{ "Event": { "published": true, "date": "2026-05-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-29", "timestamp": 1780099381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9cab784e-5d98-4a5e-b3d3-77c1e4d46a8e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596360cf-5b60-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780060479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060479, "uuid": "16a9167d-1351-4868-8dea-1b9a34588a09", "comment": "Malware payload (Mirai)", "value": "e0a492b634e79f006a1c1761940dfcdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060479, "uuid": "5ca95c04-e12c-416e-b057-a8c8de721bc5", "comment": "Malware payload (Mirai)", "value": "00ae2c03716b0dac432f6f5787c6be915b1c37c967474318a0d9c4efb09a5548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060479, "uuid": "74d3c4ba-51cf-41d0-a187-ea0bd73713b4", "comment": "Malware payload (Mirai)", "value": "36e6cd8b9c7a26c1caa044c16c8fe38f318a71a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060479, "uuid": "a5eeb2db-da6f-463b-bf14-ccb7bfc3e646", "comment": "Malware payload (Mirai)", "value": "d28f79d8d9483a3669a7e20a13da4a38f56ee2e83063064052659755bbf132a3918dbb5a8c74be54bd4232fc6adc7f7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060479, "uuid": "2d7f7026-1e32-41c4-a95e-e368fc249e50", "value": "T141E31956F8819F12D5D151BEFE0E128E33131B7CE2DE72129E246B70778A8BB0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060479, "uuid": "87e0d3e3-970c-4133-b6a5-59469d9c4d61", "value": "3072:oLKDzQVuQRjdMt7tLa8WXnTMchzGPPe0egkm5QidKTCMMXO:TcwSjdQtLa8WXTMumPeHgkm5DKTvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060479, "uuid": "0ab31fe3-34a4-449d-ba1a-40a5d47e0f68", "value": 146036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060479, "uuid": "bef3c1a4-54a0-42ab-b041-ae8460edb37c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060479, "uuid": "440f1466-ba2e-45da-828e-52be13511212", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dae85ce-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780040649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040649, "uuid": "50586eee-4425-4db7-b894-95384850d5e6", "comment": "Malware payload", "value": "83acfca3625fa769799ccd82e26dbcfd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040649, "uuid": "382f217d-1186-4ed3-ac09-50b828d1be25", "comment": "Malware payload", "value": "013723553a157de6a46952a5e06cbbb7efa2de04e5292a2066cd95e226192ca7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040649, "uuid": "ffc79ff6-169c-4aa7-b12b-f9b60a1b8d9a", "comment": "Malware payload", "value": "b9a54fc90e4c2d7d99c095e4bc5ec2e000102a4c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040649, "uuid": "d42ae411-152c-4760-9eb0-703a3bb497be", "comment": "Malware payload", "value": "0033d345ee17ae200d9fc2b0204f9877f1d8cea15078251cc5ccf3989c188dec66576ad510467e809490fa535ec6789d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040649, "uuid": "1bf9e584-6cc8-420f-b6ad-629a7d8d3487", "value": "T103E5333595483FD2D16D1F74AA3A1115F8A133A3AC4185476E2AF60D372EBABDB0433E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040649, "uuid": "09cd4cde-afd6-47dc-926b-8458bab5a88f", "value": "35f3e5e1597ffec9c6b30622e5e4c0bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040649, "uuid": "8d3940ae-bfe7-49d2-8240-37b7a560e496", "value": "98304:14GdoSDFyj/AMJUJPK7uTaD3N+Wp/MiuIb:GGKSU/AMJ4CgaDtpCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040649, "uuid": "cff39ae5-8050-43bc-83a2-3d91c8e53a3c", "value": 3237040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040649, "uuid": "f952cc05-aaa7-4eed-a2a3-be20aa4d991d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040649, "uuid": "6f35bc08-9505-4901-a4bd-5a41aafc9ec9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7213b-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047121, "uuid": "9202f7ea-cccd-47d5-a3f5-7156c25763b8", "comment": "Malware payload", "value": "22db2e6e5fe8a6bfb32839b697d2c917", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047121, "uuid": "592c9a61-798c-4e26-8572-8ad31c0bb569", "comment": "Malware payload", "value": "018ef44b2d71de8d1bfb768592daa406a91a6187bc87a74dee67cb2a0d344f0a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047121, "uuid": "c294805a-e052-4f0b-8caa-7dbe76e2c272", "comment": "Malware payload", "value": "0556e71248b652184805d387efaf9e9af3aacc12", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047121, "uuid": "cb9a0024-1b48-4832-a974-781ce72561d9", "comment": "Malware payload", "value": "9736eb47d2a498bde411d7d4ec73e496a3cea5353d8cb8fb41c3a6d69fd5f5efc6d66fb7e58688f196834ea602966891", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047121, "uuid": "6f2ee770-85c5-4313-a5f2-0c72d185cfac", "value": "T150955A1BAC9149EAC49A53338CB762917BB5BC480F3223C72E50B6382F767E45D3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047121, "uuid": "bad59733-ba16-4722-abdc-be3582fe0fd2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047121, "uuid": "c2d6ddd3-0fb6-4568-a668-cad09a302d60", "value": "24576:POt7lPozrEYVsTdKTFYH8t808HTLJ734qFeiszAfLBele5ZK2hgWl:PORlAzrpVshUaH1lzdTJerWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047121, "uuid": "2ffcdba6-b8f5-4f0d-a80a-8e21895d8278", "value": 1976960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047121, "uuid": "1aef8827-cabf-420c-81c9-f5d4e13acb28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047121, "uuid": "ab0d5e77-69df-4647-8f36-874f6224922d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da45a48-5b5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780057963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057963, "uuid": "18f80971-310a-402e-95c7-c05e12e1a6f0", "comment": "Malware payload", "value": "3cab611fa88251ccbd6863435378dca9", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057963, "uuid": "2f434dc1-503f-4b99-98ad-334ed4cc3097", "comment": "Malware payload", "value": "0274c4b51541381c299a387909e49db5bfc8cafe18e2ddbf2b26eb5dad73cd85", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057963, "uuid": "6ec8d4cd-374a-4389-9657-258e2cf47179", "comment": "Malware payload", "value": "7a6af487ef0f731ddf47ba1f502b6e3f584c99f0", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057963, "uuid": "086cef4d-8f4d-4e17-8094-a1176f4c6f87", "comment": "Malware payload", "value": "74f8afbb0e02fa06f4e40db57fd01e91ebf7e24d3a48e29480cf0f4e91a8ff3532e981e5f4b80906ab4c721145534598", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057963, "uuid": "f3dbd88f-ccbf-4347-aed7-e185274df8bf", "value": "T1CE92DC8076E81704E575FE39CEB9B7840437BAA1EDB1CB1C8A20CC5D18A1A52DE35F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057963, "uuid": "7467468d-c828-4e4e-959f-781feb51e707", "value": "96:8IJu/Felr2z7+LwIJu/FelO2BUAtWwj8E/Fela2bKfs9LY:3u/FeZa7+LLu/FeMu9yE/FeIws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057963, "uuid": "fbec8f3e-9297-488b-aed3-480e566ae7d8", "value": 20495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057963, "uuid": "3d5abf51-3bf1-4be5-8d88-a998bfebfa9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057963, "uuid": "62263ea6-8907-44af-9055-b0257429f0c3", "value": "Nakaz_neprybutkuvannya_boyeprypasiv.docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb5240-5b51-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780054212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054212, "uuid": "51610776-0490-44f6-8647-8b94c7cdebc5", "comment": "Malware payload (Phorpiex)", "value": "5e93cfd01bac9ac4729f29be8f67de15", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054212, "uuid": "5e2a3a0d-c142-4b8b-be33-cacf102795a9", "comment": "Malware payload (Phorpiex)", "value": "0371fbbff34ec41ee9ae007482edbcb75f1749661b863da3a2ffe86638cd62a3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054212, "uuid": "1aee0c66-97c4-43c3-8739-69c3571815b3", "comment": "Malware payload (Phorpiex)", "value": "9c31065da22663f8060b87bc7f28f46d43a41148", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054212, "uuid": "4abbf10b-676b-4126-922b-3b6a7d83e130", "comment": "Malware payload (Phorpiex)", "value": "7d00158e4291a09e2b438c20b3b0efdfd2b2c8edfcf313a81cc2e2b5876621577ba7fcd4a12e242bbb6a76bed6002457", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054212, "uuid": "0a46bffe-2710-4644-ae92-31ee624c23a9", "value": "T141B39E1034C1C432E566117A88EAC7B58A6DFC310F75A6DBBFC406BD4F266D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054212, "uuid": "b9a12437-b2a2-48a8-8ec8-d7b334fa642d", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054212, "uuid": "b7749f3c-422c-46bc-9dde-b7f188b82e78", "value": "1536:W5UDS80TzdtyxeX38YmLfSFLQfeciC0iU4aIxl5/A26E87:oUDS1T7fEfSFL+eF7Ixl5/Auy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780054212, "uuid": "d5d29de8-1af6-4dca-b9ea-146044e46b95", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780054212, "uuid": "39af585b-e4ed-46f4-9b5c-953508f0a7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054212, "uuid": "55434481-f535-4e0b-b7e8-57034fe32375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4285776-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043103, "uuid": "85274665-7b93-4971-a88d-1fa7b81480d7", "comment": "Malware payload (ACRStealer)", "value": "7eb2e08f23a08304f76cfd128af545a9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043103, "uuid": "9640bda4-be7a-4257-9522-0e1b80bad0a4", "comment": "Malware payload (ACRStealer)", "value": "03e696190ce37a2d01f27446fd957804e5ba83438ad83f52b9d3fa302df4e12b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043103, "uuid": "9ba2ce7b-7d56-45af-aae3-521af22fc86f", "comment": "Malware payload (ACRStealer)", "value": "31a37417fa8ac2af4ed3f2fe934891f85594c8c0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043103, "uuid": "1b5c403a-5c62-4825-9303-e4e1fd72f3f9", "comment": "Malware payload (ACRStealer)", "value": "69acb70f1384e327b0fcacad39f7113a4c451e04ae7527e5a27221f7d09d513ab30decbc36a32ec977b1f776ba4a79e5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043103, "uuid": "10858ef0-63dd-485a-a7fa-b8abc1125fc7", "value": "T191957B437C90A4B6D5BA923189B5A2E07231BC494F3127D33F15BABA2E777D40E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043103, "uuid": "2058492f-9160-49eb-8838-af085e5f55cf", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043103, "uuid": "f9cf2130-58c2-43e6-80b1-c0db7fa974ee", "value": "24576:O+jE3dR+V7pLbsMJGygaeQiF08LLtgZ4jnZuc10yCEGjQ6OgLP88Wd020+KxHD1o:O+o3m7tbsMJBgaeQ40ongLPtHD112", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043103, "uuid": "3b2f0772-ac59-4b66-87b7-b41bc1a4e7c9", "value": 2026112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043103, "uuid": "b219589d-afc3-42e8-b0ab-146720b4463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043103, "uuid": "af6143ee-f571-4946-8bfb-2b27ed7c9956", "value": "SecuriteInfo.com.Win64.Evo-gen.26592866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb4996a-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058765, "uuid": "18e6215b-1e41-40c6-b5f8-5c821689d563", "comment": "Malware payload (Phorpiex)", "value": "8054e9d7b0134b8fcc00e88a1471167f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058765, "uuid": "f89cb519-152e-4600-8af7-b33a80a35c8c", "comment": "Malware payload (Phorpiex)", "value": "041341453321adb6bceb73abee88484a28f27f0de1e2916575cdbc197ea839dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058765, "uuid": "dc18c177-2eb2-4497-81ac-fc6be7e0df75", "comment": "Malware payload (Phorpiex)", "value": "eee2af2ec7cbfe7bf11bbb9d54889f279ddc4ec3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058765, "uuid": "edf5c8be-33ea-4cb5-b44b-4fe41fccd891", "comment": "Malware payload (Phorpiex)", "value": "5ec6a73ce8f4953bf50bf3ae1231fa042a1d045e8c871e2aa5f9c7fcf1a8a69b0c4aab3ca2ecaccc87ffb54217dc3db7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058765, "uuid": "ebec5a60-e214-4a3f-9cc8-5edc61f179a0", "value": "T13B824A0FF9418216D1E210B452B5867BDA799C72338458DBFBD08A9D0BA86E6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058765, "uuid": "e260481f-4191-48bc-b394-e518b85219bf", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058765, "uuid": "bda0e370-1e9c-4c7f-9b6a-dba417093541", "value": "192:kIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJm:mIblVP4Y/2N0bLu9JgPL7Nyav8U9cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058765, "uuid": "244468ec-32b8-491b-9a1d-127376bd7dde", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058765, "uuid": "532dee7b-6d74-477c-aa57-d5a6080be7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058765, "uuid": "7cf93ef4-1e36-4c18-9a54-b82b14806033", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912cd2f5-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055849, "uuid": "f2127fa6-6a7a-4e53-8ed4-f35b4f9d3720", "comment": "Malware payload (BlackMatter)", "value": "9da9a92d9dc922f3a3783354e289368a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055849, "uuid": "f73f8678-01e9-4a59-8dc9-eff35aa610fa", "comment": "Malware payload (BlackMatter)", "value": "044539a2eacfd520e93aecc7f977b7ebea9d15c941a7101f5682ccb9fec68e1f", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055849, "uuid": "6ae66e06-1ed3-41fc-ba59-17909f42289d", "comment": "Malware payload (BlackMatter)", "value": "48565eccea6f3525b47ded20717bc2cf010945bc", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055849, "uuid": "03a67ca3-853f-43f7-bc7a-af63cbbcd420", "comment": "Malware payload (BlackMatter)", "value": "47157f591912e1af230a76d77df062cad97e3bc5ef883ac8e4c3973c183d3462c5e24860cc8945c6fc7d6fcb89f489a7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055849, "uuid": "afffb039-3588-48f0-a7c7-af80eb29bc1a", "value": "T158E36D21F612D073C83718F52736B572F3DE4E6C19A96457EAD80F99BCA48232F04697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055849, "uuid": "43a2e807-8959-48be-ae2f-8f1b2252cff4", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055849, "uuid": "79b968af-4db4-4189-ad9c-e87a4244b839", "value": "3072:f6glyuxE4GsUPnliByocWepoayM7sZ+y9b:f6gDBGpvEByocWe2aye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055849, "uuid": "1821859e-0f41-4287-8abb-d984374418b8", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055849, "uuid": "aad94eb1-f191-4d1c-9c01-443c994be620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055849, "uuid": "75ef87f4-054b-4b26-ba7d-8edcd880e36d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e87ff4-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043099, "uuid": "c9268edf-e88f-4637-ae28-41873352c71d", "comment": "Malware payload (ACRStealer)", "value": "aafcb50fbdcb5d29046ee5c091a731fd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043099, "uuid": "5412fe71-4eaa-4e29-8cd8-ba9ae678ebaa", "comment": "Malware payload (ACRStealer)", "value": "053ab9bf3778ec777342c045bac855a44d80fb75e224a5362134b53a2c864993", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043099, "uuid": "10a11dc0-8e3b-43a1-9503-f11d0602a17e", "comment": "Malware payload (ACRStealer)", "value": "19b084fdd494f7b918893b49eb31e91818ea617e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043099, "uuid": "5ee16c81-a546-4893-965e-3d95687ce427", "comment": "Malware payload (ACRStealer)", "value": "dc728fed080225a4bac974f3809caef48828888f29c996599e113aded9afdc55ba8915ab15d707bbf9bccfb01fba5d1e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043099, "uuid": "121e5df1-9f86-4954-b585-1eca6026b175", "value": "T122F57C5B7CE048FAC09A633289B32196BB74BC181F3223D72E51B6782FB26E45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043099, "uuid": "58ddde43-920f-44ce-8b8b-f2b5fb59ce0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043099, "uuid": "428fe3f8-5298-42c3-aa5d-32ebd58d7dc7", "value": "49152:7ETqEPUwuP9by4hqR8tHafC0hv5xX47yskQ:7H7A4hqR8xypv5xoWskQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043099, "uuid": "64f6e217-15b5-489c-8400-ead494ea2b92", "value": 3358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043099, "uuid": "d91b81c8-3758-482a-bcc2-20c08cf1b406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043099, "uuid": "97f82b64-fe43-4ee5-8fcc-f688d0e67295", "value": "SecuriteInfo.com.Win64.MalwareX-gen.29376287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bc37b6-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089110, "uuid": "9db8494e-b072-4d99-9abb-7d098e736db9", "comment": "Malware payload (Mirai)", "value": "19378353f5a8519453bec8b552dfd8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089110, "uuid": "1c9c3d8a-1b85-43d1-aada-8905eb137a81", "comment": "Malware payload (Mirai)", "value": "06cd8b579b111c6b1c2d75b41f792908fec69cf8406fc6745043101aac53c599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089110, "uuid": "fb50c474-4781-4334-8c02-1c2b955e837f", "comment": "Malware payload (Mirai)", "value": "1a00438f8b9fd16560067412850f1d9ea81790bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089110, "uuid": "09f154ef-f588-41a9-9acc-49bb541ab085", "comment": "Malware payload (Mirai)", "value": "c85437a9c1fd5582fe24fe0f7b25bd0f7d5d2253b2051c86e4fa2cfd480e62bc5e710b0cc3a9b4556a0ffb66942497d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089110, "uuid": "688ab01f-8e64-4f32-8e68-38d1aff376dc", "value": "T173B30A45FC405B13C6C666B7FF4E428D7B2A17A8D3FE720399256F20379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089110, "uuid": "98646ce4-4141-45c7-bee5-8697d2928065", "value": "1536:5PJqPz8mYMU4VaR2TENbvKUOAvDMj7O3q/YlVdwywO4JfeT1oMjlQhdJuS:NEPzFU462oNbG/O6yK3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089110, "uuid": "cacac27f-deec-4382-9eb8-4779a1b2b588", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089110, "uuid": "d71fe49d-a4f0-478a-8aa1-18d6922f1695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089110, "uuid": "da1f36ac-d33d-4967-b0ac-f45a900ae7c9", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a979f182-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056748, "uuid": "d2a5a895-df4b-4368-9498-eabc1b669c09", "comment": "Malware payload (BlackMatter)", "value": "2e166b0ed08d9a559fe3ab4194eebf9b", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056748, "uuid": "6cc37f54-9367-4e4c-8a45-77058f1c5c58", "comment": "Malware payload (BlackMatter)", "value": "06fe6a157bd3f67ae9f7cdf3478a0db670c2772b584cae5900d2473b6b109bb7", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056748, "uuid": "8c0c99c0-dfd1-4aa9-ad19-87a459b0ccd7", "comment": "Malware payload (BlackMatter)", "value": "8a97aa6405949976461441e74526debb05984658", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056748, "uuid": "86a23d1e-e29a-4e97-850c-7c00b15db2b1", "comment": "Malware payload (BlackMatter)", "value": "58d2ba95ac4233c2b9c96264d668422d3b5ef3f32323ab5a710fd3adcdeae5feddf3cfaf7cb65150e293f8f450cb4435", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056748, "uuid": "851e0aa9-5ec2-408f-83a1-504d993c02d5", "value": "T179E36E21F212D0B3C83718F12736B572F39E8D2C16A96907EAE80F5DBC658236F45697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056748, "uuid": "33232ccd-975d-42cc-9d1f-e8829967d378", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056748, "uuid": "31b5e20b-16ee-4785-a304-a008e45fc11e", "value": "3072:26glyuxE4GsUPnliByocWepDP7LENPCHCpmzd08C:26gDBGpvEByocWe5z+PCip0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056748, "uuid": "87f8350f-8371-489f-9def-10620a2d9ab7", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056748, "uuid": "12b484b4-1a4f-4694-95af-08cfde12ce50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056748, "uuid": "0b745f1e-4789-4dea-aae6-c6eb3575211e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2cc4e5-5b4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780051117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051117, "uuid": "51f2a163-0331-4f5f-a61c-2f23781f6a2a", "comment": "Malware payload", "value": "47d5a6b163c4b8f60a94df23a8b5af2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051117, "uuid": "accb0da2-8776-4db4-9eaa-31880c692d55", "comment": "Malware payload", "value": "07f3b3b3d68b66d02e38edc1a4dde77f2245c3b33054b92322d757f0d27b4697", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051117, "uuid": "eb7d742a-8374-41a4-a0ee-32f9be1e475c", "comment": "Malware payload", "value": "f26ce344a5b8696dde14842322c8745004a59e2f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051117, "uuid": "4ccbe85c-3a6e-47bf-a9e6-4046c1079d61", "comment": "Malware payload", "value": "ff3830c8eb2969b41eb93ea60b2e83368739639b68c3ca54aef9387f13600290f6c9b4ec7a99805cce34e54304d5e1f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051117, "uuid": "9f9d3206-6d3a-41c8-8b2a-b7e63da265eb", "value": "T117137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051117, "uuid": "bb80d509-74a7-4c95-b308-9506f49c63c6", "value": "768:w+e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:w+Lcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780051117, "uuid": "20699b15-c07c-4879-aba9-e3cbd1acd231", "value": 45538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780051117, "uuid": "bd283545-cf22-4946-a302-0c72b7f2a70a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051117, "uuid": "b32222b5-6e74-4358-a402-2ec520de6968", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e02ea-5b77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780070573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070573, "uuid": "3cfac83d-69f5-40f7-b398-241815192d43", "comment": "Malware payload", "value": "d457426271ed3f9dfb5ff129287aeb43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070573, "uuid": "e11d7503-3bb7-4edf-94f6-d15db466c06d", "comment": "Malware payload", "value": "08a69e8b4ae7660c97057109c4077577832f5b9a2c6c6d7e5e804aceb0aea39b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070573, "uuid": "4ce25f18-831d-4bb4-9a33-944aa536237d", "comment": "Malware payload", "value": "8755b62b88b189437b71bee7a5bf3a81d6dfe9dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070573, "uuid": "3ab84c06-0427-4d2a-bdb2-38ec167b90fb", "comment": "Malware payload", "value": "631a8aa53b7ad1fc4ef6ad2bbde377bd1e93da725f60de478dbe85c07bc36986be0a21f51688ccdab1313c5a19bc5e49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070573, "uuid": "14501275-67a5-4257-a76b-3af73586222c", "value": "T1F807AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070573, "uuid": "becaab06-f4b0-4ac4-98f8-7749ab8ba8f2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQY:cqYUQuVDt0TZEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780070573, "uuid": "200299fc-5dbd-4b65-9e3d-2880bbd14c0c", "value": 17661952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780070573, "uuid": "e8a4909a-a639-41a9-a136-4c3d113ae49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070573, "uuid": "c4ce52d9-a213-453e-ad11-ba2b1752f6ae", "value": "08a69e8b4ae7660c97057109c4077577832f5b9a2c6c6d7e5e804aceb0aea39b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543f5b38-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017521, "uuid": "3c642e02-e9be-466c-bc71-dc4d7e5fe0a6", "comment": "Malware payload (Mirai)", "value": "79cf8be327b44b85c551b52562eb4f83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017521, "uuid": "8add0bb9-a2b9-42b1-add7-e4944dd37e01", "comment": "Malware payload (Mirai)", "value": "08f136e60b807f7ded14a969df1fbc719e8c39b38a0cbdb69051718be3ef51a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017521, "uuid": "4dc21cd5-ab68-44e4-8c8b-cf194c5c22e1", "comment": "Malware payload (Mirai)", "value": "46c67230793ad6864c45e10dd4239b7d276326e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017521, "uuid": "7b308a36-414d-4539-aaf4-394c88cbbb71", "comment": "Malware payload (Mirai)", "value": "3dc2ca1d0eb6d6f8d1564acb9d4f3c52785894b83b89e1c50b17d10ae2c3c29b740ded76a7d971daa6db374a246bb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017521, "uuid": "e639dcbe-9ea1-4a16-90f4-dba3d5f6b9b4", "value": "T130D39E97F6075868C83506F40BCB4B5D2A2321058E2B96F77C1E373E2A7E9DB59063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017521, "uuid": "0a8548e6-07d4-4004-abb5-941930e67655", "value": "3072:16g1UeGZ2rYrtWCow1AX1YqILDgPCMr11Y/zq:16eUkrOsCoLFLSSCMx1gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017521, "uuid": "808f1f0f-9b43-44f6-a0b2-3ba93784bf47", "value": 132808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017521, "uuid": "56b04137-039b-46b7-b8e5-90872ceffbf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017521, "uuid": "23b030d5-4a3d-427f-8cc7-4d8accf5d1f9", "value": "bot.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0987bbbf-5b1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780030281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780030281, "uuid": "531fea98-8ece-4e03-a875-ddf74adf301b", "comment": "Malware payload (Formbook)", "value": "5d9feebaa2e86fae9b6705abd56c1669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780030281, "uuid": "86354dd9-60d8-472d-8971-83659413dd29", "comment": "Malware payload (Formbook)", "value": "0becdb662b66302f1391bb651af0f8eadf42bac64654db18ddd13d860377cacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780030281, "uuid": "1d6c66eb-f190-4225-97b9-16b1da181127", "comment": "Malware payload (Formbook)", "value": "f80a2ac060841d234c0aee32e43dd0b5025bd10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780030281, "uuid": "600c6b7e-3527-47a2-b808-8a34b7e2088c", "comment": "Malware payload (Formbook)", "value": "3474f7a53f238f12a5b8d261f9b64f53de882bfa8e3e9d7b4ffe5967c188e4c0cb866337db1b589f458fb1a6a36fd2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780030281, "uuid": "807dea34-ce44-4cb7-9544-92d327dd2c2f", "value": "T1B4350246221ADA03D5E64FF45960E2B517749ED9E831D203CFEA7EEFB8BB3441815382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780030281, "uuid": "b6a70965-4974-49b2-8d52-4b6cc4639247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780030281, "uuid": "81d7c67e-b44c-4ae2-8190-fe289730f0ba", "value": "24576:dZLydJAEFT0D+ypNRfEC6IaVTmhCULE3pSkS/V/twDhWPk+Arpwbp:dZL83FQ3NR96IWTmHFkS/tIB+gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780030281, "uuid": "fe04a2d6-8183-43d2-bc77-0ced1d81138d", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780030281, "uuid": "2b37a027-6773-43da-8159-64a6b8a84dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780030281, "uuid": "40b7b22f-0682-4135-87f9-d33da0324aae", "value": "MV_Lila_Houston_Vessel_Information_Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f63e0cb-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056705, "uuid": "cbaec1df-db5b-4efc-a9b2-df4cd7205824", "comment": "Malware payload (BlackMatter)", "value": "ce52f7d83d81eaaf9f01bea6343d0ce8", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056705, "uuid": "dc534e1b-e0e4-4956-b0a4-858cbd55fa41", "comment": "Malware payload (BlackMatter)", "value": "0cd5240c696194cf2eb701cd4d4ca81e7f17612a4042ebb56959008d66537b4b", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056705, "uuid": "1525d86f-970b-4c97-be43-3da868c858f6", "comment": "Malware payload (BlackMatter)", "value": "b12135523a1f8d1ce0fa2845ffcaa049e2e09952", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056705, "uuid": "bc76d65a-d2da-4e9c-972a-01a098b1ed83", "comment": "Malware payload (BlackMatter)", "value": "74dab4f43f61f12aa4fc1d36349aac12ccb421ed2ef692edc4baae6d2a798cccf14e8621c12944e7b3c74729872e2dd3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056705, "uuid": "e1d408f3-5f6a-4f21-b1cc-3c7f9f5886b8", "value": "T198E36D21F212D073C87718F13736B5B2F39E8E2C19A96847EAE80F59BC658232F15597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056705, "uuid": "0cdbb220-906d-46b0-b224-50f4a813466e", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056705, "uuid": "28b42e67-3f11-40a0-a047-390eb73fdf8b", "value": "3072:e6glyuxE4GsUPnliByocWepxJIpiyIEjWV:e6gDBGpvEByocWeLJyiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056705, "uuid": "05124895-4cbb-4b0a-b1ee-86c134705819", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056705, "uuid": "1071cb29-0a14-43a0-bd45-136fc2a60270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056705, "uuid": "4240837a-b8d4-433f-9cd3-b189c1fe9eed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6b6b61-5b65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780062899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062899, "uuid": "706801da-bac2-4d4a-9d1d-fcec90e23203", "comment": "Malware payload (Formbook)", "value": "151d4da17c225b257f3a61deb2e2d421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062899, "uuid": "c0773dc0-81f0-4d08-aaf4-41a1f759cc12", "comment": "Malware payload (Formbook)", "value": "0cfbc10a408c5747c977cbac7e92bee4aaac42f6fb8d3d73b6e3b0de05208ba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062899, "uuid": "8e942578-f133-453f-9734-77a061f8c661", "comment": "Malware payload (Formbook)", "value": "725f7ba01ecee151b112117e587a5b1536149313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062899, "uuid": "5bdd63a2-0c76-4b19-ad0a-53384c58e0f8", "comment": "Malware payload (Formbook)", "value": "259be0f3fc79e0911f8ad312122b738c4563ca92ee78df80258af1ad8130824eff11432b92f4f5483cc0b41f654be593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062899, "uuid": "230ccb65-c4af-418b-9e6f-4aee4fcc4044", "value": "T15F250195261ECD06D4E64FF85960D2B817B49ED5E932E2039FDABDFFB87A3401805382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062899, "uuid": "e66ebbe1-9367-46ec-bf31-a5fa65fb524a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062899, "uuid": "95ce6d67-782a-43ac-8e9f-37e03a0bdf6f", "value": "24576:xZLfdRAEFT0DZEOrEvcVkstDS7G+RaTVrbiDrLro:xZLb3FQeGrpS7G8ahiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062899, "uuid": "e9110657-3154-417a-a9fa-54b9ee218bd7", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062899, "uuid": "62517d95-2845-4880-8ccc-4743bedb7404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062899, "uuid": "c9ed83ef-2bc0-4ba7-a2a4-3c96f5937c27", "value": "MT103_\u20ac162,024,40_Febeuary-May 2026_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0939c0-5b81-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780074681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074681, "uuid": "f8ed59d7-4242-424f-a071-1c8296e4c705", "comment": "Malware payload (SalatStealer)", "value": "0c345829cb77ab898947a1cbfee8b112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074681, "uuid": "2ecb2ba7-7142-4f92-a86e-0757bc02d9c4", "comment": "Malware payload (SalatStealer)", "value": "0d65a7a087223adece78c09cee5771fb9d7f41e12a174e85d3c29cf846470f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074681, "uuid": "1f6c6bc4-878a-47f5-9b56-c1573aef2f4e", "comment": "Malware payload (SalatStealer)", "value": "a28563dba55a88f4ceb6274f4fb5bbdc82f912f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074681, "uuid": "b46feac2-50b5-40de-9c85-d3543af77857", "comment": "Malware payload (SalatStealer)", "value": "1c20c97cb45520477a3ba0e8d3a8387b461a757e6e7ae3cef9d75b3697f36e13c910f6d63b20e37724a39fbed34e3498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074681, "uuid": "d5629898-7cdf-44f7-b49f-d4e1c0581765", "value": "T18E87231637BDA05DE76B9BF4487456838692FC374CA7908872CE41CA0F4F6503DBCA6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074681, "uuid": "67abb592-c699-47a8-bdf4-35bd9f4951fa", "value": "911b582fbf4f62a027519a6e85cb99fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074681, "uuid": "6a2a6b6f-8c0f-4d4a-b21d-a5d8ff0c7f9c", "value": "786432:jNr0iv7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7o7u:1v7o7o7o7o7o7o7o7o7o7o7o7o7o7o7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780074681, "uuid": "9b88535e-38ad-4cdb-ab32-5855358d3c73", "value": 37278672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780074681, "uuid": "917a2ef7-fda2-4798-a84c-1032a4465f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074681, "uuid": "cee19c35-9955-4bdf-a19a-9bc90d5230b6", "value": "spoolsv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88c8d36-5b92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780082221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082221, "uuid": "571008af-208c-45d6-9158-63a5b4902300", "comment": "Malware payload", "value": "730ccb76af5ee3d2b98d37eb63254581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082221, "uuid": "30d6675e-cfe0-45b1-bc51-c7e88c1f0da4", "comment": "Malware payload", "value": "0e2bd6cefeabfc90fc29501d26c4460cab14c8fbe549c7fda58aa0934389f399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082221, "uuid": "563bac8c-d37f-45e3-9435-7b92809c2daf", "comment": "Malware payload", "value": "0422fa3b9ecb22c81b19e6ee5cd8f847713eae6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082221, "uuid": "40001059-9f19-4de3-b18b-0b1b7695170f", "comment": "Malware payload", "value": "cce25e93a959a0a6ab9c75d17970ba0c1c8a5fe8a4ee203f454728615c8d24071c4aa6a6cce736ca46045d0ba78272d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082221, "uuid": "8ad55c65-3649-4f83-9df6-f474c3ed41ed", "value": "T18BF5194369DB0DA9DDD677B861C36339A738FD71CB2A1F2EA604C13129536C4AD2EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082221, "uuid": "d5133b8c-72ea-4c9f-9d15-6f436ab2fc3d", "value": "9b0dc33bab417a1f674e6f4b6afd4b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082221, "uuid": "cace7866-2c52-4618-9790-0dcdd01bf73e", "value": "49152:Jch2KuDZ5ywqUDZAZQnEMH802y50fftUDXupoUJEewCcYHs:JOKywqdR02lffOKpoUJEewCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780082221, "uuid": "c0dc606a-d4b6-41ca-b68e-f012c17e4587", "value": 3568197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780082221, "uuid": "f4345dda-9b75-4c53-8d2d-281589506d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082221, "uuid": "59e073b3-9949-4243-a613-6da701ddbaf6", "value": "NexusMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3571d5-5b66-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780063304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063304, "uuid": "674be3da-dd7a-41e8-9a9b-e34e15b8a046", "comment": "Malware payload (Mirai)", "value": "1d82937b5492e97008968127bd04b288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063304, "uuid": "3a4d9d06-ad46-4f77-81f7-065a38d2e646", "comment": "Malware payload (Mirai)", "value": "0f85685ba1041523eb8c9bc159605cec822c0097cfce76113f64ef5241b56d56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063304, "uuid": "f96e857f-6f30-439e-9f1a-867a23a280a6", "comment": "Malware payload (Mirai)", "value": "535a7117d1dc3665f444dabbb1aa3ca9cd6fbaba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063304, "uuid": "498f3029-fef6-41e2-9da1-fad88798a3b2", "comment": "Malware payload (Mirai)", "value": "351f1dc1a1a27e50795eb1ad218b77c78aa20d0e5aa1e5b264760b6cae642e6a945823aa0b4ed67745c78a924bf7d007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063304, "uuid": "9595fa92-ba35-4059-a9a0-9f58e4005558", "value": "T17BD43A55F8809FA2C6C02976F65D86AC73174B79C3EB720689254B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063304, "uuid": "5bd2dd7b-803f-422d-9d59-137c4530b656", "value": "12288:exNv3bWpfa/JkCSY/Bfw1Eqw212Y6ztLPVgpWStTsp:expLYfa/vSNwu2Y8ta9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063304, "uuid": "0b6139c3-040f-486c-9036-d978549bff97", "value": 607708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063304, "uuid": "00c044de-4d83-482b-9f32-eee5cc6f0c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063304, "uuid": "87164df6-17c5-482a-a12f-4433d37ad4ef", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e083f995-5b6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780066290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066290, "uuid": "45322cc7-e5b3-4055-bd73-a35b81d90f17", "comment": "Malware payload", "value": "9d42738546aef0d61b7186365fa69765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066290, "uuid": "94925766-582c-4545-8856-891889a251f2", "comment": "Malware payload", "value": "101351cff5f971cd39bd6280be02a5e0e8f08d9874cae78b971e3a421a7050f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066290, "uuid": "bd50946c-df04-4099-adb7-cabdac55f4fc", "comment": "Malware payload", "value": "fbe222c767e4797d639a930082181c3d1f6dda34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066290, "uuid": "d558a145-9379-4d50-a09c-c6b7664f26b2", "comment": "Malware payload", "value": "8bf01e8e92504ae18da1bba7dd9e8e92049308c2be3a6ef6197341bca8bf7659b112b05353e103b72b3013cbe5d57c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucidStealer", "colour": "#D76279", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066290, "uuid": "f5d77cca-14e3-4c54-a864-408f7e9d9907", "value": "T13F285C22A2A605B5E8BFFA3196E65D139D22BC076F3045DF334817361F73AE05A36B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066290, "uuid": "852a00d4-8d30-4fae-9eb4-8ef3b68840f2", "value": "359e649ab913e838011b9d61180c7f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066290, "uuid": "11b05864-a240-429c-9f6c-8f2db381b115", "value": "786432:3WJVDSfPhj2e7pAp6B65Eu1J6dG/u3XFU41B:3W7DSRj2e7WEu1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780066290, "uuid": "4e2191d9-cc6e-4398-9d03-307be54f81b0", "value": 100491776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780066290, "uuid": "c5a6ff8f-a433-457e-994f-02919148058d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066290, "uuid": "c049577e-3eff-4d76-b1d6-2dc4c1b3b4ad", "value": "node.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04fecad-5b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780059766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059766, "uuid": "65272c11-f900-4eb2-a96c-1e682c528aa9", "comment": "Malware payload (Mirai)", "value": "76953aa52fe434fa55b46cb6c4510a05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059766, "uuid": "6f8fdba5-a514-4536-92d9-afdabc162355", "comment": "Malware payload (Mirai)", "value": "121448bb3eb771de731d4d5ca51d0fdd1b1282369db7ced0e6126992f009d114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059766, "uuid": "81e88745-d742-47eb-9766-1bc998223297", "comment": "Malware payload (Mirai)", "value": "29511dea583a8fc5223c09b51c19bd1c98172817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059766, "uuid": "573a2df8-77ae-4428-918f-3df1763419c5", "comment": "Malware payload (Mirai)", "value": "ff404004215299a484f05c156709b611311e3418a15401d77256210b06c6ade8812cbd8dd254bf14d150c56ba9f42943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059766, "uuid": "c72626ba-d3da-4d34-84a7-5017fe039c8a", "value": "T1B6D31A45FC519F17CAD255BBFB4E438D7B2A0768D2EE72039A255F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059766, "uuid": "b464c2e2-7ea3-4e39-b24e-31fb15b48328", "value": "3072:sCYBeJd6jRQ3YgwuFNiZVAKdNPdXBo1XI4MSTLK:vYoKS3YgwGNiZJbRBYVTLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059766, "uuid": "90a9c1dd-67df-4d8a-a0bb-6d8c58fe6da9", "value": 134520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059766, "uuid": "55be7ba2-db9f-45ed-b367-77d22c68b683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059766, "uuid": "0553c97d-58de-4399-b711-b13623fa4e10", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee4f20c-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018479, "uuid": "2afcea61-626f-49ac-89ee-b94123a00d9d", "comment": "Malware payload (Mirai)", "value": "62f5900c3ad696e9ab58bfc026e07a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018479, "uuid": "9c57a88c-5d63-4a53-8194-a567ff9e9b01", "comment": "Malware payload (Mirai)", "value": "121efeab15afe22e2594d465aa550c1d005accb9dc85780994b17fa4839ec223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018479, "uuid": "1cc87438-4127-4994-aaaa-9e0748f03c0c", "comment": "Malware payload (Mirai)", "value": "18e5e95960e8384eddcc3f525d3e9de2f9506bd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018479, "uuid": "5e5e4c12-7e38-4150-b548-33dd78c46b12", "comment": "Malware payload (Mirai)", "value": "d46d0db98a7fecfa3b48b0c3dcdb2a930d283534cbd5f9808e7abee52bb740bebcd18a96c25ab75ea37f8703facbafc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018479, "uuid": "d7384cef-8f5f-479e-b639-031ed02b4f38", "value": "T117F318C7F900D9F6F809E7374853080AB130FBA244925A776257357FED3A199187BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018479, "uuid": "d3ca8d39-ccbc-43d0-8dba-38b60c4d1d0b", "value": "3072:+DNwVPixQ500CZ0t5VyL1efYEO9kUvbIwdhFeFVfjbi2LtewdHaOH:lNZ5YWlyL8fYEO+UznFelLw9OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018479, "uuid": "9ad987f6-55d6-4609-9e20-0d1bdc381253", "value": 162392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018479, "uuid": "adad1021-3d3f-4416-9676-271dd3916cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018479, "uuid": "70d7d106-0b91-4e69-bfed-0552ce7cf3d2", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6716183-5bb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780094969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780094969, "uuid": "09b1b210-059a-43f9-b2aa-e899a413cac7", "comment": "Malware payload (Mirai)", "value": "b9dd882c856a09ef6372902f12fa8317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780094969, "uuid": "3230b7c3-3537-4ea4-a72c-67c71df78cec", "comment": "Malware payload (Mirai)", "value": "126598bb7865437ce37ecc801797a2cbf783ab5400b0ebc985863261c37edc40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780094969, "uuid": "86abf7ee-faec-4f62-abf5-ddb5d82e5ed1", "comment": "Malware payload (Mirai)", "value": "d03561b9654242ebe7b9b3c31ec22e7e7a66c3b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780094969, "uuid": "83e332de-0544-4aae-b18a-0dff38f06ee5", "comment": "Malware payload (Mirai)", "value": "cff9e4b40817b6404decf1ac01bbc90acfda8ec79564908b2767fba20ee7d5391de2e26f5a15ac95f7ec6c04fcb17f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780094969, "uuid": "a71226a0-54ae-4638-a3fc-8a33150e8489", "value": "T185C3BE52C45068E4C25841B2B2B0FE3DD363D62E61972EF7AA99CD26944BFD8B40D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780094969, "uuid": "b7b16f00-8527-4b0c-939d-7f36021ce117", "value": "3072:g3cMpI+F4Fbv5esToBO80eWA+7QoARjz1ojv:g3c6Az5TU8D8Luv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780094969, "uuid": "1966962e-e097-4b94-9fe7-4fea3718574b", "value": 124440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780094969, "uuid": "576d88d5-36f3-4c7e-a8d7-251b241aed9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780094969, "uuid": "c5537aa1-984a-4344-afcd-0345d4637488", "value": "023782pler.