "value": "768:ERXRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Erlx0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500566, "uuid": "89715ecf-e351-41d4-87d3-a348a4dc5eae", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500566, "uuid": "3327a71b-814c-4cc3-9326-816389cd32e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500566, "uuid": "6931202c-7ccb-4e2e-a23a-4e96a0ff2d73", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8e30b1-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786521704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521704, "uuid": "e9f9a46a-a423-43a2-998f-85b05abe3f90", "comment": "Malware payload", "value": "ec0406f14aa08949fbe2d7c2b5699177", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521704, "uuid": "178ccf62-cb4b-4bc1-b4bd-4660dbc1f184", "comment": "Malware payload", "value": "dec4cc0652d9d432baa8ac74b7d5b8d399fae7c4b955a8426a0d70715511de78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521704, "uuid": "fa0645f0-c5cf-4a34-bacc-0b336f24f54e", "comment": "Malware payload", "value": "02251530ccb4b9e7993f66038ba8b115a48396ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521704, "uuid": "75a14f99-7121-47a3-b979-a93417d444a4", "comment": "Malware payload", "value": "1c252ef6eadb27cb091715dcf2bd3eb2115da78b774195f1efe98c6759ded11c37a9e9f93d4bbac2d553cc63826cf1ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521704, "uuid": "5e01df87-c47f-4880-9cbf-7fea32b46022", "value": "T1AE25A4EAA387421979D7E0FD491E2810CE3B136E4A725237754FF4C4AB5562CE0A7A33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521704, "uuid": "104b82e5-bdd0-4be9-893c-71c977fa86e9", "value": "384:URjBAQiZFUn04ashyhKOuFbF0Abrg+FHFTw+sGNFFBFyIxQGjZFsFhfMPzfFAIm9:SZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521704, "uuid": "42e1249e-a53a-4547-b3e2-5fbb8be4c739", "value": 1038532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521704, "uuid": "57e43ed4-f43c-4973-96c9-8bb5b9f291dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521704, "uuid": "66cde048-b748-46dc-ac5b-6e0c0b9bde37", "value": "Tender Details to Bid.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad766539-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512520, "uuid": "82532f27-5fbc-43c9-bfd7-cf31d9de3067", "comment": "Malware payload (Mirai)", "value": "7ee503571ceb866bad6d8255b4bafd12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512520, "uuid": "cec44ae9-b225-48a5-aa3a-3dced4ff9ec1", "comment": "Malware payload (Mirai)", "value": "df40478ef5f5b877bdb523bb3a87e2210bcd3cc84f8f27699558e7ee9495a09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512520, "uuid": "8b9e4c68-b300-45bd-8111-c2bfd810b805", "comment": "Malware payload (Mirai)", "value": "535edade61447a8dfd8741ed03814a7790f557c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512520, "uuid": "e79c0be5-d0c3-43a1-adb7-6050a321bdb0", "comment": "Malware payload (Mirai)", "value": "d0498a11b02adce361c8b797c28129c326df2dad60a3d9bf08856d338441b52c132442e7436e57438055408c4c5dd324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512520, "uuid": "743452d2-ccaf-40c7-8ad4-74f0547377e9", "value": "T11003F286EEC8F9CDC9CEFDF9044E13918E9DE95021EBAB4971448DCDA50A397704D8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512520, "uuid": "d05d2d76-6fd9-46e3-8bc1-52713c77632a", "value": "768:+VyIwYjG0JFHwPLlge0i8ZSu3PJpChkg2Ji5F4uFV//Wo:+VyYjXJpwPOeQEEJAF2m4u7/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512520, "uuid": "361e87ec-2087-47cd-824f-b96eef77e1f2", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512520, "uuid": "ce4c0a9a-42a7-4379-b06b-6f3f77d5c9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512520, "uuid": "04bb3ca8-7ffc-49d6-9502-b8724c224062", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fd1c02-9622-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786521150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521150, "uuid": "c7e621b9-c800-4782-b106-c071d24e12b2", "comment": "Malware payload (Efimer)", "value": "787660a571fe35cec3679726484f5121", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521150, "uuid": "9e7c18aa-27c5-4639-a381-acf2723f8d16", "comment": "Malware payload (Efimer)", "value": "df91b4bf1d00298e90ad6f91e8097eaa9ad63596ff00900a23d02d20cafa444d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521150, "uuid": "c05ecdb2-e1d5-4e72-bb56-f2009dc33998", "comment": "Malware payload (Efimer)", "value": "eeb2522814dfb5772b3e6aad6305b833185ea61e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521150, "uuid": "2ee84501-6686-402e-857b-9ed334dfa55c", "comment": "Malware payload (Efimer)", "value": "4914bb2f74c271d2cf5bb8e32250ddbd0fcb9e712723a370496844fab1d5c28b7d3c42c24184017d6aaeb62be3c9c8df", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521150, "uuid": "0ea94af1-9493-4877-b7d5-03b220da96e2", "value": "T12FE6330248D1929FC8E3903977A26F78542C36615BF5C8FB551DD1A3AC9B2D4AC3C8B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521150, "uuid": "c0b69cb9-d117-4edf-904b-972398076665", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521150, "uuid": "2995188c-0138-48a2-8ca4-1e4ac21c497d", "value": "393216:LyHG2eNwhUVtE2FGXMCHWUjscuI3/PGTAI:LyteNwjpXMb85H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521150, "uuid": "330d9126-b7e7-487e-95bf-2ba119dd24e0", "value": 13890739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521150, "uuid": "afb2175e-af52-4e50-84a0-e9f2f57ecd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521150, "uuid": "167b4dc5-0f9b-419e-a842-6704960d21dd", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3e7594-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786522769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522769, "uuid": "d3e73080-31df-43a5-931f-51eec30041c9", "comment": "Malware payload (VIPKeylogger)", "value": "1298c79f6811283a16ec76a072755e5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522769, "uuid": "01dc57c9-ad1e-4da2-bc0a-a0ce5a5e5485", "comment": "Malware payload (VIPKeylogger)", "value": "dfc8e7b7e48faab9a410111ea31001c729ab9b1c83525499f028b5344869be9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522769, "uuid": "ccf6ba9c-8ace-4e59-847b-fd9629aec738", "comment": "Malware payload (VIPKeylogger)", "value": "a51656142ad96734a2b0468acedc42283eb592bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522769, "uuid": "53404d71-71b4-4801-8316-fdefc90d5cf5", "comment": "Malware payload (VIPKeylogger)", "value": "90e13abbe4cf53d05adab33b38caf350c5ee5afd0cd9cc187f30652a05ebbd5e2915a020e4d4649e80429fadaf03ed69", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522769, "uuid": "22e49445-12ad-4e7b-8693-8e719148e2a7", "value": "T14CF5C68A3360D5B27B206B4C61FE9E209C9BD98714C5CB41357CDA0A3B2ED475768BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522769, "uuid": "d28a1773-e33d-4d2e-a64f-bfbe043da92a", "value": "98304:TBZ+7aUFbTroDSVce7Ywk9FKl9dHdUzkoREilqXtqRMNIzqw8unAuQTunSK32:TBZ+791rouVcSA9FKfdHaVadqXzhNnAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522769, "uuid": "c677f9a3-7f2c-4197-83e8-5747e530c6a4", "value": 3451854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522769, "uuid": "659d86cc-c310-4f72-9ccc-25e3cf887bfc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522769, "uuid": "926a0d50-0722-4115-9923-66418017af7b", "value": "\u8acb\u6c42\u66f8.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4ce325-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786503148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503148, "uuid": "96880d12-d039-4f27-b75d-03df49f7fa32", "comment": "Malware payload (Efimer)", "value": "5c1f104242056de9b38cfaf1e44de20c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503148, "uuid": "9f5ee213-29e2-413f-a45d-7b554a785599", "comment": "Malware payload (Efimer)", "value": "dff2505a7a6a1462ad535faef9ed0fd9d39d9b22c7ae2224f4bab3f4e6aa9773", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503148, "uuid": "780795e2-14d6-4ff4-b7c3-8b0754ef62b6", "comment": "Malware payload (Efimer)", "value": "4fd33b9d285e3aaf94c7fba84c29e8c89f880741", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503148, "uuid": "3c913486-0950-498e-8c06-470a25588e37", "comment": "Malware payload (Efimer)", "value": "04b035821591b7bced47ff5ff4437f79ced85d58e26697215ec13e2195ad0ef721c69ec84b3019e76c32b09b4dfadfc5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503148, "uuid": "f9412333-3aec-41ee-b322-602b94087b5e", "value": "T122E6331D64C4668EC9B0E13DBFE202B0A164B2B51B3743FF525997226CB73A09C3AD57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503148, "uuid": "2f0379cc-516d-4e4e-94ee-f97408e8f87a", "value": "976d2ad389e8b21847d44dfb70916b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503148, "uuid": "76246b2d-1275-4e7b-92d6-db80d1452b9e", "value": "393216:508vKf74fiYwvIt3XX7clXMCHWUjBcuI3/PGTAI:508Vf+It3XXSXMb8WH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503148, "uuid": "c923ef71-ed18-4835-94ef-3234865becbc", "value": 13887972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503148, "uuid": "d44b7d0b-c3e2-41cd-8265-5ecb100e54a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503148, "uuid": "0f1e6a1f-f643-40b9-9d4a-756094cd9c04", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dcaa64-95f1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786500025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500025, "uuid": "947c5c4a-516b-44f2-9b44-37045531cbd7", "comment": "Malware payload", "value": "80dc058741cb825234c2070cf06c0f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500025, "uuid": "1119f06a-1d63-4348-8bbe-2e8dd46ade91", "comment": "Malware payload", "value": "e02b22dbb4074aa2aef9f606d7b86808f882ab9752dadd18bc486176d4c99da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500025, "uuid": "62529a64-646e-4194-ab25-f6d6b5e3861d", "comment": "Malware payload", "value": "3b4857535990f26c243804dc858c15c7ebf2ea57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500025, "uuid": "59518019-8092-42b3-a266-16ab8b684632", "comment": "Malware payload", "value": "b9d1c4ccb8bc79bcc7c74f89e83da9cf398da01b7a18187383b22004ea26d817831d705187fb014f0320870a8f657f02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500025, "uuid": "f1f33465-239f-41b6-bd97-17899e7bf99a", "value": "T170C31235894DE7B6EBC24E70D8F08B577951ACB0E3C2B4502428EA29B78C0757EF858C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500025, "uuid": "20b17d27-fd36-4d56-a1f9-48e395fe6651", "value": "3072:aM1w+SgkBeCEGssBZr4fN2xDS3xzk13qWAOu7:ao1J4p3BWlGOxzk5AOu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500025, "uuid": "938c9ae9-5ed6-47ea-adb7-84bfa81854b9", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500025, "uuid": "6e56fc00-f369-461c-85f0-8d38d9ab6189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500025, "uuid": "37c19925-a58f-4661-80ac-254acdd985c1", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dffdd8-9612-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513954, "uuid": "63eb9637-6673-49d9-80e3-509408fe71e0", "comment": "Malware payload (Vidar)", "value": "4bb01689507867d905f316a8df277f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513954, "uuid": "a73dd0e7-3504-4cad-b3ac-4a1ff8f1830a", "comment": "Malware payload (Vidar)", "value": "e11d220af1f2fde5655d2523207a96be7fc286ef5080f1dd88b3e2db47172cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513954, "uuid": "7248fdf6-8585-41ba-874c-3bf70006227b", "comment": "Malware payload (Vidar)", "value": "cfa60c46b9c07fa56bf245a3244fca76db0cabb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513954, "uuid": "2fdec762-79ee-40cf-845e-ee6904e8c04d", "comment": "Malware payload (Vidar)", "value": "779d438258362761a1d323660f5c5b747fc92fec5c4c4df470aaf573fe84a0c22801e33b073253c259f989c5d0fad86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513954, "uuid": "8a4c67bb-9f3d-46b1-b00f-b63aae93175c", "value": "T12906AD06FD911CB6C4A6633149B612513B7DBC089B3A37E72E90B27A2F767C28D34B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513954, "uuid": "121ec861-0385-4b16-9623-9151d471492e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513954, "uuid": "5bd13026-9972-4841-b8fa-0d63fa2752f9", "value": "49152:RPzokb2VEUN8H18OppHJOtUJUb+Et+ILfm1txnTbmMdEm2:RPxGY6UJUqEt+GatVTbmYEm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513954, "uuid": "7c74c890-6049-4986-a268-a2e29daf7468", "value": 3882048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513954, "uuid": "b9254a11-b85d-4a37-8b5b-535be047f00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513954, "uuid": "b24afcf7-430e-4b87-b259-15cf969e883a", "value": "e11d220af1f2fde5655d2523207a96be7fc286ef5080f1dd88b3e2db47172cd8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c099a6ac-95f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502674, "uuid": "75d16f59-4d56-43fb-bc22-a8eaa4a9b24d", "comment": "Malware payload (Mirai)", "value": "c1449ad2e63382c5dd9bd444c9c386db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502674, "uuid": "49b1b505-e422-4842-8ef1-0b3a726a50b4", "comment": "Malware payload (Mirai)", "value": "e1f3a4483c1c27436eb19cae9850237da14a3d3964f49690a6b375b827f6391b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502674, "uuid": "a208a6f8-f214-4378-adcf-9d3bd7225ee8", "comment": "Malware payload (Mirai)", "value": "6fffc188f190db240714c50413563d696241ecef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502674, "uuid": "593d802c-010f-4180-8c4e-2f8217f6f0c5", "comment": "Malware payload (Mirai)", "value": "45f50d7ca423e4742a072a3bf4c3ee4fcb2f70c5a87a09a82ec840a8fc013a728653b15326dbaa61d5256962f5bee159", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502674, "uuid": "d1444e1b-ac23-400f-9770-63e243edd877", "value": "T16D5302ABC7C884C1F88EFD7D12B483103EA11E927248EC13A139E7549D58CFF681AB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502674, "uuid": "56206371-4134-42ca-92fa-26b3b45dc99d", "value": "1536:vU4xTHeGGTuZzdyN3GPuldgiCVjoSsq7M2jtDVJuv:vXTHHGqZ8RLgguMaVVQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502674, "uuid": "e73e9e2a-1468-4e86-b6f1-b6e2c1092422", "value": 65320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502674, "uuid": "e4b43ac6-be48-429d-8504-d09a90929542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502674, "uuid": "2444e765-e628-48fd-930d-da26cc4bf518", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023cd2b9-960c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511374, "uuid": "014e8350-8ba0-46fd-a9a9-828c969ec71e", "comment": "Malware payload (Mirai)", "value": "ae4d715fa81e45fe8c58dbe6eeae273a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511374, "uuid": "c86cc219-99ce-4b24-9520-14cd7ddf638a", "comment": "Malware payload (Mirai)", "value": "e1f4fa1b66459d3d59db113ebaf01f2cdb67e3ad7d6fe0eef2709582e9c69121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511374, "uuid": "e43e4b65-33f4-4407-9a88-7ed4c744a830", "comment": "Malware payload (Mirai)", "value": "0f7855e7b27ed12cb37356d3abc0c85d4a6f4394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511374, "uuid": "c35ddbe3-91fb-4112-ab95-b0130ab9302b", "comment": "Malware payload (Mirai)", "value": "db094461bd97c27edf0df432e873aaad48c56834e9b53800121e3d9f022c2379d8dc222576867a303515147cfa4cfd26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511374, "uuid": "b8567d1d-b6bb-46c5-adce-513dd30a4f48", "value": "T1CFC33C46B504493EF5CEB335C4F69B05B13DA68496414726227BEFABBCF12E8D83AC05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511374, "uuid": "2dbb7a74-0f5f-47d5-9a8a-c75fea1f8911", "value": "1536:RiYsDFFp7EnYYY8PI2nKKjurVHBr/iWevJiKAEAos5ypeCOn2pNTh9ph:R64ndi2puBViWeRiKAEQOE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511374, "uuid": "90e091f8-fe37-403b-8147-8716b959b466", "value": 118964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511374, "uuid": "632ae46a-d186-4b83-9a92-3a9d17221c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511374, "uuid": "e2b9f55e-1734-4cae-bc94-3bd36e1bafc7", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76a611b-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786511356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511356, "uuid": "6065f6b2-8909-45ec-9619-a67325b8bcde", "comment": "Malware payload (Vidar)", "value": "9131b67993a758f66691d3caafdd9d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511356, "uuid": "a819f7db-7a61-40e0-972c-1da6d71a8696", "comment": "Malware payload (Vidar)", "value": "e218458a55fb3c24b6a57dc0069c5459052346c0b21a7f39f47966ed5b355dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511356, "uuid": "249ed0ca-57b1-4aab-b97b-6f8cdd303669", "comment": "Malware payload (Vidar)", "value": "60a0b9dd702cb719b3cf0647d4e25504bf79fd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511356, "uuid": "d1129b19-4373-4bfd-b3fb-e97a3f0cd9cd", "comment": "Malware payload (Vidar)", "value": "43cab76256b4c63eb311e5ff4bc085326d0bb24ef1d1d9a2e1c3c4bb16d7f4c6b6ccbe1f77621fe26a18520e161ff178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511356, "uuid": "ab946df7-b043-44bd-a6ef-764707c28991", "value": "T1EBD58D0B7CA449EAC86A973589B651927B30FC460F3633DB2E9077792F726E48D35B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511356, "uuid": "f32eff17-2085-453f-a6b4-d6bfe1e2de1a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511356, "uuid": "a9f21680-9368-48df-b371-db254cebf5f6", "value": "49152:U8C/tStz91Na+E5frV/NfVOjq9Bmr1EILO9mSVQv8Pv4IN:UdobsttL946ILJv8Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511356, "uuid": "65174faf-4617-4351-afef-31695b0e66e1", "value": 2935656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511356, "uuid": "002b3b63-8a0b-46ee-87ea-222bc9be9249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511356, "uuid": "89eae378-6f78-4fe3-8abb-9a25f207b26e", "value": "e218458a55fb3c24b6a57dc0069c5459052346c0b21a7f39f47966ed5b355dab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3309d9-9647-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786537000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537000, "uuid": "872500e9-13e3-4c9c-84d9-0d034eb4a2d2", "comment": "Malware payload", "value": "ec9f6ffef480b8a2723e92511a0a6c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537000, "uuid": "3caa710b-fb9f-4004-bdd2-1fca8853bbc4", "comment": "Malware payload", "value": "e2988ff46fa33c35646ce8447f8d24ebefa42cbca16c9de9f766a81142e57f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537000, "uuid": "11a91c71-9ffa-4765-a714-1fa18e2421c4", "comment": "Malware payload", "value": "e3f614ebadd08f94ef9e4ad7a073843a8323cb4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786537000, "uuid": "9a8f0fe9-b0ab-449b-8b5a-db1af8f5575f", "comment": "Malware payload", "value": "8c61b7711df690c4f7b3adbce310b32860dec06cab2d24e73f52c5e4a7359624eb9894c6645099d11679c844e9ad80e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537000, "uuid": "7281594d-e94c-47e3-87ba-8c3b14e18a1a", "value": "T14325A1F9228E2480D9500C30CD2E61D6AB57D24C4F692E743939F6EF2B86DED6F61C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537000, "uuid": "f4a93f4b-7246-49ac-81da-841c872f1480", "value": "384:7TKYNSYkY7YRTHY6THYkYPYNoTKYNoTx5YkYhYRYLYaYLYrYkYkY7Y95Y7YRTHYs:Kvc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786537000, "uuid": "0d2c33eb-3348-4b3b-815f-f40af6eefd57", "value": 1010063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786537000, "uuid": "a5ab30a9-6bd4-4073-bd91-bb2eaf4cd13e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786537000, "uuid": "923b6485-bc65-458c-85fa-adb49500572c", "value": "HWW.