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b44b7e-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780089082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089082, "uuid": "1b4b9cf9-0df9-4bc1-85d2-7aa554715607", "comment": "Malware payload", "value": "99ecd781f4a81035bcea902c92eb3263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089082, "uuid": "44fdaada-58f0-414c-a4f7-1cb64820c82b", "comment": "Malware payload", "value": "12da7b6a288215c21beb29b9c63de0ff3558cadfa0c3468e21adcc26e72ff581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089082, "uuid": "e4c65f0f-5db2-4d03-9d79-c7238bed57e5", "comment": "Malware payload", "value": "5d319773dc485b42144767c15dd43c50fae6d025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089082, "uuid": "2aab8cec-826a-4e24-ae39-a2ee5deee261", "comment": "Malware payload", "value": "5dbd57e3e10fca8b0d7f69ae1fe9a7798a35ff6a99aa16a3ecfc7dc83f27aa6c2765e4d083ce3586e90e82a71f4456d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089082, "uuid": "7ec2e21e-ee35-4c4a-8243-aade1628ee3d", "value": "T116763A57B8924992C4E43A77B8BE81C433630EBA9B8752575D05FD383EBE1DA0E39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089082, "uuid": "5e5de7ff-d847-4a98-bb71-fda7bb2ce4d8", "value": "98304:AJ9uZQpdaF3ixD5UbhbKuBwpM21tOooVmq6ZQkuTpuzdm1hd+rj45ATylnBC9C11:W9XD5Ub1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089082, "uuid": "cb981f66-8bd7-4a35-a42f-0de76a74fb06", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089082, "uuid": "c15df1e3-af11-4939-99b0-0df6c244bf4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089082, "uuid": "6db6ff4d-9544-4fb4-bf81-64e7ee7d6d84", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd9f272-5b40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047012, "uuid": "1caecdaf-85d5-479e-bb81-4bb0e29a2473", "comment": "Malware payload", "value": "c0160b6e11f53f9fdeacaae6133bbb7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047012, "uuid": "8592f657-742b-4950-885f-547767027c46", "comment": "Malware payload", "value": "134a00b7f369a8945c928c6956750dca49230d5fa384ff94403ab176e84fd061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047012, "uuid": "16b12ed3-d7f4-464c-9910-8b78bd938bb1", "comment": "Malware payload", "value": "15cad521179a445e9afc22f77db20ee3a53b7939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047012, "uuid": "d2f2239a-2977-4da4-8fbc-80bd62d66f04", "comment": "Malware payload", "value": "2f4af4b5f3a4957048c5617b49aa483fa1768084dae65c7c6b30dbe06c6fc53c3f198fe2f6620f98f3f741e178577f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047012, "uuid": "40e1627e-f726-475a-a7b5-4ea7c5a45879", "value": "T16B44D79B6C9550E8C1EEE275862AB502BD7030A4073837DB6FA146F10F26BFD5A7C364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047012, "uuid": "3a38ec05-f8a6-4fa3-9353-fecc6822ab7e", "value": "3072:EnZnu9zMVIg/EvyrBEg0U+u6zxeynIE9f+UiU1FNY0T5OzFUiM9v8TYVHtMf:GAzRKr10xhl94oQ0oh9MR8TwMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047012, "uuid": "50a0d4a0-d14b-4e29-8d4a-4c256607458e", "value": 261834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047012, "uuid": "d68c8b00-d576-4849-b299-a6813a58ced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047012, "uuid": "9ce411fa-810e-4a67-8cbd-6a6c7a7b7f26", "value": "SecuriteInfo.com.Trojan.GenericKDZ.117992.5647.11801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e581c03-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073695, "uuid": "dfa2c2a4-6aba-4265-a0db-b990ba8647f6", "comment": "Malware payload", "value": "4ef0a963d953daf104bedc84090ebcbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073695, "uuid": "d47623c7-69e5-48c7-86a3-922535584634", "comment": "Malware payload", "value": "13518cfc04ab41027e4b01def648d009e370557f9ecfa7cf4b06526e21bce241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073695, "uuid": "1337f6cb-d5e1-4437-9f12-3ee0f9451b2f", "comment": "Malware payload", "value": "9e8eb1b0595c8c508e1aaad77750338c5c90bdac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073695, "uuid": "a42a5a47-baad-4eab-b07c-88f4e0868fad", "comment": "Malware payload", "value": "fd22e9d512b534f710e0197f1df4b23e97112f54a358083544fe5e910dc6169d218312648c5e583fe58a0e6b522db3b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073695, "uuid": "0896a36b-5b8d-41ad-8230-48ad8d87283e", "value": "T107D31946F8819B11D5D151BEFE0E124E37131B7CE2EE7212AD246B347B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073695, "uuid": "01b21569-61ff-4cbc-b344-b97948842d4b", "value": "3072:M24rLCYgPesXczYdraeC2vEf3g2zPBBgoWI:M24r+7pXcYxa9VfwGBBgoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073695, "uuid": "71545252-2d5f-4a78-ab8f-bba0c1647016", "value": 138972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073695, "uuid": "cedafd40-096f-4086-8994-d581928e808d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073695, "uuid": "6e1a2aa5-7b11-41a3-81f1-5e36678577e4", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd161205-5b40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047010, "uuid": "bfdfcf91-fc1d-4f34-81ca-ce8ac7b470b5", "comment": "Malware payload", "value": "e942e365be3375b0c7401c4ce0f185ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047010, "uuid": "e421bef5-e410-416c-b100-3a4b77cda4c4", "comment": "Malware payload", "value": "138b53c57ec807db6c5a9d5b2930d0909cf34b27b4ad8b72f5d74801fdc6c1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047010, "uuid": "f55039cc-248e-4f76-8cfd-e1fe655f3677", "comment": "Malware payload", "value": "c0a7caa515221dcc9039711ee5b690042f1816c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047010, "uuid": "8d74feee-1a12-40a9-bb87-7775286aac85", "comment": "Malware payload", "value": "4505c49913908990447f4b2c5b8cf9815e6cedab13a6f0238c3437fde177763324011502abf131db44c21443fbfaefee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047010, "uuid": "a44c8b51-5a78-42b9-a1fa-a5930a09686b", "value": "T12ED2E84B6D9190D8D5EEE1758729B506BD3170A8032837E76B6286F10B26FFC6E3C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047010, "uuid": "eb628c94-977f-41b6-8f7d-afae40f0d90e", "value": "384:+Wy/IiAY7aBZMsxc2FHIaRXHKNDbJFji65R/vzaSceJaJO8:+3IbY7SMsrpRkJs6PzaScN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047010, "uuid": "f55f2989-da57-4980-bec6-c9713c80e148", "value": 30154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047010, "uuid": "f4711d72-0a32-4f07-9346-4786af872b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047010, "uuid": "14abbc71-9ac9-4a46-9210-6ad58c5c4541", "value": "SecuriteInfo.com.Trojan.GenericKDZ.117989.26505.22636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d957eec8-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048668, "uuid": "b81d20ff-0d3b-4a8c-bfa7-4c3f85fd2728", "comment": "Malware payload (Mirai)", "value": "e265f99efcdef52a0a67568bea541e75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048668, "uuid": "7304f595-a14d-4d4a-89dd-ebc0c657cca9", "comment": "Malware payload (Mirai)", "value": "13a39e4fba0f697ac30e38ff9fd29936956bdd4c85a7f63df64cc01401be8f16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048668, "uuid": "724ad54c-98cb-402d-be19-bebcf5c8a047", "comment": "Malware payload (Mirai)", "value": "0341688eb9ef30318f84ffe3da73578705cf3df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048668, "uuid": "f64a7e82-c1cb-4023-b1bc-caae1172b6ea", "comment": "Malware payload (Mirai)", "value": "4355d0bc75bd2b88ff6b7bb7980f6e44b6b305c353605062523d14ddcadcb4abd2e343fe9e9e2bdc78d99615ff8f7804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048668, "uuid": "ae4ee0cb-7a65-4476-b40d-eb0a3de23f04", "value": "T18B2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048668, "uuid": "46bbf691-ff9a-4753-83ad-2bbab9af1682", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2i6e:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048668, "uuid": "ed470b1e-404a-438d-9e1f-67db01d7d744", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048668, "uuid": "390617a1-3f32-4f01-bdbe-72d89b71fffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048668, "uuid": "c59efb9f-247a-46ac-a922-e60c12fed84d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9490e312-5b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780059720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059720, "uuid": "00c01511-9825-40f4-84d0-d97169db6600", "comment": "Malware payload (PureCrypter)", "value": "03b61c6606910f02fa0b09a62d5fac79", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059720, "uuid": "bc264497-6e76-4f57-8b5f-04690c1c8be0", "comment": "Malware payload (PureCrypter)", "value": "13d748226193314c6dbb551cb4ce79150bdf5d430945ef9f75ac8269211530a4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059720, "uuid": "e802220c-b5a8-4330-981b-cdf4d3e9901e", "comment": "Malware payload (PureCrypter)", "value": "7abc9680b6ca680493a5bf52b552b55f13d6f46f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059720, "uuid": "07325235-8988-40ae-a1e5-1988928fd8e4", "comment": "Malware payload (PureCrypter)", "value": "bb9675a65e4f208c0f05250c09f5c13b6f02ffd69edab03ef354d03afeaaf2a62d2bb953382a3a27bc5a24c7dc7d631f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059720, "uuid": "47498368-a366-4ccf-a676-a3083f4be7f0", "value": "T15633CC3CCEA80229C7B6C53DD8A65601FAA3B90AB53D9F8E11CE63499B53001F519B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059720, "uuid": "cece118b-4a99-46e3-9f4b-cb30a9a3b1ce", "value": "24:8a+sEOHpaky7K+PWANAUWX3NCG5gMhxb11OjAGXoc4I0w4L4I0CWv97Uume:8acOg/e3H3NCGJxb11ObMI9IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059720, "uuid": "232d3b58-338f-42a5-9ece-28acfd17795f", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059720, "uuid": "01951afe-ae5f-405f-a0ed-129894e8efa4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059720, "uuid": "f6910df2-cac8-470e-847a-e10066140afb", "value": "03b61c6606910f02fa0b09a62d5fac79.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc46377-5b40-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780047015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047015, "uuid": "90f30415-a600-4965-a750-271ea112b34a", "comment": "Malware payload (LummaStealer)", "value": "0b4b4b910f32868d46d4e348a08c8e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047015, "uuid": "49a23034-f1f5-405a-8a06-e3e22cb62cb6", "comment": "Malware payload (LummaStealer)", "value": "142261c674f96c5b30d410b700f7153c1ddedcf0a1cd3b23bf6313cf416a2f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047015, "uuid": "7f7dd0aa-88a9-482c-aa69-30381bf8d78d", "comment": "Malware payload (LummaStealer)", "value": "4d5b4db0454387890a67300c4b0a29c012546cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047015, "uuid": "780ea1e1-7d0e-4cf4-81c6-bcee47f8f9c6", "comment": "Malware payload (LummaStealer)", "value": "79877a5f92c26ade7e367a7d85efc556a89cdf913704fad7d8edf12a436c42a09d73bfb425736784091fd2ad2443a7b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047015, "uuid": "7b1e37fc-779c-4752-b001-76ff50e74b82", "value": "T16EC57C00FCD719B6E40623728AA762AB273999064F329797EA44777EFD772D50C32309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047015, "uuid": "a0c43b92-d4d0-456d-81b4-41b8868da31f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047015, "uuid": "eaecacfc-c50a-40e1-8e43-c45188008199", "value": "49152:mbLf6J44F4KSnasi4/LsmJK6HBzbsO4iS:2z6JP5rsi4mLOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047015, "uuid": "cd5f73b2-a3f8-4513-ae16-120710044082", "value": 2555466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047015, "uuid": "91f3608c-f115-4a9a-9c3f-fc90cb48a62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047015, "uuid": "ce6823ab-4598-4992-af26-0ed37deb7689", "value": "SecuriteInfo.com.Win32.MalwareX-gen.33543781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2354c08-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016471, "uuid": "3af4542f-103b-4410-b4bb-1700ed2dbb46", "comment": "Malware payload (Mirai)", "value": "930f719709ac74a8081b083c303d5623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016471, "uuid": "726d6483-ba0d-43e2-b94e-f38bf16eaa09", "comment": "Malware payload (Mirai)", "value": "151ac4345ebc35ffab682e341d5fb29e76030e814d8c2fff83943d72e07fc3a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016471, "uuid": "ee85a171-0be9-4553-a681-0cf80a0b05ee", "comment": "Malware payload (Mirai)", "value": "1528b4e8889380e79d66c08c098e902135510b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016471, "uuid": "5809830f-fd9b-4643-950d-53534289bcbb", "comment": "Malware payload (Mirai)", "value": "f07fa34a799199a1b5dda0f33f9334927b6c1986ec961d98ecdcceecaffbcf355d6e90d323e967085e3ddcc16e26cfd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016471, "uuid": "0b6750b0-06e5-4de8-bf30-d3eb8cb43f0c", "value": "T1C3F35B56EA418A13C0CA1779B6AF02893323A79593DB33079D149F743FC6BAE0D73A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016471, "uuid": "95681b7f-e547-48f6-bb90-86d5eec748d8", "value": "3072:WaVO5BNmURh/x6ocSCpSJSslVIBgyYDqqPhbGQs2EeLtPm7eSm3M/9ttfW3k1SVm:Wa45BNmURh569SCMM26gyYWqPhbGQs3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016471, "uuid": "8fc5bd93-bbcf-4d4e-8623-e80efe08ee83", "value": 164900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016471, "uuid": "c531fe98-32a5-443f-ad1c-2cee3a013dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016471, "uuid": "a32929f7-f310-4d32-9daa-52a939b47866", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2255528c-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073702, "uuid": "ab6da8fb-fdc9-4f46-9c08-40844ee524cc", "comment": "Malware payload", "value": "8528c69e53e6e23b42b4fd8004d02573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073702, "uuid": "5db0ec1b-8444-4072-8c38-4df76ebc8ef7", "comment": "Malware payload", "value": "161b10951f6000e4d0aa973b0ddc939c0db1a7e24d1ded68c2dc702058121a18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073702, "uuid": "f71bf1e2-7a6d-4b88-b55e-539666251d7d", "comment": "Malware payload", "value": "c1d9823ae0db562fd18ee3257605523a6cbb3ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073702, "uuid": "54d91fa4-7f53-4d3b-a620-eb11cd534f9e", "comment": "Malware payload", "value": "d11341dc5a094de020736643939eaed261dbd0d805211091dfcc67489e49f649a3391c54a0677dfdde9ff60b52be1f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073702, "uuid": "002f6f19-7fc2-4e5a-be40-86702a95e87f", "value": "T18BA3F649FD416B10E9D635FAFE4F024933934B6CE3FA7101AA245B3123CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073702, "uuid": "7343c435-3a0e-4e0e-8ab4-75414304ff62", "value": "3072:xonrHQmNGQhemIha7NAldl/8CQyTK/GE:xonrxGQIxha7NAldxCy2/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073702, "uuid": "ae7e7eae-e2e3-48c0-97e8-79cb1df2969d", "value": 104300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073702, "uuid": "9abd3bc5-be39-44e5-a0af-caa966b185b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073702, "uuid": "8e6c5375-c3e9-49fd-a716-8d94b0cbb0fb", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1becd5-5b0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780024514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024514, "uuid": "c80994cc-fec8-4596-a5c1-79748c52650b", "comment": "Malware payload", "value": "362b99a5a9c888844d7048ccec0e03fb", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024514, "uuid": "224a5440-3bdf-4a37-9691-4f0f31763a8f", "comment": "Malware payload", "value": "16520f80193c6e45d207ac0ffad8b29446194ad9734d7ee2ea8178f91eacf491", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024514, "uuid": "6bb244c0-e4a2-48d8-bf50-da5d57e80b4a", "comment": "Malware payload", "value": "3d3f224722644abe4a12a0744d73b742c65fb3ab", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024514, "uuid": "ad0c547a-e6dd-4777-83d9-6de336c83414", "comment": "Malware payload", "value": "d6001522f2d46d323e91470d316784145b518ffac8f88eea5007e0dde9d15fdb23e63dba50170e4baeac74d4b476de9e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024514, "uuid": "702ac1ac-09b3-4256-af7b-659d65837914", "value": "T102762255B9CDCAF4C08A9BF4674510DE748E359B81FD1A6C3ECA4C11ABA0C3D486EBE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024514, "uuid": "ce409974-2ed2-4f8a-b70a-2a8543663135", "value": "56ea5bfadd58c8144e164c63d18586d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024514, "uuid": "75f91a47-0c4b-48f8-b1aa-96b180a22da4", "value": "98304:iZtIT+/sKCdur2BSdmiY/DMyJxIn9bF6gSSnXP19T+kdSrDOc4rzRGhKiDk:Fq200iuMAdSX99xdSr6VzR+fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780024514, "uuid": "20c2c2c2-755e-4c27-8948-25cb51b8873f", "value": 7576064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780024514, "uuid": "e559b670-9ba1-409c-91a7-b55d5dc7a993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024514, "uuid": "f8e11ec1-67ef-47d9-98ff-146623bd227d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb72171-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "947bec5f-e5b8-476b-a58f-91841793627d", "comment": "Malware payload (Mirai)", "value": "52fff451b95d9c8dd35ccb290dfc696b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "cf3a1ab6-2a8c-43ad-97b8-1af743d76b5f", "comment": "Malware payload (Mirai)", "value": "16b83de3819f4a952a276989c9a2bb6f19a6a6ff155bc9bfac05423e6dda462f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "f028163a-eaed-4ca5-b13a-2b81fd504d5f", "comment": "Malware payload (Mirai)", "value": "cb38897ce0514582266cc2857fdb5ad04598462d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "7bebb823-36fd-40be-96d6-2a805e641930", "comment": "Malware payload (Mirai)", "value": "9dfb42e09f76e696d64e88015b1925acf0e95300b83254399869d717573018c768badc8a6df9f0b057b635f1500155c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "46e26bda-f69d-46ad-b100-4ae61f6ed6df", "value": "T1D9B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "66c25af3-bc7e-46f5-8940-e107811c5988", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1x/LWy:c9sSyzz36YaWWgg1xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048593, "uuid": "cc45726d-abae-4a15-8309-06f2211ca491", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048593, "uuid": "cb9a4b20-c2d3-4b76-b34c-c214843ee2a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "53aa92a3-5dda-493e-a9da-2eb6237643f4", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe1aad1-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780038613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038613, "uuid": "e7d244e9-8a05-4381-9243-d85fd8dc4ffb", "comment": "Malware payload", "value": "6a8b7b0ba27da2db4b6b718303fc720d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038613, "uuid": "ac2dfddc-d1e7-4893-8f52-2a24df6c5581", "comment": "Malware payload", "value": "177244573740a3de7ffb6aac2912be53e6ab70a5f70604569a5b93d98e873d3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038613, "uuid": "335a0719-f4f8-4a86-b681-4b3b49a67129", "comment": "Malware payload", "value": "5404478851ac715d6353ea3d6ad6f9eacee5da33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038613, "uuid": "e6d967db-74be-41d7-a677-ad974b9d5971", "comment": "Malware payload", "value": "7fde0549daaa703a073a0bf013521abd3e7dd6a3d2b658172d1f1359b161b936787a4d73cec68f9f18499cd6b1fc038c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038613, "uuid": "374b12d3-0c51-4fb9-93b8-b3787d005a3e", "value": "T1F0864A137A29EB0FC62821304DB2CAD42B691C9642D79117B785F309F9F21BD49AECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038613, "uuid": "0ea5ab9e-e424-41cf-a4aa-76c82ef1ab2f", "value": "49152:xle1vaMZqaQCIxfP2QKqCNoL53a49XN+fK0iXStVuHgH4pk7FhsozWrEia5pp0Zp:CNszXAiQ0kcP+rSi6NQnUjEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038613, "uuid": "f72414ae-69f4-4ab7-bc7f-129b6c60a988", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038613, "uuid": "b06625a7-517a-4f26-a862-929d4770e548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038613, "uuid": "54f10a81-8a4d-4b81-a421-84da09c0cfcc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94f5cb9-5b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780060238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060238, "uuid": "6543f241-ecbf-4376-9b58-f3317777b44c", "comment": "Malware payload (Mirai)", "value": "70db93b08354f43a3ea27a9316fa08d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060238, "uuid": "01be09db-cc0c-471f-bdec-137e510a05b1", "comment": "Malware payload (Mirai)", "value": "17ecee93790bbad27e165cac40b8f5d856b5130207961ad373c9a130663086c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060238, "uuid": "5afc2912-4909-41b4-8763-cb17622b1669", "comment": "Malware payload (Mirai)", "value": "fbf734650d4eb8744b2b701e493f4b3f3d85c100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060238, "uuid": "1c2a24d6-3f01-4e42-bb85-524a7e85c184", "comment": "Malware payload (Mirai)", "value": "5395945c7e4d1efdd035e9eb1fac9d2e5a444d36c72afcbf8ec39c574d9cc5efe3471f5cb4ffb1b3abfd673af57e3f45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060238, "uuid": "0fbf7d16-398e-427f-8b44-cd30a3586d17", "value": "T198D3F845FC449F17C6C265BBFF4E428D772A1759D2EE720399256B30378B89B0E3A242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060238, "uuid": "20af47e6-5e14-40fa-bbc1-1af75d41bc51", "value": "3072:X6FbqsrOTQisBGCw5FVIxEkagW4UGiQQ3d:4LreHsBRwvVIxERDpGiBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060238, "uuid": "2b4577c3-ecfa-4f88-95cf-4d3234499d25", "value": 130904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060238, "uuid": "c98752d9-7a82-438b-88eb-22ea2ed0192c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060238, "uuid": "7cbcda7a-01e3-4e0b-b6f5-407a3f9c2670", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcccf33-5b50-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1780053508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780053508, "uuid": "55aa0a62-fea5-415a-ae17-fe92f1cb7a84", "comment": "Malware payload (DonutLoader)", "value": "4c6456a609950efeffc166aaab15fb33", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780053508, "uuid": "5a50d943-a8df-41c0-9486-79f4b49a6443", "comment": "Malware payload (DonutLoader)", "value": "194b912c242604d6f9a79369f22338c58a13ce0cc2ed280ce505075808bc2f14", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780053508, "uuid": "85ae4b93-f8dd-405b-bd1a-07e246843a37", "comment": "Malware payload (DonutLoader)", "value": "2f7f6347c4b1a24ce18ccc4d5f2ff88c0ca29a9b", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780053508, "uuid": "4008aa05-039c-4750-a956-6485ec6a696c", "comment": "Malware payload (DonutLoader)", "value": "619a06a118379847b283d43dd6b6c7ed46ad8a9ff4481036c64d742bc72c305f565862b2a9326db20499348d75d8b473", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780053508, "uuid": "d0e153d0-983e-4593-8746-dd24c7e2e77c", "value": "T1A50623F8BA2CB94489725A81FCAFEB1B6752E9068B8404CC1036EF77A5FDD114442D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780053508, "uuid": "35d68828-10f4-4dc2-a059-daeb216da687", "value": "98304:vido1oZygJitCb5GQ5dh54lPtD18jrVJuMVw:viLitCzZGlPtJSrT3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780053508, "uuid": "7acc388c-7cca-4583-9b79-658e5f725862", "value": 3945669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780053508, "uuid": "155d918f-e64b-41d9-a455-e0f6bd57cbc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780053508, "uuid": "c35b3c14-30ba-46ca-a548-1e46d3a485d6", "value": "\u062f_\u0647\u063a\u0648_\u06a9\u0627\u0631\u06a9\u0648\u0648\u0646\u06a9\u0648_\u0644\u06d0\u0633\u062a_\u0686\u06d0_\u062f_\u0641\u06a9\u0631\u064a_\u0627\u0648_\u0631\u0648\u0627\u0646\u064a_\u062c\u06ab\u0693\u06d0_\u0633\u06cc\u0645\u06cc\u0646\u0627\u0631_\u062a\u0647_\u0648\u0631\u067e\u06d0\u0698\u0646\u062f\u0644_\u0634\u0648\u064a_\u0648\u064812.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab03ff2-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056724, "uuid": "d8c2aef0-9738-4cc0-a5e6-4d0b1b268e14", "comment": "Malware payload (BlackMatter)", "value": "f78401ac75c92cb7b2ee618480a9fe30", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056724, "uuid": "e2f88589-10bb-4b02-aafa-b4f779a9db14", "comment": "Malware payload (BlackMatter)", "value": "1985db0655bca27343a13d8607904c53a292459083daa8c92ae2f71a5408b40a", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056724, "uuid": "64dd46bf-ccd2-4518-9857-77438ac8c140", "comment": "Malware payload (BlackMatter)", "value": "1d7263ba3db0536b5162d041fd1f75f7e0091d4f", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056724, "uuid": "2e493159-ea02-49f3-9895-2c3d84f09d59", "comment": "Malware payload (BlackMatter)", "value": "79642b0c47a89b85d9f633cf4d81bbaee69110f8337729d88ee2e1aab3f23b21daa8b5f20b6e58588f1c8815e4d18de7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056724, "uuid": "093576a4-0246-4143-bd96-ff96a09c64a0", "value": "T176E36D21F212D0B3C83718F13736B572F39E8D6C29A96847DAD80F597CA58236F44A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056724, "uuid": "b3b22811-7374-4328-ab89-2bdeeb502028", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056724, "uuid": "838fa7ff-ba97-4494-94bb-45559156cd12", "value": "3072:26glyuxE4GsUPnliByocWepaI6hq5hgQf2v:26gDBGpvEByocWehqm3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056724, "uuid": "e47cf0dd-f023-4baf-acbf-a31a958d15ca", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056724, "uuid": "264bb57b-75e7-4976-9c23-f7b3582f6ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056724, "uuid": "fe419334-2ea1-4b0f-bbe2-e065a9eb4c55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe138cca-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089103, "uuid": "5b4206bf-8cd9-4e19-b6c6-4ea4fdafb034", "comment": "Malware payload (Mirai)", "value": "bd602add46a6a7fbcd62f7dbe3ce0f1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089103, "uuid": "ba573b26-0c77-46a6-b2fa-ac88d06536f4", "comment": "Malware payload (Mirai)", "value": "1a1016c10626697a229d879faf65881c8a53a74136e59ebc5197c500d448d8d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089103, "uuid": "b71e4026-63a2-43a2-bccc-b85a23e70a55", "comment": "Malware payload (Mirai)", "value": "071d76e15278accd12bb648d518d9201e374f4be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089103, "uuid": "46ce7372-6e56-45c8-ae76-71572ce066dd", "comment": "Malware payload (Mirai)", "value": "8044c7d1a47aeb554e5d64cc47e48a9056454ad5a0d3124b64a997cc14520c567ca5d0eda487737017d4d1bdba07fa6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089103, "uuid": "4a421835-71e7-4685-957c-39f46c4daae2", "value": "T114333B4CF783E0F0ED4B0671115BF77E96349E065124DE6EDB94FE72AE32A02A11B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089103, "uuid": "979480bf-31ee-4141-a437-25e6af789890", "value": "768:RaECdsqYVw8o7lpqALH7gQ/+TboBNl/6kz/TtPXRcVsUMD31AxAD2mRhkqDSVQZR:R1CJblpF+gLbksUS31AxAD2gQeZNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089103, "uuid": "840b8a6c-54a3-4001-8087-410ae5eb1572", "value": 51660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089103, "uuid": "2c87a721-f75f-4677-acb3-326199815ad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089103, "uuid": "2d4bee78-8985-4894-9572-1eb43df8933a", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37df3281-5afd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780017903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017903, "uuid": "bcb7243c-2edd-446a-9f40-dedee5eaa2b7", "comment": "Malware payload (QuasarRAT)", "value": "d76311e02288ea1c088f56ee1bdc5961", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017903, "uuid": "f0b71162-19c3-409c-86a3-1a1137070db2", "comment": "Malware payload (QuasarRAT)", "value": "1ba40977145dbff6f52243c28807e08847b5675f4e835bed557ed04ad37f40cd", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017903, "uuid": "9f483525-b13f-4422-b8d5-b5a30d7cbd13", "comment": "Malware payload (QuasarRAT)", "value": "acdf9536b4ed291dc3864d782305a5b35c5572f2", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017903, "uuid": "6737af8e-156e-4cbd-8530-f29980558637", "comment": "Malware payload (QuasarRAT)", "value": "830f181e9406f617952ab0b84bb744702c8ec75c8b4bf9db155ac8b2ea12a0e6eba66b80baf7c624ff89eee8dca41219", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017903, "uuid": "2f93c7cd-0c0d-49e6-9ad7-32189209ab2b", "value": "T169749D57B3A4E63BD1BE173BE43246045BB0D443B616F38B5A6C45B9AD233868D423B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017903, "uuid": "fabe0cc5-548c-4915-8523-8a881d3067bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017903, "uuid": "439a5bd5-7a2a-4d75-9128-536b46bbd77d", "value": "6144:Dt6bPXhLApfp4MhC7dl2dJUdXVbm0U4drnmepgTKTPO:RmhApXmTh8zKrmeZTPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017903, "uuid": "4e482657-3cef-43dc-b99c-97d223e81757", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017903, "uuid": "3c904721-cb49-4b9b-80b8-1ed9eb0e29c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017903, "uuid": "d36ddbbe-8291-46a1-99b2-b0d6a56c06d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95506998-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1780036528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036528, "uuid": "6b2644a4-d9ef-47c7-83e1-60336cc596dc", "comment": "Malware payload (MacSync)", "value": "452186706d8bf90daf986131061793a9", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036528, "uuid": "c3850f67-4621-4de0-b432-b00482d63700", "comment": "Malware payload (MacSync)", "value": "1d67c1c1b616031c9943fb391b862bc1b5ff329786c4643c9f83dffb0e84c81d", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036528, "uuid": "6dae6909-8e63-4b8f-8795-3cef937bf15f", "comment": "Malware payload (MacSync)", "value": "13a02a01fed426fad2efb047986e17edb28fe330", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036528, "uuid": "6002f801-59b9-4b80-8196-c1100482ee01", "comment": "Malware payload (MacSync)", "value": "0bc65ebd25d880321f8abbea5521d25113e6c50bc0389f08ecbc6b8fc346e457b4e498511c6d99acfd52aa59ff0db658", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036528, "uuid": "767ffb28-6757-48d5-a59c-0ae3e8e5f2b1", "value": "T18221FBAE8112B919D401111079119C108F45D7F0CC95EE5DA920B3DE54EC3BA853FDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036528, "uuid": "6b0b10a2-b2ad-4713-a397-ebe5a56a2841", "value": "24:Bt2bSfPzDI+VSjm8HL1TEKuflnijQ1SgDbR+QnSh3R6iTpkiJJ3WUz0LqAvBFzBF:qbclSj5r1Tmfl8QHDbpSlw6kAJ3WU0i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036528, "uuid": "6aa7959e-c018-4732-bd1e-25c55a9857fb", "value": 1349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036528, "uuid": "e71f80ff-5477-4d58-ae15-dd54594d4a5d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036528, "uuid": "32aa3c07-a100-4d95-803c-7123b04a7bba", "value": "1d67c1c1b616031c9943fb391b862bc1b5ff329786c4643c9f83dffb0e84c81d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e330b3-5b98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780084447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084447, "uuid": "706c75fb-8a1a-4296-8093-4f8e16fccda8", "comment": "Malware payload (ConnectWise)", "value": "1d7c626e8f7fdb40d9e0ee9edf4c2867", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084447, "uuid": "c7f04160-1e4c-402a-943a-91451e59e640", "comment": "Malware payload (ConnectWise)", "value": "1dcc5db8916745aea784d66f13257d5d349885adef73b6f19f1a080c46abf739", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084447, "uuid": "f606f916-7e86-4021-8265-dbe33dd1c921", "comment": "Malware payload (ConnectWise)", "value": "daceb55a4b9d6700f5716478003c8148c8eeb942", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084447, "uuid": "91d32213-d64c-4d37-96a9-25e2f47af48e", "comment": "Malware payload (ConnectWise)", "value": "48ea84838997a8f4fed4a54724101443e214b67d6d41addecc6b7c0fe2507cb461a289e2eeb595c9dc702ed5995ddbbd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084447, "uuid": "c4e43b7f-b667-489e-8808-4bf9bec5ec32", "value": "T181646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084447, "uuid": "2a5774b0-9531-4293-b358-781dd921fa82", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084447, "uuid": "b611ec17-5318-4ae0-9fa4-e6c790150556", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9I:p1iw7gryNkSV1hy1Z1u2JLu9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084447, "uuid": "d146ec1c-3795-4e28-ab17-1d946abc7c0e", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084447, "uuid": "869d8ab0-1f6b-45e6-9d19-6b03d0e133be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084447, "uuid": "a88c99d5-17d8-4c2d-9987-0c9d9db97214", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81eaab3-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780089093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089093, "uuid": "a679fb6f-58cd-499a-91d3-56cfb4d237e4", "comment": "Malware payload (DDoSAgent)", "value": "aa027e5f7650fcaaeb765cb02443ea60", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089093, "uuid": "fb1d1436-5e2c-4c2e-bb99-aef52d5906ac", "comment": "Malware payload (DDoSAgent)", "value": "1dcf81ea897109ecc977bb512b1b6c1d33fc725d5384554f5e6760e85c73ac5c", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089093, "uuid": "5cbd72bd-d6a7-457e-aa9b-15eceb30a0a9", "comment": "Malware payload (DDoSAgent)", "value": "66950e8449748711f483a89eb3674c4f32875356", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089093, "uuid": "899c2dbb-6144-4902-987d-a10e4e8966a8", "comment": "Malware payload (DDoSAgent)", "value": "66ea93707e6934fc1ad092acb2b9d33f94410d2d10726c351cbf1432ca5df30a0071af16f59283276d7e4ab644ce069f", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089093, "uuid": "d12bde3b-ba78-4291-9b07-abaf302e14ef", "value": "T1858639137A28E71ED61C213018B6DA956B7A1C9A02D7A517B381F70CFAB307D496ECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089093, "uuid": "870c1b95-7aeb-4b0a-881a-6d973122b453", "value": "49152:lrcPEWNpQaKbDjcdsapVU2Q9GX0qOCGTN/QrcAGhCReA5AX+Q1hdKXlbGKqDQ3pe:kD0yogCjFGnIjEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089093, "uuid": "2abb2e81-02ab-43d4-8669-037d3596ebba", "value": 8388801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089093, "uuid": "5d6b3785-14e1-471a-aad2-a68f1fb708f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089093, "uuid": "87bf51a4-957f-4ed8-bbb6-449a152b23d1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c4b4ff-5b5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780058586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058586, "uuid": "7a3b1739-3220-4fb1-ac68-29291e5aa984", "comment": "Malware payload", "value": "32b51caf8174790ff5dc77d434bc43b3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058586, "uuid": "3e0d485f-b6be-43e2-83ce-2afa2407b6bc", "comment": "Malware payload", "value": "1df1a23a24dff84ba55dadcfa90cc3df7f7ace6dde69987d125c07474c8a1388", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058586, "uuid": "36b5c095-dea2-4d95-ad07-c5b3b1c40340", "comment": "Malware payload", "value": "60a92c6c46f39d7389ce0571fcba5640fca0b1a2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058586, "uuid": "283589f4-9f0b-4e14-82dd-7e649ded940e", "comment": "Malware payload", "value": "55a5308b5eed27a76693167bcf028ed3b8062bf383b8db41afd04f1fdae4a8037b4022a55b8f864a826587e14d47f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058586, "uuid": "f7161a78-064e-4c91-a54d-2673d6cc6b44", "value": "T18FA19F35919B4426D2DD023DD8B08F1DBEDD7C45DB6C6A12AD5D044D8DF245E0A25FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058586, "uuid": "d6673103-89fe-4d98-a2b4-250d9e4362b6", "value": "96:h0tPqTFMRKqtmQgHMbFVhhShY5Jmj1sb3BpGyqs3JxJrc8FEC9WYa:0qTFMRKqFgwnhhK8cj1wV9rzdWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058586, "uuid": "bf201b98-d5ac-4ac0-8717-7eff7842635b", "value": 4873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058586, "uuid": "925a4a62-d6bf-4141-8cb3-28b2cd48158c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058586, "uuid": "4b2f3331-c92a-4197-b56e-5c091cc00d25", "value": "photo-422406311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787c6641-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056666, "uuid": "7480e361-c33f-4c59-aa4f-cf235beac8ef", "comment": "Malware payload (BlackMatter)", "value": "f448ba89857e8e173ea821f06f4aa6d3", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056666, "uuid": "6023c0b0-0729-4903-aaf8-5b476a2f508f", "comment": "Malware payload (BlackMatter)", "value": "1e399538c41be1c39566a00c95b78b39186510254e24562ec53a414ad74c23a1", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056666, "uuid": "e0e9a28e-771d-43fb-a22a-55f1f0b8cd44", "comment": "Malware payload (BlackMatter)", "value": "5c5664eb61e44e9fe7ba2e5a8f23fd2e1bc5ff02", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056666, "uuid": "eba0ee03-78a8-476a-aa38-862f8e863eb9", "comment": "Malware payload (BlackMatter)", "value": "a7bc73537bf3e0e98c4aabf772b80e77d9ef1ef0885a748f906197f3a193344ca01b39df70af2163aacd936bb01a6a01", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056666, "uuid": "b15a6eeb-deaa-468c-ad8b-d3af930fa7a9", "value": "T1E0E37E21F212D0B3C87718F13736B5B2F39E8D6C15A96807DAD80F99BCA58232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056666, "uuid": "2f676bc6-6d40-4fed-b359-6457eae45a12", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056666, "uuid": "b39dd07d-fd1b-43a3-aa3f-6d93666eff9a", "value": "3072:26glyuxE4GsUPnliByocWepo7wglcr869H4h9:26gDBGpvEByocWeG7HlcDV4h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056666, "uuid": "33f03086-f744-420a-830f-30e8b26d63ac", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056666, "uuid": "35e9a94f-efb8-4b06-9419-075a3ac149b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056666, "uuid": "9495ee37-bd6e-4e84-88aa-9cbd6c512f05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa6147c-5b03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780020708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020708, "uuid": "fb9fd4cd-a873-44c7-9fa3-6724d8e3755b", "comment": "Malware payload (Mirai)", "value": "2700f17872e2cb99d37e84ed3c5e4523", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020708, "uuid": "7e76e6d1-0feb-4137-b769-cff7e91b5654", "comment": "Malware payload (Mirai)", "value": "1e7d9ae20c8ca6b4e14ce9a92e76fa6db70d45584e1512be8f9e1967c9b7a724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020708, "uuid": "7b20c10e-7c07-4fee-b4d8-8536d4d32bb5", "comment": "Malware payload (Mirai)", "value": "bce006a73bc91c91623b321176b95a2a3ac15162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020708, "uuid": "d978b0e6-9086-4ed7-8ba0-39ae244168bb", "comment": "Malware payload (Mirai)", "value": "7c29adaeacd70f6f6f6792e256191c2f90960a276d78d8944689a1eef28b74f0c594ad0f9b6e1f7c580fb35ba7ddd260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020708, "uuid": "a40ccc2f-9ed0-4d4a-b548-4c88f8fdbf7f", "value": "T19DF3F709AB610FFBE89FCD3B45F92705158C591622A93F76B530D818F64B28F26E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020708, "uuid": "342c323e-68c4-4787-a923-38d9c98746f9", "value": "3072:zaCZvp+U7dmfvV+BB7IXJ36mkhrD/DjgpDClcAO2fV5WeEI:OCaU7dmf9+BB7YV6DhrbDMpDClcAO2YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020708, "uuid": "868f1ae1-f59f-438c-a607-b56df522db15", "value": 172808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020708, "uuid": "09dcdb9d-52dc-45bc-99bd-32e4314eea3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020708, "uuid": "94a7c5c7-8cae-4d69-a38d-c94be9819ad3", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5bb565-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089101, "uuid": "8e61063a-2787-490e-aa23-183e665e6797", "comment": "Malware payload (Mirai)", "value": "d711f312434ec9b31cd5cca40437a1ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089101, "uuid": "df1bc76a-c452-4cad-9470-29b2aaaf1989", "comment": "Malware payload (Mirai)", "value": "1eb3f62d55cf55412c164fa7cd891d40225066d391ea54363de788f29f20d8c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089101, "uuid": "b2e7c456-38f6-404f-a65e-ece59fd14419", "comment": "Malware payload (Mirai)", "value": "493bf9b875cc3c905afb2136f3cd8fa8cbcb738f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089101, "uuid": "034a5726-26ac-4df4-98ce-e127a741ad2e", "comment": "Malware payload (Mirai)", "value": "b5601c8a1ee36baf23c42ca54d012d350ecb90f5769cbef98d51c8bef8a2ae91a31ae91a073898db2dfa21e43b7aff41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089101, "uuid": "f4a2870d-6921-4756-9d64-8e7090e84a69", "value": "T17993F649FD416B00E5D635FAFE4F024973934B6CE3FA7201AA245B3123CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089101, "uuid": "0bce3739-b60b-4941-82a6-aec0efa08296", "value": "1536:iona8VllfZtCYrnkhWvkL3fa8yihhjN9o5Rl8KXsui8f8HTPMOZpYJKmU:osfTFrsWvkL3fa8yihhB2sMf8HTPlT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089101, "uuid": "37d92410-affa-4f3a-9726-09217c604e0a", "value": 94548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089101, "uuid": "8a84966d-b8b2-4e7e-b98d-614f2425a494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089101, "uuid": "0694b029-4a33-44f8-885b-0e3d32de3b8b", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351044fb-5b66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780062996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062996, "uuid": "b71b75b6-4228-4c6e-a477-f9a93c3a4061", "comment": "Malware payload", "value": "c12b822ca17394c3431a1296d6045997", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062996, "uuid": "72f8f8ce-0cc7-408a-b645-f1f63d34b4f3", "comment": "Malware payload", "value": "1edfaca721f86dcc5bd3c43f46b25cb8722c5e76e8775fe8da868ca8017c5d96", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062996, "uuid": "6fef33fd-740d-4b28-afac-f8504444dbdb", "comment": "Malware payload", "value": "60730d2d7a75e67e795e34dafda7c24399e87e2e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062996, "uuid": "cf255cc7-cca0-48cc-a9a9-6d147824459c", "comment": "Malware payload", "value": "1af2484f6572e18b79b8683d82448939e450a4f249c33ece94a664fab4923b6acfaa15694286013a18ba463058de15eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062996, "uuid": "2a379d78-22e0-4923-9ebc-ba975caa30d9", "value": "T143D097DC08206C17813ACA03F18B42D2AB5621C322B0D334706E63327E6F0E0BDC6F00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062996, "uuid": "03d596b9-de65-41dd-a974-4d83a1c74cbb", "value": "6:oe1+TAcP5606BAkSWC70XQCP/v094ajV0UGBHBxLv:oewTjP5Pp9F70ACP/vAej1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062996, "uuid": "24230b4c-9485-4c64-a3ff-2f619a9cd0a5", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062996, "uuid": "64b92d11-414d-4126-8a4f-d163f07c6512", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062996, "uuid": "81435452-0925-4a2f-8601-0a55b9b3ed2f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f39433-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043098, "uuid": "f6ab39f1-ed20-4ee9-bbec-e377e29bc5eb", "comment": "Malware payload (ACRStealer)", "value": "c349ebc3f71a078f097510f7280a91d7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043098, "uuid": "aafaf03c-ca01-4c64-b55f-3b9994db49d4", "comment": "Malware payload (ACRStealer)", "value": "1f921e25dd57750a484fbe2af25db6e5f7a1f977a432acfd54bcee6f58521aea", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043098, "uuid": "cc8ea884-b8fd-4a6a-809d-4bbda8152c6c", "comment": "Malware payload (ACRStealer)", "value": "f8dcd064c350dfda51ba46cc925daa70f985d184", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043098, "uuid": "92254753-43be-44d9-a64d-0f487a699b10", "comment": "Malware payload (ACRStealer)", "value": "a6d1ce486224d906d7ff8d7c10656e1b9678a49f9fbd635de261a30850b2d7a4472698891ad7d4dd6aaaefc21e453ca3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043098, "uuid": "d5f7e5b2-e842-4ea9-88a0-a692654c7ec9", "value": "T187A57B067CC4A1B6D5FA923289B512A2B731FC490B2127C72B55BAB93F373D40E79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043098, "uuid": "f3b4a263-02b0-450d-a26b-742de2c4b80a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043098, "uuid": "c0372069-2cdf-4c6a-a45f-81a00c447711", "value": "49152:8RuYLhvdH31e44PCPV8jDocePK8RIOSgk0f+D1WI:Ah31ACPV8jYb5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043098, "uuid": "159cdd1d-b96f-465a-a6a9-9d113636d310", "value": 2087112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043098, "uuid": "6acee5e4-bccc-46d0-8854-7dfa51811b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043098, "uuid": "ccc18cf6-3da2-42a1-ab62-945743b0a30f", "value": "SecuriteInfo.com.Win64.MalwareX-gen.46492466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f727d368-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037551, "uuid": "61406154-cc02-45b0-8a0a-463d6028489d", "comment": "Malware payload", "value": "b1c902e5da74b3763a6f0255da4865e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037551, "uuid": "ccd2a4f4-4d26-49b0-9307-76f4986f5d21", "comment": "Malware payload", "value": "1fbaf8ab9f90dc7288b2dfa77d12c22452f162046134750036bdafc8d7500bbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037551, "uuid": "3e3df38d-c707-4f3d-931b-dec306ac6c60", "comment": "Malware payload", "value": "f6b23c7e1a833b22bfa93c4d72b93db7e51d131a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037551, "uuid": "9d1e067c-49d3-4f34-bdba-ae19330d4297", "comment": "Malware payload", "value": "f4680b30a7edb29e2eb0a87fe98f00b1a9dfce1f2aa227afe99497f41203560157b7fc7a7015471377728ddb42b80831", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037551, "uuid": "19ded528-1cfd-4a37-aad4-b2b4ef7ff3fd", "value": "T15096DEAB6DDC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037551, "uuid": "64ba7565-da73-4938-a6f6-85ab72ff4666", "value": "6144:nubnYpsco3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsowpNVVwS0msFJvXiESUWjW:4PnJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037551, "uuid": "099dc45b-4a28-4bd1-80d9-f48ded3ecc89", "value": 9015938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037551, "uuid": "52502df8-9d14-497e-b502-920090d9804b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037551, "uuid": "680e3047-41e2-4acd-a96d-e974fcb775ba", "value": "Update_25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8a38a5-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089105, "uuid": "1f3a64e9-150d-4907-b989-a1144ab2d5b2", "comment": "Malware payload (Mirai)", "value": "b075fee9d1bfc2d40c242200eee03d04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089105, "uuid": "c241f2e5-a204-4340-b1a1-737af06989ce", "comment": "Malware payload (Mirai)", "value": "1ffc747ac1100c28eed31f7363886515696caec803f832ab473cb310bab03212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089105, "uuid": "4bb284c7-92f1-4404-b863-57eab90f36fe", "comment": "Malware payload (Mirai)", "value": "3f17e0d499826c78999e3eed589dc91ab7bd4d6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089105, "uuid": "7f8256f4-2e2d-4843-8c0c-34e6a93cde13", "comment": "Malware payload (Mirai)", "value": "f3ea29d5163bb35a81cb3b9e12091db869f15f33bd5174881cc00146bd45cf4ea2df4f354eb0954481a2927db2e6af38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089105, "uuid": "0384c206-fb15-4b9f-a29e-f419cefa2615", "value": "T10CC30549ED41AB01D9D635FEFE4F028973531BACE3FE7101AA245B2523CAA6B0F76105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089105, "uuid": "72403792-3bbc-4bac-b436-8393300f2532", "value": "3072:U/+F5YwgyF3FmlEsD3KanU/tBVl0Glwx3cTfMnTFUUO:9r7F1mltTKan8tBVl0A0cjSTFUUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089105, "uuid": "e907a385-2dbe-4220-b6b5-69c0fd13f0d1", "value": 121812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089105, "uuid": "3912aec5-e0c6-49e0-b856-168c18524cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089105, "uuid": "d1f1bc6a-8977-4f55-85ad-e539ace61dcf", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45ac965-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780089086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089086, "uuid": "17d0c3b0-cad9-45e1-b8d5-af050d5bd25f", "comment": "Malware payload (DDoSAgent)", "value": "8f06e0262e9af4ea6a1ce47f1172e9c4", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089086, "uuid": "27918ec8-d54a-46a9-b059-ed6c4e6c3fa2", "comment": "Malware payload (DDoSAgent)", "value": "202e85a567296cd7048d515f022479b447e2b65448e0e9e1bb6e4eac5ae7ec91", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089086, "uuid": "3a9b909c-d575-4722-a019-baf2f6045d95", "comment": "Malware payload (DDoSAgent)", "value": "ee5f924935ad6b1ed323b667adf74f299f9919ac", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089086, "uuid": "5302983f-d222-40a9-82a1-0877a4e0140c", "comment": "Malware payload (DDoSAgent)", "value": "8bf3c015f18bf556e1da9f979e033a5ab4ffc57eecd5694b2477951365fa2a7f271b82bfc47a4608ddfdc43f157c5a4a", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089086, "uuid": "3f41ecfa-dfdb-421f-bb65-609e721d8f61", "value": "T132860805ADC53BF6C82D4E3485EACA9603705E140AF2466A2664FE69BC772387F57CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089086, "uuid": "f815bfef-8098-4724-bd49-0e26c49b4e34", "value": "98304:LnT9itCYYcjCmpJxBtGJGIPPOt75elbxO0Rl+8ncmGvyGgV4xl55XEkq:Ln3YYcjCmpJWkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089086, "uuid": "53b6f367-01fe-4a06-9c20-7fcc4fa47fd7", "value": 8388801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089086, "uuid": "07bc9a12-f87d-4288-90bf-5bb3d5d8d414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089086, "uuid": "10fe462c-c441-4c9a-867b-8e620e309dbe", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbde2e13-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089099, "uuid": "40c24144-5caf-4e93-9212-a111adc93a71", "comment": "Malware payload (Mirai)", "value": "7c761b23f0ff6a3a71091d5efe19f46d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089099, "uuid": "99789a10-80a0-412d-88b4-1eb1a2b0e559", "comment": "Malware payload (Mirai)", "value": "20727a163bcbe6aca6dfdde726d7049df53a93d08d238aec93266e1ef11d9206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089099, "uuid": "f216753f-bdf7-421f-ab06-a83aefa05e17", "comment": "Malware payload (Mirai)", "value": "878315052cd01f10c29a15d18c3e1298677c4907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089099, "uuid": "fde06838-d547-452f-9f9f-39193c7b0648", "comment": "Malware payload (Mirai)", "value": "ddf06b7b2c51afd729bf9e17ca5cda41c7b0426a69452ca43f1ff1c545d73ff3b5188ef19fa59098006b3a6a5ef00aef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089099, "uuid": "3dcce9f0-54c5-4444-a441-5a1a58b8a58b", "value": "T115D31956F8819B11D5D151BAFE0E124E77131B3CE2DE7302AD24AB707B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089099, "uuid": "30ccfd0d-d205-4053-80ad-4ce54c59b270", "value": "1536:1rn7mWCfYxSSbe7mxXy6tOoLaXTHkt2XiZB6Gka3eEV8Mt7kA5io3ms0m0/VU+os:1CYzbAcXW8ayB6Gka3eEV82QA4o3W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089099, "uuid": "fbc56a07-ae9c-4d75-80a6-9f5d54fedb2e", "value": 130108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089099, "uuid": "d119cacb-3584-4763-9c8d-4c74f20c79ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089099, "uuid": "724ab3a4-e4da-4e14-bfca-796e94847c3d", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a4ff7e-5b98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780084448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "7b94e808-abb5-41e5-93f7-a1b6c31fe4d1", "comment": "Malware payload", "value": "d09965901727f4c42eba30652c0a8477", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "95ccf2d4-2089-4370-b37e-932b17c7cdec", "comment": "Malware payload", "value": "20bb05c56b9b8bc52677949a41b0c0371efb032e25eb27ae026b1d8f1330563b", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "09a26892-07e8-4dfc-9021-99dcde5fc256", "comment": "Malware payload", "value": "1544d9e4518fae7969ade713f7212316d2b9211e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "55d29036-91e4-4163-9716-97e01165ddcc", "comment": "Malware payload", "value": "1d359ad46ee5d2cd0c72c1505f8770a4b988ce018d18a1d7cf9ae9e88875f5b7c26d572e212ab4852a6b4528995a6ca9", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "6be1c79c-afe1-43fe-814d-d550cee66860", "value": "T10946E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "c1632daf-3306-4d59-94d4-a340ac1f85f3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "51e332cd-70d9-488e-bb5b-53311c43f319", "value": "98304:NzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:NhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084448, "uuid": "ebdcfc6d-16b7-409d-91e0-71613a421a7d", "value": 5642240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084448, "uuid": "ebac74bf-0ff5-4b01-9ebc-1092b3a7ab3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "4dae1b5e-f162-479d-a0b5-23f8fbcc84df", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21cd7b0-5b53-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780055125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055125, "uuid": "52815617-5b13-4f65-89b9-a62795d188ff", "comment": "Malware payload (LummaStealer)", "value": "c937c31e11e61fcd3f7d5cfdf0933dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055125, "uuid": "401292d8-c0a8-47e4-ba9d-a0926798fd68", "comment": "Malware payload (LummaStealer)", "value": "2120b8b7bf98e214fc99cb7c373382d0a04c3e3207a080c72876d4ba75e9943d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055125, "uuid": "2067c5cb-c876-47ea-8034-afca412e0941", "comment": "Malware payload (LummaStealer)", "value": "604d9a1c2de90dbf6d5e72eb1c74ba1e88080f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055125, "uuid": "11b17806-3ead-4c62-ad8b-0df0f4399c5c", "comment": "Malware payload (LummaStealer)", "value": "93110b1ae5d3f0cce998cfa21797a6a254dae07ea71a62af6abae320e57db861def9c326dd47ea10884a19d07e53637e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055125, "uuid": "5699c8f8-497c-4b50-8688-f6389df529b9", "value": "T135F57C10FC8745F2E406533649AB63AF23359C090B36DB97EA447ABDF9B72D5093630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055125, "uuid": "8b5ab61d-0aee-4a38-b5a4-32c16f147273", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055125, "uuid": "5c18e34c-d6f6-4117-8612-c2ef6e56ed60", "value": "49152:DYX6YN6omG12LbG2lZL6YLiEpRf2Rbs5cWAVJ:8v6o92bG6LHLLz5TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055125, "uuid": "77004a8e-5cc6-40cd-b55b-1355a765273b", "value": 3509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055125, "uuid": "44bd5ff6-14a9-44d1-bc25-786586786bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055125, "uuid": "e37c40e0-73ca-494f-a975-23d620aceb4b", "value": "SecuriteInfo.com.Win32.Evo-gen.84353985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ccd76b-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037527, "uuid": "10ece318-8e87-4ec2-9ec0-ce7ca570b147", "comment": "Malware payload", "value": "31950b064d1b114ca01a1b951727a430", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037527, "uuid": "32c93283-3a07-48db-ad71-e54f9948adbc", "comment": "Malware payload", "value": "2274d74fcc2ad81b9c41c4ca578be6f252a34aaa858020bdaa07eb34e2cd196b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037527, "uuid": "9a8a362f-1c54-407d-a634-27f01bca0682", "comment": "Malware payload", "value": "fee110153f6efa34484c320d462f3fe850254e66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037527, "uuid": "07913492-7926-47d1-b1b9-a30288834772", "comment": "Malware payload", "value": "d514401603796e0c267e82ab31ebd79ed7ac06b7b05b39d56ad44afb87bdaa25a18ac4305c2dcb28cba310099c13247c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037527, "uuid": "fa866ca9-f168-49f6-aba6-5032a83ecf2e", "value": "T13196DFAB6DEC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AF649AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037527, "uuid": "04c8bc16-fccd-40c9-93b8-aed370564b58", "value": "6144:PubnYpscA3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfcl9wpNAVwS0msFJvXiESUWE:gPskO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037527, "uuid": "49fcccf2-2ed9-4b62-b3dd-49198abaaa5e", "value": 9283780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037527, "uuid": "c52df07f-7e36-48e2-adeb-5ef0f032f845", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037527, "uuid": "fda0c34c-444a-4bb4-a7bc-60f940d748dc", "value": "Update_11.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f36b80-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780037231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037231, "uuid": "1e827376-6391-479c-9b04-df1a7029a128", "comment": "Malware payload (Mirai)", "value": "5403973d364c27a702caa9ae47ebbaf3", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037231, "uuid": "15a4e2e7-e8e2-4ec1-946c-d3651c435395", "comment": "Malware payload (Mirai)", "value": "22f8dc41d52f6fa43005fcd8928f108ed2222240f28708c902680499eef71993", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037231, "uuid": "85853243-516d-4278-88d4-7dae59694852", "comment": "Malware payload (Mirai)", "value": "aa2f702281cd38f2d20de353bced6c268f9e49d3", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037231, "uuid": "10cd5863-0889-46d4-a92b-198ad74de1d9", "comment": "Malware payload (Mirai)", "value": "097f6b4195e45f37b133e6df5128793750217625c4892994e93205842e0861689e75ed85426b7b4baa39ed7017cc0908", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037231, "uuid": "7fe7c963-403c-43b9-9639-5d5cb68089ca", "value": "T1CFE3875E6E228F6EF678873147F74A20976D23D623E1D684E2ACC1141F6038E545FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037231, "uuid": "e904ee63-dc08-400b-8e26-cbb1d33ed837", "value": "1536:p+5TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4Vxsd:pWlybKpzEOfGQ+vEubTt4ouftL44d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037231, "uuid": "c3153746-83d5-4a78-81e6-000100d6d59a", "value": 153327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037231, "uuid": "8375a9f7-8b7d-48e1-85e3-22ba623f0c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037231, "uuid": "4d0621ad-7021-47f4-8225-d5e36a37a8d6", "value": "22f8dc41d52f6fa43005fcd8928f108ed2222240f28708c902680499eef71993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6290b0-5b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019629, "uuid": "6f4dbedf-a419-4724-9004-2938c1a1b3f5", "comment": "Malware payload (Mirai)", "value": "da6dfd38f3dccf360d329a78c39d907a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019629, "uuid": "ee376e30-ede6-4a3c-8a6a-02604c2317a3", "comment": "Malware payload (Mirai)", "value": "254b1ee932b3e597d18492c1837fd45878d1880c3e9e4600a52c329f68a4bf1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019629, "uuid": "f86e79a4-4e1c-47cb-bb6c-10f8247d491e", "comment": "Malware payload (Mirai)", "value": "771195d3abd611ca7d00cbe396bf53564475bee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019629, "uuid": "fb90c072-0eec-4bca-8a50-4eebf796e74f", "comment": "Malware payload (Mirai)", "value": "4b70b163addf62c3f085cc9b98dc8944998bb88c0fffcb915194a41760920e7446e4b3ddf216925e9eb7124b99dee7c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019629, "uuid": "371c0d5f-df6a-464b-bb4b-a4891bdd4b57", "value": "T14E835CCDB401CD3DFD0BA5F9552B0E0AF912A38192830F27A67BFDA37D621995C4AC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019629, "uuid": "21f211b0-ba38-4575-813d-34673a761623", "value": "1536:IkbJKyk/n7Mf+OyxjKaZ7xtNCo8fJ3LugMvB/GW3uK:IOi7Mf/Iec7XoLspuWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019629, "uuid": "7cf48ed7-32ae-42ee-918e-3e22789d9cd5", "value": 81812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019629, "uuid": "afcf9211-6fa0-491f-8844-c523c297e0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019629, "uuid": "08996b2b-da9f-4d28-92f5-56bd68b76fba", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7a4e21-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037557, "uuid": "ecb86e54-af20-43e0-b42c-e23b70daffbe", "comment": "Malware payload", "value": "d55b64463219f15aae0a17bef80ffb37", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037557, "uuid": "13e9633e-eb41-4b00-b900-bb4a62074a34", "comment": "Malware payload", "value": "26155786a8e0ff9745f18589d31cce9be1f5af922ca0840532b0d1ab0e9db675", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037557, "uuid": "e9d7ab9a-c1fd-4464-a5c5-8e57f3e6f7a1", "comment": "Malware payload", "value": "1a3eb2f4e6af8a441ee9f8c670cbb0e5cc5e84a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037557, "uuid": "b2a09110-a79f-431e-9931-5add0a7e88cf", "comment": "Malware payload", "value": "ad0fa7ada816bd05fc0bb3de175ce891a6f620c7925ec738bbeb1c137903716c432da178977291f82c29247c4a02dee7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037557, "uuid": "1457ff17-9e7b-4a36-ac50-fc89ef6b4d53", "value": "T15D76EE6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037557, "uuid": "337d9031-7204-4c69-b40f-654abb4b86e7", "value": "6144:XubnYpsc03SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfZr9wpNLVwS0msFJvXiESUWN:EPBie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037557, "uuid": "831528c9-2b8e-439c-baa8-cd1a709a20b9", "value": 7466720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037557, "uuid": "48e131f6-8053-49a8-a773-f3ca5c2b1f84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037557, "uuid": "00a1a00d-1bc0-47ea-87f7-9dd0f8df4fc4", "value": "Update_16.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb105e56-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "6e2267e3-fb1e-46b7-83f4-f1f3c8026f3a", "comment": "Malware payload", "value": "6d7b63ed7232ce1d8315b77464b22e6e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "22c628d8-9e7b-41a0-bccd-256c1fa59298", "comment": "Malware payload", "value": "267af906d23ef006f8569ac3896443088b2a53bf091ca956d860e0c5d9b59263", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "c855a390-5697-413a-914b-c2c1f7c4fce3", "comment": "Malware payload", "value": "1c55fc1fa66de98f1cadcaf06021c2ed0b0bd5b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "f5486634-e9bd-46a7-8f25-cf00f285db53", "comment": "Malware payload", "value": "d593fdc89b98db2d450078d059cb3d259d1bda7ee6775b0968c5a0fb254f6e7742edeb0563c8cca90ff8142571b0a6bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "e5463ace-7973-4bb9-9539-e3cb1b672df0", "value": "T106762A97B8924942C4E43637BCBE81C432630EBA9BC7165B6D15EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "04096a4b-1e18-426b-b9dc-8cfe55aad8d2", "value": "49152:lhv+w28vl/yyh6UBFd9ajhI5vSI0+qknB0ZSqP4GFsbmyWkduj5El:Hf/yyhHHd9ajhI5vQ4GFsKVVEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047436, "uuid": "cab4b7f8-3144-4b26-b5ce-12fa4e5d4a73", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047436, "uuid": "2833c3b1-51ed-4387-a377-3eca8f52d6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "c9ee22b9-9fea-4cfd-936c-4d73d2188325", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2407f669-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073704, "uuid": "f680e876-9342-4189-a060-6a75b85b8604", "comment": "Malware payload", "value": "f145478b045ce566ca44f03ed26922e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073704, "uuid": "8c1cc8ba-f3e0-431d-8219-4fb1c0db375f", "comment": "Malware payload", "value": "28891a8ec3127e0dd006f57b810d0b52b2fe8c8bceac21959b399a9c3d042d33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073704, "uuid": "204407be-e25c-470b-a574-7734fb4e9b88", "comment": "Malware payload", "value": "3a271ca75bf4ab80518e0467792386b2120a6243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073704, "uuid": "06bf2d83-235c-4f30-93cd-59150356e39a", "comment": "Malware payload", "value": "1e74e5dbb7ab800fc411392378009602a3c205d5eff071e5bac395ca109e669cfd2e6e1a7706b81880d46d815d3d1aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073704, "uuid": "cb558906-1c4e-4c64-89a7-0963ebca669b", "value": "T13AD34B1BB5C090FDC8E9C1784BEAF126D933B4295134B21E27D4AE222F9DF206F5D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073704, "uuid": "53da2a7f-0d10-4481-9940-1ae1f702e347", "value": "3072:iGdFFohEplO/N1B1k/niwRmv16LzfxIE54:Bp+zZgja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073704, "uuid": "135911ff-ba2a-4f70-9654-bacb390df8c8", "value": 135048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073704, "uuid": "ecad25ba-d56b-479a-9107-d5abff36adf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073704, "uuid": "5ed03cb5-a6be-4dac-a8ed-c06581c0841f", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a062c2cd-5b5a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780058022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058022, "uuid": "03df03d3-6a92-4347-b881-4c22a7ffff70", "comment": "Malware payload (RemcosRAT)", "value": "aff6032b73e56cfc54e1ad88592c4855", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058022, "uuid": "2bb4764f-8bc0-4264-bb23-5a640e4f81f4", "comment": "Malware payload (RemcosRAT)", "value": "2a479ad231ed4f0617a8c4f3bee51c3e6705fb5f97f271215a87bd5e662939d0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058022, "uuid": "89b64e51-01c9-4545-89fd-e9bfad481b1c", "comment": "Malware payload (RemcosRAT)", "value": "0eb920fa005050554d1d21466d61afc05a6a2d85", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058022, "uuid": "f767e8ba-e993-458f-a752-3d5e63438646", "comment": "Malware payload (RemcosRAT)", "value": "6ab7cf545390a9bde25dbf722432f583f3d591af0af78dffd1f44360137a2deb27f241a63f6a4bf4cea3c571e371ebbd", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058022, "uuid": "89cececd-12ba-4509-9b5d-4b6993b2af8a", "value": "T1E66302E87321E757BD286633EF0910E1124CDA2D83F2279D3DE79643CE8C6A464B9364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058022, "uuid": "3dc89e95-bce6-4d15-9099-fb2f90c96901", "value": "1536:tqZvQ9SMCzr2FZp9nUDaMItwxk2zV0T4TGe4KJZtmr1mG/:t6vWY2DrUWmq2EcV/43/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058022, "uuid": "a1516269-7e83-44c1-b697-f56ac67ad361", "value": 71371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058022, "uuid": "300a5a8e-c234-4d4d-aacf-b094bb706111", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058022, "uuid": "6b7ab3ac-5d49-4fe5-9fb6-c7db5b79c55e", "value": "FACTURA_202602749.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecca59e-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055818, "uuid": "53131a78-eead-459e-a612-ad91485ac5c4", "comment": "Malware payload (BlackMatter)", "value": "d0b2580f12479f9f826804b73af9d544", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055818, "uuid": "996c5533-a1bc-42fb-bdab-388971f6d85b", "comment": "Malware payload (BlackMatter)", "value": "2ac8295381ebafbe6399707f5435409e859c7c08bf51c666db4438ea5e4a4abb", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055818, "uuid": "1eca7717-5f4f-4d0d-8cd9-4a3e56f965a3", "comment": "Malware payload (BlackMatter)", "value": "134e5d42b4f6fa86d6ec87dcb586ba933d6f19ff", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055818, "uuid": "c9308809-1a59-4112-9e07-d460a8569855", "comment": "Malware payload (BlackMatter)", "value": "d9ec2c38d4d0f76f2894f84751a57ba246bd68ad3a4ef65143e9e93423685ef52baa290294ec21d8d38ac64821be700b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055818, "uuid": "1d9d25df-dc1a-4222-972d-f07e831ff6bd", "value": "T1F4E37D21B212D0B3C8771CF13736B572F39E8E2C19A56817EAD80F59BCA48236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055818, "uuid": "6ad58fc3-6a3f-4866-bd83-24b793b9dedd", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055818, "uuid": "538bea5a-ea28-4af7-8ac3-6ce125307440", "value": "3072:g6glyuxE4GsUPnliByocWepPKcWoyZzAeH:g6gDBGpvEByocWeVPazJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055818, "uuid": "c22dca41-d196-4f69-82e9-94555ba3e58f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055818, "uuid": "99ababf5-df36-4748-b605-259b43bb37f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055818, "uuid": "c895ddb0-4d44-4901-ae91-6e238f5b3508", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697f072d-5b11-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780026576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026576, "uuid": "2414ee74-26fc-48b0-ae8b-462c142cc7bb", "comment": "Malware payload (Mirai)", "value": "bfb9cfe2c02361dd1354cc5672226350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026576, "uuid": "a0eab116-22b0-444b-986d-be7e04825773", "comment": "Malware payload (Mirai)", "value": "2b38bbb299bb43147a122f896e4e4876ea8b40c453110954961019681fef915a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026576, "uuid": "afbd3e3e-5344-480a-8e20-c717a78ce79e", "comment": "Malware payload (Mirai)", "value": "ccbf700199da238c54a6ecd67b471a86d3dc0add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026576, "uuid": "ee07205f-3ff1-493e-9272-7e4af7e7e8dc", "comment": "Malware payload (Mirai)", "value": "7585d6eeb975f36cbc9004aa4a0a01747af2318d078559e0e11f312ca7ce1f617baffc0e85276427fe28b8611953ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026576, "uuid": "361cdbd6-8329-45ca-bd46-6cc045d9fb83", "value": "T1D8D38D22E9391A27C5E4947711F31331F0F3438A24B89A1EBDB10E8DBF1979026677B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026576, "uuid": "61c63bae-74cb-459b-aa6f-6653db2e3c63", "value": "1536:UgRtkTLrLwRBNU32vX/akHZXe4h8AvlGE/mDk2cFDjtDWYm5J7QQ9+tbE6T36oSe:52oBNYSOE3FnZWYOJKSS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780026576, "uuid": "4e283e53-1400-485b-9278-f083d323d2b1", "value": 135544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780026576, "uuid": "f4a62e8b-9512-46b0-9960-1fc98aa6ad27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026576, "uuid": "84dc0c85-4a8a-4577-99c5-a56e3784346e", "value": "023782pler.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013ad25-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043096, "uuid": "acd40e65-4044-4457-b2bf-808c8f2d6ed4", "comment": "Malware payload (ACRStealer)", "value": "a3a4a88fe857be030747fe0a93cf93ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043096, "uuid": "b7208bc5-0406-4d9e-b328-5d5869b1f5b4", "comment": "Malware payload (ACRStealer)", "value": "2b6c218882ae32b7d10705fa62423e650bcae27b681875c24cad87f4d9faf2a0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043096, "uuid": "8106a3f6-da21-4f48-95a5-c6caf80d25e0", "comment": "Malware payload (ACRStealer)", "value": "5ec224f80e050dd28bcd04ada71c19306ee0f117", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043096, "uuid": "85903ad6-abdc-493d-ad60-dbfa07e815f0", "comment": "Malware payload (ACRStealer)", "value": "83c8d4a520d923b77a5739163873289bf8164636fd10af4ccdc03c6d75e65bfde7206d808e0e246d53e08e3d50b2dd82", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043096, "uuid": "c5fffae3-bf31-41ef-acd8-939bd46765b2", "value": "T10B266B03ACA148E9C5A9A33989A356527B34BC491F3263D72E60B3B83F77BD05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043096, "uuid": "49c0c204-caef-4eff-9383-9d64274a68a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043096, "uuid": "169aa9f9-78a8-475a-bcc1-fe15dc823772", "value": "49152:ii/iNWYm3hn5yQbDkx08uKcXGZmofib3/FEN0GX8xvhwJS9dv0Zej:im1vjXCbuaI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043096, "uuid": "58d16d53-012b-4a2f-99cf-e3d30d7895db", "value": 4835456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043096, "uuid": "87ff7e0a-f679-4c0d-a554-9119102107ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043096, "uuid": "c52b8638-8bee-45b8-8352-8e77e4a7e828", "value": "SecuriteInfo.com.Win64.Evo-gen.75265442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10df1cdc-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037594, "uuid": "075ed3e7-413a-4643-b324-423e8b707a1f", "comment": "Malware payload", "value": "ea8df00027c611ad155a06e19ffc73a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037594, "uuid": "e3fd88cb-4076-44d8-a2de-5d3301305d0c", "comment": "Malware payload", "value": "2c86df65c4976ae885860d5c8568d545d47e50989e4008f34cb486b0f0eeb327", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037594, "uuid": "d80e5b89-839b-46fc-b7e5-110aa9a0e815", "comment": "Malware payload", "value": "358ac7b73a92998530e370f72f49d53e3f717763", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037594, "uuid": "ad0e76ec-f510-4d56-bcd4-69e3ddea2fc4", "comment": "Malware payload", "value": "8df0380d317de2e88e600acdfe14cd104cc7292e47e66a5b6dadc0ca6347fac17ac9e4a6eb2248a868fb3652eaf87b5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037594, "uuid": "ab39c1e0-f88b-4c68-81d2-f32e3757ec24", "value": "T17286DDAB6DDC361E3010B1C6F48521F5E6621336DBDE12D9B8F928337AF649AC02D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037594, "uuid": "775327cc-6277-4214-a5fd-7babc5468c61", "value": "6144:1ubnYpscw3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mf7V9wpNVVwS0msFJvXiESUWj:2P3iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037594, "uuid": "e2c92775-c689-468d-994c-6b2a2e795fec", "value": 8456411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037594, "uuid": "3836b25f-b8ae-4d3f-83a8-10388f535f1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037594, "uuid": "7e822ce8-7eae-4d5f-a4dd-719758f46adb", "value": "Update_12.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647843ac-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038594, "uuid": "7bc3038d-2ee6-4cdb-877f-cae7134a445f", "comment": "Malware payload (Mirai)", "value": "54f49151580d4cbb03f8fd7b41746310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038594, "uuid": "56732b62-7224-4e86-aa7e-d226a24a16d7", "comment": "Malware payload (Mirai)", "value": "2c98e168d95f26e4c9ddf25ada6778f8a36be1dee67abe4d4aa4d8ca4d6f1807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038594, "uuid": "bbcb7ba9-a6f1-492a-9927-bd43f53fd56b", "comment": "Malware payload (Mirai)", "value": "6e95ebd9730bb95c44ec83802076300640506637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038594, "uuid": "198df17e-9275-4a40-8588-94bb5937d804", "comment": "Malware payload (Mirai)", "value": "d10d6c713f96176fc406667a686babb50b1ab4196cdd1e93f3ca3ecc71b06b90c5956dc54af99d01f61b761664c11d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038594, "uuid": "0126a3f9-5bf4-43c5-8668-c17dca1ccd0d", "value": "T12492CF6EA46090D4D6605837E6FDCDC7A6BA0FFDE3E830711769966CF26224033B904E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038594, "uuid": "fd521a33-7ddf-4e06-ba17-04d2c311b28a", "value": "384:A3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWfxVhymdGUop5htM:wCmyqM7zLnmZQLh+IWfdzFG/QPvs3Uo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038594, "uuid": "9d948515-435f-471a-8f82-adb006c83435", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038594, "uuid": "9382e05d-982c-410f-8747-b6788f0f2e12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038594, "uuid": "dc18ed8e-bd42-4b1c-809a-3aa1488023d9", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a691a700-5b21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780033551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033551, "uuid": "b0af4880-7108-41d4-ad7a-351cffd1258f", "comment": "Malware payload", "value": "4c122a63ce31fd557a8bca9568c415f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033551, "uuid": "c15f0440-485d-4c68-9e0a-bf673287a6ea", "comment": "Malware payload", "value": "2d43717af3a2ab65e79f0bd1c97242e4c2f1823059b28fdaa0f1821012dcd926", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033551, "uuid": "b8af41f8-e9dc-4af4-88d4-a547f2058cbb", "comment": "Malware payload", "value": "3c32a049a80db228ae10a7690bd51ce463bc8cdb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033551, "uuid": "0e88d1cb-63fa-4e26-a66e-5b7e47308f87", "comment": "Malware payload", "value": "45380f45460e7adc8fd5b86f1da10b7ed59b14f9d107ceff6f1e3cc81af85d5b2a888ce7050fa23fc5ffc34e2993b0f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033551, "uuid": "f88ba5f1-ff25-483b-8548-636ccb6e5119", "value": "T1CA666B56FC1C6462C6CAB9702F3653943739BC499F82D7632614BB7CBEF23548B22261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033551, "uuid": "e1e69080-1269-4f3a-b165-a7d1696ca8d7", "value": "49152:jS6/LbPdLVorVlC0klQuGAvJovacrNh4KPVQfT+oiWREE5E9gr9DYO:jSGLbPdmC0SQYya0hDfOEmr9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033551, "uuid": "ebb82a23-187e-4077-bdb8-a74d23b80aa5", "value": 7060498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033551, "uuid": "d82dc4a4-9b22-4d76-9a7e-d5cdaeb60ab1", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033551, "uuid": "a64255a3-7ff2-4442-82ae-48a4ea334770", "value": "u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7236a003-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056656, "uuid": "dc3c448e-503e-4ecc-9b20-e72ca9f2478d", "comment": "Malware payload (BlackMatter)", "value": "90f10623c08e19324e6fce66ae11df18", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056656, "uuid": "b0b3b412-1990-474f-b916-23660138c36f", "comment": "Malware payload (BlackMatter)", "value": "2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056656, "uuid": "4f331136-e2aa-4aa5-9d75-0e6a93c85927", "comment": "Malware payload (BlackMatter)", "value": "af81578b624eca0379af79221841ae2de7485905", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056656, "uuid": "4d09ebd9-3dee-4e39-8054-92815764f7ac", "comment": "Malware payload (BlackMatter)", "value": "9c93cfda25c49b6a6713b7750ecf8a50b142fcfa7063ba19c050485f683a87f75498009ff5c91ed33c68428e3e76a5c5", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056656, "uuid": "c8965637-11b7-4b72-9b69-f61b92adcfc8", "value": "T187E37D21F213D0B3C83718F13736B572B39E8E6C19996947EAD80F59BCA58232F15993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056656, "uuid": "f10635b2-88c0-4ab7-bcd4-f63d053eee8a", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056656, "uuid": "f0f604b9-480a-43af-9697-ce6da1c2ebc6", "value": "3072:M6glyuxE4GsUPnliByocWephIid7rXg0Tb5oZw3:M6gDBGpvEByocWeThJrwsqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056656, "uuid": "b9c8302a-d3c9-470f-80ab-c004fb556041", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056656, "uuid": "8e9646d9-bfad-4f6f-b20e-a28e7c6bd2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056656, "uuid": "4b517304-3f45-48fb-8384-0b99224707f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ebc429-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780092870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092870, "uuid": "4492567f-a7f4-4831-8d8f-2e9f86c34452", "comment": "Malware payload (Gafgyt)", "value": "2a36efafb554bc1b7a2f814ac4edc272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092870, "uuid": "f60b10b2-8546-47fc-9063-1806dece5840", "comment": "Malware payload (Gafgyt)", "value": "2e5638a7e7cf968a83fa2e1eeed603f22c341178ef809b7148c64bb96f91fd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092870, "uuid": "09693a96-71ec-42d2-8e87-97854d727d4d", "comment": "Malware payload (Gafgyt)", "value": "50482f981a69369f823dfa09a2dd345eebbf0709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092870, "uuid": "21d0c3ec-93ff-444a-acc1-eb25e8b44a9a", "comment": "Malware payload (Gafgyt)", "value": "9d249a7930ac415bddba7d618641d05f4887fbe6b81ccd2687152dba07049fe69b285c3a25b6c025507715b824a87da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092870, "uuid": "c93aaafa-5cc1-4a7a-b9d6-670362cef242", "value": "T1DA922AC5BD44D912C6C4467AFA0E868C3B226398E1CE33436E177F52678686F0E3F555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092870, "uuid": "b7683ab4-4b73-4c69-9b66-7bc33145fc3f", "value": "384:zy7GSkuYDDD9xNllLwEl29QamCNQ2njl01EQTvu/Fx4es:zy7vkuq9x/lLn3FCNQ2nh9YvuAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092870, "uuid": "d3a7c4d5-d922-4ffb-8dd8-066fcea8f9c3", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092870, "uuid": "2c339e4f-ac8c-447e-9838-507072fc6db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092870, "uuid": "68712423-fe12-465e-926b-75a120ef92af", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6929155-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780057603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057603, "uuid": "7c74ac64-9ab5-47a3-a576-211e320b821f", "comment": "Malware payload (ACRStealer)", "value": "0582eed82bd977ac598f2d1cf45ddb62", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057603, "uuid": "3b74d245-be2b-4b4d-baef-309bccd310c3", "comment": "Malware payload (ACRStealer)", "value": "2f04e1e48d9db645118b69c7d55dfe2b3a21a12f7ecd70bcb26840b73557784d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057603, "uuid": "9271f18e-6578-4bb4-92f0-94027c2206b5", "comment": "Malware payload (ACRStealer)", "value": "548ea3b1014b971c7f8d294b0b944a8d28c1dd6e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057603, "uuid": "f932fb29-e765-4715-b8a4-692de46abff6", "comment": "Malware payload (ACRStealer)", "value": "66a926455bbf49278d7cc80267017250e764782c19e698e86518e80631b5a8a32c22d355b22e48d7eb13c56a68765b71", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057603, "uuid": "9ed69057-ea39-4573-9716-329b4ba26102", "value": "T17FF57D4B7CE049EAD0AA633289E352817B75FC590F3223D72E90B6782FB26E45C75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057603, "uuid": "6ac74982-643f-42d5-ad37-153f329158ca", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057603, "uuid": "744355b5-bec9-4c53-b39a-157383b437ad", "value": "24576:U2tkKWDOhHnN6JvOStyz/Dw9PMV7YH31rglMgrSBH/nBele7tK2tbQQMlrTB:U26KyOb6Jv/uEUargllrSXXM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057603, "uuid": "1df0fb01-6305-4d21-917c-a62e70e92311", "value": 3361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057603, "uuid": "87ba0582-852e-46a1-82ec-e1c8f57c757a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057603, "uuid": "d2ebd6e6-65a6-43ac-8458-04c52701fde6", "value": "SecuriteInfo.com.Win64.MalwareX-gen.82596579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893719bc-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780058842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058842, "uuid": "1cc9f6c4-6957-474d-b289-91f63a2e5fde", "comment": "Malware payload", "value": "b5cc7edcebd0fa94478a4216481014da", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058842, "uuid": "8bf1aca8-9dde-44f6-a4c8-c8c78e5d00f4", "comment": "Malware payload", "value": "2f579f4f37cc12910e5142645a136ed79d60f2ad8313a89be84ebe7dbdcbe552", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058842, "uuid": "5ce92d1c-5ad4-4eb5-85e7-290ab025a8c2", "comment": "Malware payload", "value": "3adb168881e91b4f05c9c01e9557f7a1bee77ddc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058842, "uuid": "f54b360c-bdf6-488d-824a-7be682ce836b", "comment": "Malware payload", "value": "51510a95ff65cb092cf5678d0d009eef4b544fbf1807b446e4f8f420b7b84da5a23e93e759a75c9d34161856509100f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058842, "uuid": "660dd933-32c3-445a-9c3d-50ae4df21992", "value": "T12471C90293A44055D197F770028DA653BAF6768F1C7552217B2CDEEA4EF315B89A0A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058842, "uuid": "f5445b2c-e90e-41e2-94d1-ae3b5271a04f", "value": "96:7seAjdA7hl2XtXNAjdA7hl2XtXSb9AjdA7hl2XtXfsgjbf:wmDKtXnDKtXSDDKtXEgjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058842, "uuid": "e01ec88c-315e-498b-86b3-15cc43a32ab5", "value": 3536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058842, "uuid": "def12673-1ba1-4069-8720-5ec1a12297ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058842, "uuid": "647a98fd-0eea-4296-becc-e8454551a9ce", "value": "\u0414\u043e\u0433\u043e\u0432\u043e\u0440 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u2116\u041a\u0423411-268 \u043e\u0442 23.05.2026.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e928cd9-5b94-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780082715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082715, "uuid": "bd9a6620-39fd-42b4-ad04-0cddd721065e", "comment": "Malware payload", "value": "0281c3d124426b6bfcbb8a63ac68aac9", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082715, "uuid": "6e095365-da45-4e05-a5fd-21a70347a184", "comment": "Malware payload", "value": "2f6435c735dc6361121d8b675cc954e42dc53dd9eb64029bfee9f53d3853073f", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082715, "uuid": "2624fc0c-6f6f-484f-8a9e-f26ca55059b0", "comment": "Malware payload", "value": "434f3378f2432160b3e53226acfefe15d0bfe167", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780082715, "uuid": "eebc6b95-64e0-4fae-98c1-42f51dc26ee6", "comment": "Malware payload", "value": "6dd45560053f7be236b7228f742ea0d64bac4b68011e996edd2f367233b436b4fc02b79540bf32df5bfd33e5020ec45d", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082715, "uuid": "a4c90015-8502-4c62-a6d2-c986ed7f6c77", "value": "T122C6DFEB293F00D6C9A504BD0DD96F558C5EBE60023BE43E9A673AFA46010A75CED137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082715, "uuid": "5774542b-1c6f-4c4d-a2db-8e6ef90d0c64", "value": "89cbd0d03f658f7b76d6cfbf08bc6fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082715, "uuid": "dda5502b-88cf-4de8-821b-dc387532b6c6", "value": "196608:l8BUt/pTuMujrpo0cFYhs7ufj+wD0D9TIHIs7TPT3CAPG+LXJ/Iw6gsYT/dNy7/Y:8rpobUUJiHpT7z+m5gB9YT/dobKmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780082715, "uuid": "8129fbeb-8a4f-418d-ac87-fd3bb1b7cbf9", "value": 11931648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780082715, "uuid": "45ed6e28-5f09-490e-933c-76abe167f9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780082715, "uuid": "9a192094-3cf2-4d44-8fbd-21c631f4a674", "value": "goog.ct_2026-05-29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6384c55e-5b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780059637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059637, "uuid": "a9f7e816-d87e-4ddd-a04c-7f12f383d2ea", "comment": "Malware payload (Mirai)", "value": "f9418b64120ba837e91cc6789278027d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059637, "uuid": "1b230a60-8f29-4fac-a1bc-8871905e6173", "comment": "Malware payload (Mirai)", "value": "2f7f824aa12445a4328bb2450b83606435b15a0a08670687469dac18050b1159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059637, "uuid": "9798eecf-e2e0-4ceb-a36e-b4c1c5efb711", "comment": "Malware payload (Mirai)", "value": "cfac26e5edf044520f54a69ceba27fc4f7533bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059637, "uuid": "bfe7db47-a8f9-4e47-a1db-34aca0b5de46", "comment": "Malware payload (Mirai)", "value": "ae4ef4e6cd94fed156e264596a42f358d6f6bbd78f3ba89a3055d92a7c7ad56a146f85a17a43045f56bf34e7492d1050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059637, "uuid": "5cafef5c-6b6b-4c74-9b6d-4bcf84977cf4", "value": "T1EA92291787BF6F5BC490A77701D70363A1EBAF954160930FBE089C8AAEA5340193E79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059637, "uuid": "1f4675db-9545-454d-bd6b-8f4ee08b7e05", "value": "384:13nVbIkkgrezIs3n2lprA4m3xDqBW++Wh3XTpaNiGWrqtb1O:13dvk0e/3n4rZOdqBWV+3XNaNMrqtb1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059637, "uuid": "19038de9-72ce-4caa-be04-c3ec36f4eadc", "value": 21240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059637, "uuid": "8980c449-27e6-4bac-89b0-bf0efecfedc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059637, "uuid": "3c747408-b347-4ad4-bf61-8772fad51e8c", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82131e9-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018655, "uuid": "6430089c-af21-4bf4-94e5-60dfe578c2e4", "comment": "Malware payload (Mirai)", "value": "12432ae0ce201afce77227a2d32f9515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018655, "uuid": "5e5506fc-6eb2-41a6-bf83-24715756ca70", "comment": "Malware payload (Mirai)", "value": "305c0d8309fb31ed5857f7fbe542fd856e9c8c9d69f0e1c4b01e4d2dfa7dc015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018655, "uuid": "1646118e-217a-43c1-99e0-918e8edc61c3", "comment": "Malware payload (Mirai)", "value": "6d4c8c3a281de01427fe9ea8a55c98257871fae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018655, "uuid": "476ade4d-491c-44b5-94e8-0ceeed642883", "comment": "Malware payload (Mirai)", "value": "783aeb16a03392f0dda58c9ff9180c5971afb3255bbd18f4389e0dce4af0b5cb0abb60c35a3e801b5957b0306b6364e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018655, "uuid": "76ad36cd-0e9e-470c-a13e-d623248cbb4e", "value": "T1FAA33B85FC82865AC6D027B6B76E368C3352A3E5D2DF3207DC285B2527C919E1E77780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018655, "uuid": "2a78e404-9b24-49d0-8be4-d33fb674c9d4", "value": "1536:1XS9CAmIxVNLxmA7o5g45OU5fOtViPzBuV2Y5BS5IHb9GqsEXi3gWQGgtn8KWt6t:7IxVNLxmA7o59OUvzAEwi3gDnE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018655, "uuid": "f65ff747-3603-48f8-8789-e48607d5f747", "value": 99792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018655, "uuid": "e6fdaa0d-ad3d-4186-ace9-9ed4e9d23cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018655, "uuid": "b689c6e2-420e-4bf5-b382-d7c9a5cae0a3", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1a0e48-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043094, "uuid": "8135e949-b220-4adf-9ee5-255840a600bb", "comment": "Malware payload (ACRStealer)", "value": "ae0c5b6a8ed623276b493f0f9ffa70ad", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043094, "uuid": "358e90ac-573b-437c-8a24-b4f74072c3cf", "comment": "Malware payload (ACRStealer)", "value": "3126cf23a7929e2fa339f3d3c6996eea3fde816546898dc4d515466fba52681f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043094, "uuid": "98a50135-02cb-4f1e-aebd-0b36408655aa", "comment": "Malware payload (ACRStealer)", "value": "efbde0ce5d1d55459635e2b6a3a204c925fd3ac0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043094, "uuid": "0c94ca60-b6d0-4869-b6bd-67e2774aad2c", "comment": "Malware payload (ACRStealer)", "value": "883e4eadd70984530e45cbec4fd0836c69dc1dcf0367eac32b5e436942dad56ccbf0c2249aee36687e6dfa6f78852ee5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043094, "uuid": "6c6f945f-611e-4bff-845c-273401cb9abf", "value": "T1F0E57B56ACE005E6C49A93338DB712917BB1F8580F7223C72E50B6382FB67E49D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043094, "uuid": "d25fcd6f-2ce5-46b9-a36c-9aa9407cf54d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043094, "uuid": "c38273df-61a2-4299-8c67-a88b53e7d58d", "value": "24576:Isen4OkGIHoTxRWE3zHujY1rZgTTK3ZjpmSk39/gm4QJjifLBele5ZK2hgsynjv:Iso4ONIIdsE3CjYQKi9N/gmbJUHmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043094, "uuid": "378787b1-26b3-414f-b18e-c1d05877d29b", "value": 3208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043094, "uuid": "41313ae9-5207-4395-8089-78554fce611c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043094, "uuid": "5fa5abdc-dee6-4f71-8e66-03a70020b92d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.57251374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4423316b-5b20-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780032956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032956, "uuid": "e1137245-ce3e-4a2c-9d27-580376f07ca8", "comment": "Malware payload (ACRStealer)", "value": "162548a50448b424f2f65058d3750995", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032956, "uuid": "40418aa8-dc35-41e2-83bc-8dc10c7bb672", "comment": "Malware payload (ACRStealer)", "value": "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032956, "uuid": "876e8f47-f785-4509-9b95-50e7ccb5617e", "comment": "Malware payload (ACRStealer)", "value": "0949ab0b41c74cc4ed1b5789b4aa7dcc67b98499", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032956, "uuid": "9872ae23-fa85-4610-a4ca-54047f6e0360", "comment": "Malware payload (ACRStealer)", "value": "4dad5bde154737f69eb54dd3557947c2b4898e0acf69fdbc9d3bcd40e23557f94e964099d6fe6e1eb979b24816eee99d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032956, "uuid": "27186b26-76b1-410d-983c-e587d3439314", "value": "T198B57B4A6CE048EAC0AA633689E722927B75BC450F3263C72E50B73C3FB26E45D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032956, "uuid": "106a6e37-2c5c-4500-abf6-16a9451f697f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032956, "uuid": "779cb64e-90c3-4e2e-954b-b3f7f5bc1128", "value": "49152:aI1SV9egbSDmeEKNTS4ysITtlgSwXW4LAp:aRhMRNO4zIlQml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780032956, "uuid": "65236a5c-fdc6-4b75-aac6-1ac1452b6ce1", "value": 2406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780032956, "uuid": "a19de9aa-17e0-4463-9278-bffae0b2e622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032956, "uuid": "37d3293c-ef53-4850-96ed-935c95ab5af0", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cf4d89-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056742, "uuid": "195754fe-cfdf-4155-997c-af704106977b", "comment": "Malware payload (BlackMatter)", "value": "67ac6d36ea75c63d7611aa7f993ae427", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056742, "uuid": "0628c73f-e0d1-435d-b94f-0d75a5bdfd45", "comment": "Malware payload (BlackMatter)", "value": "326536a0bcb9198049da10f4873446393c0f7ceb91098aecdd39a94f6d691112", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056742, "uuid": "9e460ac4-06f3-43a5-ba3e-9b4bf6030cf8", "comment": "Malware payload (BlackMatter)", "value": "934baa797548d52fba5ae2f0974e3876cdfdd992", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056742, "uuid": "59fe7364-5be3-413b-8424-fa482c7181e8", "comment": "Malware payload (BlackMatter)", "value": "de1773f1bbf4a25f0576084d362bfaec19957d43bf2cfee3be4638a33312d379f95903eecc0f7acc5aeb0f32cc2e9094", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056742, "uuid": "c5d42d77-f536-44a7-9431-d5e22e6f4334", "value": "T140E37E21F612D0B3C83718F12736B1B2F39E8E6C29956847DAE80F9DBC648136F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056742, "uuid": "e5d046cc-d030-49d9-9913-b67179fe485d", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056742, "uuid": "114281ff-29a5-4aef-9ef4-660898b2fe92", "value": "3072:w6glyuxE4GsUPnliByocWepV0KkuVgRjtu:w6gDBGpvEByocWeTlkuVgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056742, "uuid": "fef8d3f2-75ae-42d8-9423-29a13752f72e", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056742, "uuid": "fecfcd0e-067f-4cce-97c6-34cb4e5464bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056742, "uuid": "53899d45-d516-48d3-acbd-7b1332d37e52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114f6d1a-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047044, "uuid": "00511dab-9340-4236-b14b-2e7a0a96fc66", "comment": "Malware payload", "value": "e2886c67c4eac38d73cda61b7693222a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047044, "uuid": "e1d22e80-8157-4e5b-92ae-8d797f9a4a24", "comment": "Malware payload", "value": "32c44efae5abbf335db74360d5cc58135005ebdcc41d9cf8b61258a2ef8cafb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047044, "uuid": "fb2dc723-318f-41db-8a03-3831bd0042d2", "comment": "Malware payload", "value": "88441c648e8f7af18fbe440799076c4ff7f3f71e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047044, "uuid": "a0c8d96b-0f3f-4534-a3f6-61deb24738be", "comment": "Malware payload", "value": "31fa1d49304c2589eed315b77b7619dfc138eeb74da937e7abe93b7ada1f48b5c05ed47566a059a6372dc9878f067f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047044, "uuid": "587a5211-facc-4eff-bd7c-33cd579c906a", "value": "T11E17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047044, "uuid": "27056339-9bfb-441f-ba41-81e515235f10", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQG:cqYUQuVDt0TZEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047044, "uuid": "9f747388-3491-45b0-ae2f-9f1b7a383465", "value": 18776064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047044, "uuid": "c54281d2-68cd-4d76-8bf8-cb35d3673ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047044, "uuid": "86e254cc-8c49-4423-a1d4-74350ef9840b", "value": "32c44efae5abbf335db74360d5cc58135005ebdcc41d9cf8b61258a2ef8cafb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59267ac-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089088, "uuid": "679f9574-8d78-4914-bb03-8f201855bb19", "comment": "Malware payload (Mirai)", "value": "4a13926917d9c4550350ec07e6408584", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089088, "uuid": "4e7a4e2f-d5ab-4297-ba97-17619bdcbd7c", "comment": "Malware payload (Mirai)", "value": "3336ee03e3a32a4e4d94a0961b86b7aba15f0a32c66fdef4e321788007fff804", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089088, "uuid": "66623a0d-a3a3-43d3-8101-86aaf6240371", "comment": "Malware payload (Mirai)", "value": "dfdbf0b146861d8505813cdff11f0a570c6dd212", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089088, "uuid": "09e18548-280f-49e6-83e6-bbcb1eaf82f4", "comment": "Malware payload (Mirai)", "value": "6e99cb0994b0f5af1564b65c8828e758149667505dc8f146ed08cbf6d9e67f10fd2b4ab23a4f49949340d33602adfdc6", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089088, "uuid": "dd3d289a-ecda-439b-85a2-cfdc5739c9c1", "value": "T15A763912EACB04F6E9031D3154BBA27F1B310D064B25DBD7EB447F29F93B6A10936299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089088, "uuid": "b8f02fdb-9d03-4dab-9130-a098254bd0e1", "value": "98304:qzrZf9gr2OjmI0+iky7AXu0d4yNWl7uUbept9EE:qhf9Opiz7AXuyqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089088, "uuid": "96a0053b-cb91-4cc6-a6ab-9dfba9f4a5c9", "value": 7454882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089088, "uuid": "5bb64ecd-1d0e-46ac-b7bb-7c4928534c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089088, "uuid": "7fe35f9a-e64c-47b3-b8e0-2a2fc35dd568", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded403c5-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037511, "uuid": "af989ad6-b9e9-4537-9fb2-f7a8b0d542ff", "comment": "Malware payload", "value": "62c2dcc07d638bee623aa922c83b20e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037511, "uuid": "9f5436a4-53d8-4b7a-9763-2071d943317c", "comment": "Malware payload", "value": "3465e6eea1a937b941ef77ac819591c3578e14da950de0d78e8b2d467b819357", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037511, "uuid": "17b7fc97-09c1-4222-ab36-48b8b16e576a", "comment": "Malware payload", "value": "adf51c917bd67be3d6d33fc9f18eee24100ff19d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037511, "uuid": "9fa2ad89-0538-4450-acf2-9f247b93d825", "comment": "Malware payload", "value": "115870feb33ff222d98cbdc2a5ab6209f67bca7614022c3889cbfb9881aec2fe508d7d623370cd96876666506fa28fe7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037511, "uuid": "6c082898-8d54-418b-8d63-499a6c9cc3a9", "value": "T12486DD6BADDC361D3010F186F48525F5E6621336DBDE12D9B8F828337AF6896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037511, "uuid": "03b2987e-8bf1-4043-a58c-5da475b2673c", "value": "6144:ZubnYpscr3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfh49wpNxVwS0msFJvXiESUWY:nPqza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037511, "uuid": "7ab7a52e-94c3-4473-b402-5c2893ca5e4d", "value": 7883546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037511, "uuid": "b8fa9d7e-5501-4fdd-aae6-89c2716ebd4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037511, "uuid": "fdbccdc6-d0ca-4523-b320-d86f81c214d4", "value": "Update_20.