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b65a55-95eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786497235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497235, "uuid": "ae3f3fbb-9414-4255-bc3b-1ccc8db00584", "comment": "Malware payload (Mirai)", "value": "5994447f104ea7dd9c121d4d7d242cdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497235, "uuid": "754c4e16-5c1f-4001-8e72-b54d08ae14cb", "comment": "Malware payload (Mirai)", "value": "e32122ad84f511843008e2d7f8c1f3f80df5f38ded4e7e3ae56bddefad0d6d11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497235, "uuid": "3d57e23e-faa7-4482-9556-809c63aee7b9", "comment": "Malware payload (Mirai)", "value": "c81b214bd3815dd1b85bf645989487b8d9ca3cae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786497235, "uuid": "49151d99-6281-4829-a2fc-f33ced25e19f", "comment": "Malware payload (Mirai)", "value": "96153aacd9b9538751fb342231bd2ce67e6e80aae1c402f3f8e87d3c4c158c668d7889047fb1fd079142f2fbce243fb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497235, "uuid": "4c0b7434-a7c0-40ae-ae81-9b5144d172d8", "value": "T1D1C3127E9667BC76E6D0A979FE0CB8888C23D8ED7C6E76555304839190F0A0769F44C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497235, "uuid": "473958f3-f754-4448-8540-33ca144d9185", "value": "3072:NQ+Cpkc+q4dcQqTbzSl8pQIDRHYkbDiLbnjtq1k:NQ+WLSW5DZYk3ujtCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786497235, "uuid": "af19fd8e-cecf-4b3e-a4d5-d270eaaa3268", "value": 126496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786497235, "uuid": "28d0c81d-1c0c-460b-b7f9-64398d297654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786497235, "uuid": "e1e22225-83f7-4a1c-85b0-ec028670d294", "value": "e32122ad84f511843008e2d7f8c1f3f80df5f38ded4e7e3ae56bddefad0d6d11.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86a67c7-9605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508673, "uuid": "281d9558-2977-40cd-a58d-0ae0198ad706", "comment": "Malware payload (Mirai)", "value": "910eb66c7579e3d7e7db269559e992b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508673, "uuid": "cbade7eb-4c69-49b3-8513-886bb21a0c8a", "comment": "Malware payload (Mirai)", "value": "e33c892a96bf48a876f1976d0c2d6694862cb2e2410c4da45f7e210e82798db6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508673, "uuid": "0b3dc590-eb5e-43ea-8321-b27cb033f76a", "comment": "Malware payload (Mirai)", "value": "2cb5bea33c4aa76a07d585e39082e17fc42bd51e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508673, "uuid": "7f683f42-0d0b-4684-b258-e0927cc48e89", "comment": "Malware payload (Mirai)", "value": "937237172c94086fc2702f024a4e9ec6e2d7e5fb7de1e188db2c4de3863598b89b7341e2610611ad0beb3a8db9a58aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508673, "uuid": "7aa72886-0f9b-4389-b49c-ccc3ebc13e2b", "value": "T18E24A61E6E228F7EF269C73447F79E259B5923C623E1D641D1ACD2101E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508673, "uuid": "7f5a3459-f4f1-4715-9024-5cd9cc42c895", "value": "6144:uydHJazQFDd6Oom0yCQXTDkgzvVW83Ht7OZ:RJakFDd6OovUwgjt7OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508673, "uuid": "7a62be53-ebf1-4737-8516-859b3d544182", "value": 227076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508673, "uuid": "c1bff095-d007-449b-af17-4c30f72c9164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508673, "uuid": "92faa90a-9a63-47f6-983b-760fc17c3b9f", "value": "7e8eaec2976165bf1c94b21a504a16c6be07f7d4f5b78e46f9ed100431894cab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e215d9-961b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786517845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517845, "uuid": "686c845f-858a-4fa6-b06b-0bb3e32e991c", "comment": "Malware payload (Vidar)", "value": "c58cb816123ae729a8b704e971fca4da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517845, "uuid": "502e1158-0527-4a25-a232-b69e18ff6573", "comment": "Malware payload (Vidar)", "value": "e3483b9d72df017cd2a7909ecf97b825d69d06e0ec204067c42e4658d91fdf00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517845, "uuid": "0114a3a8-db86-4486-b9eb-d20a439ab6b8", "comment": "Malware payload (Vidar)", "value": "246702f89a6c11593bf1ac0d2a8965d3d5b4fdb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786517845, "uuid": "d8f929e3-02f3-4362-95d6-8dbf7d981440", "comment": "Malware payload (Vidar)", "value": "3e00dd402a84cae84e672de6addf7aea40744fc51d864b53f021ce1879c91a3eeb2906d3966a9a6fe4e9d622b2b244e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517845, "uuid": "9c6c3760-05b8-446b-875d-d37faeed2bf5", "value": "T14A565C43E951987AC0A1EB3044BA8356B729781C573937D32E70AEB82F767D29F36710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517845, "uuid": "4ad0ec76-ea92-489e-923d-507fdc06f83a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517845, "uuid": "5a8e6aed-1429-46a4-ae73-71153d8b44fd", "value": "49152:HyrFoTCuZAw14Y06TREyPIGCSQNrS/ID/YcS1AwlPmj7Xsv2nd6WIzZB:Hss150HJ3rSADVHNUlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786517845, "uuid": "4152b12f-d010-4bbf-aa97-cd69883d9fb7", "value": 6261208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786517845, "uuid": "92234e94-6b0a-4c16-923e-d36aa22b6d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786517845, "uuid": "c94d2c62-b1c3-4ed0-a6fe-5baa8365c291", "value": "e3483b9d72df017cd2a7909ecf97b825d69d06e0ec204067c42e4658d91fdf00.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700e3953-9653-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786542053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542053, "uuid": "ddbd0419-7b8f-4717-bdbc-fb3359ac6b16", "comment": "Malware payload", "value": "72196300b9e22821540b1de6acb48f79", "object_relation": "md5", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "MpCmdRun", "colour": "#5B2938", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542053, "uuid": "5f23c311-8ad8-47b4-ade4-fcd3303c278b", "comment": "Malware payload", "value": "e36f3cf3ed7ab2fe4bafe6629603615d6e091ba31b7a0ebe6cddd5649fbc6ca2", "object_relation": "sha256", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "MpCmdRun", "colour": "#5B2938", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542053, "uuid": "d412fcd1-d3c5-48dd-a5f1-b34a751ef283", "comment": "Malware payload", "value": "9461ba6811f0a56622cac28e5a7675581c033d60", "object_relation": "sha1", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "MpCmdRun", "colour": "#5B2938", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786542053, "uuid": "8f5ea1dd-b07d-42b3-b774-058e9a435f6c", "comment": "Malware payload", "value": "caa8cad7a8c1c724bdff3edd049a3238b52beb41532bbfce2f63b50899d470c5b85ae88c4daaa2f4aad3cea922bf4b42", "object_relation": "sha3-384", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "DLL-Sideloading", "colour": "#BB386D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "MpCmdRun", "colour": "#5B2938", "exportable": true, "hide_tag": false }, { "name": "selfsigned", "colour": "#36C065", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542053, "uuid": "24e6f6d3-5d8f-45b7-bf41-d904730c69e3", "value": "T148962727D9104C74E1CAE635C87B825BA6747C9C8B3527E72EE1BE742E727D12A38701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542053, "uuid": "bf519f31-a7ad-4729-b13c-be1fb3a323dc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542053, "uuid": "600c663c-fcf4-43da-a8f0-696cc8417eb7", "value": "98304:6tB1+wAraB+RbMvF/EmTucfKL7tnpBrLcEa2932EVcHg0deo:6DAraB+CvF/Em2Tp3zV+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786542053, "uuid": "76c6253b-842c-441a-b937-e872dc7ec20a", "value": 9128792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786542053, "uuid": "90a71879-d815-45f4-8544-c6d726cdea01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786542053, "uuid": "975654d2-0aac-46a7-9747-5561e1d302bf", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f51c26-9697-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786571211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571211, "uuid": "d3c3c76a-1ed1-4795-9cc6-d1a30b5b18a6", "comment": "Malware payload", "value": "ce9ce3395ca1e410b7949d9160b8905c", "object_relation": "md5", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571211, "uuid": "a054f8bc-6a62-4acb-914a-29f1dd0a1266", "comment": "Malware payload", "value": "e3fbe466054844db78527a099d11a4e9d12c40a4bd9add4bef9faea10a902eae", "object_relation": "sha256", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571211, "uuid": "37a4aa43-2625-4b21-8c7d-8209bb059307", "comment": "Malware payload", "value": "214f8a07827b6c51e1922f1a94735ea0633c6c53", "object_relation": "sha1", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571211, "uuid": "cd3d0cfd-9cdc-4209-b584-dae19b2fc056", "comment": "Malware payload", "value": "4fa50e686615633f0f7180cf83a9a9b595ac879a20453d05fb6ce0f5ffdee3cc7a8ba126a19b4c300682b75053fd56ce", "object_relation": "sha3-384", "Tag": [ { "name": "93-152-223-39", "colour": "#C020A6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571211, "uuid": "aa9ae955-00f7-4028-becd-b3b76c04cc35", "value": "T10003E025CD275071E0B7BA32EE1E4D90F2594B54C1D17B7B382F829990B3B4EED5B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571211, "uuid": "15916eb4-b3c9-4a9c-ac4d-0c02d50a6f49", "value": "768:ZAWFnm7rdW8Rhej2aCRWrY/CGD5uLiNTKUU2vqYfoZ4C:Lm7rZHIwr/CGD5uLmdU2iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786571211, "uuid": "85a98c31-6e35-46cb-90fe-c9e9e363b4a8", "value": 37825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786571211, "uuid": "bc9edfc2-042f-491f-9dab-8ad087f84f4c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571211, "uuid": "1dc5b8ac-6b01-4fb2-ad7b-534034d6828d", "value": "Schet_Akt_1842.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38067f8-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511349, "uuid": "67599c07-56ea-45d4-bc78-8a0c23267e6a", "comment": "Malware payload (Mirai)", "value": "34b3d5f48305f5216e8133539eca33bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511349, "uuid": "e98f993e-7cdc-4e3a-818e-7d7de0f99164", "comment": "Malware payload (Mirai)", "value": "e4a129bca0c29a6647f8683ee6ab77d1307e603351b51ff6dc3a32628ca11c25", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511349, "uuid": "091bef05-ca45-486d-8d0a-fdcc0d6b53a8", "comment": "Malware payload (Mirai)", "value": "292fc52e5b1298e0330d2cb87af2df77c06cf31d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511349, "uuid": "3f571c64-c42f-42c4-8273-ce7380b3020a", "comment": "Malware payload (Mirai)", "value": "cb03c6d6c7231540d200b35bc40c17baaf2f8c5c92bc0f673c7b19e958395751131a127b305000d909bef050d1f6fec1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511349, "uuid": "0fee3f7a-649d-472d-8236-f0b4a397fd95", "value": "T11E0105C7025671E1B281C9A4B4A3EC987E2EEA9C67E48E4CC4CD392361ACD01712DF76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511349, "uuid": "80c741cc-8375-42aa-8ddf-951d11c99fbb", "value": "12:68Bk8ByKBSd8BmKCZDYK5s3EtgYt5s3EgY5s3EoIjDYoISs3Ev3DYv2s3n:M7YCZNaOla/xec43Y/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511349, "uuid": "70f256a2-54da-491a-9f44-3ff70912cad9", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511349, "uuid": "9f54df09-26a9-4619-b21b-5ea80db96df2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511349, "uuid": "dda99e40-5bbc-4faf-a995-4c2c6ae80e05", "value": "zy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22abe37-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512528, "uuid": "4de4ad70-b252-4dfa-ae3d-c78a8319be06", "comment": "Malware payload (Mirai)", "value": "6f164a772de4efc28a5b54d0d8ba766c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512528, "uuid": "85a0031a-5777-46bc-89fa-32f1b1e9b2fc", "comment": "Malware payload (Mirai)", "value": "e4eb0f9c8d9b5c1235901d2e883a60be6d14976d67d8cf34bad73ad487ea35a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512528, "uuid": "d579451e-1fbd-4e7b-8ab0-1fbbe1784626", "comment": "Malware payload (Mirai)", "value": "e80b0c0299ece1fd77b290d7970d689e0b5d8d44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512528, "uuid": "4fd8a65c-1543-4ec1-acf8-fe0f5a93c2b9", "comment": "Malware payload (Mirai)", "value": "f3da1bc88f7683e5c1476cc88bd3e5d45728d73eac24ad2c12df30b35a4576454facf57bc0b3c2ddcb745a39260e29c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512528, "uuid": "6b5b12cc-7e20-4b79-a15d-a3a11488c33c", "value": "T173430126C70B31D61B510522D0A229937BC75FFAC4FC69222BCB6EF5B389881A57C647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512528, "uuid": "114be051-cdef-4f31-9520-451696119164", "value": "768:EqRb8Rkcu3EDbt3Vu+v4YMDx6NRfZZXEb9q3UELudA6tlVTukpUk1LrctlRh:Fb8RN2EDxE+u6NzZXE6Luy6tlV1nLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512528, "uuid": "73731f8a-9a6d-48e2-a67f-a25c66f46873", "value": 60136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512528, "uuid": "d84e65c1-fbe4-4dfd-99a3-958148a06e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512528, "uuid": "4720d827-6a5d-4368-a3ba-808ad8835737", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99074b11-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502178, "uuid": "7efec2dd-d757-4ec0-be96-f47781c9e0b9", "comment": "Malware payload (Mirai)", "value": "e93c99f407d8d120780b764f86389a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502178, "uuid": "ec413910-48da-4815-8750-b08e98a8c71a", "comment": "Malware payload (Mirai)", "value": "e55d4c51938a7ed21604c569610988680db50ec0c7ff446205fbcdb0c21ae903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502178, "uuid": "93fe857e-0349-4f46-b6d3-dbf8a946e43f", "comment": "Malware payload (Mirai)", "value": "5e5432e656d0a002eef3a824750a18ad5ce73942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502178, "uuid": "b9ac086d-b466-4ecd-9f44-5c045710abe9", "comment": "Malware payload (Mirai)", "value": "0bdec92a70f793ec6c74b7c80146809c24a26bfa67aa94ebe04b51c5b7cd6d5abc06a7ea359da10710a1c7aab447f8d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502178, "uuid": "9386d3b1-9908-4a0e-a443-cb9ee861029e", "value": "T1EA4302C0D35CE79EE5AE18FF2EA5E3593B90454F4633DAF2A1C25A059842F3B13A1D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502178, "uuid": "d0e952ca-db12-4d8d-85b4-9182a88dcd36", "value": "1536:xspndeZgJnkIy0UjU/lbVjgqgQWXUEQHXN4u+qgw09R:xsnkD0YU/rzdzXN4u+qgwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502178, "uuid": "9c37672a-c67d-4d0f-80b2-81425a96e67f", "value": 58312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502178, "uuid": "090db496-e4b3-4745-b20e-c16e9c8ec7ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502178, "uuid": "e16cdda8-d862-49bb-8761-14139d65cf98", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486c4a86-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521800, "uuid": "2fc8244a-0989-4801-8f18-cf12e816cb07", "comment": "Malware payload (AgentTesla)", "value": "469cf8fc46db911ab96bdfe15cf9860e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521800, "uuid": "44762b98-26fc-4a63-b9df-ba9c1cdbd032", "comment": "Malware payload (AgentTesla)", "value": "e598acb2e6227551be2092123b8747e74815fcdbc36a19c9ee81270ca082b431", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521800, "uuid": "dc0807fa-f274-4a64-9c43-62d893b2259d", "comment": "Malware payload (AgentTesla)", "value": "65a5a4c812eba6e647eec7513b135771f2053bce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521800, "uuid": "efd17400-4131-4f1b-98d7-299c47c1509a", "comment": "Malware payload (AgentTesla)", "value": "2320d6b52f3f8dda8e2e6b223b7350972312817888fc4c41e4f58849dcbcb194c4bf9f0f2f8054971ae45bc78f1f2774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521800, "uuid": "dd48a32a-a674-4fef-bfdb-3a5398718f05", "value": "T1EEF560409BC4A532B376A74CC636A920953E61D316E5DB15B0ADF1A83F3CD07532CAEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521800, "uuid": "bdfcb065-f2e7-4800-8d8e-3f7a0c69de6b", "value": "98304:k+5R9ncFV41utywKyeMSnAsmIrIEPR/blB/GBzK+bTNn57QzASKkgsu+X9A:k+5R9nYKlwZSAsmHEBLOBzK+95s8S5uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521800, "uuid": "0720ba98-b93e-415e-a2e1-bf4c65052860", "value": 3342964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521800, "uuid": "0beceec6-b2ea-4276-898e-e3db20e88c64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521800, "uuid": "9cfaa0a4-906d-44c3-8380-9cce295fef8b", "value": "Commercial_Quotation_Request_2026_PO-05909.