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf1f23f-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056753, "uuid": "57ff5561-1bce-498c-b3ec-7e7fd45b8228", "comment": "Malware payload (BlackMatter)", "value": "5ebb902274326f2391f99e001ef2ada1", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056753, "uuid": "6dc2a310-3a28-479d-bfca-4a2f4a45a018", "comment": "Malware payload (BlackMatter)", "value": "34f9b16d363f1bd44d912a62ee0745985ac696b6c4aaf4799a9b2b37d11720e8", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056753, "uuid": "173e9b85-db09-46cb-868c-2fc1ae81de19", "comment": "Malware payload (BlackMatter)", "value": "162f85713f3b0143cf7bc11269f2e2febde6dabd", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056753, "uuid": "7465003f-5bac-401c-bd48-410be04a8530", "comment": "Malware payload (BlackMatter)", "value": "ed772651cfaf10f1a56f206cb5abad94d47a790c93f28a361b015ebb90c4c61203cd5a1880d5d181d036f47b4f752bfc", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056753, "uuid": "4a7afbca-99b8-4200-bc50-5c2f0734e75b", "value": "T13EE36D21F212D0B3C8771CF53B26B572F39E4D2C29A96847EA980F5DBC658232F44697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056753, "uuid": "a09f8d8c-46fe-44d8-b076-2336c86c7d77", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056753, "uuid": "f2a31291-d31f-4e16-ab31-22358d63acfc", "value": "3072:W6glyuxE4GsUPnliByocWep+G+dJKiwZzE3r:W6gDBGpvEByocWewYiwZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056753, "uuid": "5a359dd2-d2d3-499a-b53d-7c2e53cafd69", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056753, "uuid": "de348089-63de-43fb-9f6e-d52c444105ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056753, "uuid": "99dafc81-3b9f-471f-b7de-c4f22c798578", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0384133c-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089112, "uuid": "67bf133d-3d75-47d6-b3bb-9d74d5101ef7", "comment": "Malware payload (Mirai)", "value": "9c59f247e1c4c8fd0254ba1816dfc88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089112, "uuid": "871595c4-1a00-4579-830e-8c7335c47f27", "comment": "Malware payload (Mirai)", "value": "36839038451f5ab313a47212fd7d904f668fd449383017a9b4696f1ef42dc5ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089112, "uuid": "84f7af1f-6c89-4a52-9d6d-7cb291ae8468", "comment": "Malware payload (Mirai)", "value": "83b435ff8478fde85b27b3a4ec27f2b855b2dfc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089112, "uuid": "4f33d6e8-35c8-4a62-b519-89506d92b1ff", "comment": "Malware payload (Mirai)", "value": "de2ea7807fbcf7e1c73e777b16ce0706da21cd7ebbc55490a1afc552b4b7d50c6deb503732ad807d001826edffe91f19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089112, "uuid": "376dfdf9-62aa-4dae-b3ed-e6669d3dffc5", "value": "T1EEF3C71A9F650EFBCC6FDD3702A90B0235CC954722A43B763674D528F54AA4B4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089112, "uuid": "78383f82-aa65-48dd-9b26-72ce29cc4f61", "value": "1536:2nk0fmdcrKsMJNgorLkuuxnKb3Dh8qSpLI2xwS+EZntQolbPGICyatb5jKWFNVu5:2nHkcrMJjvkdKbKw0XEb5jZVHQgx6jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089112, "uuid": "d189fc5e-c39c-4e96-9fae-36e2e943b2e9", "value": 157656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089112, "uuid": "664c6023-2584-43b2-b15c-0719c2a5e9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089112, "uuid": "ea151c2c-961e-4be9-80a0-8ab6cc4ea737", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a648b4b-5b5d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780059193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059193, "uuid": "87d5d509-1bb3-4ea4-9167-91abf4c10fcd", "comment": "Malware payload (Stealc)", "value": "aa68222169cedeb12d6d0298ab9c49f8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059193, "uuid": "e61db89b-84ed-4076-9cbd-b25fd0c26612", "comment": "Malware payload (Stealc)", "value": "37d8875b983771758b7ad2abcd68672315558811a2c52aee59d3ac4cd3cb79f7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059193, "uuid": "81697dbf-315e-4982-9f5c-89a3ba5f4da3", "comment": "Malware payload (Stealc)", "value": "7233937718cf55d37478f6c79fb3673b05f2b183", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059193, "uuid": "7f6a4686-8a1e-4d3a-8194-dfb8db381594", "comment": "Malware payload (Stealc)", "value": "142b1d18a200806f45adba50b8bf4c00dc1e158673adc6df426f87cdbb4492b5638d5a8e7f4e7bf44305c68ba96db6d1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059193, "uuid": "63a4c46f-fef6-4cad-827d-0e810d677369", "value": "T1B1034B1656E21FAAD8F2C236F6B65773F7B0B4426114BA1F43B0C76D1FA6582A100FC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059193, "uuid": "bf124873-f868-4d4a-9d67-189fc31c50bf", "value": "72d46649e1c061bb2f6f6d91d9b6f96a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059193, "uuid": "a3d820d8-b487-439a-908e-ec3d8b5a7701", "value": "768:QtSCYZ7IfH7p3vxLtmsQ0KJvfS90HSGf6dQ2Pa/PiXuIF9ZaBR:WWRIfH75vQpJnV/6ZPCbUiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059193, "uuid": "056a3349-17d1-4a9b-a9fa-25f5b3643a0d", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059193, "uuid": "9206af21-0a2e-4d23-9e63-c4ca4e7c306b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059193, "uuid": "f2b02dc9-c2a1-48ce-923e-68f7e4765c5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d02d6e0-5b4c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780051922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051922, "uuid": "04aed8f1-f6de-431a-bc14-3829d042a1e4", "comment": "Malware payload (PhantomStealer)", "value": "c8086eb9a5a9ef77381c0bc856c970c9", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051922, "uuid": "ed77f02e-0930-439c-b78c-fc8cb253afa0", "comment": "Malware payload (PhantomStealer)", "value": "37e8fc3692a69b04324eea93dd65d70a329bd117c8126119357bc43680f79fa2", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051922, "uuid": "7ae016bc-ac6a-4aea-a52a-f5f714fd2adc", "comment": "Malware payload (PhantomStealer)", "value": "d560992b0cf8fa52e9a3ef79c62dfe8f6d9ac37a", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051922, "uuid": "9e7817f2-22b1-4817-930c-3fa77e14ba72", "comment": "Malware payload (PhantomStealer)", "value": "5b2edb242964270b5ebdf0914574da3b17db135bd251f40951b6c07851f13545076fa009e89023069a41fdbacd78d396", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051922, "uuid": "6455482a-2477-47a3-b970-205943f8a070", "value": "T19133818DBBCAB0254212B53F2E3AB1A6E03E0DC7BA8C445CF78475D8FC95704D5A8E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051922, "uuid": "d07201ba-cc1e-4a81-93a3-d02033e74719", "value": "1536:N01c6arSuElQ6RVhHe54pQWFJg8OoTy12xtO83xZLu4:NdxrSuElHRjHoEFNOV23PTLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780051922, "uuid": "edc9236c-e329-4f27-ad8f-074f82e67952", "value": 51292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780051922, "uuid": "01dd94cc-243a-47e2-afd1-67ad2d5add38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051922, "uuid": "57da4b2d-68f5-4ca5-a4e7-624e6d6fdfd8", "value": "Payment-Swift-TT05294758.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de1ec7f-5b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019631, "uuid": "ec374691-0b28-461a-8213-49851d502d8a", "comment": "Malware payload (Mirai)", "value": "8bef0063612bf685606d901bb9f59145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019631, "uuid": "076b20c8-19eb-4f62-b2bd-da722f04107c", "comment": "Malware payload (Mirai)", "value": "3993cded52136a2c49528688a1f81a7d92551b4db1b1cbc71cc9665db3288384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019631, "uuid": "247fbb6e-c819-46d3-9d1e-dd492093fbbd", "comment": "Malware payload (Mirai)", "value": "ffd2965b462d8c15b59c67084246239ce3bd49dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019631, "uuid": "630d4685-1d61-49da-ba2e-61b4e0277368", "comment": "Malware payload (Mirai)", "value": "f4e3b848afc8de77b009f994dc9c36e2a01489361bd7622f02b08ca7abe3abcb2f7b8004b31c46fa272bc71a82193b12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019631, "uuid": "8b555bc1-8160-4390-983a-82a6cc07dfe0", "value": "T189E2E16F450145E6C628C27C25962BF49C398B65F907DD06BEAADBC2CC7F0A1D446ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019631, "uuid": "5f1cfde8-c937-48fa-99a3-a1a298bb1d90", "value": "768:nc0aSAAl2l59Ej4qbUg8NiqpGeG6+TIb/5JgGlzDpbuR1J9:XaXe4/75gs7rVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019631, "uuid": "3229a113-c165-43c9-8286-5dd4946e4432", "value": 33096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019631, "uuid": "36a0ab63-93e0-454e-b94a-6a32eb14d3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019631, "uuid": "26d93b9b-ccf3-42d6-826a-850694fe0e5f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0047faa5-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089106, "uuid": "a766648a-c0df-4a8c-a521-41fe56efb89a", "comment": "Malware payload (Mirai)", "value": "76243a31873fbd23f849d2859c6a2dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089106, "uuid": "926b8c7e-b5dc-44c5-8933-d2f443a00456", "comment": "Malware payload (Mirai)", "value": "3a06875b9404a65b68a43ddeebb17ae3e7569f0a003df2ee2f673ec591727dcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089106, "uuid": "5ffbcb4b-2cf2-4fa9-a6de-a0ec5880362a", "comment": "Malware payload (Mirai)", "value": "4f5c8d371d44fc810b765cdcb2a86d3168d29ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089106, "uuid": "e36b6f19-cb84-4791-b8ce-0252eace74a5", "comment": "Malware payload (Mirai)", "value": "5358c71a30286b4fc2f96dd80f45d9965de553ffaecee330efc654b23f405452299392cfb212fa4f3fa08e3cfe4cdd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089106, "uuid": "44d1705c-2002-442a-80ba-fdd2be62b17c", "value": "T115E3965A6E328FAEF66C873147F74924976D23D623E1D684E2ACC1141F2038E545FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089106, "uuid": "f4f51825-e9bf-44ce-add9-7dd63905f9e2", "value": "1536:eo93AiQLWJgqUtDqhjhpa0iRdDI2wTOehToUN4tenoATOKFJ3ehwPD1C:eo9NSqYea0mDI2wTjN4vsFBehm1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089106, "uuid": "8a3b8eea-bb5f-4179-b175-6ca98e5f3f55", "value": 156696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089106, "uuid": "26628cc8-64e3-4122-9541-0a9d16a73d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089106, "uuid": "db885f35-86e3-41ca-ba3e-012e9c4d5815", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771df792-5ba5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780090165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780090165, "uuid": "3f152967-248e-4f45-b5ee-cbbdb049c0b4", "comment": "Malware payload (Mirai)", "value": "174d44fab477e43f5a03d1723eeec54b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780090165, "uuid": "5a4bc030-670b-4e7c-bb49-b154565cc6d9", "comment": "Malware payload (Mirai)", "value": "3ac5b8f081f6e31870832558c27150048a701678307a951a4644ec5b7aa3b830", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780090165, "uuid": "d77309f6-c612-4d35-b102-43d22a4794f7", "comment": "Malware payload (Mirai)", "value": "11e04ace61ae4be476dee10bca87495f02086954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780090165, "uuid": "066d483b-b14e-4f6a-949f-077e93f57a92", "comment": "Malware payload (Mirai)", "value": "e3f1081041be6f9d68959406f79307213492013e1c8b23d75bc9b1d0ed8a7059e69202bca7a100646600c7108109ef98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780090165, "uuid": "d775d299-9915-4418-8523-e26f032b7562", "value": "T1CDD35B42B7180983D5575DF02A3F37E583AFE5A120F0B689790BDA0A8175EB7254AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780090165, "uuid": "4f9c8a70-de54-408b-af84-3ca2fbb8ed82", "value": "3072:EkfXYKHj6ULPnQu6sHkc2beSTvlwILj7z:dfXYKHj6UL4sHAbeSTvyQ7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780090165, "uuid": "012754c5-54b6-4ae2-ad03-80f5a26402e5", "value": 132672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780090165, "uuid": "3db9d3e4-e908-4cd3-820e-1332808cf8e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780090165, "uuid": "303ebc7e-ad73-46c6-88b7-74add96628b5", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d363cbb5-5b64-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780062402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062402, "uuid": "58cdcca4-1e65-47bd-899d-ca6ef7cd4acb", "comment": "Malware payload (RemcosRAT)", "value": "ea13fbee24fcd8cc9c7619f47472d1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062402, "uuid": "69bc1c65-b075-42f7-8647-0a084a463ab3", "comment": "Malware payload (RemcosRAT)", "value": "3bd5345502072fdb537ae2f36daaf4c8b0c36058484bb52887a57fa59381795f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062402, "uuid": "2a4a3664-3a79-455e-bd2d-ffbbc7b09325", "comment": "Malware payload (RemcosRAT)", "value": "fb2387aa67f3c6d0c44ad10d5410b9e7fdbec642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062402, "uuid": "85ed94ed-7db7-4c08-a906-f6c5a1c11ea7", "comment": "Malware payload (RemcosRAT)", "value": "c9728cb9a12eb442e763ce6d8925adb000888e9f3e5f5d983f71d9709c199033565468418d80e42d84246503b07441a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062402, "uuid": "47713428-57c9-4cf6-a286-cfbf0fa60810", "value": "T12543E703BF0640B1D56502F00A452713EFF95DEA0A49A273DB41D500BEFAFA7D8A636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062402, "uuid": "8153173c-94f0-4ff3-9726-75ec065bb633", "value": "c0ffd3202ba559b30937f4875cd4b035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062402, "uuid": "4040b5ca-8d09-4c20-88aa-2acaa43eafc0", "value": "768:id6YcrtoDHUEWBGxsQz7cu1eQ47/TV+lw59m/e/Gt5q3LgbTuemCr1:iIBSzUB2b1eDQw59vUSEHuemCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062402, "uuid": "e32593ab-25a4-4770-8619-fd06c0ea49e3", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062402, "uuid": "6cc73607-0d2b-40bc-9a62-0bce3e479b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062402, "uuid": "9f46b6d5-6732-434f-980f-099191c3335e", "value": "eastvillageeatery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc88bb8b-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016435, "uuid": "cb943836-3102-4184-b070-1ef0b054f58e", "comment": "Malware payload (Mirai)", "value": "db789c9fa2571c2991b21e9c75598bae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016435, "uuid": "f627a4c3-229c-4a65-9dd6-8ff5621b43ee", "comment": "Malware payload (Mirai)", "value": "3be7bbae927222df000632e604b489d5a7583b9bf6b72f56f7f58406877b7515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016435, "uuid": "3422d4a5-7015-4ea9-9589-9ea2cf75958a", "comment": "Malware payload (Mirai)", "value": "867c0c43f926d70010a264672bfbf6a1dbbc7791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016435, "uuid": "34d79cbc-346b-461d-9001-3a0a98410a8a", "comment": "Malware payload (Mirai)", "value": "3d40a41c84e8b30a67a8cd784d0169a49ce62753f541bfe72a03e22513a2ef76f968caacb44d1b6b7ec73a786502ce19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016435, "uuid": "ae21acd2-2b40-4712-8f8d-65582aa59952", "value": "T1F9D35C85FD818A22C6D512B7FB2E228D331653A8D2EE3103DD246F2537C659F1E7B681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016435, "uuid": "c1b16e41-a5a0-4583-8aa1-4e9bb7ccb6ab", "value": "3072:YJJwiDKzqXH43c2KQQLozLDQ//2GGU3Ni1c:mJwyKGXYs2KQQUk32GV9+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016435, "uuid": "1f536cdf-5f36-4dc7-9453-a06a702d99f1", "value": 136672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016435, "uuid": "f9373ede-59f2-452e-8144-904818378c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016435, "uuid": "f8f0ff7a-0dc4-4495-a26a-01e934f9a71e", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd4404b-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058631, "uuid": "af163c19-3cb2-45fc-b461-a62be82f0fd2", "comment": "Malware payload (Phorpiex)", "value": "d09e10ac0759583d99ac91350c96daa8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058631, "uuid": "92c03dfd-f068-4d65-bdc1-c2f36b8dcf60", "comment": "Malware payload (Phorpiex)", "value": "3bfbfb354bcb470401421a22b7bce071d0ec77f9d6be1d5241fe49b69a169678", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058631, "uuid": "36c242c9-b2a7-4c09-9a95-4475f59071b7", "comment": "Malware payload (Phorpiex)", "value": "619408dfabedbdd59bfd34e8ad2af58574072d2d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058631, "uuid": "7ddacd42-05c7-4e83-a30c-3ce5793ab70a", "comment": "Malware payload (Phorpiex)", "value": "83a068e58203dda1e753bf60af4d02ccc33f17288f2ed15a9ea96aabd16e927d4df94b611c81e944d214fcfec8b9196e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058631, "uuid": "4130d17a-e531-4235-9d49-73f8f831effc", "value": "T171824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058631, "uuid": "ed68b366-e3c3-422c-af8a-606391c0d8c1", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058631, "uuid": "3bd4b418-83d7-4233-a55d-5ff978e5ced4", "value": "192:tIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJ4:vIblVP4Y/2N0bLu9JgPL7Nyav8U9co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058631, "uuid": "3543dab5-d0e2-42a3-a8e7-dfd8363ccc3b", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058631, "uuid": "aaefd73c-4292-42fe-a4ab-0cf5ff526b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058631, "uuid": "462f3964-047a-4eb1-84d8-c44f4864855e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15f732-5b49-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780050765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050765, "uuid": "15d4fa3b-80a5-4861-8d02-b1eb20fb28b8", "comment": "Malware payload (Mirai)", "value": "b253d108ef2b42394fdde142dc9f6391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050765, "uuid": "d4ad2883-e594-43dc-9bb2-7928d90cba82", "comment": "Malware payload (Mirai)", "value": "3ceb5dfb6583e055c5da0e320926e3373907897b5a51e9292cd5d24175ba06a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050765, "uuid": "ad81e8b6-46f3-4fd0-a1fe-ce63efd19a8c", "comment": "Malware payload (Mirai)", "value": "f984ca06f4863fc2b8fba5c3cfa5ce99ae5e2322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050765, "uuid": "9ebf9dd4-fd8e-437a-8ff0-8187752bc073", "comment": "Malware payload (Mirai)", "value": "e4c7822e39ac9a063e3149603384b0b6894a02e0e6229ff2ae105382a9ff0dc0d7a0340acdc12d02a70e4abf8533739b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050765, "uuid": "99aea373-6fa5-49a6-8cc4-87543cd07055", "value": "T193D38248ED68A73DC3E372FFE75902CE732A1B9877D671258E324A5637C8B95A434120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050765, "uuid": "dec23eb8-713b-49af-9186-0a0bcd474646", "value": "3072:TfwjrYa8FQiNnQk13qVqyD76tbkfiDt1E06Hh5ZC5M5l2:Yc+OU0E5C5M5l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780050765, "uuid": "2a75b521-16b0-4d76-a52b-7eb0ba4a728f", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780050765, "uuid": "427b2607-9e12-40fb-9b8e-0b78a9c3ddb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050765, "uuid": "f8017371-e56e-4560-b7a0-a0176b9c0036", "value": "3ceb5dfb6583e055c5da0e320926e3373907897b5a51e9292cd5d24175ba06a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227c5513-5b6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780065541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065541, "uuid": "46749c15-38b3-49b2-9a0f-3981ce332702", "comment": "Malware payload", "value": "990ed2f1d010ec493129324d39de1eda", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065541, "uuid": "cf508515-c485-4880-8031-1db107dbfebc", "comment": "Malware payload", "value": "3e5c65edd61d8f1b95ea79451758c43cf4483bf1a262942f1ca3a5229f107b3c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065541, "uuid": "12e5f31d-21c4-48a9-b884-d93e3843219e", "comment": "Malware payload", "value": "aa755b2cfa622e1c38ebd05b228b2fd0312038cb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065541, "uuid": "7e37180c-e99a-41aa-80bc-d508a94f402d", "comment": "Malware payload", "value": "efb6ca28624cc02eee12d1227f54615e1278f9c29f3b31ce99950018026439c8bdb4ee30c8c0dcd385223a3c4d94af8c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065541, "uuid": "d1dd5439-8ffa-4838-b5d6-796398c60a12", "value": "T1DFC4239340245866DC328E79E39C46E3AE310138235C94BD5ACCDF332C99576FE9AB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065541, "uuid": "0bd96b82-733b-47c3-9c21-882c8b949e9f", "value": "12288:jUVIQ050I4pLnZHzzMlwPtsL22tQDRQUHh:jVQ0z6VfMmPtP2tQLHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780065541, "uuid": "7c15a2d3-3985-41d6-90c8-33632881bcd8", "value": 572788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780065541, "uuid": "1ba71ab0-dbad-4674-bdac-130a47dc80d2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065541, "uuid": "29a19fc2-362c-48aa-8041-098cb3ad09ee", "value": "Krypton+.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6c3112-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016676, "uuid": "48b1259c-e21c-452a-81ed-99f92bbc0931", "comment": "Malware payload (Mirai)", "value": "3be24451b70e3047bcdefb719b6d9782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016676, "uuid": "25335ec6-ce04-4ea9-9f78-9b5f0bbbcd52", "comment": "Malware payload (Mirai)", "value": "40268ee654993eebe9346cbd8bc3e4fbca1532f12a00f2ab463cef400fd7af58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016676, "uuid": "97655911-7aba-42a8-9e35-1c2ac92d960a", "comment": "Malware payload (Mirai)", "value": "ee330e67e892347cc4388f2c20cf51ab26eee0ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016676, "uuid": "60e1fe3b-0f55-44ec-97de-01f3ba8937e6", "comment": "Malware payload (Mirai)", "value": "83102026fab0546955eca2c6789e1d28c757d7a0e77c071359aadc19ba2b59dcc17198b85edaa7a4d47c4b82ee0715ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016676, "uuid": "91929be6-ca9b-453d-81c7-a437ce7e5092", "value": "T162A31996BC828A12D5C8137AB92D15CD335323E9E2DE7213DE105F3136C992F0D7AEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016676, "uuid": "3e98b850-b90e-448d-8800-f83ec1404c7c", "value": "3072:Wm9UyggwMxNVH0SsqC7y4mcm1TN2NU9VpfBV:WmeyggwMxNVUSdCpm51TN2i9VXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016676, "uuid": "f87a54f4-2984-4b6c-98f5-d5cba0e77234", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016676, "uuid": "13a5d511-118e-4454-8791-dc8723b6e93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016676, "uuid": "e04aa340-f66d-4df9-aadd-78106310322a", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0e2493-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036566, "uuid": "cd4bc7cf-0cdb-4145-ae7d-9d97f61abf17", "comment": "Malware payload (Mirai)", "value": "198386e1ca6608978f24d1bcd6494dcc", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036566, "uuid": "8b34659e-cc92-4d5c-8f45-2ecf5aa6537b", "comment": "Malware payload (Mirai)", "value": "404a2348e028566d36fdf75cb736319d14e72b6c26596664350b222066d2ceee", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036566, "uuid": "34935e26-3097-42ee-8aeb-e9e299bc3438", "comment": "Malware payload (Mirai)", "value": "48ced8d35619f7bc4d951e57c816031dd4161555", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036566, "uuid": "c85ccea2-25f1-4f7b-85d2-cbb76adc31f0", "comment": "Malware payload (Mirai)", "value": "3f53a12543d57217188bb003a5d595eff358b12942c8b878c5ef47051dd176b131c8cb98ddaaa718987c2ee1cfaff820", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036566, "uuid": "bcf96d6a-041e-460e-9e06-36049afaec4f", "value": "T142C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036566, "uuid": "3b7f293c-55c6-486d-b5e0-8ee73e40013b", "value": "3072:+f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4Jqe:+f0tJBR4NSALD7rnCrheiKqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036566, "uuid": "b27603d1-bb01-4609-8def-62642c64279a", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036566, "uuid": "976497a3-485d-405c-9d91-8e465c5f09e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036566, "uuid": "dcc9dbba-c56a-4c33-bc63-0792000e6a1c", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be2f3db-5b29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036727, "uuid": "b35580ae-7756-449c-9dd8-ebe11da7449b", "comment": "Malware payload (Mirai)", "value": "ee1f7e029f6796f3fce4a17c681084da", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036727, "uuid": "bac02f74-4f7f-4f8f-ad13-246a840c844c", "comment": "Malware payload (Mirai)", "value": "404b856e5f523b6354adef5c99becc5ec973edeab666af39f57157c654b47f5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036727, "uuid": "20760316-d9b6-491e-a7d7-2cbab84856c1", "comment": "Malware payload (Mirai)", "value": "553be53d9a423aaa3768f4c8f30e0db7a64c8f16", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036727, "uuid": "f4febe09-3c4f-4ded-8cc2-8d5e8467d801", "comment": "Malware payload (Mirai)", "value": "cf26673b91fbf351bf9e91bc5a07ba765fade1ee7769a9537b0a0d2eb28028d4cb153c28e2317a0e9b80dc709d4421ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036727, "uuid": "6ec76da7-7797-4f4f-a2c0-adff9a6c8861", "value": "T190514DC922D25032AEBAD97373B98544B9A0589734C67E489CEC38F5C48CD47A8C5BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036727, "uuid": "af776d04-218f-495e-9350-dd939dada39d", "value": "48:ipmWpU54pV2p5+pr6pROpTGp4upF2psD4p7mpnepvepKYpT4g:irY42WQ2IxuHQckRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036727, "uuid": "41c2af6b-e87c-4c19-becc-e1a888946af2", "value": 2482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036727, "uuid": "5650bebe-f7b0-40b6-ba33-f3697c7adb3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036727, "uuid": "7dc66b64-80ae-4a82-93a2-4182c32f2ac7", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbac95a3-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047437, "uuid": "be59b66a-6fde-465d-901e-700a43e6e3ab", "comment": "Malware payload", "value": "9d82c35ea1eec25a389fc6c5e2dfede1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047437, "uuid": "c3f9e077-76c8-4c19-94f4-48e85b18e470", "comment": "Malware payload", "value": "40650687d9ea0066d09dde43489cedb2841497ffecadd87c4f8822a1c40fef09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047437, "uuid": "ef0a90dd-9564-4b65-b5c3-84881ab0766e", "comment": "Malware payload", "value": "e36431c0483873afa464536e0e011f85fa34e493", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047437, "uuid": "263f3a3c-b350-4c3f-8675-1eae55a98650", "comment": "Malware payload", "value": "94a6eec9a0223408349fbf7911ba0346e67d3aa60febf87e92f8e42ea3f5cf5118e50de7d53968613df54cd8116c20d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047437, "uuid": "6e04625a-6b3a-47b7-a4ee-2493a089fde4", "value": "T172761957B8924942C4E43A37B8BE81C432634EBA8BC712576D15FE383EBE5D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047437, "uuid": "612f10d7-5304-44fb-b65f-299cff85ad47", "value": "49152:Jf4rG9BJuwlSbZpGE6sNAsdLMNS67R/oBJtTpiB+MuN5Ek:JiGZuwlSbZpGE6sjM/kJtdiB+tEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047437, "uuid": "1ffc7ba7-370e-4387-bb7d-84800aa1af12", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047437, "uuid": "736f33ba-64ff-4c61-b33f-55e6ead78235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047437, "uuid": "d3226dc9-90ef-4ad5-87d5-f2f2419b134d", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1b33cf-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039142, "uuid": "c7066729-2fc0-4be2-8bc7-33b291e8a840", "comment": "Malware payload", "value": "e9e88851055c2b46357869434e546273", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039142, "uuid": "5abf642d-d7f0-448c-a852-d815692481b5", "comment": "Malware payload", "value": "40d6c0d0be3788ae6c0b319017cbd190e510f3985650bae20d5b57f36f6ee34f", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039142, "uuid": "0914c118-ff4c-4932-8c0c-a396e1c97b5f", "comment": "Malware payload", "value": "af8dbdf97e3fcefb3af7725c460fa3a6ac76e87e", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039142, "uuid": "5a5abf56-c342-4178-84d3-b01271c39bd5", "comment": "Malware payload", "value": "e8760c2514289ee83c39ee806161083d7f16807c6229b4023e6de91d7faf325b7d265a0262d51f85ea105edebf0a3d3e", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039142, "uuid": "02671271-fde1-4594-a8db-d324837923ad", "value": "T116F1C703419F5C67A3847F1BEDF42E8D3BDAE64DBCF49844254A29AC058CC5DE8B822D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039142, "uuid": "ca17e4ca-8a0e-4507-9a36-8c52c8c4aee8", "value": "192:zEkDUjSYLHBjZq/EkDUjSYLHBjZquEkDUjSYLHBjZq41:zNgvBtANgvBt3NgvBtv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039142, "uuid": "d9187308-b447-418e-a725-5f0f2a5e5d02", "value": 8067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039142, "uuid": "2abffc73-6094-4659-8dfa-6cf8371b99fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039142, "uuid": "caa4dd04-fec4-436d-bc61-4bc353b00d62", "value": "40d6c0d0be3788ae6c0b319017cbd190e510f3985650bae20d5b57f36f6ee34f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af683a3c-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036572, "uuid": "54d05565-7473-4205-84ba-c4803ef48e0c", "comment": "Malware payload (Mirai)", "value": "5a9f795642d00d06ada7cda345004e0a", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036572, "uuid": "101a606c-33ad-430c-b1e8-a834adefe160", "comment": "Malware payload (Mirai)", "value": "410e7d8672a4aa7ccca8b2c98d7f2e11cb05f0f6d27c0ec7278bad9d7a7284ae", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036572, "uuid": "ba74e8ba-099c-459a-8e54-806a99b01d49", "comment": "Malware payload (Mirai)", "value": "acd66674e6e5bf66542db36e4afe5f343dc937d0", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036572, "uuid": "4e409d4e-a79e-4664-bc4e-0561c8a2cb2c", "comment": "Malware payload (Mirai)", "value": "85287e5ba0667e0aee13347267fba41096f27e9652949857b821e2c21f9053aa6de039cbcfa0255f2987c2a1f446be47", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036572, "uuid": "6f750306-3a1b-4fd7-9e43-064c64056da1", "value": "T16AC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036572, "uuid": "071a7b32-d4a0-4bd9-8ffd-0193d30169f2", "value": "1536:6qB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dgJ:6oB4exMF7oZKJnCNYaaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036572, "uuid": "3cd1ecbb-6299-4d84-bd53-1f0c6efa6f8b", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036572, "uuid": "99cfe1cd-3f0f-498e-8921-483c9641c68d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036572, "uuid": "c9c1cbc6-257e-42fe-a74f-4bc8a66e9829", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec894434-5afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017347, "uuid": "d537ae0d-fb7f-4d24-84b5-a982a6501cd5", "comment": "Malware payload (Mirai)", "value": "a6ee7f7d11b909ef4209f0c1e1ffc75a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017347, "uuid": "5ed91e0a-df09-4678-899a-242e70e810b3", "comment": "Malware payload (Mirai)", "value": "41c7b0455f185460db1e660cbbc75e375fad2863cbb3178d6c35de1741da6181", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017347, "uuid": "3ae4fc23-523b-4073-a3ab-2660ecd18076", "comment": "Malware payload (Mirai)", "value": "2bfc64bfefc8eece6a9f68e6f28e24814cdb6dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017347, "uuid": "5d4e0127-8381-4820-a3a9-e229daaff65a", "comment": "Malware payload (Mirai)", "value": "2084e186fb1d86495e56bdd3e2ae04094008562b7c9e03c1b8ced09dec5707b45d3948c5f55371b0629955b39917a1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017347, "uuid": "9d630473-8f25-4379-8605-5d79401ddc54", "value": "T115E2F174B41516D7C805A33FA51DC40EEBC0B5C187A8AB05DBC6C76524B2273BF249DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017347, "uuid": "fced5aab-775a-445b-84c2-e0dbcf5b977d", "value": "384:M2JikV5Ql1OVMy4fNXhHsXmtaG/CrP1cRFy1djYb3W3HZ+QBWhgEFIHevqioHtSn:vUk7QlicfPssPA1cLyLcb8wQEdueHMZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017347, "uuid": "8619dc07-2463-4cf8-b62f-a3d81184f304", "value": 33156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017347, "uuid": "6ca930e3-73d0-4f95-bc95-5699cc02aa49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017347, "uuid": "b7ed4da9-e204-4775-9c02-8b175d682476", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0859d1b7-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017394, "uuid": "d7ad06d8-b76b-4c44-bcdb-543784b23263", "comment": "Malware payload (Mirai)", "value": "09654774dd8dcd4a82e78dd0abfb7a29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017394, "uuid": "04d6a981-5a50-4982-89e5-87aa2e5dbd03", "comment": "Malware payload (Mirai)", "value": "426fb8e451373b628d8e24279822d8b733343234b3f97ca9a9993512a5c84d7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017394, "uuid": "96b041a9-8e34-4784-b72b-8c73d7560dd9", "comment": "Malware payload (Mirai)", "value": "5de5e89d297ea0c8ea186301c1918717fd170b05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017394, "uuid": "c23a0e56-3479-4b42-a118-63b6ee712b5f", "comment": "Malware payload (Mirai)", "value": "1e648071a9b5f31a7e3f7f419a64fc71430efeacce6d545f71ff44b167d2b927ec1cc3ddc73b87ada3013acf8302dc5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017394, "uuid": "964f9619-7451-4ec3-81d3-5e54a41f6642", "value": "T18C730A91BC828A27C6D4537AB6BE65CD336233F8D2CA3217CD218F21759941F0D7AE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017394, "uuid": "004e0331-9d81-4264-9d90-5aadf450095a", "value": "1536:BY5FRDFk66h5q2Lzog+IRLWs8CfyQFzi2YoAe2xuWA7lNv7KPoOYiA23PW3yw+:i5v6gsFyQFo4owOYiA23PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017394, "uuid": "9fcdcb74-450e-43e7-aa98-8ac53552e551", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017394, "uuid": "abceb67a-a3a9-4b7c-a3fa-5ba96ec49e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017394, "uuid": "d5e3e1e2-7e7a-4f5b-9a5e-25fc02f08fe9", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df98ed02-5b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780035794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035794, "uuid": "701468b6-6e04-444c-a5c4-d6c9dec48f45", "comment": "Malware payload", "value": "ba37d5b783b568a54e2fda673f030b82", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035794, "uuid": "fc4824b5-f8af-4d59-ae5f-551c827ffe5b", "comment": "Malware payload", "value": "42bf3414cf6479d2626ca2a9bd11921692da33758678f6be68714d9cb094cffc", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035794, "uuid": "dbed4151-cac6-4616-a124-9eba11d3647f", "comment": "Malware payload", "value": "a1b9db5606bd792fc863d19c452e28ed557f02d1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035794, "uuid": "8e6af2c5-4d8f-4fc9-afba-0c2552e7b4ce", "comment": "Malware payload", "value": "06c453536b2a1006d3ad4554b7ab7e0c32ed171ab1d0fed8b4907265360a6f93195a4445e10ac427fbb4acae0de8c281", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035794, "uuid": "fc47b5ee-cae2-42db-a006-e7850b6581d2", "value": "T1E263D807B961273FE69D830AE18449BC975EC35D422BF17C92DDD13F190DE8EA231A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035794, "uuid": "a66c2e70-5634-49c2-b733-719a740cdfc8", "value": "384:/8KO9MznZHOZa1Gqot68NZ8pxtO+3pByOT1DnmGYMQ6bsBWGiYyZYEttBIt4+Df1:QOOq58H8XtO8fpk6bsKZJZS9Ggr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780035794, "uuid": "ba056a84-cd79-4f02-8be9-822c953e4fc9", "value": 68929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780035794, "uuid": "ba249cf1-5c32-4b9b-aa52-518a79bb9847", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035794, "uuid": "c87713a3-0012-4f2d-aaa7-62371df4a8a1", "value": "sleestak_payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d52045-5b4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780051152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051152, "uuid": "d151f1d3-2c68-40da-b05a-4ad2a5c9186c", "comment": "Malware payload", "value": "06d4e133278ccea6d85866101901436e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051152, "uuid": "99317ccf-31dc-462b-8e56-44a1fe3608b8", "comment": "Malware payload", "value": "450022431a5d5d5589895b878420747c860a85928d560f48355acbc8825ba744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051152, "uuid": "c007aa56-8309-4a27-bba8-6cdb265e8743", "comment": "Malware payload", "value": "9ebad5dd75f26a4d83d3346a7512e45f40cbe2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051152, "uuid": "608cb292-58ae-4396-b12c-cbbd770d522d", "comment": "Malware payload", "value": "fccd5d71d5e5fb82f410780907614328d291d742dcfc8fb2dc5231cecc22e1d7706812529766a9d6d02db6e5906d54f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051152, "uuid": "c5ede025-df6b-4bec-a662-a4519ea4d94a", "value": "T167C7333BF286A53FE1245B3579B29121543B7A11A4428C4692ECF8CDCF761B10E2F6DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051152, "uuid": "1d567eff-8981-474d-894a-2f4646b3fa3a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051152, "uuid": "04d4da33-7447-434f-86ce-6b28edbb3a93", "value": "1572864:bZT5vQnGbS5OtUIYjFbUTtpl/tyueaM2Lx:bZTVLZuFbcVyu1M2Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780051152, "uuid": "6f946b2a-60f2-41a0-abfd-38a767df4dd5", "value": 56597152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780051152, "uuid": "a1fa8b7b-d396-473b-85f9-e3590bebbec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051152, "uuid": "fdf65d42-606d-4fe2-8a51-771387173dac", "value": "EasySuiteerSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7077b7db-5b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780056223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056223, "uuid": "5c308458-c86b-4331-aba6-a8b3be892cf8", "comment": "Malware payload", "value": "f8b94ba51d375426f4b52eb6e84d41e0", "object_relation": "md5", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056223, "uuid": "499fd088-010c-47db-ab63-e4cbc19f3611", "comment": "Malware payload", "value": "453096b73372f1a001c7e2f93b00fa095c8e0c5534f4ace6ede0bda4196fe69f", "object_relation": "sha256", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056223, "uuid": "87e51f96-9c76-402e-a1f4-4459efb37024", "comment": "Malware payload", "value": "0018e573fc9c689e717c38963af1bbf869fe1e76", "object_relation": "sha1", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056223, "uuid": "144b4f02-d9d0-49be-9776-c61ed5acc4ad", "comment": "Malware