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d86dd5-95ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786498472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498472, "uuid": "8446bc20-30cd-45d6-9fe3-e70442059be0", "comment": "Malware payload (Mirai)", "value": "8b13ec7fb75fc9a53e2ac5ca1c0e1e4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498472, "uuid": "2a2a264b-75a6-442b-8215-c3695d07dba8", "comment": "Malware payload (Mirai)", "value": "e62736b6d3e6b82a82650b82d924f9018b040416294ec6cc858135f724264444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498472, "uuid": "dc4a103b-ad98-4dd9-b258-f48e217ea6c2", "comment": "Malware payload (Mirai)", "value": "c94f3ac4913daa28fc48576665c688aec40a7d7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786498472, "uuid": "d30fc1e4-94bd-4a22-aca8-35e3752b36f5", "comment": "Malware payload (Mirai)", "value": "2be83288206b46a4769d9d1e911d5257680f54e09f08c3ecbca6093556a79abb427a30a5ff87d2fbec88aa3e66376d75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498472, "uuid": "96beeef6-1803-4ae6-8a7d-a7b0b5268bb3", "value": "T11CE31945FC505F26C6D621BBFB4E428D372A1BA8D3EE720389255F303B9A9570E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498472, "uuid": "ab1feb20-44c5-4f9e-a213-dd91bde9612c", "value": "1536:Kpqh/ljEpD2uMOE1WnBIGPlVAB17QDAD2GMToTldZbZmOOPbJOYTHtrBlH2wywxn:K+jyDbGolVDAbMERdFWbJr56Nq5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786498472, "uuid": "e72599ef-0f47-458c-8e9e-0b295724c063", "value": 146096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786498472, "uuid": "13ccaa98-9871-4f60-ba54-b656cd9d3203", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786498472, "uuid": "d6f452d9-4a95-41a9-9550-c049ea672090", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f475a7d6-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511351, "uuid": "3c084364-57dc-43ef-a396-6707fe4f55a4", "comment": "Malware payload (Mirai)", "value": "0bfbbf37fbba863b6e28f961c43d636f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511351, "uuid": "b335f7a4-f8a9-42d1-85d5-72f8622cd785", "comment": "Malware payload (Mirai)", "value": "e677c9a6eeaad9cb02f4aa55eb1d264617cbac7e07091939b6f517446b5f17ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511351, "uuid": "38fc4370-b012-4360-829d-2626479d1cde", "comment": "Malware payload (Mirai)", "value": "10b245df2e66759861ceb795890d05a1529df95c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511351, "uuid": "bac94c70-9164-4103-b076-7019d491dbd0", "comment": "Malware payload (Mirai)", "value": "5979a88d30fa452c154748c8b247b0af3f7146c5dba0b4294fd1124044a1d82ddf7563b3b1cdec3e3d6def7666de8acc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511351, "uuid": "d4ce7897-20f6-46cb-aff9-fa8475e3e4ed", "value": "T1F4C33B56FD3C64E0E4051CF1A8149FBD4363B0618AC39EBB5795C2588807FFCBA593AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511351, "uuid": "d464d40a-4597-407f-b961-b5cd915c858f", "value": "1536:ta5VmrE0hycHKpZ3Qed3YwCgRgIAFJtSJqYXASDvMh:tyLmyeAYw/gIAVSkYXLQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511351, "uuid": "948496f7-6f6b-41d8-aee9-807d105b7986", "value": 119892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511351, "uuid": "93fdd2c9-027f-4be4-8b9b-9c2260c25991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511351, "uuid": "05e480b5-84bd-4cca-b5fd-c5418131b6ba", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd18cb6-9655-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786543121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543121, "uuid": "cdf5e146-fdbc-4eec-b385-1a2fbcddc316", "comment": "Malware payload (Prometei)", "value": "b30401388df64c08c6c75fae346d3ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543121, "uuid": "c8bd2981-6c28-4d27-9473-3cd2b254ca6a", "comment": "Malware payload (Prometei)", "value": "e69af12eed31a629e08a7584d9aa9d038baea48e5eb8c9e58436383e23751e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543121, "uuid": "1dd90397-35e7-42ff-a57a-ce9046cc5de7", "comment": "Malware payload (Prometei)", "value": "4f7b886a88697ef615e22771feff2403a0543daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543121, "uuid": "b16ce92a-88e7-492c-a9f1-e5351463cdb3", "comment": "Malware payload (Prometei)", "value": "c585628457dcd33a2aad1b8eec85cf418986d64eb000c5e3888b181de4c5c0c1a0ade999cf96bc79a8c8b32317168aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543121, "uuid": "a3ceb61e-adea-4e48-a6fa-7d1c5b9afbad", "value": "T11D34BF63A4BCAAAFDDD82F379C4E880713B66FE4D890603E1C44710EFE1A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543121, "uuid": "d7c52c56-1bbf-4b44-bc3e-c02d42f5c3e2", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543121, "uuid": "94b00230-1063-4d61-af5c-7734e2d0dd73", "value": "6144:kGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOb:kG60BpL8jk1FGjDc8GVdOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786543121, "uuid": "c6dca83c-104d-4f63-8ba4-4c8eaa5cdc86", "value": 246113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786543121, "uuid": "7d62ac2c-af46-45fe-b6c6-d7ab25e7bef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543121, "uuid": "4e591503-7b6a-4ef2-abac-2e3fc99bbf3e", "value": "e69af12eed31a629e08a7584d9aa9d038baea48e5eb8c9e58436383e23751e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8197b949-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786507722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507722, "uuid": "9e3bc6f8-0089-4046-bb53-964b0755a8cb", "comment": "Malware payload (Mirai)", "value": "97839d47761257caf040916e1798b1b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507722, "uuid": "277d0fcb-c8f5-4d53-af48-eda3a9537e2f", "comment": "Malware payload (Mirai)", "value": "e80f489c57cb47a7b72fdb2e6b8e144492071a99521ab9b148646351489cf223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507722, "uuid": "b81d34a9-c9a9-41a5-b1d9-5c12e947d2db", "comment": "Malware payload (Mirai)", "value": "802588ceb982675358952ca9adaa2df5b9761a78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507722, "uuid": "7dde10f2-1cd7-43a0-b83d-c0e348e3f332", "comment": "Malware payload (Mirai)", "value": "6bcab3ce4b6da10ce7ad86671f2d7921298c3ed8630e9fe4de281f7c4ce044b3661be2d6fbc1b4decdb359d91997e0d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507722, "uuid": "aed1289f-d491-408f-b27d-93a917ee4396", "value": "T182B2E160379459A3C7F9CC31A99981871754033ED2ED33370A68B768A5CA5A754FF8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507722, "uuid": "2ad44237-6823-4ad2-aef7-ce3a16bf0f17", "value": "384:vViSHBFw9zB4FM3WUTxt/7WxK0DtL9ZpZnPZKB3eIanuNFAqnEFm/NShymdGUopT:vXg9qFMZ/SxK0DF/Z+gwFaW4s3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507722, "uuid": "11583aa4-ef4f-420e-8844-e529c7837e03", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507722, "uuid": "db911a93-3e1e-4fe8-90be-486ac39647ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507722, "uuid": "f06fd161-15dc-4015-8c3a-e9d2f4307287", "value": "e80f489c57cb47a7b72fdb2e6b8e144492071a99521ab9b148646351489cf223.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a845416-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786507710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507710, "uuid": "eaff1114-4c84-4edb-9bd9-b15f25a53f1e", "comment": "Malware payload (Vidar)", "value": "6e8acc3e0918331488137a328c8c8256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507710, "uuid": "db35dbfd-4331-4392-bf63-c70964982456", "comment": "Malware payload (Vidar)", "value": "e82442c4bd6886a8ae8923c05cfdef45ef6c7e19d4ea0710a567f8dc3e776f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507710, "uuid": "6b7d3195-74d1-4cc9-936a-bbbcc8ed52dc", "comment": "Malware payload (Vidar)", "value": "c535aaec5fc835c77cf7df62430cebadbde0af85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507710, "uuid": "0a0b1546-b480-4c93-be4c-7fb264e8404f", "comment": "Malware payload (Vidar)", "value": "4cefcf5bd1de10ac6e350146fd8f4978f868647b87663ed45a9e922e9f57348d5974528fa18f90207b135860c8678951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507710, "uuid": "3d1d987a-b468-4061-a305-1175b8e4a959", "value": "T18A566B03E9A29A79C0A5E731C4BA4257B628BC4C873137931E70AE793F367D29E35750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507710, "uuid": "4b8a75cd-91ba-4a2d-823b-5f08a18986c5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507710, "uuid": "288da924-8aff-4994-aba2-d0854cea12e5", "value": "49152:IY9TLKzUnTNX1uyyJtMygYHpToEFgZQhAA0Usq4Vl53Jg/HwAj5iGG:IyRQaJQhAA+1ZEZ0GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507710, "uuid": "0ccc15d1-d499-4b00-926f-616192c6835e", "value": 5920640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507710, "uuid": "6f2968f8-34b4-4c00-805c-d57966f2b6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507710, "uuid": "5ae793ae-3af8-4791-82f6-3a44816df1e9", "value": "e82442c4bd6886a8ae8923c05cfdef45ef6c7e19d4ea0710a567f8dc3e776f3c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4f621e-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556091, "uuid": "1976da40-b71c-472a-81a5-07193425667e", "comment": "Malware payload (Mirai)", "value": "cb826dcbfb10aa761eefcf90d88ba1bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556091, "uuid": "ebf42446-f28f-4010-a228-97c89d7f6812", "comment": "Malware payload (Mirai)", "value": "e85f8098b358c5eadd8f50545f084adcc9f5d0526d286e4682cdbde078d0145d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556091, "uuid": "316eae3b-e869-4d8c-a003-0a3624545b7f", "comment": "Malware payload (Mirai)", "value": "8e531123faef4d9a9b03fd6f1c24917d2d110973", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556091, "uuid": "df10ca89-1e2a-4f71-b90a-51a4af9862a1", "comment": "Malware payload (Mirai)", "value": "9409b985e1564cfe845cbcb30a4e34738db30c7b57159f8e9094c9fd144d2bcbd913d96b64e3f25d7ab5f0559e76d4fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556091, "uuid": "bb1922b3-96a5-42fa-925a-af79adf0fecd", "value": "T13E042B03771C0A83C15B6EF03AFB27F187ABE95115A66280F21FFE845332AB06559F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556091, "uuid": "a5fcbc22-e302-492e-aa1e-4700d62b74b6", "value": "3072:8jQYjLyxQactlYC6UrVO9GkjM5/GKTK6vFBv7oxXkl2CLf5QwD:8/uxQamlYFn3O/FTK6vFBv7oxXkl2CL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556091, "uuid": "11b0f30a-a60d-47c2-959b-3318058cd432", "value": 175339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556091, "uuid": "09c49cf2-285c-4b4b-a126-63220fd5d82d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556091, "uuid": "cff37a06-fe03-4b6c-87ab-f2395412b44e", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9e9c1f-968c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786566579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566579, "uuid": "c9db2942-6067-439a-a360-1bc80dc54e64", "comment": "Malware payload (Vidar)", "value": "6db50acb272807b33c5cb41eceef3b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566579, "uuid": "620f50fe-f6b7-47bf-b64a-769adb5ab9d9", "comment": "Malware payload (Vidar)", "value": "e8e3cbd3e99636bbd54efb8e62b07f8c53a79c23a968a6252317d5c2db8e3248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566579, "uuid": "ad940081-e290-49b3-8f7b-d4b2c6ed2473", "comment": "Malware payload (Vidar)", "value": "a5a7efe523bddd7f8f09c32e434e6928e8d6387b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786566579, "uuid": "3e305492-b61f-4f98-87b7-7739ca85e9d9", "comment": "Malware payload (Vidar)", "value": "2fe15bcf93963c1cc39cac867089a9ecc59591e2702cd69c01565874204ba30424dc7e566c45e2d91b844f8c3a0739ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566579, "uuid": "2c97ff3d-4180-42bb-b270-d8f134c864bf", "value": "T1DC164A177A9409F9C4A9E736C8B75261BA70BC4C8B3133D32E50AA782F723D19D79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566579, "uuid": "d8202cb5-d642-466d-a488-8d2d654c6324", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566579, "uuid": "c849871f-9165-40cf-b3f5-e7cbd1a42fba", "value": "49152:dbZvI1zk935SUWFjXt1OdG5J+RW/13mUZ7TgojA5exA7FA:dVIGWd3GGVRTgP5e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786566579, "uuid": "46ee1fec-c287-4299-884f-6735dd696f56", "value": 4220768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786566579, "uuid": "93f8096d-b019-4579-8287-b9b1ea2d3df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786566579, "uuid": "bdf89b73-d3f7-4d24-8785-0f975c8bdad0", "value": "e8e3cbd3e99636bbd54efb8e62b07f8c53a79c23a968a6252317d5c2db8e3248.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78f99da-9605-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508645, "uuid": "762c860c-720e-4030-8b70-db4fd0977520", "comment": "Malware payload (Mirai)", "value": "b31de654e8599de9741b46c7e1c2491b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508645, "uuid": "a45f4230-3a40-46d0-977d-49f340c9d4db", "comment": "Malware payload (Mirai)", "value": "e9ae8c960ffbb5dfce49f0713840340ac1fdea99092f1032cc1fea730b2565df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508645, "uuid": "d923a064-7427-4966-8b68-8eed9c56e94e", "comment": "Malware payload (Mirai)", "value": "52ce37b6a1c61675df1d5faccc7239e701e7d500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508645, "uuid": "6d66479c-1181-40d6-ac35-8b263e84465c", "comment": "Malware payload (Mirai)", "value": "a0c3fc12e67862e15cfe310b320178783482730dc61dde5f4e7054b2058570777ce1ae302448b2f60a1e97c3adb4ec78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508645, "uuid": "797c0fd8-3a73-49f6-86ba-33fea0d26bd1", "value": "T111E38C76E82A2F64D565D434B0249F392F2395D482835FAB55B7C3B09083D8EF908FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508645, "uuid": "75bc0170-9d47-4ae8-93cc-7e88f0af1b02", "value": "3072:zMnmB1MMbwclZtRApgdIp37l+HC6eWLEXY1O4m:gnmB1hT13dIpZ0LL/1pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508645, "uuid": "cd3bb823-a6a3-41d0-ada5-dd7c43a13afc", "value": 146720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508645, "uuid": "5291597b-6d2c-4448-8efc-fe69a949b444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508645, "uuid": "49c2b1bd-2ae8-40a9-a0c4-840c9e327dca", "value": "e9ae8c960ffbb5dfce49f0713840340ac1fdea99092f1032cc1fea730b2565df.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e9df0e-95f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786502955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502955, "uuid": "41e030d3-188f-4b03-bd24-ef840d6ed9ed", "comment": "Malware payload (Mirai)", "value": "7b97c504fa0e65adadd5224c7fe7fd94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502955, "uuid": "cc2d73bc-13ba-42ae-b609-d5ea19cad93d", "comment": "Malware payload (Mirai)", "value": "e9b252e799ee515217ec51d87aa4c6355fcd030021eb305f0d728bde80f83155", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502955, "uuid": "f3b948f0-1e51-4b1a-a4e3-f595b5d6b15b", "comment": "Malware payload (Mirai)", "value": "892aed5b067080abde5e1e980722c68c3f79c860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502955, "uuid": "549d8fc8-548b-451b-a1b9-63677aba2cee", "comment": "Malware payload (Mirai)", "value": "fd08c942cf4ef3d03cba79ab60739a8a04e604089f365e2556f1ad132abbed607e300dcf72b6afdac5564ef9027753af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502955, "uuid": "f2789827-b7d2-47f7-9f47-7dadf1dacf93", "value": "T103E2F1BBE51A6F82E23C8178695F7CA14815670D714DC653DBEC78A34C74B272A50F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502955, "uuid": "5a560a43-9731-492b-8b3d-7d8f6f949ab4", "value": "768:Bg5EO7ekFp649EUv9cdNp5Bue7FH6tp/29CM4nbcuyD7U4/2t:C5EOR6U8zueB6H2QM4nouy8Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502955, "uuid": "dc872172-3031-4118-a839-a1752b620cf3", "value": 33608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502955, "uuid": "894e7df2-c757-4000-852e-2aaeb4efabb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502955, "uuid": "0e7e0a1e-380e-43cf-a9ec-8edfe9354d66", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9e5c4f-964c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786539230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539230, "uuid": "8d53293b-5417-4257-a432-d0599cfff7f3", "comment": "Malware payload", "value": "c16ea756c0837ba9091029889d6b9301", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539230, "uuid": "b80412a7-a69b-444c-9bd1-8d04f272a5ab", "comment": "Malware payload", "value": "e9ef72852871ea19efabf62c7a6300602f5a40fa393ead99e80cb998b09e5644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539230, "uuid": "3f43278d-86aa-49d4-9341-8e4a46112354", "comment": "Malware payload", "value": "c088599bb8073f09eecca3f30cafac98cf4fa4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786539230, "uuid": "e0b348b6-b43b-4125-80a5-2ca46cd01e95", "comment": "Malware payload", "value": "d3cf54074eaba6267560062791b8d227240cc134a45da73b3843a73095dd34678077855aaa5c87760f46b46a5574357b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539230, "uuid": "00e118a3-c7c3-41e4-917a-b2ccbc4b92e8", "value": "T16523F135D2B69EFBC967DCA04EA3D589B22092893386DC8E80D9A7C14395A3FF545CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539230, "uuid": "570c6b4d-6bbd-4a32-b5ce-2409797903dd", "value": "768:0De3B5I9gxOWBXTUqKin91eTeCXVqyKdjsWpjYwYrPrrr1x0dg34uVcqgw093:0DCBxAqwin96ZlfKSWpjFYNqdS4u+qgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786539230, "uuid": "571335b8-0713-4fc6-a4f8-471353997bbb", "value": 46124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786539230, "uuid": "b93f9a14-239b-4242-a64b-7911f1f67ea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786539230, "uuid": "c6e3b197-a41c-4aff-ae1e-f511687615a8", "value": "miron.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b832c7-95e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786493017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493017, "uuid": "4511de6c-b378-4756-80ea-d973bc3e7e4b", "comment": "Malware payload (Vidar)", "value": "4eb445fa407548953c9691a6e74bec68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493017, "uuid": "fb2b438d-268a-406d-965c-7ed97e708e02", "comment": "Malware payload (Vidar)", "value": "ea45f48dff97a4d082ccc9b12b35c968b8783c341d1c7aad5321ce235fe92b8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493017, "uuid": "39a0a501-ae7b-4b46-87b6-f803fe430e58", "comment": "Malware payload (Vidar)", "value": "0fceb7b39f27d192070d6a291ff7956639646b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786493017, "uuid": "2c1bb661-ae76-4262-8094-f7e4f533e865", "comment": "Malware payload (Vidar)", "value": "c9f508bf22d65217560e6c8b058cf91f1a8457a92a8f88c21877b3358ad6137eb44c3ac680df7e1f0055d851e23d3c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493017, "uuid": "70adca27-9f33-4558-90a4-02af1168dc85", "value": "T141266B03BE9158F5C095E73189B74252BA74BC4C9B3133D32E61AAB82F763C06E79B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493017, "uuid": "202e3972-e5b2-4acf-8a19-bdc33b89fdd7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493017, "uuid": "108c7afa-5a7c-4a91-aa47-cb6332c75115", "value": "49152:6wquOKtKFigsQ9ejntvrLheePWzZTaHPIlNllaAey0:6Gs8ntvPUa0NllaQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786493017, "uuid": "7f070c06-128e-497a-9f69-d8917a738dcb", "value": 4718984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786493017, "uuid": "58b3cffb-49a4-4532-bdc8-cefcfae40730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786493017, "uuid": "6374645e-1447-4213-948a-44cd8ae55ad5", "value": "ea45f48dff97a4d082ccc9b12b35c968b8783c341d1c7aad5321ce235fe92b8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0af56d5-9675-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556791, "uuid": "18c27490-ef4f-4017-b0bb-a547a98d268b", "comment": "Malware payload (Mirai)", "value": "6d9ea6c94edecfeecd2b1ea770dfc13f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556791, "uuid": "b766602f-79e4-4fe9-a8d9-d2516bddb093", "comment": "Malware payload (Mirai)", "value": "eb137a1e89c75ad2426a58d4bac62266baa486f89305d12a8ecb67146bbc7bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556791, "uuid": "f13d4b82-7fed-4574-ae6a-e5a13617ea27", "comment": "Malware payload (Mirai)", "value": "c7653c0da009fa8e618ed1eaa62e7fa3f95a79a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556791, "uuid": "43814956-902c-43ac-b361-e5e1ba7f1d6c", "comment": "Malware payload (Mirai)", "value": "c2f5f7a511119eac55b48fdef2b5865ef576b1769d9a655ab7f24e4d273e2fad0e46238d9c7d916916019481b7a48f0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556791, "uuid": "566aba16-ea29-4477-9037-5891fe06b722", "value": "T1A9430276152C6A29F32610B8F6BC5206AE5622D5B2D77A1BE370680CF4F2316C5F1BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556791, "uuid": "a91873ad-b8af-4c11-9511-99bcf84e5ccb", "value": "1536:7oW9VbGnmWQtRfHmqCSnn32CnMp3rc+2TQmLqfs:7oW9VamWQtRfHv3ju2zek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556791, "uuid": "2b39156e-2e50-42c8-a2c9-3ea002bb4b59", "value": 56412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556791, "uuid": "19800b32-d5d9-43cc-8b37-0ed2173590e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556791, "uuid": "2ae0ca9b-5dbf-441e-893f-141043332dc8", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d6136f-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786503997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503997, "uuid": "f643a8d1-5d02-4f3d-9562-0576909c016c", "comment": "Malware payload (Mirai)", "value": "dcb46bc66790fdc7bbcbfee44150073b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503997, "uuid": "f554bfc8-1e61-45e8-91c1-43bac19705e0", "comment": "Malware payload (Mirai)", "value": "eb47ae7d154c127b7cbac08f85541bcca0bac277896c589c44e8961b200d4e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503997, "uuid": "aa6c9096-4d1a-4226-a823-f14aa2d1e689", "comment": "Malware payload (Mirai)", "value": "92eca3e63b486efbbb160459ff14aa08e603d5db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503997, "uuid": "aac0311f-bd7e-4418-911f-04570b4c5413", "comment": "Malware payload (Mirai)", "value": "f54578ceb4c5d6e6902e7bfca5a7f911121a3af736a45ad861b6fe4e9aa7a2019f961d44dd5d7ff4338fe4782f164f33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503997, "uuid": "f6de2fc8-14ae-4df6-8ee2-1de68c5f00c1", "value": "T1BF532A94F880DA35CBD075BAF61D43DD33130FA8E2DA71158E219A353BEB9194E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503997, "uuid": "808bd35a-1532-434c-ad62-3af30a6dd04e", "value": "1536:L+Za69OMiyJNFtDsxP3ItKpxiTWYFuzPxppyzLiu0I0rX:LZU83pxiTWYFYpgv09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503997, "uuid": "f49d798a-585f-45e0-9a55-7ae8501bdd70", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503997, "uuid": "accb4eed-8291-42d8-9472-91c054af440e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503997, "uuid": "f385d7af-f5f0-4dd9-8885-d75df977d0bc", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dae7995-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786521809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521809, "uuid": "065d2282-1c18-4668-a828-dc0ce0a4a7ea", "comment": "Malware payload (AgentTesla)", "value": "ef4eed6cbfb0611a80941887eebfabb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521809, "uuid": "c54af522-9b17-4103-86cc-785d238c6b90", "comment": "Malware payload (AgentTesla)", "value": "ec5a1dc0d9ae6c53b11f07b5e9d3ccf6915e421574c692d96dcf6532af04f8c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521809, "uuid": "cfb6708b-9567-4ee8-bb47-cb694a3ab4a4", "comment": "Malware payload (AgentTesla)", "value": "b847e7edbb52a534beb593104b0585cdd315dcdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521809, "uuid": "7c46564f-8da2-46c5-a310-dde0b4c97658", "comment": "Malware payload (AgentTesla)", "value": "d08e45c68d393fc96e325ef38a45f6d0d4eadf577cfc976f20709cb92a361d4ffc07249c594a325e9421a77828c21802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521809, "uuid": "60460113-5c07-4447-a9dc-e58ba1fdc1bf", "value": "T10A076FFA26484ED4CCD9A412A57037BF81B98D2DA58F069D87F00743D982AB363D357B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521809, "uuid": "735b5cb2-3130-4d57-aeb5-9ce3e2831541", "value": "384:gcpd8yD8UIvmofbzTyAkpAK9+fR2iEyCIXFcgOwSazdgFcJ1NFI546OcCReYXD69:5j/84Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521809, "uuid": "7c9ef109-1e76-4770-b464-2300e470d228", "value": 17906816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521809, "uuid": "0b448477-b5e4-4395-8390-b45391126a07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521809, "uuid": "64247964-d50e-4f5b-b335-f9162075617b", "value": "\u039a\u0391\u03a4\u0391\u03a3\u03a4\u0391\u03a3\u0397 \u039b\u039f\u0393\u0391\u03a1\u0399\u0391\u03a3\u039c\u039f\u03a5 575844.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731cfd5d-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786522730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522730, "uuid": "7fda09ed-7c48-4554-b580-45e6353e17c0", "comment": "Malware payload (XWorm)", "value": "56a1a04402525db58d698133ba613816", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522730, "uuid": "30e88d63-f9ba-47f1-88d0-6dee82785b4c", "comment": "Malware payload (XWorm)", "value": "ecba08fd6e47535e2fecf0673ce5e6b49e752e9d6df0b02846ec1aef72a183a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522730, "uuid": "c200fa55-efde-4ebb-8858-f8caab4103f3", "comment": "Malware payload (XWorm)", "value": "6630ac851417dc223a752f37a22f68b1ef80ddb5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522730, "uuid": "0001e5f6-85d7-465b-9fd4-81fcb55470b7", "comment": "Malware payload (XWorm)", "value": "7a5e1f223263025f4976d875081f80fea455a23a54ff5c5b705a041e580d714e3a92e828665b9bee5cf5cad9095d24cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522730, "uuid": "cb8da299-1fa9-4485-be1e-ef28b6ef1565", "value": "T11ED5FA91361D2A151821379DE48C925E8F55C09A1FE2EAF0F8DF06E4654F10E2EECF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522730, "uuid": "fa92081d-8d37-4727-8611-a9d071d2ec96", "value": "12288:0c5PaLPI1IuivT41LOAtIgaREB3TeVyZHrRRkWs+0+GiTg1/bR40STZi/3ZNx0/e:0c5PaTI1I/vT48AFtkkKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522730, "uuid": "e40342ab-b07d-43eb-bdf2-9ac90960e8a2", "value": 2885451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522730, "uuid": "14ebdbe4-686b-44a1-beb1-34bd13ebc167", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522730, "uuid": "286770fd-6c74-4596-8b15-62a6766d0f7d", "value": "LOA-AD-169919-169930.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65bb375-96a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786576557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786576557, "uuid": "aa0de98b-d34a-4a97-a7bb-a16dae909309", "comment": "Malware payload (WannaCry)", "value": "469f0e42341e9d6caeed17669c8bfed2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786576557, "uuid": "ed8c9eb3-ea21-4b71-8062-bf5e448b354b", "comment": "Malware payload (WannaCry)", "value": "ed2a78cca645750490acdd56cf1a819967d669bf1a2f13bbef44b9d7ce1db61f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786576557, "uuid": "eaeda366-4c0d-46df-bddf-13ddb29478d5", "comment": "Malware payload (WannaCry)", "value": "ac3aea578e9af171fb80ffb6b7421b72d2bda308", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786576557, "uuid": "564d2ffc-3414-4b1c-b32f-aebb7922137b", "comment": "Malware payload (WannaCry)", "value": "239eca8d87f870bcfdfe6f2e877c2788223a2eb7e7f755b2400f8e847203eef718bf456190f5662e8966d170b9edc6f5", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786576557, "uuid": "5ff4c4bc-a206-4e79-bba3-c322c0010160", "value": "T15536BF01D9E41B54D6B28BB6A97B8710537A7E848D57970E0358A02A1C33F1CDEE2FED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786576557, "uuid": "6c84db1e-6de7-47d0-92bb-681e167c481d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786576557, "uuid": "ac8c1fae-0eb0-426a-98d4-b2e411211e6a", "value": "49152:jnXnAQqMSPbcBVQej/1INGx+TSqTdX1HkQo6SAA:DXDqPoBhz1aGxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786576557, "uuid": "000f393a-c0d8-40c4-8b70-8ce6c1d7a5ab", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786576557, "uuid": "e28d7667-6de5-46c2-8045-aef2cbb3101f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786576557, "uuid": "b7cb02ce-8f99-457d-84c9-194aa44b13ce", "value": "ed2a78cca645750490acdd56cf1a819967d669bf1a2f13bbef44b9d7ce1db61f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3afc9bf-9638-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786530623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530623, "uuid": "558b61c1-2607-489c-b9d4-947c5db016a1", "comment": "Malware payload (Vidar)", "value": "7a933fff468a55cfe086b1939080127d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530623, "uuid": "9161ba2f-a45c-4526-b856-7e4f35cc2c80", "comment": "Malware payload (Vidar)", "value": "ed44c0375058d416da981d3cb3cf9ca4fb5e506c36a2082a0b20ade834e1cbc1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530623, "uuid": "8925c3c9-ce7d-4a58-8222-8c1dd67002f2", "comment": "Malware payload (Vidar)", "value": "05e65d358f84b7efcb9ffc9487b0b25ef4ef7456", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786530623, "uuid": "39b9b6f7-2748-40a7-ac44-cbf93279e4e3", "comment": "Malware payload (Vidar)", "value": "2b85332cb0e356e94712d802f02cbb51c434cfb58beba0655821227685d6c3fb0e876d591f8f7e10837ecdea2664d02a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530623, "uuid": "d80e66e0-387a-4a5a-b704-955d95f7f582", "value": "T183864A13BB1599B5C09AD63489B7A21A6934F89DC73433E31E716EB41F217B22F78B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530623, "uuid": "e971b555-dc98-4bf0-a1ce-c597b73f533e", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530623, "uuid": "7fbc4874-dea6-4c20-940d-9007292f319c", "value": "49152:evxArM2xm0iJRL7JICP9MWX4g6EEOd5wuww+3073RVRKQsAzHKvkVHKx/GfyZ8II:e6OXdWysfdEPYixvvVuEhXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786530623, "uuid": "08d3a078-7605-4d24-9987-e18507994414", "value": 8280040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786530623, "uuid": "e052e622-24c5-44cf-9005-8b1f5b7ce0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786530623, "uuid": "56e71856-800b-440c-91e7-e2f5177a37dd", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d707936-96a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786575066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575066, "uuid": "91e63000-4d09-4686-822e-6183b35f95a2", "comment": "Malware payload (Mirai)", "value": "ff57b6dcabb6bd7521a97b39e56a7e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575066, "uuid": "608372c0-6075-4ed4-aeb5-fd8362fc9322", "comment": "Malware payload (Mirai)", "value": "edc2b90996347cf8ebffb8befe24b96a2a3a6e489b9e02768315f8f7a3c07cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575066, "uuid": "44022bae-fde1-4bb0-9566-65f5291e7868", "comment": "Malware payload (Mirai)", "value": "d8019f00461aab6406144476fc1684c6babee7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786575066, "uuid": "9d86fd81-961a-4003-9d13-085fa8db5744", "comment": "Malware payload (Mirai)", "value": "7205f234bb8e17b822f5b14e63ce07b1159469495e9549114ffe194823e1690b9608fff650da66e5b5e376f00e787eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575066, "uuid": "e27be8af-6288-4d7e-895f-18c3af5ba505", "value": "T14A94B54A6E228F7DF67887348BF70A30D76D23D613E1D584E1ACD1151E2424EA91FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575066, "uuid": "5da5d354-6057-4b9c-bb45-1bf072bea4d3", "value": "6144:gvZBbY6i/JCNVGly8wzgFpdZZWxpe1bqhYFgp8TzMRw5RJLm+BX6:6ud3diRaX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786575066, "uuid": "9c4cacf9-35a8-4a7e-a001-bfc4450d0887", "value": 448656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786575066, "uuid": "880f8284-bf84-4dac-a26c-6b2bdce38246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786575066, "uuid": "8ce8301b-87fa-40f7-a46e-e4921d1bf3db", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b303d0e-9621-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786520623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520623, "uuid": "38aa0150-5dd6-41d5-aac8-e7d62d1aef42", "comment": "Malware payload (Mirai)", "value": "ed105282878eedfd281d4b19cccb4135", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520623, "uuid": "51d8df02-b47d-4f19-a1cf-4fd8c199738a", "comment": "Malware payload (Mirai)", "value": "ee0387335ba9b0043ca5c5e2f5f789ef6c47353699834cc59040739d124b8a91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520623, "uuid": "160101ed-0957-4d04-a492-32be09921fff", "comment": "Malware payload (Mirai)", "value": "1f221e0557a1aa358b29d98b68c1263fb062fd02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520623, "uuid": "86aed3d9-9981-4ee4-94ca-250c76a17016", "comment": "Malware payload (Mirai)", "value": "ef0cbb94059711c0f11a73932d9eca4969b5b0b49ae616590279f3e8b956ec689278f3806482300c87cb4999e4032aa4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520623, "uuid": "748c0925-97bf-46be-aa06-305ceb38ff23", "value": "T1CF315C1CC2C2AA6199805DE5F1C691237917D7DC7BB20E34EE09F6B2782C8897132D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520623, "uuid": "4b0288e3-a07f-44dd-96bd-caf1b48bce73", "value": "48:QvQhnojhnojhnojhno0jDZEBETEqEHEroEP:AQhnAhnAhnAhn/jFEBETEqEHEEEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520623, "uuid": "3a7f2741-9129-481c-b419-fe6c481019cf", "value": 1711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520623, "uuid": "8b3a4d20-f5c7-469b-9e97-097b3cccaf52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520623, "uuid": "843945f2-048c-42ce-bc0a-287eebe6d936", "value": "mload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707467ae-9676-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786557086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557086, "uuid": "e928dbb1-5cd6-423a-9302-ef1dbc65c44b", "comment": "Malware payload (Mirai)", "value": "90bcb2b9b5cf5189d5b2c1c15dacdcb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557086, "uuid": "20e25b44-865d-4a1e-bb34-161c62d9fe2d", "comment": "Malware payload (Mirai)", "value": "ee3bcc2ca6ce9ec9e05f6580e574064f91f4045cfbd4f432cbed202d5b5569eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557086, "uuid": "da6211cd-dc0c-47ef-b654-baef42ddb78e", "comment": "Malware payload (Mirai)", "value": "9cf0878d7dcda3f81f7823ca9c96b3bc8c7e7eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786557086, "uuid": "f9082d34-47ea-4898-802d-66a94c007f5c", "comment": "Malware payload (Mirai)", "value": "451a2d0588b98ee62e628e72bbaa62d59fad71e1d97780ab3aca3020283d3ea8682f17f6fef077ec7a8de0d577e8d814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557086, "uuid": "7497bbc9-f50c-431a-9490-8208c8446c2f", "value": "T1B9C319A9F880DE52C6D52676FB5E418C33231778C3DA7105CE109E35FBEBD5A0E2A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557086, "uuid": "c07f8d9d-ce16-46ec-97ac-d8f605546e66", "value": "3072:k8UWljtkimUjqI61hcYEEUjTisJOOvL1IlPUvz5NIFxNZZuCf1Dl:kLwjrFShcYEEUjTisY+LeBUvINwC95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786557086, "uuid": "870a1dff-9538-465e-a159-285c329d2491", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786557086, "uuid": "d4414698-c250-4950-975d-ae10f6383fa3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786557086, "uuid": "d42b24e8-a0a4-445a-a053-aeb7e080a699", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45ac3cf-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786509525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509525, "uuid": "68e89e2e-d63c-4fc4-a7e0-1cf09d0784b2", "comment": "Malware payload (Vidar)", "value": "a997de65fee3d2660eda9946471f3b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509525, "uuid": "1eaeade9-4b2b-4eb5-877c-00cc803c6b22", "comment": "Malware payload (Vidar)", "value": "ee9330cbe7289c6c848cc7736069c9358d24dbef1e294689e6fdb0e9b3d0aba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509525, "uuid": "6da51447-3b92-44cd-9bce-93f430a2e1fe", "comment": "Malware payload (Vidar)", "value": "f7e1a72ec337d5a8562ff45d264c05e4f0cbe3e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509525, "uuid": "79d68c47-2a4e-4bc4-98fb-66d173edd460", "comment": "Malware payload (Vidar)", "value": "37cfe8c2ba57087fa6ac44a2c0db3790185769f2c456c4397572255a9122f6941cf95c728ce5ad3a1ac11caaa1fe00d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509525, "uuid": "c5f6acbf-f5cb-4ac5-b00d-9726066b33bb", "value": "T1D4068C47BDA04EB9C0A992328DB652527B3DFC4A0B3723D32E50763A3E767E18875714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509525, "uuid": "05849ae0-f8ae-4f8a-95e5-07adc0cd6dfa", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509525, "uuid": "56a1768f-2b35-4804-866a-f6f131b36c77", "value": "98304:0vgr1dSv64dc2g2i7iuuy98HfEYAZ0Nxh:0v+dSv64dc2g2i7iuuy98M56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509525, "uuid": "101b1fc9-0df1-4a6c-948c-fd9de7bd1089", "value": 3807832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509525, "uuid": "643fb155-cf95-4d45-9c1d-462a3cb2eccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509525, "uuid": "23a0a9b3-eb0c-401b-9810-8bc5bcfb3976", "value": "ee9330cbe7289c6c848cc7736069c9358d24dbef1e294689e6fdb0e9b3d0aba1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f759fe-9656-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786543165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543165, "uuid": "f0d37def-371a-4e2e-abc1-bee9092ff96d", "comment": "Malware payload", "value": "7e3949779fbabdb00fc3d8b20833677d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543165, "uuid": "68d35d12-1702-4e33-8175-8362fd6e5a9a", "comment": "Malware payload", "value": "efe3b8edb900b01348ed6cb1070cb915713903b89ed3e351d5182c803dd67820", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543165, "uuid": "c4fbc9d6-cdf8-4ed7-8f60-8f46691a5366", "comment": "Malware payload", "value": "18b147c4b35475b99564a471aef0f85db579977b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543165, "uuid": "f46aecd0-26e5-470c-901a-29056bc307f2", "comment": "Malware payload", "value": "d94df8971ae027282819622797c9ea96cc13add79af1fe6c3aee8df52badb47f65bbdacb2aa3a9c5210025335131b849", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543165, "uuid": "85355d57-01f9-479e-b535-d0c1366b5b32", "value": "T1CB3187DB54150A315103CA8EB7A23448759ED2EB288FE7E48C484DED43887CDF265F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543165, "uuid": "260e014a-1c40-42a3-a37c-6d3186cf8e29", "value": "48:oiQxVvdPOGPp83o8maIa4BiO9g8NGFh9iABW:oiQxVvdPOKiO9gTiABW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786543165, "uuid": "cb5ed354-6473-47b8-bbf8-53c0b50600bb", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786543165, "uuid": "7aec5f6d-5962-4b04-9fe9-21f6d1a42774", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543165, "uuid": "1a129a77-5034-4cab-afea-516f7cbe9001", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a89a65-9636-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786529627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529627, "uuid": "053ceefb-4e02-4c34-87e4-d63d422176de", "comment": "Malware payload (CoinMiner)", "value": "dd7cfd448f8fc48232a1a6576ee1fc14", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529627, "uuid": "ff7ce148-a3be-40ea-9a7c-80f29e61064f", "comment": "Malware payload (CoinMiner)", "value": "f02beda33cb97340412881e0805c32580be96de246afd46bac6b75562087ff0d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529627, "uuid": "4db66ea4-8289-4738-aaf3-e69a0fa20624", "comment": "Malware payload (CoinMiner)", "value": "56784228c6253277a808b3e8404e2f43c6647f1d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786529627, "uuid": "4fb614be-28ed-4f1e-9fbd-b46f8829da15", "comment": "Malware payload (CoinMiner)", "value": "8c42cd5204a8b9df67932f90c1e47e88e1e423930a2acce28b632438272cd0e494493f7df1130ac50cb4e6de48c42a38", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529627, "uuid": "8058b04d-572e-4fc3-a715-375216329dfb", "value": "T10D3633E56CCAA138E457C7B89826B0BEB77EFB8045247E9FBADC2D405D5B520043EB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529627, "uuid": "aba0ed8e-5b54-4a89-a1d3-929de6efa643", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529627, "uuid": "43b42475-c693-430a-9617-718ba75caae8", "value": "98304:ktmE1Kr6a6o8TtFkK6kHiAwSGBTmHudQHH3eVv0p/s6+oUhjMeP8yL:ktDKr6a6o8Tt2lBTmHGQHXy0m65KMePn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786529627, "uuid": "92c6559d-a4f0-4b66-b099-dbc45412a321", "value": 5320704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786529627, "uuid": "b27798d1-15f9-4a98-9ff8-b2821d5b02ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786529627, "uuid": "b4297c09-d8c0-48b6-9389-b97ac631f7aa", "value": "f02beda33cb97340412881e0805c32580be96de246afd46bac6b75562087ff0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512bd57-95e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786494843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494843, "uuid": "0773c9ec-3d0f-4248-986f-5200a13ff1c0", "comment": "Malware payload (Vidar)", "value": "cb0bb2240f2900a4351d7d260d34e0ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494843, "uuid": "32c6526d-bf1f-4ecc-89aa-b5e0d69a784e", "comment": "Malware payload (Vidar)", "value": "f04837713c07587b67f080677b5914b14124b158eca4bcc3cf7e7a6ae5afcd49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494843, "uuid": "5fcb6e70-676d-4110-b064-500ce631d904", "comment": "Malware payload (Vidar)", "value": "efaf64da8e179e9bf9343b9a721b3f9574763a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786494843, "uuid": "49599d90-6764-4c6d-9ab1-5b4c48d5f293", "comment": "Malware payload (Vidar)", "value": "4588e84033a437f67cd678c5543f55afe255a5b4d908073639f01c4abb774fcdc9ebddacf2852e5d31cbc8ef7412dea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494843, "uuid": "419c08b1-b5c8-4126-8128-09316dca10f9", "value": "T1D696381B5A614D78C0A8E73584B7466FBA707C6D8730B3630E627E78AF213D55E28B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494843, "uuid": "49726789-4b6f-448b-8287-2c2c8fc7649c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494843, "uuid": "6bb81f23-c9ba-417f-8c41-10d886315723", "value": "49152:UZhKxEsfCRkkZmf9xEW6d0YWm7CV6acwoOcj45WMH4JnM4UuyvhDpggVbKixNX6:UmmWSRCV6k424UVFggm+X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786494843, "uuid": "e3a1c3aa-a2bc-45e9-89e6-f8089b4e8a36", "value": 8888840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786494843, "uuid": "20bf983e-6226-4b20-b0e7-356d05d6537c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786494843, "uuid": "fbd1862b-012c-4ad8-8f0c-922062d8ecd4", "value": "f04837713c07587b67f080677b5914b14124b158eca4bcc3cf7e7a6ae5afcd49.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45fe29c-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512532, "uuid": "6f4be148-1ea7-4e43-bc53-1588d2bde63d", "comment": "Malware payload (Mirai)", "value": "f111bbdba9877dba17754d65d8f1b444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512532, "uuid": "ff2dd037-de58-44b9-bda4-70a2ef9d02fe", "comment": "Malware payload (Mirai)", "value": "f05be81ef3b3bd033eddcadd88985efe1f441c579e3723a155cc5be3866e70b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512532, "uuid": "67d155ad-5ecc-4607-8e35-cabd5490fd94", "comment": "Malware payload (Mirai)", "value": "04a9719f9337563e4b6be3eae32653d36a6d3b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512532, "uuid": "8d1279d5-b6ee-4566-871a-e35290e6a2ed", "comment": "Malware payload (Mirai)", "value": "6508fbecc4d043a2500fc8a1901012b51e9f2ef63d8bfc5880fdac97cbf0d61f32b94579b229220a14b838be09d998d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512532, "uuid": "62760747-54f1-4c30-9689-e9b6d00d29d2", "value": "T126F2F1393711888BC462E3F990290391DB4547F3A845DE97B404B3D3AFDB05E72D2BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512532, "uuid": "e4bc7aa3-708e-463b-bd02-6c5e10cbea9f", "value": "768:NNYKyukZoTMKev9qNA2r/WXfTth6AkD0nxtrtHoaHoKk5mJgGlzDpbuR1Ju:HYdWlev8Ac/WXrGAkD0vtIaS5SVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512532, "uuid": "ca89a715-1232-4bb2-b802-f1f8ce574965", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512532, "uuid": "c8a698ff-353f-4280-99da-613009056a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512532, "uuid": "772dbf45-5bef-4452-bf3f-f0bf4f8a5718", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135acb5f-9643-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786535025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535025, "uuid": "fd5f29c3-d174-4e06-a2e3-6eac4b3ac4e4", "comment": "Malware payload (Mirai)", "value": "a385fe4b94e773c7cd195044174e8d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535025, "uuid": "06b18f83-863a-4293-a425-d773e5057156", "comment": "Malware payload (Mirai)", "value": "f08dbe82bf0e3e33571ea3143bead346fb999192aad73400ee5d19f240a2223c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535025, "uuid": "e140ccac-6830-47f2-b44d-b01a09b8e3fc", "comment": "Malware payload (Mirai)", "value": "419bd47d6911f2a8840ce6d737dd2c3a76cec672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786535025, "uuid": "44e1f0d3-21f3-4ecc-a5bc-03e603fb1bf5", "comment": "Malware payload (Mirai)", "value": "efdf6c50edea425bdcd16df33751e47ebdb76fffdbeaca8a3ea7c3bb9451ae8914db9d4df08245a9a66b013d2e6d2421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535025, "uuid": "f8a5140a-586b-49ac-a108-5a6f8e30ea90", "value": "T1B104A82E2E228F6DF668873547F74E25976C23C626E1D644D1ACC2106F6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535025, "uuid": "4a35dfd6-bb0f-46c5-8592-474d34d1502d", "value": "3072:+0qJ3YAXyh+KX2s+oN6vaOsBtNEIBzgy/dUoZXo4:+0qJ3TXyh+Km/INFcy/uoy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786535025, "uuid": "19d21412-8e06-4409-9f5b-81d90215c095", "value": 173176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786535025, "uuid": "ff498c47-c3c1-4ae8-9b1c-8f2bd701feb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786535025, "uuid": "399e9f83-440d-481c-9b13-dcdab0dbde15", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c37f504-9615-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786515283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515283, "uuid": "fd67f72e-2dae-4e55-9fe9-f117d8b5c985", "comment": "Malware payload (Mirai)", "value": "841cef69babd82a317b40ce9214125b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515283, "uuid": "fc2c42ad-3b1e-45f5-aa9b-f44fda007c86", "comment": "Malware payload (Mirai)", "value": "f0e10688ce7ac1f0f88a86a5afc8a4f28e5f466b899a6aad0d56aa6d2a65310b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515283, "uuid": "9adb756e-83a5-420e-b859-4d8be660fecc", "comment": "Malware payload (Mirai)", "value": "0c524615e5c98e44d8a6031c53fffdd436497e76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786515283, "uuid": "107edd37-c3c8-449d-8697-b7fb66a91aac", "comment": "Malware payload (Mirai)", "value": "b078656266ae496fe8f5d5e278575982496a9e1bc1fbe866e9b889793176a06a54c89011ccaa940c7e77496b690b5394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515283, "uuid": "3ab69239-677e-4072-9eee-133079c33160", "value": "T12534C70ABF510EBBE86BDD3701E81B0629CC645722A53F757674C928F94A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515283, "uuid": "170e2c0e-c260-48e0-ba25-e0c0f04ae75a", "value": "6144:grloEPM7zu0Tg2PpGlbKSueAWbYhKXnfghSUh36XPhxMBgNR:g2Glbbue8h6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786515283, "uuid": "bbd4907c-cd6d-4629-9ce1-47336258c61f", "value": 231164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786515283, "uuid": "95123f59-1e71-4fd8-85ad-d6673857d3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786515283, "uuid": "dccaa26a-e764-4f90-8c33-cdb4c9257a83", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3aa5cba-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512531, "uuid": "17a7cb13-47f8-4b5f-b274-5c0acfc3d586", "comment": "Malware payload (Mirai)", "value": "215a7f85a2104a1bf2cd0ee9ffbc5619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512531, "uuid": "6f9796a8-fcbb-4790-87cc-ab28909053fc", "comment": "Malware payload (Mirai)", "value": "f2a57f46f45d9b3d98e5e76ee3c5265b53a628ee16af3654b6283a962d7ce02d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512531, "uuid": "8c493711-9f12-463e-a6e2-5a88140f83c2", "comment": "Malware payload (Mirai)", "value": "94343a01dacf306b85941f3010ef8e44b432cffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512531, "uuid": "ee0e62a0-460d-4107-ba11-8ea55ea5a66b", "comment": "Malware payload (Mirai)", "value": "72260abea59228d5d37225bb069b139b774b291d98b1d65325c44b4723ae950428203a186c22358b962cc3f0a9a3b0ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512531, "uuid": "611b1e04-5925-44b4-bbb7-8459d92ef801", "value": "T142735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512531, "uuid": "e157271d-9733-4882-972d-f120f68e0d4c", "value": "1536:jP+SbCGR18pspTH1CDQ2tXXUN95s0xwlWptCMR8/pW:zf4yVMpENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512531, "uuid": "4be4e93d-d565-408b-b722-611513c40eb7", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512531, "uuid": "15c6596b-ac84-4b21-ba53-bebd1b881c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512531, "uuid": "45167c5d-a92d-48ab-a856-0d1c3157910a", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91644b7-9655-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786543142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543142, "uuid": "1bc61c89-7d9d-4849-a6ee-c02d46d9c461", "comment": "Malware payload (Prometei)", "value": "33e072ee6e4a6beecca55702278ddf75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543142, "uuid": "0c50aa83-be39-43c7-a190-f06467e9d402", "comment": "Malware payload (Prometei)", "value": "f306184e69c3d59df46903e25acd332b1cb63165e7ac7e40e6ed83f2366d7ccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543142, "uuid": "a7e87a8a-11b4-471c-8e60-7c22ed956ef0", "comment": "Malware payload (Prometei)", "value": "5e2784f9032b08b9198761cee84c7331269d4aa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786543142, "uuid": "62eb681c-6008-4254-9d49-18174feb381a", "comment": "Malware payload (Prometei)", "value": "8896c7d8e004020b785028eac278370a0e204e1e85b02ed80b858660c4abc69ff897c6975301f15342760dbd02b2f58d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543142, "uuid": "29573b25-cf79-4ca6-a37b-cb01c47e2dfc", "value": "T164A423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543142, "uuid": "89a72312-4d3b-482a-82db-021494fd667c", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdW:Fs6pyCC/Ya2hpi6T6N4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786543142, "uuid": "a13534c4-c52e-4732-8b48-fab012ed0399", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786543142, "uuid": "88eb2cd4-4aad-4a1b-947b-f060be05b996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786543142, "uuid": "ba894c17-3853-4aa3-a9fc-29375ebe234f", "value": "f306184e69c3d59df46903e25acd332b1cb63165e7ac7e40e6ed83f2366d7ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e92bd5-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786521762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521762, "uuid": "b39a14aa-3bd7-454a-a58d-bd312dfb63bc", "comment": "Malware payload (MassLogger)", "value": "e47c20b0502d0495ffe676b54466ed29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521762, "uuid": "868a9554-5807-4cd1-a618-9a7fdbf63fa2", "comment": "Malware payload (MassLogger)", "value": "f4886d0f0224515575e426b6dc60fc3ae27a3ceb0f8d7d31c7dab933959d4413", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521762, "uuid": "ff9bcdf3-c3ce-4231-900a-1bbde96fc3bf", "comment": "Malware payload (MassLogger)", "value": "e113ced3350727a6e774e0b89ece80cf39deb38b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521762, "uuid": "3b4cbe2f-f6c6-4124-a91f-c61a0ff27bef", "comment": "Malware payload (MassLogger)", "value": "b3be5128b55367dc51b443d161a0c846dd82dfab0e9faf8fe8eda0b2de208bca7fef4ea56cfd463cc2e17d4e8127e441", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521762, "uuid": "d5ca2809-c3f6-4cb7-ac49-f8f0d7c86f45", "value": "T1BEF5D5E312AF69C49C193BA6704D16154FE8E55008D792E0E8EF4BC0265F08BADD7DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521762, "uuid": "71d1cec9-327e-4d58-b14c-61b9ab83d4aa", "value": "6144:jlVXbS2PyQHgR6BGYOKjAKpsjLgPkh7AlWnjrKoNWNv2nkDs/ixDlxagJ+Dw2L5d:Ls3KpDEDm3aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521762, "uuid": "6dbbaef9-efe7-4750-a64c-b4d8d2978afd", "value": 3643655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521762, "uuid": "23261021-df77-4361-81b9-c002da1039b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521762, "uuid": "25a357c7-3b96-42b8-b50a-06a35297c8c3", "value": "MV_GLOBAL_FAITH_VSL_FULL_DESCRIPTION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4576c066-95f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786500320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500320, "uuid": "d86641d1-1d19-49fd-bcff-5d24ef3fe8be", "comment": "Malware payload (Vidar)", "value": "d49825b244bad8dbdc63dfe538d1d88f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500320, "uuid": "d83addee-159d-4fca-a6a3-9168ad29fbe6", "comment": "Malware payload (Vidar)", "value": "f51ae7f0c46bdeb283578db0a83c79e7cf92919f34eeedba9165d7eecf39f689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500320, "uuid": "6559b007-1001-4c16-8f9d-d3900f5c6ef3", "comment": "Malware payload (Vidar)", "value": "87a5955d77ee06029763179128d70effe9b7db4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786500320, "uuid": "3eeb6328-f830-4ad5-b816-7053d717378d", "comment": "Malware payload (Vidar)", "value": "2b9520f1aca81731cb2a845695d85ed89bb17d555909342a08c3f82b7e59c38fad567d2d0c81876bdc81fd62b3f8064b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500320, "uuid": "02b8e008-a14b-469b-ab38-56e402931dd5", "value": "T1B9666A0BAF5194B4C494EB30887A4296BA74BC8C8734B3F39D56AE346F593D21D38B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500320, "uuid": "e7d82807-6411-4c5f-9f44-c5344f4b41a5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500320, "uuid": "42219b0f-4ad4-46e6-95c7-d482b70e16d9", "value": "49152:RHrSXju6w1cRHAkiTTY71ecnjfZObTR/fal5zJ9ERgC/eNMC931pO0dm2K:Rg8kinYxp+/Sl5zJZa2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786500320, "uuid": "f8d61479-3f07-445c-a78f-f9d23114a19b", "value": 6613256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786500320, "uuid": "24f00816-20f3-46bd-952d-f5239df141dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786500320, "uuid": "8fe0e6dd-7324-4402-b291-e7b5581b50fe", "value": "f51ae7f0c46bdeb283578db0a83c79e7cf92919f34eeedba9165d7eecf39f689.