payload", "value": "f66fa64abc3c41a15e8e3c89a1dd780c6947155bc45d5cd8479d0c9f7d9163e613355969b9d9cb6f7ab6956aece4d5cc", "object_relation": "sha3-384", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056223, "uuid": "575f7da9-7c24-466d-91dd-fb5a55a211d1", "value": "T1B8E208018C191EF1D38BC26D7F89D45562262A1B16157838FFECD6902F8CB3542F9ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056223, "uuid": "dd4cd4ad-f320-4a96-a219-7147a9a733fd", "value": "384:HGkGO/0fbxyAXtAn/q8jU3R1Ohb8IXQME5eTGZN9tqeyjtdV80zyulLP4HXAmHri:HcbOC8jm+8IgMMv0dVdyHbLw7vrrRPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056223, "uuid": "35170040-e631-4c0c-9129-2b63fd3502f5", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056223, "uuid": "71d20e16-0bcc-44ec-8423-765090550bd9", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056223, "uuid": "315ebedb-ad61-48f2-b436-7a2c9540cf2d", "value": "20260529-054035_sftp__tmp_bendi_py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc6281c-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "e9332652-304d-460b-affa-5ff4f96e9697", "comment": "Malware payload (Mirai)", "value": "ae9defa23cfac7e8e1181db07f5f7972", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "aee17b31-c98c-45bd-b9be-b31e6a2a6c71", "comment": "Malware payload (Mirai)", "value": "45431a93bb87ce95c8dfac027c477738048b708a4456ed2164fbe92529ac9353", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "27ad5a67-eed2-4cc2-915e-f551b9784b64", "comment": "Malware payload (Mirai)", "value": "63c424be720c93947c942f366d003ea709a302f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "f428f454-2641-406c-b802-1a1d891618a7", "comment": "Malware payload (Mirai)", "value": "ca64dd4fd98a24f3b0f3b3da2107b8061f27ef4a5520e123a59e2313d76bd09412ccea7956fb0c5e7d14dd4ec2daf1d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "107a8045-0845-45a2-a4e4-316d1107b9b6", "value": "T1A2B2D03C1B111B98DE1EC0BE839D0B613CB41B7591829D4B6207EDD7AF9A8747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "c9b05bf3-05c5-47e7-87e3-00a03b665cd7", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiy7mdtJgGlzDpH7uNj1JAV:YeD8ZSWvZHZbs1row697qohQvg98itJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048593, "uuid": "da14dc5d-22e8-4564-b5a8-b4cb2ddea612", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048593, "uuid": "1d34d848-053f-4bc9-b716-c48d115b4c46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "d097a429-11e7-4778-88a9-dcb9b3fcd9c3", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b6aa65-5b0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780024713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024713, "uuid": "9a4d2b1c-33af-457f-a61e-2ebfa2d8a54f", "comment": "Malware payload", "value": "0ac68a243e419baf56ce088929dbf998", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024713, "uuid": "e01eb953-23f2-4257-b79b-dd8b9b50c3ad", "comment": "Malware payload", "value": "454aa25721156dff0eb2dec32628e40bcb5154f718da445c5481079a62b32d74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024713, "uuid": "fbc0e144-c935-4186-a90d-e8acc206ce8c", "comment": "Malware payload", "value": "4465cda8a2880cf380cbac055e9ca9ef53089d0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780024713, "uuid": "bfbac9f5-165d-4ed6-a74b-ebdd73609dce", "comment": "Malware payload", "value": "791e9937162ee4018f2b506a195813c16907fb9b101cd615301b6ef74e9a90ce1166cb7cb03655ad3de785cb51b28abb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024713, "uuid": "c5f90575-914f-4f81-8908-a9e4eae332e0", "value": "T14FC080CB0B253434C042EC1875D5012E428F774034B44F0C78D40F51E649940F425F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024713, "uuid": "a267bbfb-5c72-4110-b1d7-06b38f2244d1", "value": "3:O22exART6EQi3FOdJ2GL9rSL6EQzBFS/TWUKT6VVI9LJdvvvF:O2546N12GLNSL6NZTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780024713, "uuid": "0e7e8002-78b3-4d59-bc79-fc2aaad6adf1", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780024713, "uuid": "7bc3e1c4-cba7-45a6-b135-0bb9d5015ba0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780024713, "uuid": "5d8792ba-db85-4557-97af-03c712aead5d", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec66611-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036571, "uuid": "dcb27d22-e454-4ae4-b814-3ca6d9090400", "comment": "Malware payload (Mirai)", "value": "bda4072c595508fa051a9ad51b78b785", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036571, "uuid": "9d331595-1cb8-4841-93c8-7e80d2c46b9a", "comment": "Malware payload (Mirai)", "value": "45974c4e90dee6cbd1bf285d3c48755566c03e6c9ef20d0a8b2c9a9b772fa232", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036571, "uuid": "67d5c3fc-6ac9-444f-a17e-5039e180bf7e", "comment": "Malware payload (Mirai)", "value": "5959f9e23b83c8471ab9922b367dc95c42ac8d65", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036571, "uuid": "928694f3-f0a2-45af-87e5-5bd5ffaca055", "comment": "Malware payload (Mirai)", "value": "644036561fd7fb5dfd4031edd32c09ffbdad92b7b6c75df4d6983b786543a73dbd9789008adb21a4e3d5dabc700240b5", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036571, "uuid": "c4359da0-cde3-424c-aeec-77cfeae7c8a2", "value": "T19A32B417A7B7AF1BC4D027770193072162A99F916024472F7D0D1C8E5E9B3812D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036571, "uuid": "d4154121-36fa-43b2-b97d-747a015b85a0", "value": "192:xvPOR1CQOV/1NxfAzJHaCD0SdbNlDqM+2mKdc0Ew+e+f:xvPbbzfaJ6CISd1/c0Ewkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036571, "uuid": "c614da03-dd39-4a1c-8d9a-61c79a84381e", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036571, "uuid": "2c0afa01-5873-4d93-baf4-e3310ecb43b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036571, "uuid": "a7905b7c-7721-461a-87c5-6d6fa1585d1c", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f164c5b-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780073696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073696, "uuid": "f37a8705-3cfe-4e34-898e-49994955590b", "comment": "Malware payload (Mirai)", "value": "2d9f4eadc4d626c1856314ee68cb4ed7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073696, "uuid": "5f992c11-8c7e-44ed-8d04-372e2a3ab608", "comment": "Malware payload (Mirai)", "value": "47033c3121eb75b97fbf027a0d363edb1ad2a2cc23bc1012451128df746f4e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073696, "uuid": "62cb20c6-8e99-4b60-a1f8-f6827f1cf637", "comment": "Malware payload (Mirai)", "value": "4881295450e14a138a07387f3eeb7ac69d78756b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073696, "uuid": "d8221943-1be5-4011-ba2b-6f7fccc8ceb0", "comment": "Malware payload (Mirai)", "value": "726887878c30f94481c74af88d495951345553bc95d99dda2196a2bb6175d1f416d1d69c890ef7ef755b8abbc56422f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073696, "uuid": "30bd67c4-4232-4906-a1c8-4237c6f69395", "value": "T16FB35AB3CC266F68C265E5B4B0B48F792B93A960818B5FBE5577C2748043D8DF6053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073696, "uuid": "b159e0d6-fcff-45fe-b881-508db98342c1", "value": "3072:MW1Wk1jbHIORhXz731Rl3L2rDWXx4yM+:Mg5jbHIORhXz758SXDM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073696, "uuid": "152bfefe-e696-4147-861e-1bf306e8185f", "value": 113248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073696, "uuid": "90caaf43-60be-4d5d-b90c-9c3482a9fdfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073696, "uuid": "46d244dd-0d74-43f5-986f-4dc461ac5564", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76d4459-5b66-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1780063268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063268, "uuid": "3423ebfc-a7f8-43f3-af73-02f3e4cfd8f1", "comment": "Malware payload (DonutLoader)", "value": "aac4858b7d13894e0c7665584f903a83", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063268, "uuid": "090e583e-d39b-4f0b-9dd4-a043b5a479c4", "comment": "Malware payload (DonutLoader)", "value": "480c184e69a19d4f3bb595324d618eead8f6fcc5176f1ebc5e44ee1389472503", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063268, "uuid": "6fc25fac-ebda-43ca-8ec5-171f7ca7391d", "comment": "Malware payload (DonutLoader)", "value": "2f38ca78c83592c91ed2ff0b675d43b1cb009be3", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063268, "uuid": "75b182d8-bf69-4e3d-a907-dcf1b8944f1c", "comment": "Malware payload (DonutLoader)", "value": "07866b74e59ac7a566ef59a6d609a85f69500f1bd803945e3d7ceaae322e08845f1382b5c8bfe25a8a6b5c5fac9bdb26", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063268, "uuid": "f05b3ad3-e555-4656-a26d-e11ae163233e", "value": "T139360227738AE13DE06A4A3D5972D2F0553B6E116D02CD0A96E43C5CCF3B5A0FE3A646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063268, "uuid": "7818f3ec-788a-4e8f-a953-e5c831d2de29", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063268, "uuid": "2fa1efa3-653b-458d-b7db-b0d5a5b3d1e3", "value": "98304:ML8NcAwr9ehRQn2dgTQXJJZvtHbepO19Z/Rm0Wy+B42lm:HKrGjdg8DZvtHbepO1T/Rm0Wy+Bts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063268, "uuid": "d9116500-a3f8-4032-b179-e3ceef028764", "value": 5295183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063268, "uuid": "b5fbf350-da32-46b6-a4b1-4482cd79c359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063268, "uuid": "fecbcc96-bfa0-47d4-8a09-9936dd87396e", "value": "1.chation_mscate..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0256f4d0-5b7b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780071930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071930, "uuid": "4e673221-fad3-487b-b4c6-a6c258b2222b", "comment": "Malware payload", "value": "9b600122e39e4e588aaaa0438adb10f3", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071930, "uuid": "247a8de4-81a9-4d69-9932-8d40ed637b98", "comment": "Malware payload", "value": "483c41f2a77142319b4e93d393e0434486ff84b6e0f979e4aef3256a351d94e6", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071930, "uuid": "e4b51468-fbc5-4ca2-b6c8-6d5a58d7fbb0", "comment": "Malware payload", "value": "bb215aeb62175f6095bdcb51e62e3c33988531e0", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071930, "uuid": "13e491f4-5066-4c12-8c50-f3f0a9f29026", "comment": "Malware payload", "value": "c74e1858513e6b58333611c2017ff5a7bf2aded592dbbfb115e0ae6d5cf91ad0ba2d5e5c830f8e8dde090e7aef489834", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071930, "uuid": "6ab306bd-9be7-4af1-89a9-170246d7852b", "value": "T157D293B70720702AF8F7A7740F59F27D5F1ABC521E0A410588C94FA7A71A364EC6367A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071930, "uuid": "ad0ed652-e4f1-4e4a-9039-082a660ad6bf", "value": "d86a3374c3fe39b7f1f94b04aa81d5ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071930, "uuid": "76153b0b-a12c-4d51-809f-51f57c04b955", "value": "192:2WsfTgYGZfo3E9u9u9DClFE9u9u9DClGuRtnE9u9u9DCl:2RTgVcaYYD0aYYDdcnaYYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780071930, "uuid": "7d0a9080-604a-4fee-be0c-875977bf5df7", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780071930, "uuid": "06b15514-493b-4014-a7fb-cdec0466a90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071930, "uuid": "44090d41-b62d-480c-b3aa-c81ee8754949", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add11ec4-5b82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780075224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780075224, "uuid": "779c0c14-e418-4ede-9ae6-dbd4028a6559", "comment": "Malware payload", "value": "8df24100a18b3a264b077c0435a0706e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780075224, "uuid": "849c6f75-9ddf-4bdf-a75c-423408d60c9b", "comment": "Malware payload", "value": "48cf34be5d2d82a9e5dd4e4494f740b9a65f8d3c75c466da21494c1ed6154e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780075224, "uuid": "896c226a-b7ff-49a4-8437-41936b799236", "comment": "Malware payload", "value": "6667dce1c258fc5026ba65342e62a8804bcf5c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780075224, "uuid": "6b01052e-fe9e-4c14-907a-d27803783895", "comment": "Malware payload", "value": "a5b75860b18d383e7480bc91dc25866594a77e4accda3d1bf94fa02087cae5555b11255326e6338f19c51c3bd462b4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780075224, "uuid": "63958d2f-c670-41eb-a6bc-5b9be8303c1a", "value": "T1540833494475E12CD2473DB8BBD6ECAE8527232EC85E250BEC6861403EEF52647FE217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780075224, "uuid": "51da5ce2-08b0-4410-9ecb-02231ab6eefa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780075224, "uuid": "40b8a838-abfa-45a6-965d-4171d4de0bc3", "value": "1572864:7t9IKPUarUYGsCexgk5bnTGqfxnJdOZYXx5eA17:7UKc2UYGsBgUbTGqfxnUYXGA17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780075224, "uuid": "aeef12b7-da05-420e-abe6-80af32fe45cf", "value": 77480023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780075224, "uuid": "a93aec6d-0a7a-4383-9825-9301399cbf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780075224, "uuid": "aa7abe2d-5434-4183-a038-caa64b60e36e", "value": "cryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b9e6a1-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058779, "uuid": "fa4a5d46-325a-4957-bbaa-40fc71ab6628", "comment": "Malware payload (Phorpiex)", "value": "1f145e6889d358c276432fb8b19a9fad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058779, "uuid": "1ef35bb8-3757-4093-9821-baa69c06f59e", "comment": "Malware payload (Phorpiex)", "value": "49740d891262803c8b246275ac6a80bb64ee2c3fb76953b3f365f5b236105031", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058779, "uuid": "d8aefd3a-8ff8-4706-9694-a3d7a1a7aaf2", "comment": "Malware payload (Phorpiex)", "value": "4fb135f170eba5771580b502e3346b1a846e192b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058779, "uuid": "f6a762b2-ebf9-467d-8b0c-0b05f0679921", "comment": "Malware payload (Phorpiex)", "value": "2d01432826b57c0977293e0ec942ceceb6a33756f7a3f61e1b9f81591bfe9c48f09edd0e9d70f199fe74aab683e70fde", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058779, "uuid": "263f7d3a-3bd2-4549-ac05-5cf248dc7e4c", "value": "T14E824B0FF9418216D1E210B452B5867BD9799C72338468DBFBD08A9D0BA86D6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058779, "uuid": "ec7270ff-d0eb-41db-a2df-99ae16b34ac7", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058779, "uuid": "5c8bc7e7-d3ad-4952-8489-dec738f94b50", "value": "192:0IISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJs:WIblVP4Y/2N0bLu9JgPL7Nyav8U9cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058779, "uuid": "8159a3bd-ab6d-4f05-bf1d-73f2a8715376", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058779, "uuid": "912d88b8-b7b8-4b90-a1c6-d93f6f5dc324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058779, "uuid": "68a617b5-bf0e-46c3-be58-0a2aa68be83b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f645b-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016622, "uuid": "a5f985e2-9175-4f3b-b05c-8f55807c397f", "comment": "Malware payload (Mirai)", "value": "5544fa3ddb5373ed1f43318e369eff7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016622, "uuid": "4af83f68-0ee9-4e5b-8d67-e26590d5dbed", "comment": "Malware payload (Mirai)", "value": "49acd7a15c269f30ec52e00df2382b8757b5394a7cf421e3d86d49f9948e3b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016622, "uuid": "f3b5bdac-26ac-457f-b7f2-9c21b729f7f7", "comment": "Malware payload (Mirai)", "value": "b00c2ab270302604757effe9c334e6d1571ce8e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016622, "uuid": "416a22bf-bbb6-433b-96a0-d7e66ae19c5c", "comment": "Malware payload (Mirai)", "value": "6f161f16dd05678e38170cccacd076a54c5fa3a94c4109d388c25bca10dc8d650449648bd357eb6a4a2b6656bff5a023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016622, "uuid": "122ff1cc-882a-4575-991b-47ccaacd775c", "value": "T103F2D108CF039DF5CFA11D79DF98154ABA980BFCA4D1BD7241E04BBD8AD61442EFA242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016622, "uuid": "b21106ee-9081-45d2-9d8e-6afaecd03d2b", "value": "768:cGvCMXvQ4jvzuYjw00s7K+Sgxfn3XSa7uaLjC9q3UELts:cCho4zT50s7Dxfn3Xf7DLj3LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016622, "uuid": "b5a8c50b-0d0e-4d23-bb34-73badfc6b3f3", "value": 36124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016622, "uuid": "767abd27-8916-423b-ba56-fbadde79a7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016622, "uuid": "dfbb418a-6baf-4662-9ebb-4824f7e31072", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3aee3a-5b63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780061749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061749, "uuid": "47f8b7d9-1252-40f9-bb41-bfd253a75638", "comment": "Malware payload (Mirai)", "value": "29c51a1a8a619719f902e4c9b3f52bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061749, "uuid": "383854a3-c8c8-41be-97f6-fd3ed99f76ed", "comment": "Malware payload (Mirai)", "value": "4ac059bc558dfee8d337f28d0cda9af5c3dcadb0649d138e428aa49e3762d758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061749, "uuid": "d2cb6ff3-4aa4-4766-ac4c-889c3f861c5d", "comment": "Malware payload (Mirai)", "value": "c307ea69fa9aa9286b46b46b46599230a7a11805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061749, "uuid": "6a7f8664-69e6-49e6-91cd-46fafa2961f0", "comment": "Malware payload (Mirai)", "value": "45073df83450218e1f8995d517980921e5fb991633d0ab6718385dd4ecb66c99e3c0434139645edac2d9a443256c3065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061749, "uuid": "d9d1786a-5fbb-4192-b493-5710b25a39be", "value": "T144D37C07B5C0D0FDC8E9C1B44BAAE226DA73B0296235B25E27D46E262F5EF205F1D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061749, "uuid": "8eb32f1f-3ee8-46b0-97d4-1989f9bc6588", "value": "3072:OtoWBXMpjhqympwL31tnxzaAycZST+ph1hDA2LlI8SV:qKl9xZCUfe8SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780061749, "uuid": "02b10d59-9ff8-41fc-8b01-bf89cb4fbcc2", "value": 139720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780061749, "uuid": "4b9d61f3-8000-476c-b0fa-1e19fde44b03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061749, "uuid": "a719d7d4-ee95-4549-89f6-ccd6b05a18ef", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f7bed9-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780040984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040984, "uuid": "a5c1d062-e518-435b-92db-792c1263d34d", "comment": "Malware payload (Mirai)", "value": "f7a1ccec860c381a41d1119b9b051afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040984, "uuid": "664db073-fa9b-4310-be48-4566c4db9b82", "comment": "Malware payload (Mirai)", "value": "4bff8b25d25c8731d934c89f747ee55205be028cd4919abe7d72c8d89e423309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040984, "uuid": "88261de3-34e9-4be9-a7ed-75544ab28921", "comment": "Malware payload (Mirai)", "value": "d25c0d9ccc811629aab8019c11155feaa8e03853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040984, "uuid": "be853b62-155e-4be3-bc7b-ea4985f2d82f", "comment": "Malware payload (Mirai)", "value": "e710cb106ff49686cb3c5ff9550e9cb8b0e9cf34b5f0a86b1ed744e8e6b9c9685bb5a63bf5058f141568708daa9cbc30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040984, "uuid": "09e72d20-6115-4d0c-a5e6-5d72ae2fe954", "value": "T1C3E39248EE64AB2DC3E332FEFB5902CE336A1BD8B7E670218D354A5537C8B55A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040984, "uuid": "f217d6b5-ae40-4b6d-9f3d-c564f33439f0", "value": "3072:87TVt9dEYVQUNuEuJ2qVqyD7NkFTXtMrI7mohM5BiN9SXfE3:w2khiYmohM5BiHSc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040984, "uuid": "f8815835-1096-4010-ace6-da06897e1bcc", "value": 144540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040984, "uuid": "39ff6f3f-d6b7-4ee6-b28c-f482e52213e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040984, "uuid": "8b7870ee-8840-4ff5-a09e-73492fc12528", "value": "4bff8b25d25c8731d934c89f747ee55205be028cd4919abe7d72c8d89e423309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc33c49-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037589, "uuid": "10559f87-d8cf-4636-a1ee-432c95e048aa", "comment": "Malware payload", "value": "916d7d7998d4324256626fae85307e65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037589, "uuid": "7e4a7455-472e-46b5-ab94-630853896426", "comment": "Malware payload", "value": "4c57911f992d2760d089820ec5a73be433aa4f91a656f241b7fc980c98b0ba8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037589, "uuid": "a94a4af1-9e53-4d90-adbc-ade029576420", "comment": "Malware payload", "value": "e651468b160cb1aa695e36019b4b18480fad8abb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037589, "uuid": "9c4b0ece-50c5-4e9c-935a-f8cb88381461", "comment": "Malware payload", "value": "91c6cfe44bc9d1d17a3012da45bff31aecdff61c6da259e6dece7837823b456a1a9d1f4ed5e5274c72406f458216c3c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037589, "uuid": "9639621b-3241-4bd3-9943-29d43d9f1866", "value": "T1FC76DD6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037589, "uuid": "4ea6ff61-9a1c-4aff-9286-42760896ddf1", "value": "6144:GubnYpsc63SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsYwpNtVwS0msFJvXiESUWjq:3PHR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037589, "uuid": "25ddd3cf-ccf9-4abd-b0af-b3f23bb32745", "value": 7699519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037589, "uuid": "a3425de6-7bf1-429b-b0ec-400027d4ec5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037589, "uuid": "a1530a02-2bc4-4d1f-aced-9d0ea6524cfa", "value": "Update_15.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86c9647-5ba8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780091563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780091563, "uuid": "43f64be8-aacd-4bbc-aa6f-0904643d7a19", "comment": "Malware payload", "value": "bf5144823338b3c89d11aa3e57ae98c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780091563, "uuid": "d9eaba81-a0fa-4e79-8848-20ff148a6062", "comment": "Malware payload", "value": "4cf6ce197514e25f03bb1eb5aebe7cd725877844886b704271ee704d2d3332c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780091563, "uuid": "cf936ee9-d46a-4f44-8e5e-e32712fcb79a", "comment": "Malware payload", "value": "9e44ff2e3f023307aedc1224a5303b03c9e224b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780091563, "uuid": "dd787c97-6770-44ad-84f9-fb61b447908d", "comment": "Malware payload", "value": "a9f74bddc663b39bbbd5a73e705422da227c836457463a2eebfe1e78fb6eb7f6d0ed73497887947050954acf59092684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780091563, "uuid": "9a2f2ce6-7551-45f6-89c2-aac16405094f", "value": "T1D408336A69B08A7BF15F4CF81D31B812CF4CB0ADF416192BE78A912470E6553215E3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780091563, "uuid": "3a361469-c2e3-4b1f-8483-933435d3ad88", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780091563, "uuid": "413bc667-0034-4b6d-9a6d-a5f9b7505628", "value": "1572864:Wt9IKPOz+HxuLDoyQnWoTRWefXCfpSp5TFSktZgNV3sRAP7:WUKmz+Hx+oyQnWOtfXSpwF4URAP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780091563, "uuid": "812e8438-27af-4e56-b6e1-50879d3bc85c", "value": 77437097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780091563, "uuid": "8e8a1497-047f-4954-bada-eb2edf158ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780091563, "uuid": "58e9fa6c-70a9-4cf3-829a-6ce4ce40d36c", "value": "Setup_3_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d54a076-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073693, "uuid": "c766ba47-0ad8-486b-b5ab-7d0c7fc7ca5e", "comment": "Malware payload", "value": "d449edf9f5f4998e0ea07fbb3726d9d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073693, "uuid": "cef47c65-a3ab-48a7-921e-1bcffc2adbc7", "comment": "Malware payload", "value": "4da9a7ff9e1f8cf3cedfb783465dd84a8ac2d12680a0909228816b4080d29dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073693, "uuid": "8587a405-5d9b-46d6-9fc7-547898c49ad4", "comment": "Malware payload", "value": "b2b0fa1c15acea9dc05f5516f9c402eee111b0c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073693, "uuid": "670a26b4-78d8-43b0-8de0-2201904904e9", "comment": "Malware payload", "value": "dd81111d92739634687864e61bb30ccf2f9cd177b3d864e78f8edac972e1fe300ab8ba21db8def45aae86f15ca394cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073693, "uuid": "95ef72b5-67f8-47cb-bbea-43dab8176372", "value": "T177C31A45F8519B13CAC665BBFB4E438C7B2A0768D3EE720399256F30378B9570E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073693, "uuid": "1708b973-1f94-414e-8b9b-5649fe86bfe2", "value": "1536:SDyxS4XncnT8buaV4VZSaTew84ziXMcMOKdZ5K6OElb/wywApeca+yn4wX6WWnVx:bMKcnTho4Saiw84JfVIedL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073693, "uuid": "040a8d49-57a7-437f-be3f-fb5b55c1ac9b", "value": 129568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073693, "uuid": "e52d1398-cc6e-4907-b133-843e0e84a00c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073693, "uuid": "716a41dc-b627-49b8-b3ad-6c417a9d053c", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f778948-5b21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780033512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033512, "uuid": "f7023b36-9ed0-42a2-b42f-5d0f88d54555", "comment": "Malware payload (Mirai)", "value": "d05212766c93c10c9b08b0064f7a4346", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033512, "uuid": "ddd50793-0dc1-489f-be92-da55b4cc230d", "comment": "Malware payload (Mirai)", "value": "4dbc7775b799f58549e84ad33e929c6e79d0bb1d3a3e6b68815f42bdbd79d2c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033512, "uuid": "9ea86d75-1b53-4f2d-966f-05e00cb88687", "comment": "Malware payload (Mirai)", "value": "2fbaab2e068920fcdf83391efb70c5e9c0301c87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033512, "uuid": "36253a4f-e20d-40e8-b235-b9611900aae3", "comment": "Malware payload (Mirai)", "value": "91832dcc19ecd4175da85d851cfb9cc4f75e40e6eb278ae77c07719cc3549d508a5debb00b2e853d543739a421e2941e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033512, "uuid": "4e82b171-318a-4a7d-9832-d12ec3e1ffed", "value": "T1EE514D87025249397967BB23FDB9CE1C31C1D1D23CEA6F04E5DD35A95A8CD893288AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033512, "uuid": "d60dbcd2-233c-4497-bcac-ff92cde136ff", "value": "48:i4oNohml4o7onEl4oAoCXl4oEoePl4oaPoazvZl4oapoaFvjl4o9Nho9z4gel4ov:iImloEl6Xl6PlK9zvZlKLFvjltez4Zl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033512, "uuid": "e2ab0807-7314-465c-994f-7409a7902b48", "value": 2929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033512, "uuid": "7c8885a2-7308-4a28-8516-aeb6d7815c3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033512, "uuid": "23a1bc77-c891-410b-a1be-a0f1f5af29d8", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ac96d2-5b63-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780062005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062005, "uuid": "01e9cf4f-cd25-4199-a90b-3add607f3c45", "comment": "Malware payload (NanoCore)", "value": "1dea9128e695458cfeccb5d3e9bb7919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062005, "uuid": "874259b9-284a-40a5-89db-d4c7f74208bc", "comment": "Malware payload (NanoCore)", "value": "4eed8d8f0ee2f147dd5106c5d783085a3964b127f88f8e4a203896c40fb88e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062005, "uuid": "83e45ddc-daaa-481d-8f39-8b6c78cec4de", "comment": "Malware payload (NanoCore)", "value": "55e010e663de73d22d3cad0571e84f574e5d607e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062005, "uuid": "a4020232-9de4-453c-b043-df3a0694348c", "comment": "Malware payload (NanoCore)", "value": "3d05a7119bbfa556551edddf3454d5ed6388d1cfd3d7c08f4dc295e984686b4e09e73f8f5cdf1a2f00df6a729d836ab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062005, "uuid": "e54d926a-d38d-4d9d-b2c6-e6afefe9ed3d", "value": "T16914BF1677A8852FE2DE8679611202578378C2E398C3F7DF28D860B75F663E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062005, "uuid": "7eb27dcb-8b7b-4f12-b22d-5932e5ac1f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062005, "uuid": "166f5d89-ea77-4995-978e-3ba804cf729a", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRdcgL85uMwEvFn8VNtuq2LEc:ULV6Bta6dtJmakIM53xcEvFcuvYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062005, "uuid": "77b1ecb5-9430-46f2-9211-d3faaa54586c", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062005, "uuid": "a6e85a62-49f8-495c-b417-70df91d37b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062005, "uuid": "b04805a9-e556-41cf-b534-202c10c74ad4", "value": "sh4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dec36e2-5b79-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780071305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071305, "uuid": "b15e6364-1495-4bd3-90a2-377633d4b8cf", "comment": "Malware payload (NanoCore)", "value": "1ecf0c148b0e3c754b930620e87aa329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071305, "uuid": "5bcfbaac-48a1-4b75-b185-70208ac6a884", "comment": "Malware payload (NanoCore)", "value": "4f2dcd1f7f75bf675eb9a6fb82786f75060aec246d76b493c4599b8388535d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071305, "uuid": "fe98f338-aea9-4363-9e75-c2dfb9226818", "comment": "Malware payload (NanoCore)", "value": "6ca56b6ddecacded481adc211ac7dd133704421c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780071305, "uuid": "9bd6b1ce-e8f6-4155-8281-2825cf56b14c", "comment": "Malware payload (NanoCore)", "value": "9cc13528ca37576f9ad9d863d3df9fa2efe1501a0497c2aa425be6af24ae46f671ff3484c36ba72da28808d3d1d54951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071305, "uuid": "7b0cf817-21a9-4fab-b70a-ff0d8f568f45", "value": "T1D514BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071305, "uuid": "e272eea1-d2a5-421a-9ca0-eb48a3bc5887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071305, "uuid": "db3f1ad5-47a9-4286-a0a3-20a6557e7381", "value": "6144:sLV6Bta6dtJmakIM57BGmPDZ1ZgJB6QUWT3:sLV6BtpmkOBGmPDZ1gB65WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780071305, "uuid": "d0fcdbec-7946-47b3-8065-e944b71d7a46", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780071305, "uuid": "703ed1ca-b84f-4a74-918d-fa9a0b8e47ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780071305, "uuid": "25fad6b7-2874-4783-a24e-bf33e52de622", "value": "kim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e90e4-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058642, "uuid": "f927486a-7e97-4bb6-923e-0ae267efa844", "comment": "Malware payload (Phorpiex)", "value": "00ec1e9f4d4152c376fee8f02a572c20", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058642, "uuid": "287cef4b-9ca2-4a3c-8570-07761f9972c7", "comment": "Malware payload (Phorpiex)", "value": "5076fdc39445369e67daaccb7ec1699107a5f227aaaec978ec9d77d966124f3d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058642, "uuid": "6ad16dfa-3b3e-4e3f-af70-7a2a1e256ac4", "comment": "Malware payload (Phorpiex)", "value": "cba3637aa5b1bf64bc52574277e1f5fea350664b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058642, "uuid": "3fe57a05-57d0-4f36-a730-2cc25a6eb0b4", "comment": "Malware payload (Phorpiex)", "value": "80a7852cdf9962762c4bd094bf7b8be22445c7bf319c67216039ffb518070686d4b66ae29be3056cf2313533f0ed7ca0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058642, "uuid": "9dae1df2-6838-4da7-ae4f-2a2f0ce44477", "value": "T1EB824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058642, "uuid": "2fbf51ad-4e72-4548-9a82-21f98da93507", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058642, "uuid": "95781929-7630-4fda-8124-c6763cdcea51", "value": "192:CIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJQ:UIblVP4Y/2N0bLu9JgPL7Nyav8U9c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058642, "uuid": "0454aadf-0236-4973-8c59-0d76dda172c1", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058642, "uuid": "b7bba65b-79bb-4bdc-83aa-bfcbcad95568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058642, "uuid": "afec60d1-1ea6-4327-98aa-ffa12bd09bad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226891e8-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037624, "uuid": "d1ed1fcb-2c0c-4165-89df-a811a6d41a6f", "comment": "Malware payload", "value": "844600b452c71b5a6913d83fa71f3831", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037624, "uuid": "2aa30d54-01b6-4899-877f-54ebf7edc47e", "comment": "Malware payload", "value": "50a8668bad8043c6fa7610f0fc8bb119dd998e183f20a15e78f32efee108a753", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037624, "uuid": "7cb276b6-f2ae-41c9-821c-61b1fa8ebe0c", "comment": "Malware payload", "value": "a68e9bfa59f2f81542093b71c423ce4567255eb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037624, "uuid": "42bff08e-3097-4984-838d-320199511b53", "comment": "Malware payload", "value": "8924ab95f2e80efb1a03be89729c03fcd88143e3125e81655e328719c52a40795606bb281f9d748334641528559579eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037624, "uuid": "167e4dba-d6b6-4385-b886-bd4f831d3478", "value": "T13F76EE6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037624, "uuid": "b8603b3e-cc13-4568-853a-e288cf2ffc0a", "value": "6144:SubnYpsc03SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfJg9wpN+VwS0msFJvXiESUWD:bPUZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037624, "uuid": "51ae41b4-f63f-40cc-b70c-12d378a01543", "value": 7420361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037624, "uuid": "e5990de7-19ca-4d10-bf44-5ffddac20c3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037624, "uuid": "b5e1a890-f4a8-4ae6-8187-b396b1bc1cf2", "value": "Update_6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e275f12d-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037517, "uuid": "b1704f5f-1f64-469a-a3d5-c095f2a8768a", "comment": "Malware payload", "value": "a84037d887c729b297d3f79cefabe7a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037517, "uuid": "04331895-ee68-4e01-8718-564016d45060", "comment": "Malware payload", "value": "5126076d59dd812f922dedd8fcc4a43e5dbe383a412b094ab275079ccb820a3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037517, "uuid": "5a1ce137-5f10-4940-9c67-aebba7aaf81b", "comment": "Malware payload", "value": "df8cc87380f7779e8ca940258ebb50f56cad5531", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037517, "uuid": "7a74a176-5459-4b4b-a15b-e6835d565115", "comment": "Malware payload", "value": "7567723101daeedb490f0015dc35754b33b2426093de852c9bbc310ab0f2090b993f9481eaf3941830ae8c7887befc24", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037517, "uuid": "87d48e2b-4776-43e5-946a-3dcbe15af46c", "value": "T1BE96DFAB6DDC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037517, "uuid": "89bac0b6-1ed8-4d95-8406-ef591f1bdbdf", "value": "6144:qubnYpscM3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfs19wpNQVwS0msFJvXiESUWd:1Pgb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037517, "uuid": "15147a87-beca-48bb-a08b-957db58409c9", "value": 9149370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037517, "uuid": "a9ea81d1-ab7c-4631-8be5-de0f9b68e9fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037517, "uuid": "950936f1-347d-431c-b551-b35e226ffcbd", "value": "Update_2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05040c56-5b64-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780062056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062056, "uuid": "3e1cafa1-2ff2-4942-8a1e-eb9a31c19a02", "comment": "Malware payload (RemcosRAT)", "value": "c9be80b675c5b5b32bd399b831385e0e", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062056, "uuid": "29bff87d-f102-4212-96c9-bbe6aba891c8", "comment": "Malware payload (RemcosRAT)", "value": "522ff9a14cba958db505cf1a0d850f9d92a6394c0383952d0914086fdbc58f3c", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062056, "uuid": "56a6941a-ce84-4871-bd04-78e2e10e2837", "comment": "Malware payload (RemcosRAT)", "value": "d22a02a99a38070dd393760d173ed4b0e64f5ade", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062056, "uuid": "58e730b3-b2d9-419e-8174-46c9c022403d", "comment": "Malware payload (RemcosRAT)", "value": "c5d01d5e260b3539674717e2c6de8bbb928ec278393d0e0dcd31470f8f408c335f202af066e2c2ba8917b3fad20469d0", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062056, "uuid": "1a7451c6-7522-4f7b-9f47-5387627ea91c", "value": "T17A93D813FA4AD0B2E42591F146426F32CEBCBC3736492173D38FCA419D79892D456EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062056, "uuid": "ab786eec-1b00-4d0e-bbb5-7b18953f1751", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062056, "uuid": "a2a58c6e-90eb-4ecb-b0fd-b98826bd12f4", "value": "1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6hru:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062056, "uuid": "394a01cb-0322-426d-b12a-8492a4ebb8cb", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062056, "uuid": "19b80d32-49b2-463c-b631-57874207945a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062056, "uuid": "4a1cc6c6-4425-4b8b-b8aa-511854811a71", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e583618-5afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016974, "uuid": "9aa11957-636d-4e6f-8bbc-98a2a92cacbc", "comment": "Malware payload (Mirai)", "value": "99e5a2c2b1ba63704b7d37aa45eefc2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016974, "uuid": "18169ef4-97f5-40e8-b35d-92fd0a481277", "comment": "Malware payload (Mirai)", "value": "52c8c652238399606d98af098d941f308529c0401dba9915bd50350bdf5ab7f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016974, "uuid": "78aff3d2-3c51-4eb9-8aec-a9566474dd81", "comment": "Malware payload (Mirai)", "value": "2530374f28e12efee486e6ec44fdf537cdf441db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016974, "uuid": "11f7edb8-aec7-4bcb-b8ce-ddd2b74ff067", "comment": "Malware payload (Mirai)", "value": "5fe8bdc35a75897c594f707eb7c79ce4c90988e096aaabee00df9831ddff513856fad94017b63806dd81758d2399bfc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016974, "uuid": "c8dcfc36-a2d2-46c3-b11e-927402da144b", "value": "T1F1B31975B914EB3FC80E93306873C76016D12DB12E926ABD3268EB9C7E3515B1E4B5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016974, "uuid": "693572da-41c4-4acf-98e9-c74e144c6d2c", "value": "1536:mDgrqSvuaUyANk0rtcFSDyubQmGr26UMBTZadawtSSFZeKczqgApmsIuAyWO:vqSvuIANbjDywQmCz4awcSTeKc+gApmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016974, "uuid": "18bc1a20-80d0-49f7-9f24-068036924bf6", "value": 110988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016974, "uuid": "c36025b4-a7df-44c3-bed3-229ec5a9cdba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016974, "uuid": "60c8bfb6-455b-423d-9e38-57bf04799b9d", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb29032d-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018660, "uuid": "91e6182a-4702-4928-8d2b-63ba8b9ff2b5", "comment": "Malware payload (Mirai)", "value": "0006e44bdee3b8ed834d4623be5e445e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018660, "uuid": "614d23b4-9a4b-422c-9a5e-440e3f72dffa", "comment": "Malware payload (Mirai)", "value": "53beee68bf3f2e1303e3f9f4736fdfff9b10f4d57b14f27d128ea6e3e54b5bb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018660, "uuid": "be4d25a6-b99f-497a-8655-5efc3d4a2014", "comment": "Malware payload (Mirai)", "value": "338957c4b56b56d4689bd284c7a2f9c034b48454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018660, "uuid": "e5db21d0-f87d-4b9f-9620-5b14206520a5", "comment": "Malware payload (Mirai)", "value": "9db0e02f029acb298b4b2cfcc298f6d8bddd174e9a0fc7c0e7eece9ade141231c5f0de860994a8c8b1bff6f56536e16c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018660, "uuid": "d0ff844e-6537-4f3f-b81b-2e43423386a4", "value": "T1BDE307D7F900E9F6F80AE33748530906B130BBA249925A373257357BED3E1D95463E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018660, "uuid": "9dfd9b61-1dcc-45df-80f7-74d125924d08", "value": "3072:JphJfif5EErUyBFwEy7jZFHhkrKK6K8rVHjbiLLsCKi6u1:JHEUyBiEy7tFWF6K82LsW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018660, "uuid": "7dcc59a5-4ef3-4d3e-ba9a-031e80401e2b", "value": 147936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018660, "uuid": "d7e07a13-6110-4954-9542-07bec31e6f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018660, "uuid": "15547987-e553-4b81-8aaf-024b4c882f21", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea031a2-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056730, "uuid": "9f6d7a7b-afce-4c9b-97cf-a3839d4a3563", "comment": "Malware payload (BlackMatter)", "value": "ebd66b9e9216335c1f8626e47897d354", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056730, "uuid": "07432e9a-a78c-4b35-bf70-97682c1ec29b", "comment": "Malware payload (BlackMatter)", "value": "53e315669d72051a4add2e28938733dc116bb46fdc05dcda1958e7ea466812ed", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056730, "uuid": "118cf2ef-dc2f-4047-ba93-86255b80b450", "comment": "Malware payload (BlackMatter)", "value": "4491158d1db3d03f4d90850913a037d56fce4e11", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056730, "uuid": "18a188e7-9f71-48de-86f9-6885783c5368", "comment": "Malware payload (BlackMatter)", "value": "c228c5e4bf7d0b8a2ed067835096e7c804794f88ac0c6ff66ecda9ced4dacf4cad1d52d40dd1ffa1f76d91b073c41954", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056730, "uuid": "577efe95-0a8f-4eda-a637-b05cab78e03c", "value": "T1C7E36D21F212D0B3C83719F53B3675B2F39E8D6C19A96807DAD80F99BCA48232F45597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056730, "uuid": "4f0a8a17-6db2-4072-b1ca-65023a2d45f9", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056730, "uuid": "bcbe0426-9868-4b93-bf76-a7f0753ef825", "value": "3072:Z6glyuxE4GsUPnliByocWepNR+Bh0qVhm4ysEh7SD:Z6gDBGpvEByocWeHMBh0Km4ybwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056730, "uuid": "acea3d27-bf7b-415c-9505-bc26f09a07cd", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056730, "uuid": "4892a722-8c5e-4f0d-bf87-49d050f0ef6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056730, "uuid": "0faf67ae-371b-4ed7-9606-f3e7cf4c47b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d006b53-5b58-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780056915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056915, "uuid": "c86da76d-ef7c-454c-b2eb-e010d2f14070", "comment": "Malware payload (WannaCry)", "value": "a787df5babe621dbb775d18d1111b9e2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056915, "uuid": "6a8e8b58-bbdb-446c-9a49-3d5e94985d77", "comment": "Malware payload (WannaCry)", "value": "541c9bc518635762bf9c14baec63c2703e3d9887246d3816865c95e2e430bfff", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056915, "uuid": "b7dfa660-33c8-4d4d-a52c-3acc315c7383", "comment": "Malware payload (WannaCry)", "value": "c4a99eefcf99df6ede95867dd76535ca83b2f950", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056915, "uuid": "e813be96-5f9a-4a83-ac07-c1da56520cce", "comment": "Malware payload (WannaCry)", "value": "f3b49f56cc55596f01b92458db89d32d4f19d6c53b253e20dd0b9f664bb632f3762f2dcf5a8be85cfe5c977a38353dd9", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056915, "uuid": "cac44154-efa4-41f3-bb00-36cdbd38cc91", "value": "T1B63623593278C1FCD10615B844B78E66E3B37C5666FE6A0F8B40867B1E03B56EB64B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056915, "uuid": "76dfcb6d-8ba6-477d-81e7-9b2733478c35", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056915, "uuid": "c3be31ab-9bcd-42a2-9278-ebba4f60ee10", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H:DyDqPoBhz1aRxcSUDk36SAEdhvxWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056915, "uuid": "330ee81b-fc9c-48ac-b4fe-04a252644a6b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056915, "uuid": "4f4d2053-6323-47b5-be2c-31699380d4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056915, "uuid": "5d67278d-7da2-43e3-858a-3e4ea47e54b8", "value": "541c9bc518635762bf9c14baec63c2703e3d9887246d3816865c95e2e430bfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3920c880-5af2-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780013181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013181, "uuid": "02983eb6-df60-43ed-a486-089cd4d16e7b", "comment": "Malware payload (ACRStealer)", "value": "adc84ff571d5b4049d4023c0b7461d52", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013181, "uuid": "bec859d1-565d-4191-84a6-e897eab55196", "comment": "Malware payload (ACRStealer)", "value": "5588efb268c8bcc40cf1942db862387ccd2f4f8ca88464c0d316faedf90f80d5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013181, "uuid": "fe6636db-45ca-48d0-9ff0-81ff633ff75b", "comment": "Malware payload (ACRStealer)", "value": "95a538ee4e1005bbc59bd7d00c6c10270b7c4bb9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013181, "uuid": "8bdeeb44-8593-442b-bf52-c5a6fbe8758d", "comment": "Malware payload (ACRStealer)", "value": "b79ceaf78cce4ef52e04ce59a6fcfb34719e9e6ae5c83bcaee5bc6f119032e6cd50c15dc6f28104a610657a2fd33dd15", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013181, "uuid": "9f51abe1-c1e5-414e-b130-b44e0384d240", "value": "T1A1B59E42FCDB24B2EA06513218B2E2AF2731A9091F359FC3D940B77ABC775A51933365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013181, "uuid": "435cc923-70dd-40f1-9a34-a8ed2efbe257", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013181, "uuid": "8ce42bcf-798e-48bc-82bb-e0680eaac7ac", "value": "49152:PrBvcNujA1yJKQqBkpGqui/Dah0oYD1a33:zpcNWA1V3Du/Dah0433", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780013181, "uuid": "86555156-a553-42e7-808e-339e83e3b1df", "value": 2347720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780013181, "uuid": "b9d4a9cd-9a5a-4773-af53-eea20dd14734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013181, "uuid": "456effb6-62b0-4394-a4b7-c91f63a96a3f", "value": "VKkQj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf006e97-5aff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019016, "uuid": "b1a4e0b2-27cc-4c72-9092-0388fa9413af", "comment": "Malware payload (Mirai)", "value": "3abf120459d0413daf6074da92d19746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019016, "uuid": "467e2f08-df91-4d1b-8085-73e4efc83829", "comment": "Malware payload (Mirai)", "value": "56ab4b2c5af8a909546f9d593ceb185f9dc3cbf7ed6700c5b7ab5dc9680fde40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019016, "uuid": "36dcf319-b52e-472b-8a0a-dd8485c33dc4", "comment": "Malware payload (Mirai)", "value": "19bb635f3244c50c392583da9ea64766e6d14430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019016, "uuid": "a1f8343e-8793-41e5-87b5-df777b7fb4cf", "comment": "Malware payload (Mirai)", "value": "4ce2069e876163f7e6b0c956c183036d40c4e44fa2c18a4a4fd40e2af8ea5fca064141b7f76497851c941df507229540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019016, "uuid": "c223ec77-3db7-464e-885f-afff1825c1ee", "value": "T177535C45F783E0F4E94F0671111BA7BD86349E165018EF2EDB947E72AD32A12E21B71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019016, "uuid": "78b54146-4bee-46f9-b107-0d36b11b2c15", "value": "1536:cqcKy1UTZllOqUG31ElxjbWodkQdU+NvNvr:cp1UTHl+P3xdUc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019016, "uuid": "4d72a81a-c91f-400c-9782-9a6e7dc81026", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019016, "uuid": "da8e4867-6be8-446d-93e7-30e87ae5fcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019016, "uuid": "459939e0-36bb-4461-9c8b-aaa8aca2b22e", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20461d8f-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1780038479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038479, "uuid": "9d058979-1210-47bb-a819-bafee9a66ac8", "comment": "Malware payload (LxBaseRAT)", "value": "33684f618c42ada10f5bbd38059427dc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038479, "uuid": "119cca4e-69c2-4c1b-bf47-781a8000f547", "comment": "Malware payload (LxBaseRAT)", "value": "5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038479, "uuid": "bfd97225-d42c-4413-b4ca-6eecd318a21d", "comment": "Malware payload (LxBaseRAT)", "value": "7a60a9c1816d66f2c3cb3aa1366c95e6fbd3b158", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038479, "uuid": "27811f9e-8594-41bb-a1cd-b03d8df394b5", "comment": "Malware payload (LxBaseRAT)", "value": "b9c4fb234c0715e868a242100e0c1b123b1232f4fda01e4ddfd57fa8eb4f5b96ab76d3c7cada42ba4db3e5b01e95d2e0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038479, "uuid": "dd3456c7-c781-4f23-b012-ba837c78d683", "value": "T138452364542A51DB0D11D1FFF326B4A9318E33DB0E866326025AD2E630F89F55AA7CF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038479, "uuid": "ef959e19-d711-4851-9950-29015af577ad", "value": "24576:eGyxl/k7gGVBIB4G2CpytdXCcCxuS1uY35rWQ4toxX2pny1yaah:conBIB409cHI+eXayU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038479, "uuid": "1a43b47b-0a58-404f-b319-be9e2d16ef7b", "value": 1181509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038479, "uuid": "5b2ff7a2-418b-484f-87d8-19c8e4cd958b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038479, "uuid": "f832e88b-c710-4bea-a061-e76c08e3bf5a", "value": "LX_2026815111.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6361cadf-5b3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780046323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046323, "uuid": "388ec239-2c23-4571-8739-0362cb468c54", "comment": "Malware payload (Formbook)", "value": "2ce037d5a137a811502826ebab3fc675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046323, "uuid": "78fa6086-fdfc-488b-86e5-2c129b3dfd99", "comment": "Malware payload (Formbook)", "value": "5b4f596d3cf54c94c57934ccc75e31d7f5999df9abb1b77ff6f8cff007da8d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046323, "uuid": "76d8d9a6-50b0-4c2b-ad66-d192743ecccc", "comment": "Malware payload (Formbook)", "value": "28f9b21aeb34919ca6e24f8c6367fcf66ce92842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046323, "uuid": "2dfe3392-c176-407c-afce-306d8aaf0ae0", "comment": "Malware payload (Formbook)", "value": "363590e0944228f9e9daa243f682047adff1674def4102eabb7c98e0583c848a7f070abdad885a4f8455691a2ce6dcdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046323, "uuid": "3c4b90cc-945e-427a-8106-fce746e2b1e3", "value": "T16D350214231ADA06D4FB9BB64870E37006783E48B675E3078EE97DEB783679258583D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046323, "uuid": "c72261d7-4aa0-4c47-b585-f4f6b006f086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046323, "uuid": "e715b4c6-b335-4b32-ba0c-c26c66cccf50", "value": "24576:7Rux28K6ICqbXLnNdure1p3PRPENpW2w2T1PzlR:7t56gN0ep5PEpfw0BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780046323, "uuid": "5b5e3304-e986-4fcd-ba68-6584a679c4b7", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780046323, "uuid": "a1e593a8-134b-440b-854a-384145c5dfcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046323, "uuid": "b541abd9-ba5c-452c-857d-6a6a7511ca1b", "value": "DWG-00141842- MENTORTECH Request For the Quotation information 3001410 - 20260521 GF8017.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530d1acf-5afd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017949, "uuid": "10754349-1d5e-4b6f-a658-76e11b251d83", "comment": "Malware payload (Mirai)", "value": "a24a2b101d41ba22936c6b6f36dee3fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017949, "uuid": "412faf8b-fc7c-4744-9cb4-a7714b799ce3", "comment": "Malware payload (Mirai)", "value": "5b82a54f9d7cfb9fe544d50961fcb213a1964d2bedfea0d6e6866f067e9293c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017949, "uuid": "f0bd75aa-7e1c-472e-bd24-3905c1bd4a0a", "comment": "Malware payload (Mirai)", "value": "861a7f624c4e8c36f18fe4b78baac6c47693b707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017949, "uuid": "9b2e077f-33fd-496a-beae-7b173d5f53df", "comment": "Malware payload (Mirai)", "value": "0ae01a08eec555f40f000464b0dcb846536f6410a1da51f09c439d6cfae78f927f7e7bbea14e1cb497c421db9e8e5203", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017949, "uuid": "e8da50d8-3997-4af3-953c-3714770e65b6", "value": "T141735CC5F603D4F4EC1A06B4207AFF3E5FB6E17F122CEA47DB905A23A841602E51666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017949, "uuid": "88007e0d-47c3-43c0-9049-97b944ca35f7", "value": "1536:Qz/fuxjsZ4J7sID6JEcXu+X05KW0czU2zxo4HminaRSzg+GhSu:Q6xjsZ4NsE6J9u+W0QpiPiawz8hSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017949, "uuid": "9fbad36e-3b50-45d9-a666-247268ff9978", "value": 78608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017949, "uuid": "b9e9bd4b-c606-409a-8314-db2e18c25e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017949, "uuid": "6508f998-6459-4611-92f3-27ed5a30e3ba", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02873dc0-5b12-11f1-a769-42010a9c0008", "comment": "Malware payload (AnyDesk)", "timestamp": 1780026833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026833, "uuid": "3389feb1-70b3-4935-8440-1576f8c393d7", "comment": "Malware payload (AnyDesk)", "value": "53a087452c8bab6b4959141d6df07181", "object_relation": "md5", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026833, "uuid": "40004324-137f-4e9a-9a09-41cb07886dd5", "comment": "Malware payload (AnyDesk)", "value": "5bf2945ceaaac681fad1b9b999c6620ce8393f919179ce6ca0fef5b411e984e5", "object_relation": "sha256", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026833, "uuid": "897774d2-4f9a-4ef6-8c9c-9fe2b993a97d", "comment": "Malware payload (AnyDesk)", "value": "ecc9a556d1a458f9e39ddc80a33e26059c1e263d", "object_relation": "sha1", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780026833, "uuid": "7a876105-79bd-4fe7-bfdc-ba51660eb221", "comment": "Malware payload (AnyDesk)", "value": "fa4b4686b2f846497abdd5fc1071f93b28d87344f230cba56263aee1f6068662adf569413493c906297d6bad19fe0426", "object_relation": "sha3-384", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026833, "uuid": "d93e8c04-62ce-4e4f-b673-0e82613bf093", "value": "T159863395D2D68677F261C570BBC3220587E1FE600F61948CF45EEF32C9F32912A96E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026833, "uuid": "d7fb8794-dca2-4e42-a325-4c12880b0383", "value": "196608:pbjOBuwl3DddCPC38Gk8QJuQSV44SI0Pg2jVZl2i16IyWn:NOBuwlJkGk8QJrSVcBPh1gWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780026833, "uuid": "77c358e6-884e-4dd0-b973-16cb45bb4a38", "value": 8277432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780026833, "uuid": "96c216d4-fd3d-40d5-8bae-e41aa81a8c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780026833, "uuid": "187e7130-4efb-4354-999b-7ef6f796de54", "value": "AnyDesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18361f29-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037607, "uuid": "ad42f701-76a3-4107-8ebe-388348574184", "comment": "Malware payload", "value": "d8e1eb4966ce67e0bb6221603499642f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037607, "uuid": "19b4f2fa-cb4c-47c0-9e3d-4dfa458455d5", "comment": "Malware payload", "value": "5ebd96a1eb9cf6179dc7ea68b5b221c7aab22c460567071a930a11a24cd03f8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037607, "uuid": "b3947fb7-8ce7-4da7-8986-ca59a40aec3a", "comment": "Malware payload", "value": "6fbc9fa389a87bd3b5f1ebe074f4bebab0304407", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037607, "uuid": "158048d0-e2dd-4782-848a-dd77988b1582", "comment": "Malware payload", "value": "bc7ae58208bda6ad457bba6d2b85ca3591b29cf4ff3e5bfa0bf084c794c8badb0dbbf1489d3be3a5c75e8f47b1ab4dc4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037607, "uuid": "96673c23-cd78-4b44-a97d-f17ebc3d25d9", "value": "T14896DFAB6DEC361D3000B1C2F48521F5E6621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037607, "uuid": "393ed31b-55cb-44de-a6fd-7ce4eaf1a6f3", "value": "6144:/ubnYpscp3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsw9wpNQVwS0msFJvXiESUWq:DPBqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037607, "uuid": "4e62de2a-85ac-484d-a96f-73d2cdea6cb5", "value": 9227899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037607, "uuid": "9003851f-af0d-409c-b07d-ae95d45e17a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037607, "uuid": "a7331f3b-d58e-4145-b030-0ecd66fc0196", "value": "Update_9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88489097-5af4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780014173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780014173, "uuid": "b85fea9a-f807-4ba0-acac-dcc748527361", "comment": "Malware payload", "value": "742da938ad02627dc96a328a53bc8a1c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780014173, "uuid": "3092f60c-fde6-4636-933e-b43a260bbdb5", "comment": "Malware payload", "value": "5ef623d696ac40bb710cd841fb558136c8325401b08cc680f8cb56fc16bc9917", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780014173, "uuid": "7daffa91-6fa5-4e39-93f1-43a56682651f", "comment": "Malware payload", "value": "b75cea61c33a17eaa5877799d01533a2baa202ce", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780014173, "uuid": "4386b0b7-60b4-4e7a-b32f-8ddecc36fad8", "comment": "Malware payload", "value": "f56ce4b3ae7d321376be7a8bff78b9e34f966492478a574ed82b34b4fcac470a6242eb1199818b549f6ec0be1c30c6ad", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780014173, "uuid": "2bdc68c8-d684-495a-a431-958a9272f1c6", "value": "T102B57D0B7CE049EAC0AA633289A362927B75B8490F3223D72E50B77D3F72AD45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780014173, "uuid": "9f2c6f89-fd6d-48cc-b027-49f4b18f0358", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780014173, "uuid": "5018bcff-e7d1-4454-b52f-e327c1d6dccf", "value": "49152:Fictft7sqeAObaMzJ+rwyBf+i/M9qn8WlX3+p:FTMdaSJ+rwyBfS9qn8WlH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780014173, "uuid": "bd0fe519-94e4-4d5b-8a82-65bee90f052f", "value": 2397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780014173, "uuid": "617660d3-0b7f-4cfd-bc32-e379dde63748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780014173, "uuid": "26241d84-b3c8-4e47-a20d-68ca577269df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecb09d7-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089104, "uuid": "fdf6d8db-77af-406c-b482-0893389cb80a", "comment": "Malware payload (Mirai)", "value": "6734dd74b904854ae5b794345b8206a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089104, "uuid": "43523725-0187-48ea-bfc9-a6270671008a", "comment": "Malware payload (Mirai)", "value": "5f7aad3cd758c51387940f9899324d461bfc58cedf819594f3b002b42ddbd4cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089104, "uuid": "e6d54644-a4a2-4c7b-9eaf-66412442ebd3", "comment": "Malware payload (Mirai)", "value": "ca7417e6a9fd09738bd2e1419004b3320d0c39ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089104, "uuid": "ab7bce9a-1dbc-4db0-86b2-f0a3266df228", "comment": "Malware payload (Mirai)", "value": "94a8bb90b533aa675a41d58af732a28d8d6c8b884a8cc7384058fca3b56428207f5bca5829e257a43f000aefcb899dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089104, "uuid": "28676ada-cc5a-471e-b4ab-30e9ae246a3d", "value": "T160D3F8C7F900DEF6F80AE7374853080AB130BBA205925A776257356FED7A1990477E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089104, "uuid": "71224353-35ef-4483-8eba-b81570ad7754", "value": "3072:Qv/7+GExEOyFczQVfZrj6Kc3v0j/sEm0vEVhjbiSLgcMlYtPs:Q9OyF0QVfA3o/m0ALgws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089104, "uuid": "1c56733d-a7c8-4bf8-a330-4a0b79081dcc", "value": 140704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089104, "uuid": "3c00fe7a-2d87-4291-bb46-50eba3db9a26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089104, "uuid": "cf1ba034-52b7-4a6d-bbd6-0bc43005ded9", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce766c84-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016438, "uuid": "56dece5c-e576-458b-a818-61cb9afeb7c4", "comment": "Malware payload (Mirai)", "value": "9ce5477acbfa226097a22ce8afee6e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016438, "uuid": "0cbcbd4b-432b-46ac-a1f5-bea41eb0a47b", "comment": "Malware payload (Mirai)", "value": "5f961b539c7f75781cf706024d29dd900f909e723c3d56029ba013f8e073fece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016438, "uuid": "07485178-fc37-44af-b046-927238cc3ad8", "comment": "Malware payload (Mirai)", "value": "5f21c8391f53eb3cdb755910f6e4f18a27f0da9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016438, "uuid": "21218614-3acb-43a7-bf66-35f5ae57e98d", "comment": "Malware payload (Mirai)", "value": "43ee9494bca2a1cc2ff184cf5505ebf5684ae1c8a12c86b338121273a323c76608a9084650da6c69d75fb0b5d89b71e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016438, "uuid": "83e1f5f4-c342-4bd6-9cf9-c786217590cc", "value": "T17343027E426F4DA2E17160B6EB7441D0A81EF838F3B5407DAE141A78E9C18E995AD3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016438, "uuid": "aeb225c6-5962-402c-8257-aced9f9ade05", "value": "1536:Cxq/QuStYrPhk34OkPLIXMyYxMNn3POm9hjErLNLCIgvxVIr0V35J:EBuStoJMrkUt2NLop5V35J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016438, "uuid": "15183201-e67e-4b73-8db0-9550d21020fa", "value": 56532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016438, "uuid": "80874a62-7ea0-4ec1-b996-43bca6ca705e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016438, "uuid": "6720cbbc-2383-45d3-b2ed-e0118a462365", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e44b41e-5b35-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780041992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780041992, "uuid": "01354b8f-a7a1-4222-a609-8ffda764f883", "comment": "Malware payload (GuLoader)", "value": "d3361c4dc0fe16054902f8dbd23a2332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780041992, "uuid": "e3ab566a-9d4b-482d-b5e3-60f50764b227", "comment": "Malware payload (GuLoader)", "value": "600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780041992, "uuid": "ee4d8d3a-bc7f-456c-9a63-4077be19e1fd", "comment": "Malware payload (GuLoader)", "value": "ba8065c9a5f88892fa9c80b267ea93ed7982d7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780041992, "uuid": "1cb853a0-3670-428f-938b-96658d00d666", "comment": "Malware payload (GuLoader)", "value": "174fc58d9b7da11c6eb2af50c2a3f4345b9faab728476608adb3c7e3865b771ed4f280af8ba806f85d7e19568587ad84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780041992, "uuid": "06e80863-d403-4c5a-ae75-a434b155b124", "value": "T18704E0A57150C877C4D206B018BA82F5DBB79E981061EB432F513E9FBC36AB6D91F243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780041992, "uuid": "a5101820-fe8a-40dd-af64-bd98d7755bfc", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780041992, "uuid": "b233e3ed-c6f3-4490-9360-da5a856efbff", "value": "3072:buL3hi8lMcxV66ziJR5dA6TIziPrT6PM6ErqjJTtQ2fQtBtLtV:b0hv5V6fRA6TI+yPt+qjw2fKjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780041992, "uuid": "b8c5e6c6-81e9-4517-bb83-1f0a2ce306e2", "value": 173648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780041992, "uuid": "1f17c540-8aaa-4ec1-98b0-fe57870262a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780041992, "uuid": "0626b009-93ed-45b7-8130-1a9a5d91e314", "value": "GARPE (339) LISTADO DE FACTURAS PENDIENTES DE PAGO.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb483af-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016436, "uuid": "ce9171a1-0e95-483c-aa56-49234bfad9bf", "comment": "Malware payload (Mirai)", "value": "44925dac791182cad0303a1ce8c7faf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016436, "uuid": "a370e691-88e4-4553-9107-daa42cc2e3b4", "comment": "Malware payload (Mirai)", "value": "60586e82588a9890bc7579c255ffa0e5450d2decb5ed09bf86b20aeea6445b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016436, "uuid": "fc02fe83-76f3-45b2-acf2-3be4fa5d74e5", "comment": "Malware payload (Mirai)", "value": "47459f4dc3b7017ea9670e32e5152d28be5b797b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016436, "uuid": "b89d9826-9fa8-4bf4-9ad1-77367eca4db8", "comment": "Malware payload (Mirai)", "value": "431a7fb93c1d6be5d83a91a6795ab95a74fc02feb6cf2bf124fe14f0ed63ce251408fb4ad352ca163b81fa8458e7c64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016436, "uuid": "f9ccc3b8-4fd5-4590-800b-90923a20b3fe", "value": "T16BE2D021630F37B5E3B16C38AF3D09076D530AE5D2CFB0B1792A157AEB922456AB054A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016436, "uuid": "186330b9-941e-48c0-92ba-39db8a7a77be", "value": "768:0CjxVtQhR7kz7hQhVU5p86qq6rX45s3UozS:0CjxVnpQs0Q6L4EzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016436, "uuid": "cda07eb0-aabf-4044-8e94-f29138fddfef", "value": 31376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016436, "uuid": "12cc2611-f6a1-44e3-b6d8-e708b6fe658d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016436, "uuid": "3c8e1f4f-c7a3-4672-8b12-1269d17807f0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05e2d4-5b00-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019336, "uuid": "a08371ee-0b4c-48aa-a275-b052a57dc2dd", "comment": "Malware payload (Mirai)", "value": "941498226eb6de93e35da2fe8c3f94e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019336, "uuid": "7a1c074a-4b2d-4c71-b837-e550c1a7a675", "comment": "Malware payload (Mirai)", "value": "62066b0e17dcce96227a52166801d0f137ece184d781c50905a726589b4b4ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019336, "uuid": "a7a7c09d-850e-4652-a684-b91ffa57bf4a", "comment": "Malware payload (Mirai)", "value": "dcb6db5a22c0043d575d520d18b248b6b74ca4dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019336, "uuid": "c709764f-911e-4969-ad60-bd9f8b2a6ea3", "comment": "Malware payload (Mirai)", "value": "a247458edeaab1d70ca2588591be9aab8878ae6a37cf6007487f99bb5b000aa660a3165a4b41a791dce399cd861f871e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019336, "uuid": "fc7386f9-86a0-4db7-9add-f7dc5dc1729c", "value": "T17C831911AB080C7BC4F75CF4547B0328BB946BC712DA9815192AFA435BB0773674AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019336, "uuid": "671cff80-6e6e-4e34-9d9a-46dc36c490c6", "value": "1536:grTL5isSHyQofPv6AXDFYPvPA+v2/eu/k1aiNJokZzZdLtZPASo8nPqJzSyK:4TLvPv6AXCfA+mriNJXZnxtASoQeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019336, "uuid": "6d1cec34-1485-4125-9c00-73261ad0e15f", "value": 87196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019336, "uuid": "2c00dd0e-97fa-4e31-9a80-c5e06183f022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019336, "uuid": "11de68f2-82ab-4952-b70c-6d1ad31cf998", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8856253e-5b64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780062276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062276, "uuid": "02648126-d3d9-4b3e-a606-302e0075b16f", "comment": "Malware payload", "value": "fcc1bedeb60b4520cbe8fb2be5232a43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062276, "uuid": "4bc3746b-6d14-467e-91ea-5957360743dd", "comment": "Malware payload", "value": "6253eeeb0d742e8cd46da8e89658577fcebff8f6c4dabc2e586b2d6bf4dd0cac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062276, "uuid": "8016e63b-c1e2-4af4-980d-c0e0cbd6d534", "comment": "Malware payload", "value": "dddef7d66de71ac42c8ace5c78aa03d35e672f12", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062276, "uuid": "95d12050-1b57-49ef-a4b5-c7f4fea87aa4", "comment": "Malware payload", "value": "d81637fda1913fd970b4d6d1754267b6db8fb37d8fe3a83e28f01462d0cc05e5ea2fe05a340126fa13b38a9c5faa0e79", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062276, "uuid": "5fa2eb61-237f-4b8c-91a3-042c1e7f12a7", "value": "T18A137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062276, "uuid": "b0c0bb48-e3c9-420a-872a-4b339d5a7c83", "value": "768:mXRWNGxVs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Clxjcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062276, "uuid": "82e13827-23ca-4f4f-a8d5-fa1761221241", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062276, "uuid": "f1f1ef8f-8907-457a-9e24-ed2b4dd63c3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062276, "uuid": "b3e747f2-1885-42da-989a-2184b349af50", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4583ad-5b68-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780064140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064140, "uuid": "6832ec20-0e14-4acc-92f6-2f836d63cc20", "comment": "Malware payload (QuasarRAT)", "value": "4eea57d95beee50cf97899a241854ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064140, "uuid": "c0d25ea0-9e0b-4879-bf90-b216900cd938", "comment": "Malware payload (QuasarRAT)", "value": "62f608d61b28702ca4adadd574f3761c79860bd08da402e3129ab19176f7da9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064140, "uuid": "355037ad-c7bb-4e9e-b377-eb9f3557f185", "comment": "Malware payload (QuasarRAT)", "value": "9701fd0ceb56811de7b5c5f6c8d575580869d986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064140, "uuid": "2393c807-593d-426b-a510-c835aa534fa9", "comment": "Malware payload (QuasarRAT)", "value": "2c40996346a08588b8e22c2ec67ac0fba7912796569e6e087f33acaafc8e8ac5fe46867ba79f87226451e1d6777891c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064140, "uuid": "4b1d81e5-aea9-4f40-b036-10339da11fc1", "value": "T17AF55B0477F85E62E1AAD37295F0541367F0FC2AB3A3EB0B6591777A1CB3B4088416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064140, "uuid": "7e8c7c67-adac-41c6-a812-202302d6416e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064140, "uuid": "ffe95b98-dbb9-46a6-96f3-74e55d04f12e", "value": "49152:ovjlL26AaNeWgPhlmVqvMQ7XSKoQFtOOmIILokh7jdTHHB72eh2NT:ovZL26AaNeWgPhlmVqkQ7XSKdFtOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780064140, "uuid": "0a7a53f6-0d6f-4d8f-8f41-9f87fa2456c4", "value": 3544576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780064140, "uuid": "d7a989ac-07c8-4d81-a16f-116441435e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064140, "uuid": "745b7b9d-ee6e-4924-8d58-31c141274c2b", "value": "Xeno-v1.3.50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a072f7c3-5b21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780033540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033540, "uuid": "121880b7-3749-405c-9cad-2612465c0213", "comment": "Malware payload", "value": "eed09dd724455a3f25de44d61176cf74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033540, "uuid": "5a15ffdf-6f59-4938-89a8-8dec3dd23977", "comment": "Malware payload", "value": "636f7e8a0ff3db0e7da27451cb64e0ab2ff8ea19e9b666ec714b3db879da965a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033540, "uuid": "81322d40-ad00-45d7-872a-7f218d816a19", "comment": "Malware payload", "value": "78dd53a91fb65e0069acde6eee5ffd9cdb70202b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033540, "uuid": "3f29d65c-e011-4fdf-95e5-25f4c841214d", "comment": "Malware payload", "value": "eb757a9796ea4024edc17bcbd6dbd2e05a8ca87dd7392c0c47147dad1b15c6cb27d3aaab9c31f1f90c4d868711d10f06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033540, "uuid": "c7f1d08b-4c77-4eae-bdcc-274883fb50ce", "value": "T1FDF0C0FAF8F193E0274D0094741950FE6166CC7D291CF9C490468D74604B2BDF67B366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033540, "uuid": "678e4bba-75bc-487f-8eec-ad6d946f9526", "value": "12:ZFl/Q7xK+ITTyARD/bbKLCvdwYVo4FGSjVMB2LwG:Xt+dARrrlwY3Dj+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033540, "uuid": "fa429044-2f1d-4978-bf4b-a9dabdb04b71", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033540, "uuid": "a9a49d0c-0305-4bef-9864-907a2a9da73c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033540, "uuid": "c3d33d99-6e83-44a9-80ce-1ff76cee7246", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be51219-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1780036539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036539, "uuid": "d843aa5c-07c2-4e0f-8319-2ae7dfa51352", "comment": "Malware payload (MacSync)", "value": "1db78cd4f71d5743c9a5719430d6ffb6", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036539, "uuid": "4f4e5751-3f58-461c-bb01-e97c22791718", "comment": "Malware payload (MacSync)", "value": "63f6dcab9e0dabb78449efda7aa7ecd2c10a8ef4e35b7f7346df76c60d17e12f", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036539, "uuid": "76a252dd-b6d9-4f70-ac28-807af41c432c", "comment": "Malware payload (MacSync)", "value": "e804bc60e9cc13a62340386b5e6e21b87e7fc1f2", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036539, "uuid": "e44e256b-638e-423a-bd3f-397fdc941334", "comment": "Malware payload (MacSync)", "value": "d67688486c63ccd971017bfc4034b03da994b05bb84b0ee4336034b38fe9c1c6817342246da31b1a278569479d1397d9", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036539, "uuid": "86a496b5-fca1-48fb-89c6-91f04ad59ecd", "value": "T1D021FBA69E30333474809E4E5D852787AB69CBC670A2349A56ECB4061A84020511E752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036539, "uuid": "6bb47a97-a71d-4778-a170-24d02a6af035", "value": "24:jt2WAEzJNxNL2r9gP5SYPmxuMTyHlkFIXueplaI79kkoKfUo9c2B4vnZsYc:sWAEzJ7B2CPsYeUHeFIh33R6KfUU4vWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036539, "uuid": "f3397e8c-00fd-4f23-adc0-88e57f567c56", "value": 1305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036539, "uuid": "f48cef09-8985-4c61-819e-486ee74ed6f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036539, "uuid": "a4370039-0e3c-4d63-8bf2-a71cc1c3cf22", "value": "63f6dcab9e0dabb78449efda7aa7ecd2c10a8ef4e35b7f7346df76c60d17e12f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada884b0-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016812, "uuid": "813dc9e9-f951-4089-bd40-c29d2dafad70", "comment": "Malware payload (Mirai)", "value": "9f61a9b6fa3cbc6db087b454fe0161c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016812, "uuid": "b6f64b82-d467-446c-a65f-201c57e2c5a0", "comment": "Malware payload (Mirai)", "value": "6419c9ec7aad4efc12cdfe6e9a79b196215174b542653b88bf84ce4527c7e78c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016812, "uuid": "a7bb1802-1588-4806-a6a1-3e3509f5076a", "comment": "Malware payload (Mirai)", "value": "5d34da28d88c597a8169c7c209800006b4c7ff3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016812, "uuid": "d04ea5d0-7536-434d-ad51-749afba4ebb8", "comment": "Malware payload (Mirai)", "value": "1a66192f3333ee270058425faab1033c5de8f616f989f8c02e6d2cc4446ad1e5208f0ef3f462c454c7804cd0201bee01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016812, "uuid": "7c96c6b3-c12d-427e-a784-385901ae5111", "value": "T18B834A35B9392B52C0E1A47E20FB8769B1E166CE1254975E7D330E6FFF216402506EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016812, "uuid": "f3aa2b9d-9517-4645-a54c-9f919c4f4fb1", "value": "1536:2PTXE+kgyZIxi3qqii7xyCuv+sPDyGseSKELjzXbfRnwdwZfOUJebkA:2LYFyCnsPD5SVfrf5TZfzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016812, "uuid": "30782365-a74f-4478-a33e-28f448c47449", "value": 87960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016812, "uuid": "617666af-1eb6-4d77-8e48-c7edfe4cdc9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016812, "uuid": "d2d05631-58cc-41a7-b7c6-17a67df2fe3d", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad55880d-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "1eeb929c-a8aa-44dc-8992-0fb1ad500fd6", "comment": "Malware payload (Mirai)", "value": "1e6406729eb0eb9bfc40c9816f890254", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "f46b062a-ba40-451b-aaab-0b9c7cf7db3a", "comment": "Malware payload (Mirai)", "value": "64b09a7911309bd8e6e47bc1f89db193151ca0f6db8f61d152d05a2f8544fd20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "dede8f12-cc0f-4f9d-9608-88bb9a37b2f5", "comment": "Malware payload (Mirai)", "value": "788555b8188a19830eeaf90a1726f46c92672286", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "6178dd91-fb7f-4858-835d-e9eb57d1ad15", "comment": "Malware payload (Mirai)", "value": "88303afd5a7ee7405842ecc362f334efd5a0bd4c5f6f4b10f1ee6d71f3d52c446ad1e92b2e11dfa36c2daf7aed7e02dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "d5725d8a-fd18-4a9a-8f1e-ebfe02a5f81e", "value": "T121336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "5d53d5d9-bb1f-480e-81ea-58a27bbc6600", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048594, "uuid": "0fb00165-77b9-44ab-997f-e985c6777494", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048594, "uuid": "5fbf6407-893d-4763-96f3-ac5d7329ae7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "c1938f94-a636-47fa-83e1-a0eeccd0a178", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfbb89d-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055842, "uuid": "7452fd36-ca1e-48eb-8fde-bf51a7189590", "comment": "Malware payload (BlackMatter)", "value": "0d5996f95d8a8ff91a565bac402c0e11", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055842, "uuid": "12a1f5b9-2d17-478e-a5e4-93fffde9316c", "comment": "Malware payload (BlackMatter)", "value": "65844473d39bb5b0cc86715b2da6da6fbb8dc12730d5a6caf972d132d74542f0", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055842, "uuid": "0792d8bf-6bc0-431b-a5c8-91bb0910bfa7", "comment": "Malware payload (BlackMatter)", "value": "b87b8ce71edd23712a349e8708567cce7f7bca42", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055842, "uuid": "a6cabbba-4159-4fb3-aad5-6ecae29fc48a", "comment": "Malware payload (BlackMatter)", "value": "ad52e5f476c16b16541ae836053c342d3550f9dfce773d00d6d2000acbe15ef195ceeddbf81e769debf95638d8a34520", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055842, "uuid": "93d7d599-fe0a-494e-bb7d-d42b63b29088", "value": "T1F3E36D21F212D0B3C87718F13736B5B2F39E4D2C25A96807EAD80F59BCA58236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055842, "uuid": "ba5e2e9e-fb58-492e-b047-6e433fd9c03f", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055842, "uuid": "85be7cf4-d82b-47b9-9873-3ee209e640f3", "value": "3072:e6glyuxE4GsUPnliByocWepl4nMLeao4/PZOHxwl:e6gDBGpvEByocWeoV4/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055842, "uuid": "daf991e2-b4dd-4b49-aa3a-3dc12c62a4f4", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055842, "uuid": "37bf3193-36ea-43f8-8347-8da50c591baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055842, "uuid": "39ada333-1cf3-4578-a007-92f801d5fe8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dc8ad8-5b63-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780061836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061836, "uuid": "b7bf7508-59ab-4eee-81bf-f47d7e7c51ad", "comment": "Malware payload (RemcosRAT)", "value": "1673b88c4b810d12923f1004f6e9080b", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061836, "uuid": "8fb4619c-fc6e-48b1-a62e-a84165c8fa5d", "comment": "Malware payload (RemcosRAT)", "value": "65d3a51a436d55aff9c6845dfb8974ce4ee9456e4d3beb6dd2c8b3c4e9fdcd0d", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061836, "uuid": "004b74f3-0e70-4323-9e01-1e28d6eb0491", "comment": "Malware payload (RemcosRAT)", "value": "05404ccb5fefafba753608593758a3dc8513d8b5", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061836, "uuid": "a0fd3b37-1289-47fe-b181-a64ca21b8d54", "comment": "Malware payload (RemcosRAT)", "value": "6eb59f0d0ed5f570b344e688d9137ec1176b1818a28958571e16b6110d5d5002bfa352c43e2c5020544a68cd46c172a3", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061836, "uuid": "deb0a9b5-8778-40fa-89aa-b1f0db1e6174", "value": "T1AB93D813FA4AD0B2E46591F146426F31CEBCBC3636492173D38FCA41AD79892D416EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061836, "uuid": "f664147f-28a8-4e39-9079-3a7ca95d44cf", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061836, "uuid": "943a6468-2f53-4fa7-aa5d-a69ed3b583db", "value": "1536:YhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6PrU:+hzYTGWVvJ8f2v1TbPzuMsIFSHNThy+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780061836, "uuid": "758b4fd8-8fa8-441d-adb9-509832dcbdc2", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780061836, "uuid": "355b31fa-a112-47be-86b6-22204a4b4d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061836, "uuid": "ce2b05cd-ee76-45e5-8e03-99b93f1362dc", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f7ee8c-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089109, "uuid": "37e76796-bd57-4c8c-ae2f-495cd04ab6c3", "comment": "Malware payload (Mirai)", "value": "5c136fd021555f0526937aec1a3d2dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089109, "uuid": "4e0668c1-bda8-4bd2-8da9-bbf07ed36fbc", "comment": "Malware payload (Mirai)", "value": "6604953557307a6964489f1b071bdd0e46d173f777f05a67d1088923f05aa3cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089109, "uuid": "bbade385-7d6b-4f96-9098-8cd3029d1c48", "comment": "Malware payload (Mirai)", "value": "8e7134778934b27eddc84ef68e4e5ce0e291da6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089109, "uuid": "09abb810-cfa3-4e3c-9a75-d4a866e8162c", "comment": "Malware payload (Mirai)", "value": "df329f9a2221b9b065336672256e7e84cda768c8fb4e7920b5b611f19c3deb35db0b1d88341e964cfe87c1e9c3baf717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089109, "uuid": "51b39590-95e6-4d88-ba62-fe3907d0fe1e", "value": "T16614C91A3E228FEFF16D877147F34930976966D617E29684E26CD5102F203CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089109, "uuid": "e657caf6-26e7-418b-824f-938eb161db16", "value": "6144:zoeqEs2C4yBeQ1yrrpm6WtCqjYW8VV1j2cWI:cusTcfpm6WtCqjYW8VV1j2cWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089109, "uuid": "e30d4290-11b5-4d30-bf11-d4b79e80d6e5", "value": 202299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089109, "uuid": "6d4d563a-54dd-4b52-b169-d0cfc056e068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089109, "uuid": "967d1734-4b99-47b7-bdee-3765f586036c", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cc9eb0-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780092867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092867, "uuid": "9ee5ee56-564c-446a-a7df-391919e87037", "comment": "Malware payload (Gafgyt)", "value": "2cecafe45bcd4ebad3eae45e9ea487a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092867, "uuid": "7c246377-fb08-4fa5-abd9-0df553515e51", "comment": "Malware payload (Gafgyt)", "value": "6670263deb150bdc7dc0d5fb7598ddacdbadc438dcbe6327717298cbf1fbf4c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092867, "uuid": "42b213de-ffd9-4ee8-a9ac-4028cdae7924", "comment": "Malware payload (Gafgyt)", "value": "5e0820c0b7c4069df5b81f627993d7248b30052a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092867, "uuid": "807247a7-d3af-4285-9019-68ddb8b6af36", "comment": "Malware payload (Gafgyt)", "value": "d9ffa733f2f5635360ef5900b050d2508c198f697e68dca6243a95add80e1e38e659516248bafb917f800931d4c89d5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092867, "uuid": "17f82c68-0a4c-4dd5-b23a-51e8fda7cbbc", "value": "T135C23005AFA14EABEC6FDD3389FD0B4631CD900621A53B762934D428B35F59F09E38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092867, "uuid": "c1259c8f-51d7-455b-9241-ef42737964c2", "value": "384:AhNpQuxwbw2p44s2ASaKpj+2m9L1C/eFe4lefqMoFaXiWEtIZqTzDNT:AmPlp1UA/eFe4leDocXif2ZqPZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092867, "uuid": "8acd17db-2fcb-4f3a-a6d8-03b16127d7e2", "value": 26876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092867, "uuid": "f3aa9a80-4c42-4dd5-9310-457aa3eb6f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092867, "uuid": "2fa5f8b6-5dd6-4e46-a556-851c7bfc3ed1", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccc1fb1-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089181, "uuid": "bf7479a6-b1af-469c-ae9c-a1709da975d2", "comment": "Malware payload (Mirai)", "value": "4e5985f199e3e66ea919cb2afecdebed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089181, "uuid": "c479e9a9-4a3e-43d6-87a4-57a406ef26dd", "comment": "Malware payload (Mirai)", "value": "675c3e3bfea3589e2c34eb7e7f5abcaf2ea070d44a372ec1e15ff8bd6fe2bc6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089181, "uuid": "2d60d533-f87a-4131-9efa-6246261b9809", "comment": "Malware payload (Mirai)", "value": "abefb3d69b1bf14fdd7a5d1eb9ba5109a82a6cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089181, "uuid": "0d1813d3-99be-417d-a2b4-5cbc1274be2d", "comment": "Malware payload (Mirai)", "value": "aee5dd0d98f0e83f8d7a941a8210e38a3e602f0b41e059c7d76b1a35bf46adafc0669965ad5b70b13ab03b3521b3d21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089181, "uuid": "3a8841f8-9a98-4c0d-a448-ab53948674bd", "value": "T170C33B1775C180FEC9E9C2B44BEBE127DA73B4291138B61E2BD46A271F9DE206F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089181, "uuid": "5d98304b-88e6-416f-8599-cd91e489de1e", "value": "3072:ryWrVhUrqeP/1wKTdzO0R6PGKyOH86sDb:uW6BYpBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089181, "uuid": "b9df7a3a-6a09-427c-a21c-5a525712a25f", "value": 126856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089181, "uuid": "e24712d3-4c47-4a87-9e0d-3badce0979c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089181, "uuid": "1e59397d-434a-4338-bb2e-20e0f742deab", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0096dbde-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780088677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088677, "uuid": "a9cd411e-a628-4caf-81ee-7257c30b4abb", "comment": "Malware payload (Vidar)", "value": "b7020b7880837ab666ede6bb93058758", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088677, "uuid": "a65b21cf-e017-49c8-a4af-92158ae5cba0", "comment": "Malware payload (Vidar)", "value": "675d1742c70b33b3e56eeb2c6a01634d253c2c116ef3b4dc4769ce52c9f2d9f2", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088677, "uuid": "22ae28d4-e34a-4e8e-b4d5-dbd54b2d78f5", "comment": "Malware payload (Vidar)", "value": "fefdf5de5e0a5803a5ca20a7a4e456d347dbaa6e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088677, "uuid": "4da10a05-d680-4c7d-8d9b-76a0b423e561", "comment": "Malware payload (Vidar)", "value": "e2d2089f523996ef774da59ca64d24a70076a7b05ffa6489ab9fb7c3451e728c93fd29c8841739824ede689424cb0b36", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088677, "uuid": "7b3287e9-6b12-4057-b937-02c8fa5fcfa3", "value": "T1D9C58D1ABCE109EAC0AA633289B366917B75FC450F3263D72E50B6382F72BE45C75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088677, "uuid": "64218273-7692-4c32-a337-5d88241bea24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088677, "uuid": "738f7eb2-6a19-4354-8231-7e01bf127959", "value": "49152:fe8FOwnjq0JV/FaN2CbzAKgEIyy+ks71VkbmXS2:f753Farn1gTEhr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780088677, "uuid": "21f0e28a-2156-4174-ad75-4e953b5e99e0", "value": 2505864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780088677, "uuid": "1507eb94-a0d0-4de7-ba70-47356a72c012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088677, "uuid": "255dbbb6-0c84-4fc3-9bb4-ffa08781ab7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b660766e-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780088982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088982, "uuid": "13838d05-0f17-4547-867d-53aa4dcc161f", "comment": "Malware payload (Mirai)", "value": "c10f1749bc74d5ee3128ae663b4a8f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088982, "uuid": "ae03b58f-d1e7-4c41-b75b-877b14d46ed1", "comment": "Malware payload (Mirai)", "value": "677bf1a17d85713c2f6fc6a3504a7cc02c92f131912b3669f9702cb48d701058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088982, "uuid": "3d934622-1d3a-4997-8a55-7c727603b2e2", "comment": "Malware payload (Mirai)", "value": "5eb2ec3e8fad0668226aec3f452a9aa0780aa728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780088982, "uuid": "fba6d05b-292f-4cbf-8ac8-71fae44fca2a", "comment": "Malware payload (Mirai)", "value": "93609b07635881ad8763e1a98038308ab308d21e49ef620d3ae7d5bc30e713ba2e57a37ae96f43ae2849a92a16d548e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088982, "uuid": "2dabd153-aa77-4370-afce-7b5885520dd8", "value": "T1ECE307C7F900DDFAF80AE73748570509B230BBA209925A373257356FED3A1991477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088982, "uuid": "6147baa3-be7b-4bfd-ba9e-73b00ef5eda6", "value": "3072:8ZN8x+5r8+ayEPvoFkyhxYiou2ukLX4Vqjbi8LW7dphm:qyVyEHoC0x9aLXfLWXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780088982, "uuid": "49a2b11a-f7a7-4e1a-8548-022f565e7ea8", "value": 148736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780088982, "uuid": "ea269354-ad7c-4a48-aee6-b238e6bdef22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780088982, "uuid": "50318cfd-5e91-4fcf-935f-ec820ef6f948", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14440db0-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058646, "uuid": "02bd2731-2e85-4403-bf8b-d18a93e22db2", "comment": "Malware payload (Phorpiex)", "value": "fc368188d7e8f2d2ba21a4f95c2a1e13", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058646, "uuid": "07e85379-f94f-4e4e-b988-dc5b4de46bcc", "comment": "Malware payload (Phorpiex)", "value": "67ae1ba4090ec9277beb8bdc56379716cc59054d9a5151886cc91838eed217b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058646, "uuid": "5b7e1e13-5cba-48e1-aa4f-728718622b74", "comment": "Malware payload (Phorpiex)", "value": "76a0803f3c77968d834beb22f12757abbd00ffb5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058646, "uuid": "9f1166f5-60ba-4ae5-869f-328424547664", "comment": "Malware payload (Phorpiex)", "value": "56bcbba68dd33e86993ef60eb1e2ae072f10fa15f605567ad2649b4d09ab6ce0fc9dd8218496b530f51ed732201d997e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058646, "uuid": "29465bbc-e464-468c-9585-b7e81d30cfa6", "value": "T1CA824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86E6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058646, "uuid": "71e5a3ff-ddf3-4e67-8d66-9c5a84cf02ee", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058646, "uuid": "02768d23-662a-44e3-aa3c-4edec96326e7", "value": "192:NIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJ4:PIblVP4Y/2N0bLu9JgPL7Nyav8U9c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058646, "uuid": "fa35a7e0-b230-4f35-92fd-071e9f25afc8", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058646, "uuid": "f1e7e29b-f38e-4efa-8a06-504859e059cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058646, "uuid": "5db8b5b6-1760-4ca8-9a9b-7855713ce28e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cc056c-5b09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780023106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023106, "uuid": "c92b0e4b-bdf4-4a13-87df-6de551a19ef0", "comment": "Malware payload", "value": "440c641a099b391dcd20a5dc64752b59", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023106, "uuid": "ea1d04ac-58c2-4fa6-ab4b-a9ddf8875969", "comment": "Malware payload", "value": "68fa126b9676b42b751e650a22937a624d13457a0df92d3361dfbe86ad943c52", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023106, "uuid": "60a81254-1332-4c7f-bd68-28570f6b5714", "comment": "Malware payload", "value": "8e86eaa00d8005f2c3d981dfbe05d0e8976a2a65", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023106, "uuid": "e31c8794-1120-4f10-b9dc-6cae68952c29", "comment": "Malware payload", "value": "55ec3e6037993aa79d2cb1643f63ed3f5f2e5a602eb12aafad22adc73396200300e73e1608109f4b8dafd30a74905d2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023106, "uuid": "523f59f4-91d7-4195-a96c-0c6bf1a6f1bb", "value": "T1DB0186DA0B3619B9F011ED1578E1452A53CFBFD421AC63AC75A44F91B049C70B81AF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023106, "uuid": "6a1ad052-a755-458e-8666-35245fbf9b9d", "value": "6:Bk6N12GLp0J6Nhz4ARFL6N00eFK0K70J6NpfzCWkSn+uBS6N12GLviR6Nhzj6N05:BDnPF2ew9OWNn+0FnviNewt5Zt+JGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780023106, "uuid": "714f2c3e-cf58-4deb-a34c-5a4ba721d728", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780023106, "uuid": "00971b3e-4857-4d42-a150-eec9d5c2eda6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023106, "uuid": "6f15d770-908c-414b-b92c-47f3a488dc44", "value": "tbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fa1773-5bb1-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1780095211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780095211, "uuid": "efb18c90-6394-4775-b5cb-2764f51afd0d", "comment": "Malware payload (MaskGramStealer)", "value": "fdc116bf377dfd8edb76cf2dbb694b6e", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780095211, "uuid": "733624a5-6677-4dd6-820b-938c8851fc81", "comment": "Malware payload (MaskGramStealer)", "value": "69463b3cb1ee93891c49608ac67cf04d4ae4ae6251921febdf37b6378b0df384", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780095211, "uuid": "a4701909-fe12-46dc-922a-a9b831c87378", "comment": "Malware payload (MaskGramStealer)", "value": "e8e08dc9b1dd337fd6adf9fd12c9080f4d6ccfbd", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780095211, "uuid": "ef6eeb14-e944-45c2-b001-1a90dedce6de", "comment": "Malware payload (MaskGramStealer)", "value": "b678278502a798da8cb28416cce5385f0d52ed5cdc3717ecb5af5e1bbfab3e20925e4509fdbf9e6e98c09ef7d06794e8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780095211, "uuid": "45937e17-0eb6-4cdd-b3f7-549818b0a207", "value": "T138044A1BD9D140F9DC29C638869AE637A4B3B85A1936BA4F6BA0DF151F40B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780095211, "uuid": "9b418afb-7c08-4091-a2fa-b4be64778c64", "value": "ba456e94eafa9e6a7757d90b7ff6310a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780095211, "uuid": "5ca761ee-1ada-4443-86b7-d90fb8156db0", "value": "3072:5TYbsMaR0lcdmoSdr443mK0X6TVVfqLqVS7CnwOTU0DH7jIB1r4q7mv:6bsMqmoSZ33mGxVfqLQTvbCD7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780095211, "uuid": "789ee06d-9bfe-4d0c-b1f6-f9716aacce0e", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780095211, "uuid": "8662d95e-3443-43b4-96f3-6345f65ed442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780095211, "uuid": "e79a0c60-d82d-4688-bef9-c7d573164dac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c282246e-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780092868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092868, "uuid": "61f4853d-52d6-47ff-a548-67fdd20c40d7", "comment": "Malware payload (Gafgyt)", "value": "26bf08f5f3fbcedf5bc5bfe51e552e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092868, "uuid": "e6d60dd7-83e6-42b2-ac44-5f77edd34ead", "comment": "Malware payload (Gafgyt)", "value": "6b5435a551f882179384cf6b7d1a99081317e255b98d223c4a472d4f540e15f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092868, "uuid": "d8b8ec5a-c08f-4284-8361-1c6922e5292d", "comment": "Malware payload (Gafgyt)", "value": "155b38b3845ac11b371ee87dc171c2b191cd25fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092868, "uuid": "44e81857-cb41-4c1f-878a-786ab38a840f", "comment": "Malware payload (Gafgyt)", "value": "1d3083ef2f72b8ea37c2dd124de6514ae7e534c8f901d660c8bc62c1dd929a80b0e4b74fb4066a2e91e5efc328f1c0e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092868, "uuid": "54e05c07-8f11-42be-a8e1-056be48ea88c", "value": "T18CA2F7122A8199BCC84DC2F0666FBD3AD536B41C533A378B73D0FF225D4AD216A26C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092868, "uuid": "ca3a294f-3d19-4b31-a8f4-6320a0d8bb3d", "value": "192:GcahHwagoWss4sqQ5FzT+6SuJah0zvxmtgO23MbG3CvzQzJ3/iIGWcaHrH7SG3ZE:VERWstsuh0zZQ/QMrvk136KH7SsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092868, "uuid": "8b1d315b-11fe-4e2b-8af1-9d88537df9b2", "value": 21480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092868, "uuid": "130b8d1b-f898-496f-b55e-4f32d19a1bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092868, "uuid": "f35ea947-1dc7-49b6-a036-3e6c166fbc19", "value": "iran.x86_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc72628b-5b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780034903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034903, "uuid": "4c6fb646-8ffb-4dc9-b294-918454c5b436", "comment": "Malware payload (Mirai)", "value": "06d8f66706da64397949cde24de95506", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034903, "uuid": "fa93a3e5-2f82-455c-92eb-3c51864a24ed", "comment": "Malware payload (Mirai)", "value": "6bb18cd9937fb92e58d54d325b7dc7a8e03c945aa2efdd449d06bcc21a18d0cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034903, "uuid": "a5f12103-f476-40f6-aeea-0b2af960c36f", "comment": "Malware payload (Mirai)", "value": "9a15198d3444f6234867f3f765d8b93028305c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034903, "uuid": "098136a0-be73-4841-8e06-d84e6232cf3e", "comment": "Malware payload (Mirai)", "value": "b9a313b93cc9b2687d42b3e8bdb2d8a97bb8f544fafd67d2095fbc36b16c87d813815dd798beaebb619a516445a449f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034903, "uuid": "2b0f4cc0-ca73-49b2-86a2-73b1fb56d8d7", "value": "T1A873E652FE81CD51C8D938BBFA1F46DC3343076CC3EE75029E16AB2566DF1994A3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034903, "uuid": "07e3aa49-b911-4b19-bae3-43589d006309", "value": "1536:vforNxK+AO9l1ga73ffSlwp7ozIja6deFoURrO427:g6cF735pd+6deOUrOL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780034903, "uuid": "6f500d33-8f6b-4dfc-b263-ee86c5d67a84", "value": 77580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780034903, "uuid": "1e84ff25-8c74-4de2-89c5-3a8c1df002ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034903, "uuid": "cf691446-9d09-4d98-bc03-8ffacedbdb0a", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9530cd-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047439, "uuid": "79bc6abb-dd96-4a99-bfbc-0c810be31382", "comment": "Malware payload", "value": "407e67ec9fc2075728eeb0a77c40567c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047439, "uuid": "fa4fd45a-77a7-4cda-8766-8bda613879bb", "comment": "Malware payload", "value": "6bf1166cfce11dd225c6f28c5f190b3398f6be689ecb22be99fc6cc9bf6d438a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047439, "uuid": "2f6eddae-c922-4755-b30f-6eb34b16c9ea", "comment": "Malware payload", "value": "ede10a1da9303cda5ecb97560d60802e758b252e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047439, "uuid": "057e3d29-cbfb-4f94-86f0-2fa49618cac5", "comment": "Malware payload", "value": "1e12665a51d61e7b1ee0aed485b6ca73f389e0d412ee98f8ba193c59a829960d3afd60fefb7cd2b4543730b11a301bed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047439, "uuid": "1cb28eea-60b2-4fe0-8cc5-a38fc7e2ba97", "value": "T152762A97B8924952C4E43637BCBE81C432630EB99BC7565B6D04EE383EBE1D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047439, "uuid": "b03fa55e-37a3-4041-8339-f038b1e3577e", "value": "49152:cVgvs6YLK6FApHXwlbVOxv9CQ9mrGZSkU95cO78gyq85EgY:3vcLTQ3wlbVOxv9GcO78zquE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047439, "uuid": "a4c4663d-67cd-4180-a5e4-6c542a2a250e", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047439, "uuid": "74d5c78b-2cd9-4b32-af5e-d389ee154cdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047439, "uuid": "b899bf77-1ffe-4a4a-99c1-238f26f5a972", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21963bec-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780073700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073700, "uuid": "e02a9ce4-c266-4ad7-a743-9d0bd2a88400", "comment": "Malware payload (Mirai)", "value": "02ba189051514f5307e6d1d197d75c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073700, "uuid": "71cbfd27-aa03-4d23-9374-b5c7df839a6b", "comment": "Malware payload (Mirai)", "value": "6c589ea15c6f9563f4897738d54f222e66d9ead33615f5efea591671d661e115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073700, "uuid": "a8f1a755-1daa-457f-bd43-5329e8eab35b", "comment": "Malware payload (Mirai)", "value": "c73db1826b6dc9283842eeaaada4dd19fd9d51f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073700, "uuid": "c62bce0d-8da0-452f-95b0-c4002a02a3ff", "comment": "Malware payload (Mirai)", "value": "5ea0358d51be38cd258db19f37dcf35d1df23d67f0fc44fc8b8f23022ff861d369505e37bd22599edba97104534e8a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073700, "uuid": "5a0200c6-a6f1-48fe-b8d2-c2af13191a12", "value": "T1AAC31A45F8409B16CAC666B7FB4E438D772A1768D3EE72039D256F30378B8670E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073700, "uuid": "6f814ebe-414e-478c-90ed-899f1653b359", "value": "1536:t5LxEHhX9mOAAdWPD8eRs4VByeTNa+rC1doceOweoPRJAASjylXpwywmm2MhYMl/:2HhNmLLPDU46eBa+OcDRCAijhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073700, "uuid": "bae366b3-cd84-4e5c-a0ec-49ef1d72cbff", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073700, "uuid": "0426666e-8867-4cab-9d88-297a6a449499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073700, "uuid": "f73c73e7-8a1f-4d22-9d93-ab3fd825a6f0", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d91e028-5b4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780050984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050984, "uuid": "8f185c14-0666-4f17-8e84-7afe19167919", "comment": "Malware payload", "value": "f82c7f265fc6edc82040434d209c0e8e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050984, "uuid": "06a1cdb0-cd61-4083-b868-4222d76e3c3f", "comment": "Malware payload", "value": "6ce412c50c1f14d7d065f1e1fecda3f1244f76c12dc0a2605d2656d0c925353a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050984, "uuid": "0c528ab1-da39-4b3b-ac63-39cf30bdde12", "comment": "Malware payload", "value": "25c17a92bc79282de4ba938805e9f20d70894213", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780050984, "uuid": "669c4a01-b11a-43de-9186-e00ff15eeeda", "comment": "Malware payload", "value": "586be769aaac23b47293a54e2488a55ae7e0c1de88220341293c83cf12d2c9f7c96be501e6136a0c0eca0fea4e8ae589", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050984, "uuid": "5f5cc2e2-f6e0-4154-b72f-16ecae93ead5", "value": "T146B1843BEC0B1AF3AB0745A2E4639C59EFB21A23101548A1B94CC1701F59BFD99F638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050984, "uuid": "3e162c2b-66fd-4a40-8428-8c63874fd501", "value": "96:Yu+5MNnOXeWsLpKMUtxgyNP2NxtciaBQkVu7pfBTPAnYMMQ7vD7ha7xqzYf/:Y5MNOOpLINDFP2rtHaBQyw5BTPAYMv3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780050984, "uuid": "0c5aef40-01e5-491b-a9c2-8e3ef87b184e", "value": 5521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780050984, "uuid": "274691fe-fd98-4223-a613-c5a56474c497", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780050984, "uuid": "e6d9eecb-8950-4010-adfc-1cf00f047dc9", "value": "adobe-updater.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bdc88e-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (MacSync)", "timestamp": 1780036534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036534, "uuid": "48eae75d-dd0e-4a6e-bfe7-6e5e2530dfca", "comment": "Malware payload (MacSync)", "value": "78eee9c6304f28490cef7b119b06fd1a", "object_relation": "md5", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036534, "uuid": "9aa9eab5-6277-420b-ba48-494d99b8126d", "comment": "Malware payload (MacSync)", "value": "6cfdf4ec1f677e6655bf5f5c5b1b11e9a73f0c664be0610e660d4352f09e432d", "object_relation": "sha256", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036534, "uuid": "ef7df25b-d896-4b80-b76d-02e3038cd974", "comment": "Malware payload (MacSync)", "value": "6ea5c706c8dcfd5307b953b51d071e0790724f1d", "object_relation": "sha1", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036534, "uuid": "a9999ec9-bb17-4b8c-bac2-346d2f41a9e8", "comment": "Malware payload (MacSync)", "value": "966793fa23755177fcfaf779973f3bdecc9fe330c6ea9354440e4cc1bf36ffbbdb7b17f0510f5b5a0156025dde263980", "object_relation": "sha3-384", "Tag": [ { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false }, { "name": "MacSyncStealer", "colour": "#AC2BB0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036534, "uuid": "5d659168-3f33-4113-957f-ecef6ed6c1e9", "value": "T1BF21FBAE8013A91DD9010110AC129D109B45DAE0CC59FE5DA56073DD45E82BB853BDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036534, "uuid": "e0db393a-6f7d-42d4-8969-29c50cfb5bc6", "value": "24:4ptlSfPzDI+VSjm8HL1TEKuflnijQ1SgDbR+QnSh3R6iTpkiJJ3WUz0LqAvBFzBK:SclSj5r1Tmfl8QHDbpSlw6kAJ3WU0iyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036534, "uuid": "fc54f95f-2aec-4824-a347-007218743106", "value": 1349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036534, "uuid": "19945fa8-2e4b-4ad5-b57b-b539a01795c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036534, "uuid": "18984f64-9c71-4cc2-9137-45fec56b7efc", "value": "6cfdf4ec1f677e6655bf5f5c5b1b11e9a73f0c664be0610e660d4352f09e432d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf09e6f3-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017700, "uuid": "71f08de6-53b5-44b3-91ab-22e6dc186f47", "comment": "Malware payload (Mirai)", "value": "40c39911723a00a8a13ff52699f5f3f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017700, "uuid": "1ba44a0d-670a-40d4-891a-505429014a13", "comment": "Malware payload (Mirai)", "value": "6d08a3b6adba4ad9f5c0d82e9f5551f27421658ec9fb9a69b84b366ad1a8acdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017700, "uuid": "f473ebf1-e2b1-42ac-acba-87274be12a79", "comment": "Malware payload (Mirai)", "value": "1ee02088a5dab2f0863381e4c147ffde62d75f09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017700, "uuid": "552f9c06-94b3-4689-a17d-392743599a83", "comment": "Malware payload (Mirai)", "value": "ce0d411890a5ed7a17102bae6136e2f292d3e8095c947d7cc1d3b9e1a55bc8dbe5836ad971fe8f0cb58e93652b4c6a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017700, "uuid": "1a2af566-c333-4f66-8e5c-9f7a6aa14bbe", "value": "T134F2E18E8D9578C7CDD9EC3BF09C0638691770C2B2EF131A57B00E86257694BB5AD0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017700, "uuid": "54bbc10d-79cc-4fb5-bb0b-4b84be204ea3", "value": "768:6AjOmF5yjDVkFX+xyb2iQ3yo9Bmr7iwpSGws+tvUdlWc:6ASmF5MSFAyb2iayEm/1pSLsUUd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017700, "uuid": "6b6b6679-0879-4b52-a26a-654ae255e09f", "value": 34808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017700, "uuid": "86edb5a5-3bce-4506-87f4-c5e4a001aee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017700, "uuid": "a4ed4d51-a67d-4fe9-a091-dc536353effe", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653127e6-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038595, "uuid": "6e2600cc-cc62-4d8c-bba8-d3e533ae6483", "comment": "Malware payload (Mirai)", "value": "1a415108526a1f490b23261fbdcb75c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038595, "uuid": "f215f1ce-7550-4836-8997-273d9a9f5ab5", "comment": "Malware payload (Mirai)", "value": "6e78e4a31c22495ba6215faa3fbca4343f2de912d5ed70344e0d70285160d478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038595, "uuid": "b20f70a3-675c-4997-b83b-d190f0270bbf", "comment": "Malware payload (Mirai)", "value": "d12ef4f4b96e6a0a48411c813e6f6e341cd2bd37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038595, "uuid": "0c7a1236-b04c-40db-870e-e77bcd4237ab", "comment": "Malware payload (Mirai)", "value": "655f021132a9a3785d23cb1f2085019999aeeb052ca2195f858b23ffb7f46a8d2a63794ed7707c065e02f4320d588e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038595, "uuid": "b955f17e-0db9-4e58-934d-ca663af69153", "value": "T15B03F166B830095CDE7DD0380FAC0B215DF45FA2841A1D75B8D3E7539EE30B23496AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038595, "uuid": "2a3f9786-f208-469b-8150-76f923c44af9", "value": "768:ayI187beFSc+RX4qCw7kwGDGRfHBaWE71GERJgGlzDpbuR1JB:ayf7beMbIqCw7jcGX1E7kqVJu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038595, "uuid": "eecbd5fb-2912-45d5-a8c3-996436bcbd66", "value": 38124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038595, "uuid": "13187b6b-4297-4a28-a277-a98989e1bf79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038595, "uuid": "7ffb83d5-b161-4e50-8d67-c7c048a7d51e", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2183d81-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780040952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040952, "uuid": "c856b3e4-38eb-4920-a443-4d19b987f618", "comment": "Malware payload", "value": "a4907d67bc8e37643debdf41c1885b06", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040952, "uuid": "8f1ec2f5-5893-47e1-894d-e2ea81e58b81", "comment": "Malware payload", "value": "6f6656d811bb431becff1eb75da158b45af5655ae4c0b74a3ea64ea3d258fc02", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040952, "uuid": "d2fcf9dc-1fce-4da7-8d2f-4ddf937390bb", "comment": "Malware payload", "value": "4af3c84e268008297d0af7d2c645096e74e1f651", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040952, "uuid": "4638c955-2498-4da3-b678-3450905eb918", "comment": "Malware payload", "value": "ec0e7c3877df1a79046807780cec070fd695401d0abcbb6b14952dbdbb14f15cb41c7676ad1cb672b53e5ebf19a4d4c5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040952, "uuid": "50577834-b85e-4cc2-8904-3d666052c4f1", "value": "T13552DC8126EC0204F1B6FE36DE7E6785083BBED0EEB5D69C4A10DC5C5424E51CA75F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040952, "uuid": "db50f52a-969d-4dd2-b0fd-d46368c567f3", "value": "48:TPCmQqXFDW9lurgkUFjsGPwm0SNQqXFDW9lurIw0kUFSiBrS1/uo/9e:TKm/Fel8Z2gG4m0SN/Fel8112hjye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040952, "uuid": "7f30da05-2d12-4b97-9d2d-411c230a2198", "value": 13245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040952, "uuid": "45c31aa2-c016-46c0-91f7-7e8bb25dfd5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040952, "uuid": "44336d16-cb6c-4826-8f88-5402ed90cee7", "value": "Dodatok.docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb5d76c-5b4a-11f1-a769-42010a9c0008", "comment": "Malware payload (GoToResolve)", "timestamp": 1780051036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051036, "uuid": "736a9f2f-a84a-4d7c-94ea-a1906d229941", "comment": "Malware payload (GoToResolve)", "value": "68060a88826758684b686f20872c5fe0", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051036, "uuid": "ba30c165-6943-4da2-b96a-fe05d9628191", "comment": "Malware payload (GoToResolve)", "value": "6fa0be9fab7206904b68f08a672807bf32072cd73185a17f4298438d81a597af", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051036, "uuid": "4077be89-21c1-457a-b0c3-4db2cd37d789", "comment": "Malware payload (GoToResolve)", "value": "62d44cfca0afe30271fa6da0ef775b3309ae02a1", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780051036, "uuid": "a3b02d4b-823f-410f-b132-8a9b2e2b2683", "comment": "Malware payload (GoToResolve)", "value": "366978c83d34308bef7c85e7647aa3260def411f9eac3d8d7d8f98304d17c6a96417a06cd059aba4852e19cc7cb6b8bb", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051036, "uuid": "969a81cb-c1f8-4439-bfe0-0ed0bb032043", "value": "T118872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051036, "uuid": "d07eb53a-56c2-46e7-8cb9-825f0f23ce53", "value": "786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780051036, "uuid": "0a8be1aa-7e5c-4c1a-bc7b-c76408e28dd4", "value": 37085184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780051036, "uuid": "552f0778-819b-4efd-84d8-f8dd2821d3d4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780051036, "uuid": "dc68c98c-8bc1-4aa6-86b1-da8bf0915b12", "value": "updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca8ea4d-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "7562d643-6617-41b3-9dc0-5e09ff999131", "comment": "Malware payload (Mirai)", "value": "639f95a8512df44462107b56857dfeeb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "0d04f525-981c-4467-8b68-bf0cfa2fb1ea", "comment": "Malware payload (Mirai)", "value": "703488c54fb190d98f41bbcad2aacfd1303ccc86f3d608982ade3d213b654d44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "cf154d3c-95f6-4ffd-ace3-3f4bae107678", "comment": "Malware payload (Mirai)", "value": "7b5fe1c2addfa7659fd716bda7d85e212ecdb3fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "962f3d30-bfed-494b-a40b-69439fb4f37c", "comment": "Malware payload (Mirai)", "value": "a7f3f25d4d979e1d235546579ed89a4fa158a95a9966ceb72b8464185759356c4e4d237fcabd697e13398e58b0df55f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "e5b081e2-21cd-4d1a-bc1c-75834b7e4526", "value": "T14DA2D01562A32D65F3EC1C3DC96A8357B9A70BFC90F6327679415A20C90D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "5ff62a10-ca98-452a-ba77-5c403d6031a8", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjQhymdGUop5hf:vvQn4j+ZO5fKAlx0s3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048593, "uuid": "c97bca2f-0ab0-463b-bb40-861609b02b6b", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048593, "uuid": "92a23199-392e-479c-859e-33081a820882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "f0d3f2cf-707e-4cd2-938c-a9a4f9685aa9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b26a5c-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037541, "uuid": "50886e3c-1bff-4062-b9b7-d2a06f18f36e", "comment": "Malware payload", "value": "e0a0486f9119d12f7d96141788be02b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037541, "uuid": "6b1a577e-85e1-4278-868a-9d091c44f612", "comment": "Malware payload", "value": "70862e4de4bdab9b3b4980b090982baa022cedc03f4d839260bb20bb179eced8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037541, "uuid": "6e10f0e3-e97f-4307-878d-c09674fe60cb", "comment": "Malware payload", "value": "f8e10736acebc18d0cf7eb1cce8a2a60079eef6f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037541, "uuid": "3c793a9a-5bcb-4582-b3ab-d4403d59f7bb", "comment": "Malware payload", "value": "ec0515f97d69590795029e1b95a68e40bef2c4c285e71b326cc20e2e20952802a52ec8876b68550d1b18b1b62c1633ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037541, "uuid": "4d4bb3f2-8ab9-4304-a24e-a408150ebd98", "value": "T1E886DDAB6DDC361E3010B1C6F48521F5E6621336DBDE12D9B8F928337AF649AC02D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037541, "uuid": "2d415731-c278-4c03-9875-aca2d49b621e", "value": "6144:9ubnYpscp3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mf+1wpNEVwS0msFJvXiESUWjm:pPmcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037541, "uuid": "16fcdfc0-88d3-493c-91dd-3dcc4e512b94", "value": 8337794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037541, "uuid": "2cda364d-b66b-4df5-9273-44b8478aaccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037541, "uuid": "8e4ace45-5517-4b81-8f54-9bb53c433ec9", "value": "Update_13.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bde823-5b0f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780025761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780025761, "uuid": "2980564c-a943-4f5e-9940-9d657e384ee2", "comment": "Malware payload (Mirai)", "value": "4d4553626a09b72316f413797f6f8387", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780025761, "uuid": "cf89a185-1c53-4f64-9670-ace329aa6284", "comment": "Malware payload (Mirai)", "value": "71d6805debf8fe437b557565a9e67b47bd153f27a08190f89d55a8efe0cbd92d", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780025761, "uuid": "b1ae4cc6-ef56-479d-b565-53a4afd9b3cf", "comment": "Malware payload (Mirai)", "value": "7e2588f1cc2fffbc4e4d7ba269173e665d4bcfb5", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780025761, "uuid": "a1c3b400-8bea-4b8e-9630-750b42653a6a", "comment": "Malware payload (Mirai)", "value": "b616fa937639b8e14d26ba196e3389e81faba4266cfbef293c40b5a354a4c713abb4a3902f949a359023d43f51b08379", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780025761, "uuid": "45fc2789-dffd-4db4-8df1-96de9b4d3cb3", "value": "T105E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780025761, "uuid": "d0b6fcbf-6bb2-45c2-90d3-b3f6f1d5cef3", "value": "3072:kxjJw1Cc/0s6YAPwenUr48pzfR+Jonky:kxlw1xAop0YfRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780025761, "uuid": "d3889d05-e5a5-45ee-882d-8a51933c6d0b", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780025761, "uuid": "befb187a-329c-4095-9230-0e51a21a7f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780025761, "uuid": "8db169dd-51f2-452e-a996-77b99c9b6e01", "value": "71d6805debf8fe437b557565a9e67b47bd153f27a08190f89d55a8efe0cbd92d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a5ac63-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037629, "uuid": "39bf77c0-cd10-4088-9ca2-778066163c0b", "comment": "Malware payload", "value": "9278d74648c088512ba55675b49ce91a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037629, "uuid": "e0c23589-08cc-4b61-a32e-38a818548784", "comment": "Malware payload", "value": "71e6cb9e217945f0ae0b071e6b30417a7f28476fe79ca7b235d11609a8172a43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037629, "uuid": "8fd2c8e9-4317-40ac-bff4-b6e056993a1b", "comment": "Malware payload", "value": "9565257bc27f000cadb1aa673042c11ae6d64b43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037629, "uuid": "fb3f90f2-7644-48e9-904c-4bb85fa39ef2", "comment": "Malware payload", "value": "6841fce65d0cc5e7f0ce0720f95dfc2e52d2c01ee44210653debee9195f6fc80e8bd00a5c920806b48e169875ea496f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037629, "uuid": "9742a4e0-d0a6-404a-869e-453dcc3d54ff", "value": "T12C76DE6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037629, "uuid": "06faed1b-9869-4c01-894f-c2599a735e76", "value": "6144:2ubnYpscm3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfshwpN/VwS0msFJvXiESUWjn:1PGAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037629, "uuid": "8eb1e140-d10e-45df-bc42-cfb3e4e1ee10", "value": 7493234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037629, "uuid": "00939674-ce65-4ceb-ac55-d2c9cf01c417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037629, "uuid": "0a64365b-1b92-4b3c-980b-c6527ebcbf51", "value": "Update_8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053539eb-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058620, "uuid": "cceabb4a-e61c-4b5b-b06b-261bca5dd8d1", "comment": "Malware payload (Phorpiex)", "value": "d3ed3f7dbced983282fcddec90de613f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058620, "uuid": "5ada9d99-0c79-44b5-9d60-558061411167", "comment": "Malware payload (Phorpiex)", "value": "724ec6b8cf5834d429ce360dc4427c8af4b1944cfe99020657f38ebb9b4b9d25", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058620, "uuid": "ebbb33fb-e8a6-4c82-a07d-fa478f3dea2f", "comment": "Malware payload (Phorpiex)", "value": "f3fec344d1b526b2b410c0cbc4707817540c25df", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058620, "uuid": "a9e2745b-412d-469b-a9b4-11bb24195fac", "comment": "Malware payload (Phorpiex)", "value": "4142ebccdf9ec4cd8f4a5ce8a4f17f2db46707670070092c40c2e446c666ab5c89e55fb6e4b272d8efaa25f2788762ab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058620, "uuid": "c1447a59-7f66-41c0-bd52-04be5510ee91", "value": "T1E1823A0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058620, "uuid": "e540f203-fa86-489d-bccd-3b2f9128fcd1", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058620, "uuid": "e398ee2f-7e04-47c7-a8ab-426806d986c6", "value": "192:zIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJV:VIblVP4Y/2N0bLu9JgPL7Nyav8U9ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058620, "uuid": "300eebf3-bfc4-4d64-8234-78508a1e38c9", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058620, "uuid": "6ed52bea-3e24-4a62-b90a-d152a7b8bbd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058620, "uuid": "571afefb-5e64-44da-ab2b-843a87860930", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d39fca-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780089090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089090, "uuid": "a16af1e5-4434-40b9-99df-2e44d6b7114d", "comment": "Malware payload", "value": "d54fd34cb8229828362a7f325da96cf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089090, "uuid": "ea4a297e-4037-4367-9f99-4b1943b1ae6e", "comment": "Malware payload", "value": "74edc2fd86ae60db7b5bacde6b14f3ce41854bfc0c6a86c8c77b4eca5753480c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089090, "uuid": "b2ff7175-31b5-4788-a243-e3cf88404574", "comment": "Malware payload", "value": "555e7348fb358e11b5477abf548b67d3135121cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089090, "uuid": "cd946a5a-a3a5-4b30-b12c-c0e3fc34d45a", "comment": "Malware payload", "value": "7502c1ec7d1b0f68b470fb96f5195980512c7465b51622059227465222d18eb602893f8367e8b62c86301e3dac186c5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089090, "uuid": "a8bf6a56-20e3-4729-987b-7f523ceb5dd4", "value": "T190762957B9A24942C5E43A37B8BE81C433630EB98BC752579D05FE387ABE1DA0E35740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089090, "uuid": "fca1f1f9-1a43-4820-95a5-ef99e3d6403c", "value": "49152:igBPCFQyxRHtnW2gbNDxR501Mde8U+X0Z1n795Ei:VBPCFQyxRHtnWPBDS16eP+X0nEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089090, "uuid": "da5a952f-3c17-446a-8c63-79672a3adb5b", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089090, "uuid": "bfd443e6-472f-4bb9-a8b7-5654c284ce58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089090, "uuid": "d83b0dcb-961a-48ed-8276-c642520838e9", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9001e9f8-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039096, "uuid": "d2cd1d06-e5de-4037-a5f4-468ef44d0ae6", "comment": "Malware payload", "value": "f654d2365037146b82b67499cd707ef7", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039096, "uuid": "fc14d310-ff9e-4cef-bc45-8d2511ad950f", "comment": "Malware payload", "value": "76f1cf01e9ea5622a2998bd29fdf647ad7c5797c6bf7570ea585e32bcd43353c", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039096, "uuid": "78fbf00d-f9d3-4e5d-bb5d-ed2bc5087e9f", "comment": "Malware payload", "value": "71288a2d739f58fcb8b7f0f61e85a6d74fadcb61", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039096, "uuid": "832f0277-c76d-4b61-ae12-05588c2847c8", "comment": "Malware payload", "value": "983b13ac45f39a1c26bee37ec9c476a49ccbf19f7f1cc0359534cb4511e1297b49eb29bd7062a99b25daaa0a1408c11c", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039096, "uuid": "05602598-0997-4ae4-af9a-63a97d0e66d6", "value": "T18A137D6926813C289D9998371D7E2F0CB9A983E6310891DCBFCF3CF58C5979DE218719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039096, "uuid": "4ff8a7a0-02e5-47fc-9c19-77bc76b53d98", "value": "768:1XOGVv69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:xLXco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039096, "uuid": "03bcbeb8-8ed4-4b37-ac7b-926ec3883978", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039096, "uuid": "d173e7ee-d8ee-4af8-9d8a-eefab59e4f69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039096, "uuid": "5f466c62-fd0b-4fda-9c1a-1aed5477b4a5", "value": "76f1cf01e9ea5622a2998bd29fdf647ad7c5797c6bf7570ea585e32bcd43353c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb813cd7-5b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780076643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076643, "uuid": "7e9bd1f0-fea5-48f9-94d3-3c533f742441", "comment": "Malware payload", "value": "625e014233cbac318cec7b3f47ac1e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076643, "uuid": "39b40be1-7dd9-4b26-a90d-7e9c22f85633", "comment": "Malware payload", "value": "7703380d87320d20cb3a1ca4aca3e72e235125eb2219fe63c46884715b5d90d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076643, "uuid": "6a2890c5-33c4-49ae-b4ed-67595a1c7ed0", "comment": "Malware payload", "value": "6c18beafb1829814b196e2576ebf950619c34f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076643, "uuid": "9d7be2cf-d256-44f7-aad7-b073ca959c0a", "comment": "Malware payload", "value": "fdb47c6a87f9a796ab21ab62f4526228c965914772eb966801cc048073d19b7422c5025b460e1d8d6dce81e1edd61d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076643, "uuid": "6ce5e420-f4c6-4c5e-812b-a446cf1cd213", "value": "T1EA17335067E018BBDAF65A7AC036A16891A2B4124B81C1EF5BFCD31A5F6B7E03D3CD05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076643, "uuid": "05a31525-3bf3-4d04-973c-8cc979ee7568", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076643, "uuid": "d5627aa0-6d4f-40e8-8ef7-c99810f89849", "value": "393216:785vzasFl7dCR1C99OXr8Lg5lQbZklOIl2lInEroX314S2kIn8vaxbc50BcPmT1C:I5vzJFlUR1OOb8aQQLErUqkWMaxA50BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780076643, "uuid": "f922e255-39ca-49c3-9d63-18278635914e", "value": 19291319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780076643, "uuid": "013af7d0-e1df-4e40-ab0c-7ee46dcaf447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076643, "uuid": "488a5b49-b916-408f-9e90-640cc5753d39", "value": "CookRuntime.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8487d161-5b7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073007, "uuid": "fbf5cef4-77ec-4690-9cda-dacfbb3a31cc", "comment": "Malware payload", "value": "632b95a895d8745754d1ffec84240f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073007, "uuid": "098ae686-b832-4a78-bc55-665f07151c76", "comment": "Malware payload", "value": "771815d8b0a83a098022bfdd17e4a7791682e0b9dbc285dd87fdfd0df2d409f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073007, "uuid": "23f17a8f-5ba2-4bc7-b573-8440eccce743", "comment": "Malware payload", "value": "1b7cdcdeed7a433f38b6de4eb61e659634bf84fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073007, "uuid": "5b011737-de6d-47d8-9d71-1d70da9ea816", "comment": "Malware payload", "value": "f397787e14e5a227d305a30ebe503b93ae40f1d0b5147d7fbaa49002441bd6e8fcd53ac1de4cc267ad47fb2e1d7fd1e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073007, "uuid": "7cd09796-b595-4a08-b467-db5e5dbb05a6", "value": "T19017BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073007, "uuid": "dc3c969a-3d9f-4bbb-9cfe-b426ab79413f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQo:cqYUQuVDt0TZEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073007, "uuid": "1d5ecaee-7b44-4778-9b35-6412364e4fb8", "value": 19070976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073007, "uuid": "ab03878d-f64e-425a-8e66-901246513be0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073007, "uuid": "26e39dda-2b3b-4043-adca-9afc3cd17414", "value": "771815d8b0a83a098022bfdd17e4a7791682e0b9dbc285dd87fdfd0df2d409f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ea0100-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780089084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089084, "uuid": "8aa9fab2-56ae-45be-ab60-7fab1fef9280", "comment": "Malware payload", "value": "7b89b064dbd37f8fe49b1d41e8a9ad80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089084, "uuid": "0419256b-645f-4b8a-99ec-43565bbda362", "comment": "Malware payload", "value": "78cfd5dd093d75c7a4d6a24d5e3c420c733e750ceecbed43e008e7bc7b403ad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089084, "uuid": "dccc3fbd-b82d-4b1f-aead-c738f22b7ac9", "comment": "Malware payload", "value": "e02286114b43593d772562248b36995864b6ea17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089084, "uuid": "64213ed9-6f68-441e-9295-93bc23a73557", "comment": "Malware payload", "value": "a424db7bc6653f16f9999293e24bb17bc955437b5a4766b9729e6010f90860625bb821e7800b7835543d87e5f3cfb39b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089084, "uuid": "58ed104d-b010-4b5e-afd3-932076583bc3", "value": "T186761897B8A24942C5E43A37B8BE81C433630EB98BC756575D05FD387EBE1DA0A39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089084, "uuid": "625fcb2d-4375-4411-bf65-390db39909a4", "value": "98304:p+iF71bPvXHDswiAMV+SSX9Hf0Cyj4lEU:9YwDJX9Hf0ZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089084, "uuid": "09efcba7-fc70-4ed2-b726-4412fea53293", "value": 7471266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089084, "uuid": "b6a04dfc-b46e-418e-a271-9fde3557dc42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089084, "uuid": "22952701-c084-4e93-90ec-a479baf16587", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa287178-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "7430da64-19a2-40ff-8b9e-911de053ec24", "comment": "Malware payload (Mirai)", "value": "971d7b638e7af5e2053effc541d9b2b5", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "ae59e310-4423-4831-9490-dd1c3175712a", "comment": "Malware payload (Mirai)", "value": "78e3b2952b96548185e6013b0442eed2bf4e028c093de9082309e2163cabb18c", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "d1dab72e-4070-406f-9337-a6467bd9b2c8", "comment": "Malware payload (Mirai)", "value": "3151cc9a3f118f7249b96248519111aeed2dad5e", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "d2a5b938-77d7-42ca-8d12-94b70cbb9f37", "comment": "Malware payload (Mirai)", "value": "fb15b8799087043ccf5f5260fa7243717062cd82fef3f535d295d64b3c559eab43b56cd3be414d6ccc1f57035bce1c33", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "6acf0f1e-6370-4afd-9f99-f28b99a3c201", "value": "T1CFC30956F8819B11D5C151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "31a12ff8-b7fa-4af2-9883-bcdfae0ffe71", "value": "3072:fOD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1h:fOD76aX9aKTcRQVnoiYq1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036563, "uuid": "fd4bc6df-803b-431d-b791-7a7f3c6c9cd9", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036563, "uuid": "59aea5bd-51b9-4941-8663-b80a731726ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "a1800d07-3bd6-4871-a829-1c0c406c47b5", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6240f0b5-5b45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780048898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048898, "uuid": "d0a8f9b1-4059-4ea2-8542-75fbf61d9f38", "comment": "Malware payload", "value": "336a065019bd34ff9afc842e1a98016c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048898, "uuid": "ac1af64a-3b21-4007-8d48-da4f7ecae57f", "comment": "Malware payload", "value": "796a371d25a0a76a03f74fddd75c3774077d1329b7a27366a1bf9c6dfecd882c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048898, "uuid": "c738a19e-2daf-4a16-ad36-044750186b25", "comment": "Malware payload", "value": "22ba2cf739d8321c805d09279026d0b240bee02d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048898, "uuid": "d2f14a47-f237-4243-9360-361e4523bace", "comment": "Malware payload", "value": "b7e085bb471030dfedbede9b11ca2bad02ccad89db2ac89dc518ac4e79e28d810e43e2fe3191a608f69d6fb490917d80", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048898, "uuid": "77235642-8969-4247-b537-66241d16da91", "value": "T1C1F4CE4933EE9CEBC03993B81D8D49D01BE32CA1C691C75AF6501EFD0D3A5C46E972A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048898, "uuid": "380f7b87-a135-4b77-96fa-d7ce88f58208", "value": "3ba26262c0cdb8c0f12fa10dae364d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048898, "uuid": "d0330e97-97f9-4e81-878c-62b9ef68e8bb", "value": "12288:T5SlDfoAncPEnE6IvCq+pyJhvurwFavepkB9pWD2S9IXwLIodlRx:TgxcP/JhJlurkpwpWDFIodDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048898, "uuid": "174238d8-d4b7-4cd8-9e0b-9ea5dce84f13", "value": 744566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048898, "uuid": "b7fbb024-a59a-4154-8b55-877864f3e4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048898, "uuid": "d7f30bae-15cd-48f9-880f-9800febe4cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802d4f21-5b0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780023608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023608, "uuid": "3590930c-7e92-43a1-b3d8-3f81b343f764", "comment": "Malware payload", "value": "03acf89e256c7157ba22fb02282fa8fd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023608, "uuid": "bdfa7abb-195c-436a-866a-2fb8e72dd213", "comment": "Malware payload", "value": "79a064badf89f022b2ee3eee90c03f4a204cc5c84940db761ea4caf61ab38bd3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023608, "uuid": "5219aeec-8a2a-449d-a279-d162b3f9ea6c", "comment": "Malware payload", "value": "918e02145b509246fc0df9f8a41c47eaab2edd60", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780023608, "uuid": "6f9049c0-5dd0-40d0-929c-b82ad7d4666b", "comment": "Malware payload", "value": "dda979fb84116710f885dc09e4c596474024314fd2e418b7f5e162b9d9e590141cd86510872ac9ad86495ebdab385b28", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023608, "uuid": "ac06ec81-4d98-49c9-b1de-1707db7d4f69", "value": "T10AA32741F7F94119BAB72F442AB946B8497BBFA2153DC9DDCA110D8D0B33508A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023608, "uuid": "4bceda74-964f-4c58-a6e4-64104928ff94", "value": "768:7YDReBrM1gDNNd1OOlNW7Q5mo5lPwdLAp/sUChsUArNS5A4zAteVgDuXvd5viOkV:O+xvX6LBoYqAVNPRNvPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780023608, "uuid": "667bfba2-4a12-485b-9cf3-ab1e323d6ef6", "value": 105816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780023608, "uuid": "c94275d4-2c1e-4900-9528-3b389bb70ca9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780023608, "uuid": "9bd21c16-4e3e-4b42-ba9c-40646fc3c394", "value": "rmemorando_8132777c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5b1e91-5af1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780013054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013054, "uuid": "156af42c-b50c-461c-a21b-62b8bafa76be", "comment": "Malware payload (ACRStealer)", "value": "441528669a96bfee906758bc72b5dfa8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013054, "uuid": "70837cbb-e53d-4cdf-ba42-5dca3fc9bcc3", "comment": "Malware payload (ACRStealer)", "value": "7a1b5d1b9ace3b084cb8cb116a29b659347d3154d16d62c959abd2ab79499d4e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013054, "uuid": "59870f4f-e124-4a25-9ce5-dc2035dcc123", "comment": "Malware payload (ACRStealer)", "value": "f887bbbf2c410b00f472504205343de37db189cb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013054, "uuid": "26ebd8c0-8b68-4a85-88b7-3d30421f110b", "comment": "Malware payload (ACRStealer)", "value": "3cd66126321fc0721ca651e07ca8a7aa4b0797c04d453f31699f4097714e9e0f1eba591779dffb99e33465bfa48a1ade", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013054, "uuid": "b49ad778-a018-4814-8a8c-ef0e8b884c15", "value": "T1CCB59E42FCDB54B1E906123288B292FF2331AD095B3A9FC3D9447E7ABC774A50932795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013054, "uuid": "eea39808-07ae-4325-835d-af7386402c37", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013054, "uuid": "e72fc5b2-4b6e-4a4c-ab32-111ee42900b3", "value": "49152:oxxrS/4P/TNiSMxsmRk7ipfI1iODClZtYD1c38o:09S/8/TNiSyshcAiR738o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780013054, "uuid": "dcd753fd-8a7a-4681-814b-b6b48f300252", "value": 2317512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780013054, "uuid": "de550c89-4c15-4f40-9422-d8a5e6d0931b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013054, "uuid": "2cbd1372-dbfe-461d-b504-e0fa64bdd882", "value": "uRgOy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f9e991-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017522, "uuid": "dcb693d5-a815-49f2-889d-cb520f805238", "comment": "Malware payload (Mirai)", "value": "ae6cb541c12aa15e654b82a442da9992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017522, "uuid": "c1445f2a-f97d-4ac8-93d2-8ec03a761c75", "comment": "Malware payload (Mirai)", "value": "7a646b2b11ee0a60e73b5d481023c1cfe05a0ca24cea283a279e5e9a74917e02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017522, "uuid": "6e64b3d5-d51b-4337-a567-e62719480a27", "comment": "Malware payload (Mirai)", "value": "99ea428923dad626f75780cb6b752282ee1312a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017522, "uuid": "9ed3825f-b6c0-4e0c-85ae-9ef7b10dd598", "comment": "Malware payload (Mirai)", "value": "2a0a7be08be472bfebe6a873ddb4b6827a4ac6f7c2902c26117b94b783154364f1e9c53aea9154c9f4b1d04b7c36c035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017522, "uuid": "cc61a388-8c2a-47a4-a827-2a10410f4570", "value": "T1D873AE3AD41959C4C446813C70ACCE380F13F58DA3533EB709E54AFA5887AA8BA65FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017522, "uuid": "d9baf5d8-91fc-4a7b-9ed4-707744057a90", "value": "1536:7CFFPb7EmfFi9XHo0Uncoa+f35Cc3Z+L0:7CFRbPFOI0Torf355", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017522, "uuid": "55b03a87-c43d-47d2-9f15-d15383af16eb", "value": 77348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017522, "uuid": "ba5df8cf-70d8-42f9-8ac7-6efcbec8d0a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017522, "uuid": "4e65cfc9-54a0-49a1-8737-8a88d0baf643", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41e4ab9-5b27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780036177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036177, "uuid": "eb8551e9-948c-4782-9a60-cc4ab3254bb1", "comment": "Malware payload", "value": "234b990e3958163dab2397fc3e28f905", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036177, "uuid": "ec95b6fe-b7b1-4acc-9e87-88aa6d0314f9", "comment": "Malware payload", "value": "7ab76063080e0903e58733c6e136f6816a6e26b33be0207b9a34d94c44c2b520", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036177, "uuid": "1a721763-b192-4cc4-9dca-7cfdec1261a0", "comment": "Malware payload", "value": "899cf498b959571fc24f07307327ae8528f51f9a", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036177, "uuid": "07b06f5c-fae0-4813-811d-c3bd6fa9ba8c", "comment": "Malware payload", "value": "34af63b7fffcd032c8590892d15f44c7ed3005ec23e18c855733372f8bde2750117adc43a34625876de4a671ab374647", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NovaShadow", "colour": "#69E761", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036177, "uuid": "075c7557-f1e9-46b9-9354-e248d10da8d6", "value": "T15BC451B91CA32C703E13589F42DE8D1D38CA5C1B658B6D00B99E9600AFEBF14C9B5D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036177, "uuid": "44138164-daee-4f9e-ad4c-6c7c8b77d473", "value": "3072:JgBzs9d6N38gh04fnm4lFv2l3i1IIriL+TwJX/9DsJ+UDDGRfO:J3dfgS4fnrlF2l3SII2L+TwJv9DbUEfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036177, "uuid": "a9ce5f1d-47d4-4123-90b4-da6fe6ead013", "value": 592207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036177, "uuid": "6509eadf-eed7-43a2-960f-c0a4743ebbd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036177, "uuid": "fe5528bc-c2df-4afd-b03c-5478f077b152", "value": "atribuyeres_deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ee3e90-5b98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780084448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "ecbe1bc4-acc5-4e96-8f10-754d0926bb12", "comment": "Malware payload (ConnectWise)", "value": "a970d1421c1125070e1ace4f4de7f937", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "e7e77fa5-79eb-4e04-9b90-02fb618e41b2", "comment": "Malware payload (ConnectWise)", "value": "7ae875105e38f57f67da2eadb9c0b6f3aa9dee9e53c2397d48c178ae3a1f7ed0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "28081355-774e-4ae6-820e-dba7ace8909f", "comment": "Malware payload (ConnectWise)", "value": "ac99df3f4d5633a0bcff1ea03f390fb973af16dd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "1e2254b0-e7ad-44d7-a0f5-c8509b682005", "comment": "Malware payload (ConnectWise)", "value": "5c09c38154f94e2a4b95ef078ecc1e34f01ee5b3c0bb2e660a477ca0c9001254e6c3dd413f0fdc3a269bbf98cfc164b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "941a07d9-63dd-4c40-a149-395fc523c066", "value": "T1CA46E101B3D695B6D1BF0638D87A56696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "e6d9d14f-6ddf-46e3-a978-f6f41b5c5760", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "7717feed-1481-4120-8465-feffb4286119", "value": "98304:GzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl1O:GhfefPtHxcp9ym3nltDUJVLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084448, "uuid": "28810a95-03db-476f-a703-5be5d2980f9d", "value": 5791560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084448, "uuid": "d8bd6207-cb7b-4d9b-8019-3b82d9e839be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "2db0e706-af37-4b32-9a9e-6daadc2bcc59", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e315372e-5b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780035800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035800, "uuid": "77eb3c11-9b51-45de-a866-307d5ef6a3a4", "comment": "Malware payload", "value": "10931b2611cf0fb12f6eb5d8b78980f4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035800, "uuid": "fe5fb67a-9fee-4bc8-975e-336435aa4e8a", "comment": "Malware payload", "value": "7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035800, "uuid": "cb65c3d6-4457-4821-9751-30376da7e24d", "comment": "Malware payload", "value": "24651d102908297b52b3695533323febda5b304d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035800, "uuid": "0a054ab9-ae15-47a0-ad1d-debb3b35a3f3", "comment": "Malware payload", "value": "be7084af813d5e0a92c10992285d37024c43e46510512c978623f7c2ea140be71894b5de7c8f900e9b9bc14b62bf7cfd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035800, "uuid": "25f4741b-63e0-48d9-896a-ab4be5806a48", "value": "T1E50165EF343234721B5385E65C1391574D76C27F6BD01DA878E56B3409AE020632022E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035800, "uuid": "59803592-2383-402b-a296-1136f700547c", "value": "12:SCny997dG3BCFr+Bnx8jdVXFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73Oc:7QxdGxCFnpVX1EDlgNjTidGXhGIBFVRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780035800, "uuid": "f7109312-eb8c-4129-82ed-54dff3721810", "value": 747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780035800, "uuid": "daeaf5cf-52d3-4028-8067-8e68c2afb9e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035800, "uuid": "3c204972-65e0-40d4-8a9a-1bc271dae6b8", "value": "loader (2).sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa9c610-5b02-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780020090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020090, "uuid": "0f62215f-da30-4226-ab4e-aa43d26edc45", "comment": "Malware payload (Mirai)", "value": "fda11d4240a324c4cb308a9126c0b3ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020090, "uuid": "64ed95bf-5daf-47db-b2ed-88570c4fbc02", "comment": "Malware payload (Mirai)", "value": "7c4e6d57a5ef8812aaab95edeae7615e6217320274ec66b7575a8050d2e34c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020090, "uuid": "7277e652-31a6-4352-9c85-cbe0d0851b53", "comment": "Malware payload (Mirai)", "value": "9bdefe63eeb9c432847e4e336474ca8622629a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020090, "uuid": "50d249d2-a2e0-4110-bde1-05d95600fddf", "comment": "Malware payload (Mirai)", "value": "9fa140c1dffc79c3ce98c74ff1a6a16dc645e24bd5fc71bb88878e1880103854cfdbcf6df2a309e664996aa7bd57775d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020090, "uuid": "719d02a9-0652-4ad4-94e4-d8dd6e2e0be7", "value": "T1B0B3E8467E04FFABC03D4F709AA9C71210D4A5C5B6A6A13F72A0D6DDBE792120E439DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020090, "uuid": "1a4e1904-9ebf-410d-8b4d-b1ebea9472d8", "value": "1536:61Tgkr53RfCMEc3IcmAEJQJuLZsjkR3YylBsdi+Lp+b7q1GQVEFqt9S3:nM1fEcYkXJu1sIY2LAIbG1G2EFyS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020090, "uuid": "d7810a79-ac2d-4db9-9577-23d44766f479", "value": 111532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020090, "uuid": "488b78bd-8420-44e7-9daa-4ba1eff40c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020090, "uuid": "f34ef512-c2b7-4d05-abd1-3a6ca681f32b", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba476b31-5af8-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780015974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015974, "uuid": "6c454503-9480-4cc0-9da2-71dea7c1ddb6", "comment": "Malware payload (QuasarRAT)", "value": "bb7fa33f4e49dd5689eb58504d9b94d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015974, "uuid": "6c425beb-9e32-4220-a6b6-ae6de23dc392", "comment": "Malware payload (QuasarRAT)", "value": "7cc18c8995f128cd34217627dd67041d6ba798bcaf277a38c9eec3ae8b5389c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015974, "uuid": "0a1c01ab-c601-4773-aa94-314de2018f25", "comment": "Malware payload (QuasarRAT)", "value": "1e0444121cfc04a53ecbbc94faf19d17743b0c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015974, "uuid": "99aaa9c1-541a-4f96-b441-14f0ade91c27", "comment": "Malware payload (QuasarRAT)", "value": "882cbe65cc71ca60c54457d9551bdaec717afe579d7ff9b531b745fa3d1448d85ab05b64c17fd0ba6a92960a72a4bf16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015974, "uuid": "26f271ad-24f0-4573-9b7c-a2e6efefeafd", "value": "T191E55B143BF85F23E1BBE273D5B0041667F0E82AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015974, "uuid": "5580511e-d971-43bc-8197-f5cb5fdbcd10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015974, "uuid": "e7254be0-de3c-40da-bb51-981413401331", "value": "49152:0v4FM2eBaGlMJPFlUERb6HXqwxOexNESE6k/i7LoGdsDTHHB72eh2NT:0vYM2eBaGlMJPFlUERGHXqwxvxNHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780015974, "uuid": "ace908ed-77e7-4609-9607-a11503e55bb8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780015974, "uuid": "b240280e-209b-48a8-a72d-7ad2c48d2e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015974, "uuid": "8c4cdbc0-34f6-40b3-b61f-26a65c5d441b", "value": "meridablancainc.it.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f73534-5b86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780076763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076763, "uuid": "3dc8a135-c70d-4f49-80e4-ddb6cb245cee", "comment": "Malware payload", "value": "3c345dfab8e4d21beadd9ed11d490081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076763, "uuid": "a0e13904-429a-4c3b-a991-e0c1e54bf8f2", "comment": "Malware payload", "value": "7d27644922e124a837d33a1fcbb86ca12bd04737008d49a74b215c103bb3efb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076763, "uuid": "5ab820e5-a0ee-4b28-8415-af3abaae80a8", "comment": "Malware payload", "value": "06cc4c3e24d556115f7bb9d1891ca9d6ed36dfa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076763, "uuid": "cd4796ce-49e2-4416-9b1e-57b02a7862b1", "comment": "Malware payload", "value": "7c9e5a08766dcba759dfb0d4c658d5abd04c40f41782c7b251e94e00d8db3458fbdebffe72c113289c99dfa0d2ac2abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076763, "uuid": "beb7f8c1-c7d3-4994-a32e-a64208720d24", "value": "T14DE4BE2B76668E12C3C49633C0C71A0593E4E5823637EB0F768527961E473EBDE4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076763, "uuid": "38f18b5c-e808-4d19-827a-cd5b1a614a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076763, "uuid": "57a414e9-595f-4660-b4d9-02534a8e3055", "value": "12288:/gE8zGKwiHs1GwW+n0KzPg5/SEb0MG1wSHBIdxRKWkMerRir7E1S5Jg7ohpRo0j1:WCC/4auYjt64A9BQpCpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780076763, "uuid": "3c7918f9-fd7b-4bbc-818a-11651c7eee27", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780076763, "uuid": "b5b9d0d3-87c8-4c60-8534-a3b2270e40a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076763, "uuid": "1f4746bd-365e-4f5b-84d6-65128ae6e415", "value": "out.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b2922c-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037579, "uuid": "0792b858-0d5d-4800-88eb-4ea3940b7df7", "comment": "Malware payload", "value": "5f63212b126763a9dc77ec538f3ec2cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037579, "uuid": "a5aa2c77-a806-4244-a26f-2dfc6200ba66", "comment": "Malware payload", "value": "7d47ca60c6ec500c39868a79cdd15d3af2c35221b52aff6a4976e58dca47748a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037579, "uuid": "867d779b-387c-43eb-ab66-1585714d3281", "comment": "Malware payload", "value": "cce04770b0dc3a90c8f21ed85a47e155706623aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037579, "uuid": "1b5482b1-d667-45be-8efc-08c289350415", "comment": "Malware payload", "value": "51f78927c3b1512deb85ff8bf9970a8959ec41a4b2ffd7b31e77afe4580a1e8178e0215aef0a8e08f5d0834dc0d39467", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037579, "uuid": "3299ff9a-bef9-46a5-bc20-c4ccdbb5fc9b", "value": "T11076DD6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037579, "uuid": "4365b8a4-6748-40fd-a7a8-ae05ca5fb59e", "value": "6144:rubnYpscX3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfs8wpNOVwS0msFJvXiESUWj/:RPDDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037579, "uuid": "81880236-da8e-4018-8e93-bb924fa4ed27", "value": 7674528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037579, "uuid": "5fd89108-68b1-498c-b89c-e8d2b90fd5d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037579, "uuid": "df8d27a6-14da-4556-9a36-141c31c0bc2d", "value": "Update_18.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ed0941-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038710, "uuid": "88d3f85e-f6f4-4d21-bbc8-27718f8798fa", "comment": "Malware payload (Mirai)", "value": "e5ed691b7b82cd2f41eb3035a00da4c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038710, "uuid": "4e373e13-d25c-475b-9b34-87e8ccaf081f", "comment": "Malware payload (Mirai)", "value": "7d80f4508ee1cbabdc4b5a813d5cef0a00731b3a064bf1afb0cb4a24522661be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038710, "uuid": "41eaac19-332d-46b6-938d-51097ca7c04e", "comment": "Malware payload (Mirai)", "value": "f6e02f0a39e824b200611a5cf9977a12e4e4c695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038710, "uuid": "11d79f70-67f3-4fd7-8ad7-5422560306ab", "comment": "Malware payload (Mirai)", "value": "222d5a8582de958ce78f39c8527d71cc424dd7ff61bddaf282fb5603596f0c27e75621b837fa5a2c95f0fbfb4ce1a1f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038710, "uuid": "e814b278-6c5f-4e6c-b6d6-e108f1174b8e", "value": "T134733985F987C6F2C4474830416BFB3FCB32D9A510A1DB4DDF5A9F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038710, "uuid": "cbe0a643-dc6a-4990-8628-565c37745255", "value": "1536:Wt6dVFeGBVWWI2TTeQmP7uW2wORzBbkivom3aJe2dLNn:WtSjBYWI2TTe3PrXORzBbVvH2dLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038710, "uuid": "260053dd-7c67-4748-9d61-76b7a815f797", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038710, "uuid": "bf3637b7-4024-4635-a3b2-f1b9f854aef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038710, "uuid": "fe38b85b-16df-4862-809c-6c1de53a2663", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290febf4-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037635, "uuid": "1c314f8d-c762-4f1b-8f9a-ea7745d2ee04", "comment": "Malware payload", "value": "b8aa865680b4c8fea6226f3f6b42b4a5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037635, "uuid": "32e4a3a2-affa-48db-bfaa-0838523abb79", "comment": "Malware payload", "value": "7d9ac86521aba5d8989dd21ed08ab3b138c7aeb4dd41bf8566c10d3d240f55a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037635, "uuid": "7a805390-e042-4b76-a9c4-4159bd7068b0", "comment": "Malware payload", "value": "d00d4b70c34543927e4eef7b9d6f9aec030f1e3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037635, "uuid": "bdd0d4ec-057e-4d1c-ab62-28a3d60f0495", "comment": "Malware payload", "value": "a58aa1c026fc271e319a862467e597b86af1fb7eadbd77a94277837fdb270d6cae81be66d8d94c83576ee424121d1c45", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037635, "uuid": "6ad0995c-0485-44d3-8061-c1f7a9aa77f3", "value": "T16C96DDAB6DDC361E3000B1C6F48521F5E6621336DBDE12D9B8F924337AFA49AC42D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037635, "uuid": "03a71a89-5e5a-41ce-a632-848f738202c7", "value": "6144:NubnYpscU3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsF9wpNfVwS0msFJvXiESUWF:SPA+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037635, "uuid": "d2a209cb-984e-4257-89e5-1ca783b1c195", "value": 8828881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037635, "uuid": "0450ceaf-bbe0-4888-914f-1947e477e675", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037635, "uuid": "65ce03c9-0c64-4fa5-aee8-039d7038b981", "value": "Update_24.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac0083-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055794, "uuid": "39d2e38c-e8f6-4e7b-ad3b-7447182c2d6a", "comment": "Malware payload (BlackMatter)", "value": "670f0ab908536b5804c6f06f930f915d", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055794, "uuid": "f7ffe62e-0e16-41b2-95c4-1dae7f595b0d", "comment": "Malware payload (BlackMatter)", "value": "7e9bbc5c0e10efd2ae5509243895cc74a242051cd48ad08055e99ac9da0ee781", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055794, "uuid": "a7fe8baa-4002-4ef2-ac99-7218c210b048", "comment": "Malware payload (BlackMatter)", "value": "890a0dcdea9db1716756d7e46232d92b760dc919", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055794, "uuid": "78b5e3ba-7507-421e-bebf-1c36d81bfec1", "comment": "Malware payload (BlackMatter)", "value": "f5fa6e6a7fc5477e7a78a83031157df80c2802966ec40fabd20307a619a752ee12bdf2d2a905f357242a125e568c4149", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055794, "uuid": "a04b3d92-6cd9-455f-93ab-7daa87ab85a3", "value": "T13FE36E21F222D073C83718F53736B5B2F39E8D2C25A96847EAD80F997C658132F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055794, "uuid": "94c1ac57-bbf7-423c-b752-33c77943ff50", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055794, "uuid": "2c27311c-69c4-4f79-b1d5-183605119caf", "value": "3072:+6glyuxE4GsUPnliByocWepO4j9Li2ns8T:+6gDBGpvEByocWe8aiYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055794, "uuid": "2017734d-5d89-4589-9a8a-83e03555292c", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055794, "uuid": "bc8cdfe2-3ddf-4092-81c2-a4041cd50efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055794, "uuid": "b2cbb2eb-7150-4443-8e9c-a559f6caa0a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb36d98-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038611, "uuid": "985a969d-f3c2-4b8f-96ac-5ac094d63fde", "comment": "Malware payload (Mirai)", "value": "08b3e578657067d60f497072954393c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038611, "uuid": "ccdcaeb3-7d34-4bee-afed-4ca86cb3e321", "comment": "Malware payload (Mirai)", "value": "7f3f9dfeb2741a2b95332e99c07688885a1798918af6bc188ace8db7111e2aca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038611, "uuid": "44217dee-7975-4e82-b50d-169b33713867", "comment": "Malware payload (Mirai)", "value": "58f04a4ba31d0ac4e158b465be08a451385beb11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038611, "uuid": "4e99c385-02ac-4050-a1e4-65a533312f63", "comment": "Malware payload (Mirai)", "value": "cd3f0f4c4c966d931bbface65f8737169ac34b84ad9ec14af7fd579dffc745f4b63a9325ba0dc5c1a3a3b844a10e744d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038611, "uuid": "8e8474e4-d308-4b87-9b5d-2e233e251170", "value": "T1CAF2E09595AAF945F0DC49F89CD8BC4E4200E71ED471102AEBDC36362D83F836B25ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038611, "uuid": "8ce91840-fe9a-4047-afce-c0e412fe0543", "value": "768:B9JFwkShNFPtvZg1SOaN750uQ5dv09vlTnbcuyD7UHQRj1:fwkQNgDat5os9Jnouy8Hy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038611, "uuid": "aa7ad3ed-3910-46ce-9f7b-12979b445428", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038611, "uuid": "142c4e75-ecdc-448b-b6e3-2c36ea89a315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038611, "uuid": "694ed354-343d-4d2e-9da9-7f7fa8876738", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bdba8a-5af1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780012984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012984, "uuid": "8e02b0df-c3b0-4db7-ab17-75060155953a", "comment": "Malware payload (ACRStealer)", "value": "d82a510113de948c4970e62d6e4a5599", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "he-packetcore-cc", "colour": "#896758", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012984, "uuid": "42907761-fc2a-4849-b1f4-b19c18ae7236", "comment": "Malware payload (ACRStealer)", "value": "7f9634ff29b278d08c1b04feec298f0f57969076c83b115ef3bcf5ec56f79945", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "he-packetcore-cc", "colour": "#896758", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012984, "uuid": "6641b292-b1f6-4c74-baf8-43704d5465eb", "comment": "Malware payload (ACRStealer)", "value": "964cd6290568b764c57b53bb6aaffa394fa63c94", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "he-packetcore-cc", "colour": "#896758", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012984, "uuid": "2d55fca1-d38d-44a6-8ba3-08f5f08f729f", "comment": "Malware payload (ACRStealer)", "value": "4151cb8ca2571e30338aba5b075a69cd5e7ce12a775bce0ecb8bb1f44c65cd8ae38cf076c4305cd442832396e165dded", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "he-packetcore-cc", "colour": "#896758", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012984, "uuid": "6dc740dc-4603-48f2-a154-a027b026b51a", "value": "T116F58C01FDD74AB2E002123648A723AF2735AD494F369BCBEA44777AF9772D54932309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012984, "uuid": "52f1d48c-1c9c-479d-af1f-85e29e974d97", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012984, "uuid": "dffeb430-cac2-47f7-9b37-1459ae8def97", "value": "24576:ZXTOrHuaJug/Lxpj4BB0PiBnJ/QD87j/vPb53S3iScG7amkPQELwM2j1nVC/nAD8:Zj8TMb0McQRDfw1dUInobsOgcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012984, "uuid": "f44395c7-fccf-446d-b736-a874cae60848", "value": 3566720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012984, "uuid": "03495a4c-dcd1-464e-9203-48b7d6417e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012984, "uuid": "607023b0-dbaa-425d-9d18-5c6d3a41df69", "value": "U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fd0a35-5b21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780033545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033545, "uuid": "4574397a-deaa-4fc8-87b6-f4f40ab755ce", "comment": "Malware payload", "value": "6004e861712b9514d5462b8ec1c37af1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033545, "uuid": "6f3bdb96-7281-4d9b-b12d-bf7e2cfbd18f", "comment": "Malware payload", "value": "7f977afb092575ccc870597b73fa4557cf74f7aab925c9266a68698ea92acd7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033545, "uuid": "230e7b78-6236-4606-ad5c-e4edcbcebec0", "comment": "Malware payload", "value": "c6eeb5f3305be0759088fd015a5a331c57dbd23a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033545, "uuid": "720f34ee-0fcc-4ccc-9b1b-3952276c23ee", "comment": "Malware payload", "value": "c0a1413a59a846c37c6bebfb17da824a9ec4dd3617bb99865af3d95800b671cf1b66e67cb38c66aa7f9defe3040537d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033545, "uuid": "9eb8d0e8-cb18-4485-a7bd-431af4e1788b", "value": "T12F16184B547163FAE493C030F2C7E76F6A3260742819A8E66B13E564FC27D937681F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033545, "uuid": "e5bef055-1ee7-463b-81da-d4f12cc1fb4a", "value": "49152:NUDk9Un6pbjpz02l0o1jDia/ItRwNPMrb+DBJSPAgSDs3ynbyLR/w9:NUDal0Y0RwxM2DGPW8yeLRo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033545, "uuid": "071a9a08-839b-411e-b556-08645f03a912", "value": 4059468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033545, "uuid": "45d0ea7b-ccb2-4651-ae99-ce5a82b732a7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033545, "uuid": "31001c2f-51e1-4836-a6dc-88b5573c0821", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7607666a-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056662, "uuid": "043ce245-c9bd-4b8e-b80e-88d6f3d3363c", "comment": "Malware payload (BlackMatter)", "value": "b8fe18055f6a059a65a2a6ce8a95cb31", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056662, "uuid": "9b11b9b4-59b4-4c6d-9a32-b1d2736410d2", "comment": "Malware payload (BlackMatter)", "value": "80d36c0476b5de983271b65665bb6997eb58316bc3c151f04b045f45ef80784c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056662, "uuid": "8fa0f433-973c-45f3-ab3c-7297f35973ed", "comment": "Malware payload (BlackMatter)", "value": "1e2da730fa15b3190c5d6932268b184fad749166", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056662, "uuid": "9fe1610d-ee35-4b54-8090-3e64006465db", "comment": "Malware payload (BlackMatter)", "value": "7abcc884ffd6733adfbb8b0e1c77db410482a4557627903cf824494f319313543e42a8d00dce8797c2b752ab851dac31", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056662, "uuid": "8e9e6624-03bc-41f8-bd28-47b589e58940", "value": "T1D0E36D21F212D073C87718F53736B572F3AE8D6C1AA96807EAD80F99BC648136F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056662, "uuid": "39e00f10-ed07-467c-a329-203813ae48ee", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056662, "uuid": "3b4a723f-1df6-4b1e-ab1e-45a77ee66ce1", "value": "3072:L6glyuxE4GsUPnliByocWepQiCzLoy4gBH6U2IdXq:L6gDBGpvEByocWeqvvoy4gBaVIpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056662, "uuid": "4b01a34a-e2d7-4f46-9ca4-97861e73b83b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056662, "uuid": "8742e837-a83b-4f05-8a18-747eec2ab28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056662, "uuid": "fb87dda2-19e6-4ad5-ab84-c2d8c433ec34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9beb75-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016807, "uuid": "e7754bce-ae00-49af-9860-259bfe9711a9", "comment": "Malware payload (Mirai)", "value": "cc58541e85ad4b2e415eb08bfe3fc718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016807, "uuid": "84e6aea3-6fcf-4a4b-b2fe-af798db03f8a", "comment": "Malware payload (Mirai)", "value": "8123b21fd4935db1b00c15d586cb3823145ad06738dee382398c1e3cdb48ea8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016807, "uuid": "a3bfc803-9977-4d78-9a25-45f8d315390c", "comment": "Malware payload (Mirai)", "value": "83c7185569814206309b1d100530ad04672d4067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016807, "uuid": "9d6b86d2-62ff-4695-a6c0-a02ce970c3d9", "comment": "Malware payload (Mirai)", "value": "444fa00b0f266e5dfd2670bf012bc96abd4144c584a099fcbe59998bb57b7e204ddfb79457789b73b8f7f8f5d39246b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016807, "uuid": "cd065bf0-f60a-44cd-9658-b767d86e099d", "value": "T1B4B35A63CC366F68D624E5B4B5709F781FA36960818B5FAE1467C2B58083DCDF2067B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016807, "uuid": "1b5ea0cc-cf0d-4b97-b69a-0cd61f8bacff", "value": "1536:Is/j4KotYNCcKWu3407jdl+ZKkgoCWFwvcRYaFgl+4SMY:ISj4dtYNKWQb+ZDxCWWvcRrHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016807, "uuid": "c283ef31-ab95-4941-82fb-bf5bdd21bc90", "value": 110336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016807, "uuid": "745dc18b-ab31-4d31-8b7c-9f1ef41aaa3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016807, "uuid": "3704b6f2-4ba1-4a04-bd0f-3b2c3f4fc3ab", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5af830-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038662, "uuid": "eca3b994-9db5-40ee-a0ad-5ce22be568a4", "comment": "Malware payload (Mirai)", "value": "85dc24c80e6de347d85a2e8a78125c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038662, "uuid": "62f52148-b212-4360-9b4c-02e496e1966b", "comment": "Malware payload (Mirai)", "value": "820394de350a6c3f9c6c9135f1846fb172492b4f2dd7bbc5132b8ff2bc377b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038662, "uuid": "96f09b11-c3ab-4f4d-ad57-acf7a96eef2a", "comment": "Malware payload (Mirai)", "value": "e2c3f294c3510ad85f0bfaec3f1975c356a07d2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038662, "uuid": "eb2e8791-016a-4fac-8b71-abba53fc5cd7", "comment": "Malware payload (Mirai)", "value": "99b5341a25a5762b1d510c80aea1e9ad924953c4dfd1efb053a01a36ce1c535049f33c1124e97604ac2a013e247dc676", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038662, "uuid": "1273d884-65c1-4dd7-95e4-46158db1aecd", "value": "T18DF33A46F6418B13C0D61779BA9F420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038662, "uuid": "c4d2926d-5bef-4d7e-b58e-058d75fd92d6", "value": "3072:i2bmltnY4BRae/xGPZ06v/mYp+C9T6Mj9HDjyoM/9Gc03:xbmltXRae/xGPd/z+cT6O9HDj1M/9l03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038662, "uuid": "9a54a659-98cc-4bbb-8ef5-dd031814b361", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038662, "uuid": "040bc6d9-c0e0-4795-be22-11725384146f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038662, "uuid": "cc4f90ed-38ab-4dca-8311-e38280c84095", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77077ec5-5b69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780064395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064395, "uuid": "c24b3933-2376-4340-8010-8bcd41089e2a", "comment": "Malware payload (Mirai)", "value": "8d965e4465549129c795adc286b7f34f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064395, "uuid": "b641fc88-d212-4835-85b2-aac6fc823cb6", "comment": "Malware payload (Mirai)", "value": "8217f5489d2737b547aecc45df980c857461c807d299df2bb1265bc6a2261905", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064395, "uuid": "9c754fad-e15d-47d3-bab4-9d8f376ef497", "comment": "Malware payload (Mirai)", "value": "181a8a316bd826d2e4185a95a7b8326e544d0fe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064395, "uuid": "ddb393bc-99fd-4e26-b53c-6e962c4a760b", "comment": "Malware payload (Mirai)", "value": "cb3e68887baadd1d67e5cb1d4b491549b24d4b3c6bf9025ddd2dc3f1bec280c36afd357ce3188982e5d61af78d8476aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064395, "uuid": "90f08284-3445-41f5-9d56-3e65c04e3274", "value": "T169F47D5DFE4E3C41E2DBE378DB4D83E1A22BB194D32351A23982435CD4C69E9CBB0656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064395, "uuid": "c4b642d8-271e-4671-8ec2-494f422ca829", "value": "12288:4MmeQ2oLChYQGJz/MERTIa0gULjKhWKz4HgKP2w5j7u2AUd:4dt2cQGaERTl0tOhWiG3Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780064395, "uuid": "bc8a29ba-14d5-4808-9670-992060bc6b89", "value": 729488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780064395, "uuid": "f4ba7393-eb29-4d73-bd69-f54368da7d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064395, "uuid": "488a9491-399f-46d8-8b09-f0eacd179085", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b1ab98-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780092768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092768, "uuid": "7511df8b-33be-4f79-80eb-44e5e56aa476", "comment": "Malware payload (Mirai)", "value": "c1c95d7a1cba0d555c65802a89eefe2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092768, "uuid": "cd1aff31-5cc2-4240-87c5-b0667fe26870", "comment": "Malware payload (Mirai)", "value": "83d51e2e0562a3784b248b6ef1b6962666b9124cda9b3243572782e18491d47a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092768, "uuid": "5fd858d6-306a-4a6d-bf4b-84d7971273e3", "comment": "Malware payload (Mirai)", "value": "e3da9a5fd23c12cc9fddcc191ef05b81e4eae330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092768, "uuid": "eb23a339-0ef9-4dfa-8ed3-e6773fb786d8", "comment": "Malware payload (Mirai)", "value": "09613c0cfc354c796b7c4f65ecf323fda8e9eef9087d9d193b10935d5c8ab04b6d393eb38fcd3e9dfefaee727c1f75dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092768, "uuid": "49bf9fa5-6d21-47d1-8db6-9bff4fd59061", "value": "T169A63A53EC5106DCC0BE85398A626A327BB1BC4A5B3023D35B90F2286F767D46776BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092768, "uuid": "db948acd-cdef-4f6e-89bb-9f91b1ca7c12", "value": "49152:8VJpQB9al8McrK8yya0BWFu0zM//zY5TW9xgkMlJBvQqVnfOZ6dxunJnqh8dKlKV:8VcBcNMn8TXJTxurK0M3Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092768, "uuid": "f645226d-6310-4de6-983d-38d67c612eaf", "value": 9994542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092768, "uuid": "ebef3ffe-eb6b-4851-9d7d-457b4544dc58", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092768, "uuid": "669e4a28-870b-4930-b80b-3e4039e5a6f3", "value": "wife-bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58efd29-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043105, "uuid": "15c40dcc-1cf7-4d4d-ab0e-e4141ccc4e83", "comment": "Malware payload (ACRStealer)", "value": "5cf605d0a704140c43557222caab53a6", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043105, "uuid": "44d72d47-c962-4893-af23-5e152f0fb5b5", "comment": "Malware payload (ACRStealer)", "value": "8432d734b2af5ee148915399c6f5d63b3f3435ab612182ad53b0d8897fbf74c9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043105, "uuid": "2f1d6cf2-3a31-46d6-b52a-19bb4b0f4af0", "comment": "Malware payload (ACRStealer)", "value": "aebfef17e0e682a32a6e15d1e7900d707fb3e636", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043105, "uuid": "195ec420-de94-4e40-9353-6f5d0dd8175e", "comment": "Malware payload (ACRStealer)", "value": "f5c3c6933c5ff396611cf308b7b5e3611a414d8573a691c7a2fb2c3e0df414d94fead87920deb40f01ccbc2ac282c795", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043105, "uuid": "5e999992-2496-465e-8385-1f611fc47288", "value": "T1CDE56B17BCE108E6C59A63338DB762827BB5B8080F3223C72E5076782FB66D95D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043105, "uuid": "ecddcbe8-eda1-435f-bf5d-baa557f54dff", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043105, "uuid": "c37bb914-677a-4b94-b7c2-821ea49fadd5", "value": "49152:Vftbc2n0ZbVvjQG/+D7reaZ96VQHtskQ:Vy2YBV07dwqNskQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043105, "uuid": "e42ddf8d-be7a-4612-94fa-f047586057b8", "value": 3217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043105, "uuid": "8469479c-11d6-4781-8278-0926ee153120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043105, "uuid": "f488d115-80cc-4d14-a3d9-076ea5ea28c0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.66258629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a0f88a-5b6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780066484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066484, "uuid": "b8c0b03d-c7a5-4e46-aae0-a15477613f00", "comment": "Malware payload", "value": "f3369672c888ccddd9591fb47f39e218", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066484, "uuid": "8228dbbd-7259-4683-b440-a465da35f51a", "comment": "Malware payload", "value": "85036edc5a069701636d8f99207423e0eb323d42fec239cc9bc1683272f1764b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066484, "uuid": "5b81edbf-b8ff-4db8-b5a9-02fd3847e8d7", "comment": "Malware payload", "value": "dc27fefcf4351b572041defb5383deffc4368590", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780066484, "uuid": "0cfa48c9-3301-425e-8e03-968cbf9adde4", "comment": "Malware payload", "value": "2f7db95800143685c5c6694da1bb34cf68ed3595a2ef421e66d1e7f035e2ee6b04e7ce8937631d9a9597b82581a849bb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066484, "uuid": "347df1a6-2364-41ea-a5c0-afd23c3e94b5", "value": "T1EB9533061907CC54CD034F762B67C3E3A237639C32586E7A26D1BA6A41126DBEF1D4AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066484, "uuid": "f492669f-eb30-4091-b016-d44dfe81312c", "value": "49152:jV6njolIXThFHMWhI/N6EnNy6QChDlyuVtdlD7h:jSyIXThaMgNL+gnlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780066484, "uuid": "166594d5-b1c1-4001-a350-c8d0575ab00b", "value": 1949042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780066484, "uuid": "0fdb36ed-9c57-430e-9d28-77b99507e63d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780066484, "uuid": "41f82d16-4f6e-4687-bef1-0e3e20f48714", "value": "1.21+ Fabric DonutSMP DelayPacket Duper.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b735b5f-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039089, "uuid": "c63005af-ad38-4e6c-a23d-55b7b5f28c8c", "comment": "Malware payload", "value": "963386e7a9f26422c2e7e5016771a2ce", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039089, "uuid": "067e99b3-a789-4bd7-b9ea-baccf0a4fe0b", "comment": "Malware payload", "value": "85c991b0dddbc6d255ac522983ccef5a11956162325031b19a44faf10686050e", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039089, "uuid": "59da8858-09f2-4f2c-9c1d-39d8a0c64de9", "comment": "Malware payload", "value": "b0a4b5416cf0f752384731eb80bcfc6d66e04e91", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039089, "uuid": "4e37ca14-c32b-4361-886f-e82b585599e7", "comment": "Malware payload", "value": "a0b7de84ee4f16c7ba8b7e211e9c059a490fc1920d130361f27edd0a45147bc3a546e4cb6743658c7a8f579cbeffa48d", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039089, "uuid": "526b9a3d-9879-49ff-bb30-6eedf9893498", "value": "T160138D6956857C24AE9988371C7E2F0CB9A983E1310451EDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039089, "uuid": "90341195-0124-422a-ba21-87e208d1f16f", "value": "768:X+F9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:X+Wco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039089, "uuid": "8f71e68a-ef51-4320-af05-e8387f624691", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039089, "uuid": "7eaa6bcb-5005-411c-a85e-a6d783b04de4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039089, "uuid": "10f38445-afe1-4c9d-b902-74d6c6757bae", "value": "85c991b0dddbc6d255ac522983ccef5a11956162325031b19a44faf10686050e.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868e5d94-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055831, "uuid": "08c8990c-b951-4145-9ed9-2d8a12536902", "comment": "Malware payload (BlackMatter)", "value": "c5e216618a3167741b84a93076d40139", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055831, "uuid": "a13ec68b-8808-4f3a-a385-dc1d5b2ccae6", "comment": "Malware payload (BlackMatter)", "value": "8655b3b9b297ef153354a4f9778d7b621dd94adf4ca66d526cd7f0095b7fe5d4", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055831, "uuid": "ebcfafaf-7b06-48dc-9e1b-edcd689e68ba", "comment": "Malware payload (BlackMatter)", "value": "391555f80f8f083ea35043aaa752f9a08abea6fe", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055831, "uuid": "43036618-9b77-41ad-b1cd-15c830584afb", "comment": "Malware payload (BlackMatter)", "value": "89e216011749dd9e6680f3369183bbf634ae6de3589f146ac986fe6c0a4789c040d8f7b3b8c75538a40e55815d4440ac", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055831, "uuid": "cc5e198d-6503-4c17-8818-4607d7951fae", "value": "T191E36D21F213D0B3C87718F13736B171B39E8E6C19996847EAD80F99BCA48232F55997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055831, "uuid": "374a8386-90c9-4cdc-8875-367c74bf5c16", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055831, "uuid": "8f59c910-d96c-4a5f-b542-43c22ef4928c", "value": "3072:X6glyuxE4GsUPnliByocWepokQFy6lWmRHYg:X6gDBGpvEByocWeulF4o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055831, "uuid": "75e473b8-3f5b-46f1-8ec3-6feb98b040ad", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055831, "uuid": "104876b2-a210-4fb6-a359-660d916d0410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055831, "uuid": "f3fe6855-cbe6-4a28-91e1-698b62bf2681", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732551a1-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055798, "uuid": "66ce42ec-31f6-4e42-9787-5e81e233b679", "comment": "Malware payload (BlackMatter)", "value": "12b742739d3d48d6060c488198d9e289", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055798, "uuid": "6713d3aa-cf0f-4257-a3e1-a968c4015084", "comment": "Malware payload (BlackMatter)", "value": "877f1047825cb5b73a4812279ac15e8987290c99a5d3a99473a9ec85066fabd6", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055798, "uuid": "358c736c-766a-49fa-b63f-54a9e40bcc81", "comment": "Malware payload (BlackMatter)", "value": "102ad31fdc0a7e56e6f4e45490c0cc19a99e66c7", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055798, "uuid": "116b478d-f436-44c2-b8cb-4d9c6d5baf5f", "comment": "Malware payload (BlackMatter)", "value": "114c3190fef603e861d15d329cff8abaf2c9a69ce19bd6af061be7cd57cb0ea58b0e269291d9f9ea1dea1894b56a1cbc", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055798, "uuid": "657df166-0279-4dc4-afe9-3eb65f5ac940", "value": "T159E35C21F212D0B3C43718F13736B572B3DE4E6C2A996817DAD80F99BCA48232F55697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055798, "uuid": "97e92cf5-c88c-4a07-8bb1-468b54aa7d9d", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055798, "uuid": "bfbe95bc-e94b-4c78-9a19-4f86b6ddbc45", "value": "3072:i6glyuxE4GsUPnliByocWepfCZBa2ijf6z:i6gDBGpvEByocWesBGjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055798, "uuid": "188f7960-42fc-4a82-9e80-4a08e6a6f0d8", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055798, "uuid": "5d01f1c5-058b-45a6-9c1b-34777a60257a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055798, "uuid": "f737543b-1dcd-4af6-9005-4c99633ac51c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2722e28-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056737, "uuid": "71013d40-dc44-4372-b10c-685f7b540935", "comment": "Malware payload (BlackMatter)", "value": "e67bb6fa32f75d763c809bd316dd15dd", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056737, "uuid": "79d0a78a-f345-4e1a-b419-0835bef351af", "comment": "Malware payload (BlackMatter)", "value": "8796e69f738fceb99fd177a5536dbccf5112ffa202a8b05be10ab45e600e289b", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056737, "uuid": "3aa5a406-ebe4-4caa-b03d-a7c6c311edbd", "comment": "Malware payload (BlackMatter)", "value": "48b9efe232a564532f21210e00213e7ea912b0f0", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056737, "uuid": "b2fbb8e9-303d-4393-a533-71fd91f2bc7d", "comment": "Malware payload (BlackMatter)", "value": "ddd615a1d94002b8bcce4b68952cf317fff03249b21d46e5f71e0e9900a56dd8c1ca6f27bae9586aa274e74f804ca50f", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056737, "uuid": "1e861cec-3538-48fd-a365-3564ef71a407", "value": "T138E37D21F212D0B3C87718F137367572B3DE8E2C19A96847DAE80F99BCA58132F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056737, "uuid": "b9179352-80dd-4de1-90af-3cec57ff7bb9", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056737, "uuid": "31b255ee-f7f7-479b-997d-ee7fc8320049", "value": "3072:76glyuxE4GsUPnliByocWepdLEc/1toy5:76gDBGpvEByocWezt1Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056737, "uuid": "b5b74d6d-1409-4b97-873a-efb847d847d1", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056737, "uuid": "1dc3d565-3947-4166-8ba2-a9d37133bebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056737, "uuid": "45aa2e0c-f110-400a-954e-795c6bafda12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f37471-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018657, "uuid": "0b7581c4-98c2-4b03-b2c2-1bc70a827628", "comment": "Malware payload (Mirai)", "value": "21305e8d802bc66524543e56b7032219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018657, "uuid": "7bc67013-0677-44f6-a70e-7c4eab76c339", "comment": "Malware payload (Mirai)", "value": "8802b162900ac0339019295df8e5863f47123d531028724e06866ed0f808d624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018657, "uuid": "e6986901-9c3e-40ff-9dd7-4e829a8ecbbd", "comment": "Malware payload (Mirai)", "value": "a645f907d7d31be9ddc27e9e2bc80d643692c85e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018657, "uuid": "0129741d-ae4e-4b59-8b0a-82b8f914dbe9", "comment": "Malware payload (Mirai)", "value": "83e87678f4adc1fe0bd4878a4307761499a3038ef3f9bfd0f6f9e35686bb57e7abc6e199e267eaf15eb875585601ee61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018657, "uuid": "96690736-edd8-4280-9222-5c181274c1f8", "value": "T13FD36BCAF400DD7DF88BCABA40235909B1B1D36565831B26B76BBD63BC322E51917F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018657, "uuid": "4ade6554-a55c-4c54-bf29-efb5e238fe49", "value": "3072:QtDIaikfoRs0hZMJh2/ezjymXy6hEeF/zHLOP85TBFu8dnq5v2Dc:QtqkfoO0hyn2/ezjyWRhpaE5lFZqlwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018657, "uuid": "b763e8af-b6ed-4ea4-9b29-418c7402ed59", "value": 137784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018657, "uuid": "c57735d8-c5d2-4bf1-8821-cd321312f760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018657, "uuid": "467d8990-04ba-4a38-bfa2-6512436a9b8c", "value": "023782pler.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c488d75-5b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780063786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063786, "uuid": "efe68e3a-3965-4ef4-84df-67b1f0e7d2e5", "comment": "Malware payload", "value": "afeec90859eefdfd2894ceb24d257ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063786, "uuid": "1b06959a-62c8-4a9c-8d61-a5c95bca8242", "comment": "Malware payload", "value": "88f7d22ed2494fb53d1806011173dd739f77bda9ff8d20f130b4bc5fdde761d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063786, "uuid": "2b052e42-d122-4ff0-ab44-64cfea5af153", "comment": "Malware payload", "value": "3d6c6f0363d3ed160146b4d63ad2b23c3c57afdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063786, "uuid": "764b438c-f5bb-4f67-9c67-80c8c270fcaa", "comment": "Malware payload", "value": "f5eb66befbca9951d5ed1dd16233312b0053c18187ff1c1bb6b7edc18eb1b7f40de2bad54aec