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a4daeb-95fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786504047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504047, "uuid": "65bc3f02-bd81-4fe2-b4e5-7921a95a61a5", "comment": "Malware payload (Vidar)", "value": "48873e88adf61b7e97069fa1b41ea66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504047, "uuid": "fe23f58c-1a1d-4739-a94d-9cbc47e7c948", "comment": "Malware payload (Vidar)", "value": "f574c414654ca61c27cb94e5ffbb71dfdb6a45963a1b038585459a71e88a6e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504047, "uuid": "9fc7a966-0576-4e49-b417-2b38750bec26", "comment": "Malware payload (Vidar)", "value": "6f6bc27080d4deda7a503c2b9273a2b41eb5d0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786504047, "uuid": "8edebacd-1757-495c-b030-1526f5ae9e31", "comment": "Malware payload (Vidar)", "value": "058976c1938953eb9dd7ea9ab9e1e99fc2b1f04ef13f92ce40f1fa21aabab8fef897dd14f1d25ded5c259822f2899882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504047, "uuid": "857d4700-7589-42fd-a064-00c8f730e51e", "value": "T14F763A07DA124D64C0A9EA798A7A810BB634BCADC73937A32D619DF03F757D14E39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504047, "uuid": "cc7cfffa-6560-40c3-b580-089ae5b1178a", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504047, "uuid": "3d392103-d602-4e9b-acea-6c90b11f6b71", "value": "49152:gpppRAcrzBsS0w/2UPTCp+zJov3TbOgfxwcxeywRKaX2ZL6xa88oFfJmrBaGypeU:gdfnkHbreXmZ2A88yfJmrXytx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786504047, "uuid": "6fc8abe4-1468-4258-857f-c7fd5fc2eb83", "value": 7235104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786504047, "uuid": "8a24ca00-cef6-48f1-bf14-efc220834001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786504047, "uuid": "f22c4ec8-0da7-4e8d-90c9-24bfbf7d4c77", "value": "f574c414654ca61c27cb94e5ffbb71dfdb6a45963a1b038585459a71e88a6e1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee876c0a-962e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786526373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526373, "uuid": "df17a16a-bf17-4ca8-9cc2-0d588831d20d", "comment": "Malware payload (CoinMiner)", "value": "c06ba11e5d6cd72150abb78be712afb5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526373, "uuid": "855c6a71-4565-4856-bb3c-f9abddc8d5e1", "comment": "Malware payload (CoinMiner)", "value": "f613accb61e7dcbf608211407c8b27ad1223d19ed2de4b64095fd4f42e6282b4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526373, "uuid": "50f086a9-1bd9-42d3-b4a8-c70d0ce3ff8b", "comment": "Malware payload (CoinMiner)", "value": "aae5fbda94bc505af69e38f4e159982590a85261", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786526373, "uuid": "1d53fa9c-cac5-4221-8b4c-a4ffb24aa2fc", "comment": "Malware payload (CoinMiner)", "value": "55fdc9d93158559ca8a7a286bf09fa199550f05f89e4a1bd401736ecfa73e7bc8c644df4e8d475906b20b803b7282cb7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526373, "uuid": "5c275dc1-8b13-44f0-9203-0e6cbf31259e", "value": "T1E1065C13FCA115E9C4ABD2308AA79252BA71BC440B2027E72A90F7383F77FD05A79755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526373, "uuid": "47da6ddb-6ba4-4b93-895d-4bdfd8dd0d7b", "value": "49152:7huc6QW6ypIuxKGAhxJpHo5wZ4khONVUePgOsszfSKAra:7WzLpgvI5zVUeYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786526373, "uuid": "72d6204e-81e5-4ebf-b91a-485c43dba2d5", "value": 3879016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786526373, "uuid": "102c552e-bfe7-438d-a9d3-92450fee24aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786526373, "uuid": "c9286414-2494-443d-b8c3-a8be89e79ccf", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0ad5f4-9626-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786522853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522853, "uuid": "1188e546-767a-4c67-8749-987a8f234825", "comment": "Malware payload (VIPKeylogger)", "value": "a3ff66cbae5702f9a79a73ffdfbfc35d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522853, "uuid": "afe15870-7a34-47d7-b504-d715e8cd73f0", "comment": "Malware payload (VIPKeylogger)", "value": "f63961a06ba36fcbaab664ca412ba4855f05559d3d00050bbafd7890b9e3fd10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522853, "uuid": "b36c803f-cdaa-4301-83f1-b4118cada6b1", "comment": "Malware payload (VIPKeylogger)", "value": "9054f41f390d41e85a8412110c12139fbe458332", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522853, "uuid": "d77ec329-2576-4606-b7cf-2a7a1c0193f1", "comment": "Malware payload (VIPKeylogger)", "value": "1086be30da67aca2b12edf9774319f7da82c780228cc8447b15e8da919cfd280caa16bdd6cd7f1a86aacac19e7553691", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522853, "uuid": "069c6038-f350-443c-b586-a7a941b77fe3", "value": "T14EF5C7FA93C0943372F6575EBA36A9205A0960E314E9DF05747CE224B728D07676CBE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522853, "uuid": "46ff375a-80cc-491f-b80f-25660ca4be24", "value": "98304:RsiwAExXV7/6sxNaqdKm5o0jFI2w6yl9HW5HcFre9h7LSVyWSbXVwUV:Rsi3CXV7CsxNaR7pludWSXmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522853, "uuid": "b4eedeb1-588a-4960-ae96-7631a7da3ad2", "value": 3459142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522853, "uuid": "36ffe937-3f94-418a-9032-ac9ad2256d1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522853, "uuid": "63b94607-e9f5-4e0e-be02-5555a6930701", "value": "FRA_09937_11_08_26..JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85425da-9623-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786521531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521531, "uuid": "698958c7-7cde-42ac-bbb3-2a32085644e7", "comment": "Malware payload (Vidar)", "value": "b46947a4f5da3d5b68d5973c834f2cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521531, "uuid": "30342a37-d3ca-4c77-b0bb-5b57159ffdf6", "comment": "Malware payload (Vidar)", "value": "f6d8426be30c080da3641a4f2e942e5d8c6950c9f76486489bf6074b7f090b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521531, "uuid": "2c3fb49a-54af-4fa2-9aaf-a674548f2ced", "comment": "Malware payload (Vidar)", "value": "bb9c0dcf420b9c45416caecde8ee4f8792e9abbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521531, "uuid": "59e09eaa-2cfa-4712-994d-fac320a1674f", "comment": "Malware payload (Vidar)", "value": "8ead0c048347dcce26ff15d5ee59e9c4c1f94c3c05b963ec79bc35384076ab9742d0efac13a991407d3bb585cfabb4b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521531, "uuid": "cc0ecfda-eacb-45a1-992d-7c9e101715b0", "value": "T14A067C037DA104E4D0AADB3689761281BB74BC4D8B3037EB2E50BAB42F727D1AD75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521531, "uuid": "3d25b20e-ced2-46e0-9cca-43cb91b23925", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521531, "uuid": "3377fe38-ac0e-45e9-a83b-f601c98fbf55", "value": "49152:WQyTdr2LClr8z30Mf+DdvPs21zPuq5qHMV5bTalS5wwMZ3rHrG8Kbk6ONaXNKS/a:WQIacd5wHTK5kbC121", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521531, "uuid": "b55f0eb9-7b72-4878-82df-bfe0d945efef", "value": 3945320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521531, "uuid": "87e9ead3-dc63-411b-821c-57201d215558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521531, "uuid": "a564acc8-3b6a-4d79-9cdd-d4dd85c8f630", "value": "f6d8426be30c080da3641a4f2e942e5d8c6950c9f76486489bf6074b7f090b34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe99bdd0-9611-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786513945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513945, "uuid": "7529e72b-3633-4364-ac29-7f5959fe9ba7", "comment": "Malware payload (Vidar)", "value": "b0030329a6f1600f4824f6af7624a6da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513945, "uuid": "aa78a9e3-f5d7-457a-af7e-6079018b5e6d", "comment": "Malware payload (Vidar)", "value": "f6e3e77e61728d3700220f335da269a2731255f989fa6e37d132b81f37641c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513945, "uuid": "adaf3802-0ffd-4922-8c90-d101e3ed82b0", "comment": "Malware payload (Vidar)", "value": "97341651db1f83d99307cc0cb1e6360f19504a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786513945, "uuid": "c885bd24-c70c-4f47-bf22-6024d1ff5dbb", "comment": "Malware payload (Vidar)", "value": "18f01468b4d2f5773b6652e82be72bbc874c67c07560cbae06fd2dcdd124d7a0ba841349a3a1d1b9406dbd8e44a7ad1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513945, "uuid": "d4002e39-a8f4-445a-9ef6-ddc72cd35782", "value": "T137068D4BBEC01964C496D73164AB42953A7DBC588F3637E72E40B67A2F327C48E36B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513945, "uuid": "61521f26-51c0-404f-bd6a-1752afa98a96", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513945, "uuid": "1c372d78-16a4-4c4c-ac4e-d0f7a0ed5db3", "value": "98304:cgZe5cq++CHzYyTHtcP/DtgX8otC7Zvhaxw:cgU51++CHz5K2MotCFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786513945, "uuid": "c05f7f71-9122-4045-978b-4511a6dc5db3", "value": 3748600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786513945, "uuid": "7677bb0f-e5f5-4110-b20e-f6df68bcbac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786513945, "uuid": "0705859b-525f-48cc-8355-90ebcdc35194", "value": "f6e3e77e61728d3700220f335da269a2731255f989fa6e37d132b81f37641c2a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e6d2c5-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502143, "uuid": "2a9bbf36-0c33-41fd-bc3a-2db1f15918b6", "comment": "Malware payload (Vidar)", "value": "7aa340019eacd9dbbaaece6b18293daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502143, "uuid": "4e6966cb-0528-499b-959f-03c40ded278b", "comment": "Malware payload (Vidar)", "value": "f72ac6dadd552d8e27799b945c33c933b47a1b171595850d9ce102be0997fbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502143, "uuid": "2a62adf4-79c0-4e9d-9d01-68dcd60eaf86", "comment": "Malware payload (Vidar)", "value": "8225857a9b6c273a6001d933fb523dbbb43d5ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502143, "uuid": "c8fd57c7-77c0-4401-a6c0-16a1e15b2f97", "comment": "Malware payload (Vidar)", "value": "0ca2c31ddcf54fab3e8f2f51b69a0c3cf059ae649bbbc558f07bac7f55ef99d3a058d61a9b8c8303a1b418f16a31a228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502143, "uuid": "901a5ebe-5542-44c2-b8cf-e0030f35a20f", "value": "T1C4665C03BE9154A9C065EB3185BA43567729B85D873037E32E31EF78AF267D24E39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502143, "uuid": "2c966160-7fc0-47e5-97e5-b07eba073467", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502143, "uuid": "ffa9cfd4-07f6-45bf-8564-59eba7e910fd", "value": "49152:u1ydIKd2okKPC5m9PGB1hw+H9/Cacw6/zMV+TTK6//LkiyxLeatKmaVs7/:uo6p5mMBTwA996/zMV16rv2JKW7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502143, "uuid": "546a0c3c-c31b-4fac-a572-d4f72e183088", "value": 6566880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502143, "uuid": "a556dcfd-119b-4d9c-922e-a183ea0055fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502143, "uuid": "ed3b436e-3e3a-46f5-b7dc-d53cafecfd2f", "value": "f72ac6dadd552d8e27799b945c33c933b47a1b171595850d9ce102be0997fbdb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad900cbd-9641-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786534425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534425, "uuid": "fcb26e73-530d-4472-a15a-afd8cf91601b", "comment": "Malware payload (ValleyRAT)", "value": "d1db9263aedd7bf2c97d32f9cc65c9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534425, "uuid": "4a42023f-01bc-458a-848c-a34298be20e0", "comment": "Malware payload (ValleyRAT)", "value": "f74d03062c36c4214bf1fd32fc5a2da8d33ece75ab76c1eea6b20799f84bdcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534425, "uuid": "c0987729-8989-4279-964c-c69592ef43a6", "comment": "Malware payload (ValleyRAT)", "value": "9b28331e9dc09b3d2c6237c5ab3b60a01958e9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534425, "uuid": "9fed49f3-9312-4b09-988d-936486a32895", "comment": "Malware payload (ValleyRAT)", "value": "3f6d2259712d442921826e83dab202b34fb43463652108fa81e646732c8177a06732e8106f3a28730ad6200b0e78e4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534425, "uuid": "a54d586b-a9fe-4bdb-948b-aab232597730", "value": "T16EC6330824F9CEC6E9A7D03F3C6F4AEB2DE0D2523187F16BDD1AA16E64593C0461D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534425, "uuid": "8239e6c8-b56d-483b-8565-5377469d2391", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534425, "uuid": "abb8e8f5-7397-4db1-a4fe-d1ca5614c9ba", "value": "196608:3Qe3tBhlvEAYzs50/mj61MCNHB2xKtAkD6e1Z7LH3CEIpqYcUJAAEIPooG8mMJUt:3XLh53ix+IMSB2xKtF31tL1MncS/dPof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534425, "uuid": "a67afa24-bd5a-452c-8487-84d14db89172", "value": 12426139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534425, "uuid": "a0cae6f5-ed90-4892-8ba0-9561e044ca58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534425, "uuid": "1498ce57-354e-4e27-bcf6-cce0f6b14ab6", "value": "Huorongt_12.8.1_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594e722d-966e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786553611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553611, "uuid": "9173112f-4ae6-42a1-9d76-98058f228710", "comment": "Malware payload (Mirai)", "value": "8d1ad410af2a8dbf4d56448e392930ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553611, "uuid": "198c8751-3f51-45b0-875e-c81d70ce65dc", "comment": "Malware payload (Mirai)", "value": "f7b3e2fac685ffb9ebbd75df5fbc505bc0dd52fdcee9a5ed01e033f54db49a24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553611, "uuid": "b313a146-f265-42f2-9b9d-1248a71c3e68", "comment": "Malware payload (Mirai)", "value": "e8606a9a43bd8101f19dca4d4a04e18142909265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786553611, "uuid": "5f53e4cf-11e9-4cfa-abc0-246b6d6ff2ef", "comment": "Malware payload (Mirai)", "value": "f4654d7c3b0a1dd76232dabc21ee3ad7d6c7dbfe08d9232c68ba7f1cb5fd303eb63a81f9053023830b94de2052829af8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553611, "uuid": "19662f2b-cee7-4819-94d3-e07015daa4a2", "value": "T16D044C49AE742AF7C06FCE300929831725DD644FA2F6B7396678CD4CB99F20859F3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553611, "uuid": "cb7ec4cf-c930-4f3f-83f7-5e03a61d6e01", "value": "3072:vhh1IayTDHk+Xeqh3IbSGbB3WZGsQnyhjXlXHlnGAn5V131DI:b1Vy/Hk+XRxIbSGbB3WZGsQnyhjxlnGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786553611, "uuid": "2f1d574f-fcbf-4ab1-86cf-c8161f192945", "value": 181196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786553611, "uuid": "aab87beb-873f-408e-a310-93f7cfc4ccf5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786553611, "uuid": "a04e10d2-319a-4c42-b886-d0a41293085e", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880a5acb-95f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786502150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502150, "uuid": "c8e2658d-bdfc-400b-84be-087c11e58e77", "comment": "Malware payload (Vidar)", "value": "17d018a05378de55cf28f9e7e91d82cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502150, "uuid": "8e1dcbda-af52-4588-834b-2ccb2cb21558", "comment": "Malware payload (Vidar)", "value": "f81c167e57a709eb3cb71290e7910757bdcc131ed166bb4a5b94f9a7b9311fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502150, "uuid": "f1cbd63d-c6a7-44f8-a35b-e11d4734286d", "comment": "Malware payload (Vidar)", "value": "3e0360ceb5da0aee6638010910f2634ae998841f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786502150, "uuid": "43568152-1945-4474-b24b-dbd8bba564fd", "comment": "Malware payload (Vidar)", "value": "47ae4347b687b8a63897353048f9d5e062c055e6272964e6611748f6fcb68dbcb51f5b6b4a1d6c1fbf7110b1d4bbdb06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502150, "uuid": "c3a0cb7a-763d-4c38-9af6-2d0b747af51a", "value": "T15106AE0BBCA004B5C8AA673688BA42417778FC4A4B3233D72E50F57A2F727E19D75B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502150, "uuid": "722fdcc9-cef3-4595-bce7-3ebbb72f767b", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502150, "uuid": "66f62d8f-8b7d-4158-aa0f-9783b750872b", "value": "49152:Wv2E6zt9fanhCzd9gQXha6oI1u08hQwJjnN8GdJTsFxw:Wvk7sU9Xh4FXQxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786502150, "uuid": "aa4a09eb-3185-4e6f-a343-70bc1e869391", "value": 3870536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786502150, "uuid": "3d3a5cd8-1da1-4252-9047-d85da6a5b298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786502150, "uuid": "d0351298-be1d-41b1-8a60-517fae248d58", "value": "f81c167e57a709eb3cb71290e7910757bdcc131ed166bb4a5b94f9a7b9311fe4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b1cb6e-960e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786512590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512590, "uuid": "f81501bb-51df-4498-99ad-be256338cfb8", "comment": "Malware payload (Mirai)", "value": "5e9c24c18fce3f0ca8f3837276448165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512590, "uuid": "0a947dfd-866c-4b5b-8835-88f4ec2620fe", "comment": "Malware payload (Mirai)", "value": "f955acde46175f1ee2110c1a4d53f4310b90c08834a350c8eee4bbfcb1d36b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512590, "uuid": "a6d7d098-733a-4722-8c32-184dca2b5542", "comment": "Malware payload (Mirai)", "value": "5125d8c713c6564f2b4468a170817b3c55b46cc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786512590, "uuid": "af64d77f-9e5f-468f-9ee0-36f585f3de5e", "comment": "Malware payload (Mirai)", "value": "4cb51e8ec6f4b8d3083be1237caea585ade1226ca4393f70d0074b0598b7f8cc98762fd0fec4cb6f3e03d5d918600e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512590, "uuid": "344a271a-38cd-46de-89b9-29ce7694d1c2", "value": "T1A0535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512590, "uuid": "6a36083e-76b6-4683-8954-bfd6a56368a8", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6TQtP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4b5P+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786512590, "uuid": "ee9455c6-c524-410d-a4fc-b2d8634ee9a5", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786512590, "uuid": "d048c55e-b9a4-438e-abfb-baaf63915d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786512590, "uuid": "a9133c4a-c3d4-4582-8db7-7bce902178c3", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79314f0-9642-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786534979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "30ad7cc2-d251-49c8-bd65-6642338480fe", "comment": "Malware payload (Mirai)", "value": "0f3564f14d7f878260931f17530ae54e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "b1851a2e-edb9-4a9b-80de-a3d84d1da42f", "comment": "Malware payload (Mirai)", "value": "f95fbaf1f96a73bdea5a3f90b2c1ed8a2e33dc77a644034976a23b6f5862bd53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "94b11024-3370-4b2d-a81b-5f8144ea2429", "comment": "Malware payload (Mirai)", "value": "47a8383db80906ac91cbc44b254721f460dc87f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786534979, "uuid": "28d0602e-1b96-4793-b2d6-de33848de76e", "comment": "Malware payload (Mirai)", "value": "cb33e79a89eef7af1fc14ae3107c7126994a5c11521a2cf2760a94fc5c1076a89b3e2c5dbde515cde0a79aa1778ad033", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "9f902e17-50fd-45a3-a557-b8604e971e59", "value": "T1C033F126E232CCB45A3019BDB86E5B8B1B5B0B3DC6FD25790046E278C8927056EF4DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "101b46f5-58d7-412d-a42b-c1ff7c35a8f4", "value": "1536:/k0yoKGRrS4HiXA7E9M7sI8N5ZBHDnNqFo9LM:cXvGZS0iX2E9M72HDCYLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786534979, "uuid": "8a6d5994-c44e-4e10-8b38-98c6b15a0b08", "value": 52824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786534979, "uuid": "c73f9bf9-178d-4348-9ff4-8e2c3664fcea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786534979, "uuid": "5864ca3f-63d5-4d14-836a-39b57f26c4a1", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaf739a-9603-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786507791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507791, "uuid": "fe131924-2d44-4083-8357-b30cb1fa0e46", "comment": "Malware payload (Mirai)", "value": "fb41cf851aa92052654034598055463f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507791, "uuid": "048c7258-52e6-4084-9065-d17a4bbd217f", "comment": "Malware payload (Mirai)", "value": "f9c9e38dd865bbccd83346a8c03c5a6726a67cd29b0c889f90092f46ee4770ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507791, "uuid": "4aa581f2-ef52-4ceb-b560-24c767c09461", "comment": "Malware payload (Mirai)", "value": "1d1cdaa64761294ca8385b6f8e962dda6dd91195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786507791, "uuid": "b8c95633-e4d4-4a0b-a826-7f22eac01497", "comment": "Malware payload (Mirai)", "value": "c9c756f004dbbed8ed6fbbc7c9f9300abc11bcd2998a8e63724e11bbba0c68d6dac4dfd4e579d7bfd5cc91ba0c51a715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507791, "uuid": "7e8c3281-c859-40c0-b17d-45eff40cc887", "value": "T15D63A351F8929A6BC1D2037AF58E5B8D3B2173D4D3CE7223CC614B703BCA64B4966E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507791, "uuid": "cfd9f149-17f5-4631-b204-57d4766aa263", "value": "1536:4J+SBcXom/Bakp2a2jiCt865UFgUQF0wp:4oSBRm5akpV2uC66uFgUQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786507791, "uuid": "24e2d8f4-ff32-4f06-8158-a7c031075798", "value": 67300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786507791, "uuid": "a4902b2a-ca4c-4f30-b7cf-9acd4ab1f7cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786507791, "uuid": "b74787fd-2dcf-4d2d-a31f-57bbd26c7659", "value": "e80f489c57cb47a7b72fdb2e6b8e144492071a99521ab9b148646351489cf223.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a739c299-9623-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786521529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521529, "uuid": "6a5cd5d8-76aa-415c-b28b-27638013b62b", "comment": "Malware payload (Vidar)", "value": "b7e9ab4228a2899cbdb8f64b4bc49f57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521529, "uuid": "245e5869-3cca-48ad-8f23-55339ca8ab62", "comment": "Malware payload (Vidar)", "value": "fa307f25415497d9199129e21d9511cfee130004bfb93d3caced89bb26b5cc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521529, "uuid": "3338e983-fda2-4852-a82d-a5781240f05f", "comment": "Malware payload (Vidar)", "value": "25654123c34e2965b0d8b031405f4e7698d52257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521529, "uuid": "7e035632-8788-4c9b-a034-d5c0bcb9c48c", "comment": "Malware payload (Vidar)", "value": "743af33dc3a20b5b4bc17eacf387b83f30461bff5885c615cdc139b116c15033da1b1f0ff835593cf36d9c5107b05d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521529, "uuid": "ccd18f92-6878-430a-8888-e354f6063adc", "value": "T1A4365B03BD9159BDC0A5EB348ABB86167A58784CC73133E31E71AE792F61BC26D39710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521529, "uuid": "154c1658-c0b8-4ba7-b8b7-251ed3fff330", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521529, "uuid": "d8abd56d-a124-48b9-986b-dbed344b92aa", "value": "98304:lo++OPhcq8FbbwgIaZb+tdzBc3wPuBeoqOFy1dN8bwWYy0iRRMvHdVGa0IfY2Nkg:lsxb4LxyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521529, "uuid": "29e44230-42ff-4048-9e90-d3d2bbe207ca", "value": 5244120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521529, "uuid": "ee274018-f8ed-4b75-bd14-923b35e518cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521529, "uuid": "f3dc59c4-fe08-4aa6-9aa9-67207a661f3a", "value": "fa307f25415497d9199129e21d9511cfee130004bfb93d3caced89bb26b5cc88.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cbc3e6-9617-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786516459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516459, "uuid": "21075f8a-67d0-4c6d-9265-2cf9e5dae706", "comment": "Malware payload (Mirai)", "value": "a915df039c7024403b22715559b7aad4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516459, "uuid": "bddd4823-7e57-4d3f-bdf8-8fbc29e66b04", "comment": "Malware payload (Mirai)", "value": "fa5ccda047819fc1cc8c7e0ac82230da0cc8eaf2bcbcd1679bd699a40950464f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516459, "uuid": "5d7baf7e-293d-4233-bc5d-e6802171149b", "comment": "Malware payload (Mirai)", "value": "bc58e8885881bf8966526b05f2e4eee04dd63cf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786516459, "uuid": "ed2d1218-057b-46dd-9e62-76876cf302c0", "comment": "Malware payload (Mirai)", "value": "c76ee26746b429a2303e71e0c990ea25af0e7fe208b9b18c0daf104477adac1183b30d429c5cab26a95e51cf7646e26a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516459, "uuid": "7415ed26-3de1-4f16-be7b-35f9bc0009cc", "value": "T12743F1F2CC444864DBFE96A10CE6EFC35B46678BF24578A26CD6A760771B47102839CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516459, "uuid": "19f00005-07c2-4a31-8c5c-bd89be3ab77a", "value": "1536:z3zEFohnuOk+3a41flJ45PD0rAZU9v2iT4u+qgw09Oi:bIo5JkJJD0rAu9uiT4u+qgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786516459, "uuid": "2622973e-115e-400f-9fa4-ef6f56f68dc7", "value": 57624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786516459, "uuid": "1b17d067-1395-47c7-bcca-a27d80cb50f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786516459, "uuid": "127febc1-1cd0-4f6e-8468-41956cf1e667", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8efebf-9674-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786556089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556089, "uuid": "47fcdfaf-1f07-4398-944b-2b838c5b0af1", "comment": "Malware payload (Mirai)", "value": "4f9cdbdba7829b4ebed217bd1ffe4e48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556089, "uuid": "ffb58ea0-0461-4f6e-8415-f8fe58e8d8b8", "comment": "Malware payload (Mirai)", "value": "fadfccf7b3fe8a8fce5680981323c3fd6125526d3ebbcaeccbd13879ace0111c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556089, "uuid": "6089d5f3-6fde-4e4b-9c12-50b14e576d0a", "comment": "Malware payload (Mirai)", "value": "f24e2814924d32c09cb81c47f86182a67bc058af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786556089, "uuid": "c39facae-15ea-4208-b5bc-62a8d00434b6", "comment": "Malware payload (Mirai)", "value": "d2c705e9622fad3608f8de19667dbfce91841951c8a4b7fb72d621fbafd27e16493ab1e82daf1c06cef4635dfc5f5e2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556089, "uuid": "eea33f93-bf10-4f82-aedd-e5d68d8c8593", "value": "T1B8F34B07A8655FA7C589AEB566F75A340753E8110B4F0F8AB23AEAF406079DCF40E374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556089, "uuid": "e5188265-671a-475e-819c-907e8ceae02f", "value": "3072:K7CL9hXpdAnqsTZ6UO2s90WRhGcIC0AvIC/L+5vCBv75xXBT2aLf5FwD:KWZlpdAnqsTZ7OXtRhdz1ICDmvCBv75Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786556089, "uuid": "5a76feb7-d3a9-4526-bfcf-0a1ff781ce84", "value": 163019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786556089, "uuid": "c2249f17-9a76-40fb-9962-fdcad4232c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786556089, "uuid": "350561a1-0723-4053-9534-8e5a41602a48", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c38385e-9625-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786522128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522128, "uuid": "ff9ce15d-8b7d-4fb8-b5cd-477ce6e7bd53", "comment": "Malware payload", "value": "a11466535e25dea02edb858cd552957c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522128, "uuid": "722005c0-a7a7-4b95-9b02-310539c25018", "comment": "Malware payload", "value": "fb0963d19b3af42ef86f47fcb31891098839244c3ec4e6d1a7698cbfcc8167f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522128, "uuid": "ccf68060-f91a-4804-a2c4-43a633d8d0fb", "comment": "Malware payload", "value": "d0184365efcec37dcbe1d7c00259f826b0410a24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522128, "uuid": "2b78eb8d-a289-477f-9344-0a307e1cb5a5", "comment": "Malware payload", "value": "b47254972b1974125f845d274917ab3b96b4a443a2b8bd8b3ad7a295d19205a603f17426187876dd6515a28bad3868e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522128, "uuid": "c03530e2-3598-44c6-95c9-983e047c112f", "value": "T122236C6516857C15AA99C4371C7E2F0CBDAD43E6320452DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522128, "uuid": "cef5cb3c-2e83-4e4b-8ed1-bbd52fb8d78b", "value": "768:bcsr0a1ldt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zhucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522128, "uuid": "16e4cb27-50d4-490e-9b8f-7d4238af9aa1", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522128, "uuid": "71fee8fd-68df-42e3-9bca-2771c4fb2cbb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522128, "uuid": "96e4025d-e0f5-44e7-9c43-6bbef1d87878", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b9fd6d-9669-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786551530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551530, "uuid": "d87bc1e7-d378-4b01-ad3f-b0c2d17c7672", "comment": "Malware payload (CoinMiner)", "value": "94cdcedda62d8e7a325062aea6b77912", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551530, "uuid": "43bfb99b-b2f6-4440-ad51-aad29941b67d", "comment": "Malware payload (CoinMiner)", "value": "fb1ad6ea8511aa563372a032a265d038501fd8e278e1b3d3efdf807dd8a48c8f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551530, "uuid": "a1768368-14b1-4867-a8de-a4f83c07bb47", "comment": "Malware payload (CoinMiner)", "value": "5e5f73b9bb63c3f76e23e6e1e7f67d4be12bb7b5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786551530, "uuid": "5153f4b6-7efa-4a40-aa7e-af67c22fd92d", "comment": "Malware payload (CoinMiner)", "value": "01b5fac136253a403c4c23ccf5d7036a08b72f3e820d59b3d6c717cc198ad2aba4f6b563e545c9cda37d204adb2d75b7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551530, "uuid": "1eed19af-613f-4ff2-a12a-5f296c9ebf9d", "value": "T13D36335AB9D72AB4E455C7B88996B03DF03AF7608AB6BD8BB5CC78041D4BF10583D780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551530, "uuid": "d900a85d-8a43-4535-8132-ae0b7e58207a", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551530, "uuid": "b6f68bbe-4ff6-4dbb-b1a6-c40a62ad237c", "value": "98304:kPzcpxrwsvs5P0VzfsM9NKozwQJiOxTYR13RR+k2mGfvm:kFueWTpNzni+TMlRUkhuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786551530, "uuid": "fe94a54d-e36b-4694-9da9-3fa51bd2fc36", "value": 5233664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786551530, "uuid": "992eae24-6657-44ed-afe8-52a4ca673527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786551530, "uuid": "7d0eb854-1cd5-46d0-bb4c-880b258ca786", "value": "fb1ad6ea8511aa563372a032a265d038501fd8e278e1b3d3efdf807dd8a48c8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dda0f8-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786523351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523351, "uuid": "b78cd610-9e07-4e58-904e-b18ffd3c7c89", "comment": "Malware payload (Vidar)", "value": "4128b92eacefd3fd7da5955639112951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523351, "uuid": "099b1dba-50f7-4ed9-bb0f-8d90247cacbb", "comment": "Malware payload (Vidar)", "value": "fc9de7d194ecc92019960412bbe30dd811824181b6539e796105590e5a174af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523351, "uuid": "28fb48b5-a2c4-4db6-b46a-fade704fa39e", "comment": "Malware payload (Vidar)", "value": "165488aa42290c6ec27b2aa5868787bae79b6d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523351, "uuid": "9d9055f5-5b79-4703-b1ca-9c57f3dc70e7", "comment": "Malware payload (Vidar)", "value": "bee855e9f54bb0536583625aa13dbc722f217117a0dbc1bd84782d249537f2d2ca80d146014378ae4fcb49a28ce64835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523351, "uuid": "b11927d1-134d-47e4-a379-a72e77841989", "value": "T175068D03ACA148FAD199A735C9A75546BB32BC081B7633DB2F607A783E727D06D39710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523351, "uuid": "94f01a8a-407b-47e3-b261-7d5ef87f4ec1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523351, "uuid": "7a77117a-e6bb-4e15-830f-c958da098bf3", "value": "49152:0BcdCdi7k/KVtm2pYjuuWrMI9rghR0kkQZ8kqLf53zHTX+KJ7yu05:0SXrptMIWhR0TQ4z537TuKouy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523351, "uuid": "745bdd75-cfad-4b0e-802e-3bd1120956f7", "value": 3855696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523351, "uuid": "e680d437-fb82-415b-830e-c3f10b1be21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523351, "uuid": "278d6bbd-3285-4259-b3b2-befef68378c0", "value": "fc9de7d194ecc92019960412bbe30dd811824181b6539e796105590e5a174af1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377432ea-9625-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786522201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522201, "uuid": "a799089e-dc0b-476a-b962-d46d3e8a9b42", "comment": "Malware payload (Vidar)", "value": "28ee82bbce56ddfb87ed0cc19114d8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522201, "uuid": "e1c45753-522c-4c37-b840-864c30835f98", "comment": "Malware payload (Vidar)", "value": "fc9e50e39efbaa09fa433f1b30dea8332593be0b29ea74d5b1bc3150b7865862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522201, "uuid": "379930b1-634e-4d59-bb74-dee7d780f6fe", "comment": "Malware payload (Vidar)", "value": "8dd96cba7d326859de27954d0a0d0aff24b91a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522201, "uuid": "b967d49a-4f22-441b-ac2c-f3a33ebe0887", "comment": "Malware payload (Vidar)", "value": "ea0953b149c169ac413c10e0e2552adc1e4916f9360fbb18566c049c032990da538f876347768846977cdc4451acca1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522201, "uuid": "6c87d8b5-1691-443a-bbb8-a04882bc8e57", "value": "T1D0269C23AC914A65D499FA328976A3407638F84B5B3733D72DA27E753E727D00E39B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522201, "uuid": "d2dbaaa4-18b0-457d-a68d-9c363505bc98", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522201, "uuid": "b39690e0-bfbe-47cb-aa79-bd2b509bc048", "value": "49152:oZGxXhttlM6QtdHSSREPX7mn3rqeQirMPMvCkoZN6vQzJkKsGpc1QK1P:occvQrhQzC3NzJAasP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522201, "uuid": "9f7a52e2-0ad9-4f36-a8fe-c23bbd4930c9", "value": 4754000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522201, "uuid": "91d77097-81b5-4cb0-af2a-2b688b526af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522201, "uuid": "320e12b4-c84e-4d41-816f-f49a04c96c9a", "value": "fc9e50e39efbaa09fa433f1b30dea8332593be0b29ea74d5b1bc3150b7865862.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2640f5-9698-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786571551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571551, "uuid": "a6e5df37-9698-42be-bc20-20e42cb17c70", "comment": "Malware payload", "value": "6f91c88dcd2def8e468162054063034e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571551, "uuid": "55a19e57-ec3d-4dee-bd61-eb066c863bcc", "comment": "Malware payload", "value": "fcde17b95346c7a44de2de0ce663e5e9a4dc9af982e11b10538385892428748b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571551, "uuid": "c3e416fa-b55b-4286-a967-a10c8ee1eb2d", "comment": "Malware payload", "value": "01bf757daa6ffff30366ff4c8dfe3cd0f64e33bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786571551, "uuid": "f3f13b9c-e721-40ae-944f-4484b991aca7", "comment": "Malware payload", "value": "c82e3f6c850e5875236159ab394542bed940ce4a7f4bd064d3a28ce38827bd0e239e1b47d2acd6879d1e6cc9e286248d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571551, "uuid": "656d4191-656e-4b2e-8288-1e557d9502df", "value": "T1B0F59E07BCA149F6D09AA33289B35651BB70BC484B3527D72E90BB382F727C05D7AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571551, "uuid": "b6985988-932a-4351-a92f-3ce4dd267afd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571551, "uuid": "4cddd82e-5b74-4acd-9e7f-a69e179ff73b", "value": "49152:iudlwuSAECqSSkbYCK0dcsPLHBF/zU9X4mkCxWXy:iun83IxUX4mhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786571551, "uuid": "c40ee070-6cf6-4b46-8a61-b8b7119a42a2", "value": 3352944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786571551, "uuid": "77cb4208-4e2c-4a9d-91d3-a1dd6358b953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786571551, "uuid": "21a985d6-078c-4da9-a513-2aaf0e7998f5", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f90cd08-9606-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786508927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508927, "uuid": "c268033b-9f0f-49e0-b6c1-748045ef5a01", "comment": "Malware payload (Mirai)", "value": "291c556b407d094b85727b2a33566588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508927, "uuid": "69cd9c99-23f8-4841-b0ab-2a3114837bf7", "comment": "Malware payload (Mirai)", "value": "fcf5437a7884cdecc7fd0f9b88bf6e33ec02748caedea247732db9ad3993e5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508927, "uuid": "eef4708d-3241-4ac1-8d7b-b4614063b903", "comment": "Malware payload (Mirai)", "value": "81972cbabd7f32d22e4d27406fa48830f24007f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786508927, "uuid": "5b337008-ebf0-4af2-82f7-25afff2a058e", "comment": "Malware payload (Mirai)", "value": "f377d5215f890116fa2be28830135eb286deace408690879dd1c53f550ca3e685d43d36258d02a074714e0b9e0baebf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508927, "uuid": "8ceb8500-6f1d-4d75-a54f-4cb3cc1f3c88", "value": "T1A27312AB7A53EDE9C551843EE1CCD347CE0BA56210EC94F387AA497461D62873352F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508927, "uuid": "bf170c12-7a59-4bb2-8840-8d404d8ad8f0", "value": "1536:RN30qC0bt84UggbRwN3H5pxCxpaWYPx8LcJFVgpzH50r4:3LCs+4Fzl/gg/GLr50s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786508927, "uuid": "88b4bf6e-f621-4121-9c09-1632bfdcc8db", "value": 80512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786508927, "uuid": "697893fa-9946-46f8-aa15-31ed8a190996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786508927, "uuid": "f75a3a0b-4fdf-44ee-a931-d51be9c26d4b", "value": "fcf5437a7884cdecc7fd0f9b88bf6e33ec02748caedea247732db9ad3993e5fc.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28184b77-9607-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786509290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509290, "uuid": "e29fbaf2-42df-400f-b8f9-6ebfe0395874", "comment": "Malware payload (Mirai)", "value": "20f54fe954ccc4de556780f5c47f51b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509290, "uuid": "b47478ba-e257-4dcc-8842-82cac10f118a", "comment": "Malware payload (Mirai)", "value": "fd4c636a61f254e9345bf27a6d0d63d3edb95a73228070e46c6241095724b5e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509290, "uuid": "73b627b9-500e-4d12-bcc0-bea8fb17d80a", "comment": "Malware payload (Mirai)", "value": "8eb0e9b3b0229d5a2d1fc41143da9185f224429b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786509290, "uuid": "1c16c40d-5fef-4a93-a16f-635d10b86df5", "comment": "Malware payload (Mirai)", "value": "f40a6c34861360bbc8ee4543d4c5a9b14f3cdf89dca067e024dc961aa175430fedecb5465578a08b17bc5ef15497ffda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509290, "uuid": "48299f48-5919-41a4-84b1-0043a86fc3f5", "value": "T19A34B70ABF510EBBE86BDD3701E80B0629CC645722A93F757674D928F94A50F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509290, "uuid": "5a7c3816-07a6-47c8-bed0-ba11aafe7af4", "value": "6144:zyJIYbf/6bjkN7cp4y+prU3x/nnaSkkGziKaUBocjlVlB:zppJ+RUB/GlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786509290, "uuid": "0261335c-d98c-4824-9e01-e81733c23ffc", "value": 231172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786509290, "uuid": "114d4958-f7fe-4f60-8ab3-94cc7f06b062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786509290, "uuid": "f34315f2-5451-4193-8650-efd37c50d57a", "value": "1d316bbb9849e930792df647a701e7897519b278764f2efdfe2a9e6496e457f6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29e83b9-9627-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786523347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "617eb124-2850-4704-9e5b-93617041941b", "comment": "Malware payload (Vidar)", "value": "9b3b9059992e8f185f276f3e4b4833d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "1f208cc4-8c7c-428a-9387-931b3ad95e45", "comment": "Malware payload (Vidar)", "value": "fd85311cde8c1da383c8f6ba88bcf79a29487b15c098b523d392e176b8ba8caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "5c78623d-fb24-4838-a9d0-ee299ea0f557", "comment": "Malware payload (Vidar)", "value": "20aad6827fdbdd1d702579cf167efab5dbdeb9ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786523347, "uuid": "0676785e-5068-4934-80ac-9b1c0bbfb8b9", "comment": "Malware payload (Vidar)", "value": "5ceb1e5011ab90b8b11b2c4dc2336d63eb675f2f0599bb1a3ddc9d6727cd8eb455448635988ba1a3cc480678d8ca2eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "59764923-6ef1-4b49-8ae8-647c7b5a5943", "value": "T1BE067C07BDA048E9C0AAE731CAB691567774BC0C4B3223D72E50BAB92F727D05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "fb37a2c7-0b52-4ddb-bb60-c323fafeb563", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "75019104-06fd-47db-ae1a-f0fa612c3b22", "value": "49152:CxU+ppGbqrRZ+F6nkk7i3co8FNmAfzk+G5fawkVY7M9Z/:C1xM7GL67k2Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786523347, "uuid": "d7f959fb-2db0-4c88-8802-12a480f17377", "value": 3942232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786523347, "uuid": "04b06a2a-a948-4688-bc97-5f0c8196b704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786523347, "uuid": "1c26a476-64d6-47d9-8984-3d0c6a65b6f3", "value": "fd85311cde8c1da383c8f6ba88bcf79a29487b15c098b523d392e176b8ba8caa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397d1053-95ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786505883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505883, "uuid": "51ba6890-b137-4678-971e-d4610c5be024", "comment": "Malware payload (Vidar)", "value": "a26ba6f15c730b9d942e53402fd6b5f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505883, "uuid": "0632f688-2fd7-4ea0-a3ec-c6e1f039b461", "comment": "Malware payload (Vidar)", "value": "fd977ee7a791e0145dbbda2063bed367ab71645e8778d7411a5df87f72342a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505883, "uuid": "87bbbaf0-f85e-4d75-9796-02bf6fef8558", "comment": "Malware payload (Vidar)", "value": "1e52acbf413bc8f0f50f83a82678369e2a9089c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786505883, "uuid": "855260b7-5fce-4047-a58e-4d550260475c", "comment": "Malware payload (Vidar)", "value": "1d5aca9424e9209d72fdf1514e795c5454efb3dbaea8b9d097555c88a200dde02d85fe27c47ea7cb87e00bc3ebc9298b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505883, "uuid": "222d40e5-040b-4af9-9cf1-6564d8485abe", "value": "T1B7068C87BDE11D79C0AAA33189B74292377CBC590B3227E72E60B27A2F767D05971704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505883, "uuid": "21e95ff3-9468-46aa-a2e9-2650e5ec3b73", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505883, "uuid": "54fa2007-97f6-4be5-9151-a30378b95da6", "value": "49152:GcyJ3Vz0hcw/gywaNwNRvDtJrp1/kZFu2o:GBpyaNhDDrfko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786505883, "uuid": "315b5c80-a0b6-4526-8431-fe66ae05c9eb", "value": 3984968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786505883, "uuid": "0b2d55b8-0f36-4287-a6cd-78d4fbb18b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786505883, "uuid": "21d313bf-ce42-4059-b5e9-8fb832332047", "value": "fd977ee7a791e0145dbbda2063bed367ab71645e8778d7411a5df87f72342a32.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfcfabf-95e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786496657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496657, "uuid": "4ba0357b-a790-4045-bf0a-b3d0ac841c74", "comment": "Malware payload (Vidar)", "value": "36cbc71e7c0a2cca0d53f56bab8e954e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496657, "uuid": "5b4181f2-4dbd-4d6e-81dc-fbcb997e77ee", "comment": "Malware payload (Vidar)", "value": "fda5fdd2f8923bc9f7a397628ec274981e6983d3de812fe5d14a4c7fcd4282b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496657, "uuid": "c8e8159e-f7c5-4aa2-8340-316e2ad7dec6", "comment": "Malware payload (Vidar)", "value": "57c99ffb9c6f9b55d27e676de1a4a857e902cd95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786496657, "uuid": "e4e739d9-74d5-4bfe-b5c5-900c7abe5a08", "comment": "Malware payload (Vidar)", "value": "999e60836774c8c0bc7f24b461a7de85b1897733bf3add5a10283ada906e171d38b5e87acdbedc533c0dcbe7a1aa595d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496657, "uuid": "18e1846c-81b5-4609-a695-1e26682ee120", "value": "T156366A03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496657, "uuid": "87ecafa6-59af-48c3-870d-0cc949f41103", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496657, "uuid": "f1131690-6bb1-4a28-99f7-ce69fe186319", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaaO:uc3XND1aJrCOkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786496657, "uuid": "ad4adc0f-e001-4e74-8ace-a4214bbd3c1d", "value": 5000853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786496657, "uuid": "3358a873-e585-490a-b9a6-fdffb81663ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786496657, "uuid": "10cf38da-8cf2-468c-9849-2126078806cb", "value": "fda5fdd2f8923bc9f7a397628ec274981e6983d3de812fe5d14a4c7fcd4282b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08194dfd-95f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786503224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503224, "uuid": "0be08915-1b7f-4fa4-8026-064b1a7dbf1f", "comment": "Malware payload", "value": "b9dd4b6c0f00c7e5befe8054c1406a47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503224, "uuid": "6d2833c3-fa38-4e62-8c51-14b9c8f6460d", "comment": "Malware payload", "value": "fe1390d20a45bef35ae7129bc34db63e5370dbedf4e239628c5a5112fa14c9e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503224, "uuid": "c85a41f8-5960-4b28-84cf-a2cf2c9712c6", "comment": "Malware payload", "value": "1a84acc03ae61fc3c9b5e79d66edf5fd0a81ba0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786503224, "uuid": "0b1d1787-3183-4419-b104-68b578130b7d", "comment": "Malware payload", "value": "1dda8020e9aa5845069f56abd83f01058f5e98f1a52c699d7e4d5e2467f7b8d97817fe67da50d6459086b8f9fe78e4db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503224, "uuid": "6508e937-38f7-4877-97e1-02ac7834260a", "value": "T149A35CC1F683F1F6FC1251B51027A7339733D839503ADA97C3ADEA26EC126529A1B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503224, "uuid": "58b43f25-5a03-4276-af13-fc25ffe854b3", "value": "1536:fdk8E8H1RE6PevE1RWFAqVsjUTYVYcK3c/BtoSr5eAWYg:lkXY1BhW2RQsV1K361hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786503224, "uuid": "140fd440-30bf-45d4-a1f8-d0c158c4c359", "value": 100688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786503224, "uuid": "c029fefd-5465-400b-9f25-3ceafe8d09ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786503224, "uuid": "e144126f-dfa5-4cd1-8bbb-6cae60c01366", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf79ce6-960b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786511362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511362, "uuid": "be699f41-0ef6-420d-ad15-914b83765cee", "comment": "Malware payload (Mirai)", "value": "cd00a58c7b28eac653ad9daa4d32d016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511362, "uuid": "657067ec-dd49-4eba-871c-d50fa703985b", "comment": "Malware payload (Mirai)", "value": "fe7cb6fa9d73b474e2256659d70a3bc71d20b9f38f2160bf0956166bb4131606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511362, "uuid": "43730ab0-c1d5-465a-8084-5f5ef579595e", "comment": "Malware payload (Mirai)", "value": "bd8a4bae249930a97943063f734a196da24c6bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786511362, "uuid": "58cae245-fb18-430e-9f83-058d77a40d68", "comment": "Malware payload (Mirai)", "value": "e98164571e687593861b33eb282e4736cb3895b2241338d06270abfcadc91a9b054148065e507e2a5ca8d8526f15402d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511362, "uuid": "e7387100-9627-4d46-ade0-9f32e2e05658", "value": "T194E36AB37443F568D8A042F0E58767C92A6305083F9ED4E23C86913BEF753CA6469F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511362, "uuid": "48c7a0b4-f5ce-4547-9521-33299114c2fd", "value": "3072:fcFrMyLV9DaauRbM8eMjAc5BHLro6+JssE1H0Zgxyq:fcFQyL3DkeK146u4Pyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786511362, "uuid": "286e9f22-3180-4f52-83ef-9600c0e5e45b", "value": 157068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786511362, "uuid": "87435e6d-91b7-4c2f-8044-6f51237fb629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786511362, "uuid": "acf40bc2-dd7b-4301-829b-0445bfcc01e1", "value": "bot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174a37c9-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786521717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521717, "uuid": "19a92292-52df-4461-87dc-0d5e2a43ef84", "comment": "Malware payload (XWorm)", "value": "695488d3eca1d1ec5495550c4e7b7b97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521717, "uuid": "4964afdf-01ac-474d-8bf6-7ba6f31271ca", "comment": "Malware payload (XWorm)", "value": "fef376731e94cafacb554ccd09aebc3e88d128b5744dc9c103af3707dbf9f235", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521717, "uuid": "a8d0018f-f8e8-4384-a3ab-55a6f4378c09", "comment": "Malware payload (XWorm)", "value": "cb4525e5dc41726a73c8b9ee6966947f176a8c3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786521717, "uuid": "3243dde3-41b6-45a2-8e70-a2865776be2f", "comment": "Malware payload (XWorm)", "value": "e0ba798ef4bafb393c9f15ba846e1bec800dc21c3f9ba605b4beefa16b082f3e58a605f5d27a9b70591bff7ee0938249", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521717, "uuid": "be683a88-45df-4516-b84c-562eb3416a35", "value": "T1F1C5404A57039631B93D7B1CC6BA6A20998930E310C5DB9D34BE91283774B27978F9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521717, "uuid": "66d17677-89cb-4d31-b0c5-25d6093efccc", "value": "49152:0QywJpsDI9AUR1Gg+SEQ9klZEn605BQ4aw+FDbgFMbdYgu6vK0dceEpJcu:RywJpsDI9AUR1Gg+SEQ9klZE6kCq2Dc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786521717, "uuid": "6b422fab-78cd-4ceb-8774-ab31ab31307a", "value": 2590790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786521717, "uuid": "a67bbb0f-7ddd-4cc1-9f2f-248a1a39652a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786521717, "uuid": "8b7f939b-407b-4d27-a5ba-d2ad7146bd8e", "value": "RAK-Gas-LLC UAE Project file.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad91f01-9624-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786522045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522045, "uuid": "482f7194-887a-41cf-9003-d3aa3a579020", "comment": "Malware payload (PhantomStealer)", "value": "c9e9830c2ef9b19f882b17d9d7ca3423", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522045, "uuid": "9a6def75-3015-45d4-a8f6-80a4f2c3d506", "comment": "Malware payload (PhantomStealer)", "value": "ff0a180322e7710df4c2f1bacddec867f63f2568fb36cb813688d6070c6cb4a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522045, "uuid": "0f03e889-ec99-484a-a3cf-631dd79cdb9d", "comment": "Malware payload (PhantomStealer)", "value": "1b6114676e7e45cbac798f7bf64415ed28d7ab55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786522045, "uuid": "22d7e647-5933-46bf-be80-92b344d02bef", "comment": "Malware payload (PhantomStealer)", "value": "ed24da91bc174690ba8c22a7a707ce87f2b511e33b3545072689b518c323dcbfa4580844b2f2f4a4df6fa31e4a5b9c77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522045, "uuid": "1f7f155d-573c-4599-8d51-e889245d681a", "value": "T1A406E35813AB793B712E531CE036AA90592961E725D4EF1E79FC890CB762B07234E4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522045, "uuid": "be2c713f-7f0e-4d01-a9b4-ac1b3460325f", "value": "98304:mw8H/G/xm/Vq1vdm7wpMUTTBbG6UexbOh5yOfK4V4CpfaFC8bsfW2TmAXptCOQWd:yG/M/8jm7WTBb7DOy4SCpfaFC8bc+AXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786522045, "uuid": "7dd8f4b0-2b8d-4998-9a55-fdf24563f5a5", "value": 3930966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786522045, "uuid": "ff7f253e-94e0-481b-93e2-68e72d16cd89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786522045, "uuid": "2e4797a0-d33b-4545-9530-2fdace0e591d", "value": "enlepkin.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b9c7d3-9621-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786520752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520752, "uuid": "c63676e5-85e2-44b6-a87b-caf4dcc016a9", "comment": "Malware payload (AgentTesla)", "value": "eb69e57a301155cb14d28da233d8fd43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520752, "uuid": "74bd3271-4e34-4392-9864-56a901da8a6f", "comment": "Malware payload (AgentTesla)", "value": "ff6fd5e3494dc16064da750116bb9d899c52560af353be6a430d42daeb6435b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520752, "uuid": "bd92351f-79f3-4309-b324-787d4635f5d5", "comment": "Malware payload (AgentTesla)", "value": "efc60c8a669c9a4c510ee0a60db6372a7e448ded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786520752, "uuid": "52efd3cc-c462-4621-a311-96da9befee6e", "comment": "Malware payload (AgentTesla)", "value": "fc81c3e9f1c033e5c2ffc6b704b7339771041d2e4da9d23684b4002f0f2e88d88a60390d703072eecc204099475c205f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520752, "uuid": "07c8c305-8390-47a0-9e1b-da11b3576f0f", "value": "T1933570E3568E6CA5D930ADE2BD066083F135E1C818D0FDEE37B9158F9C9A59CCB24721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520752, "uuid": "1f0c2bb2-970e-4c0d-abd9-c304dcac5e04", "value": "768:7rU7Gh66DBZFpZr5b6b6BFVphUV/DbGrE5lLPP/rZPvr5fpb6BrZZZ5rPrlLlxE7:DVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786520752, "uuid": "30af6a47-ba05-4234-85ef-29e7ba9d93c7", "value": 1079963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786520752, "uuid": "447b603c-644c-4bed-b699-d8d28d9b5d93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786520752, "uuid": "a4bc0fd7-3f18-49c2-8d1e-23cb3834aeea", "value": "yamfloor.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }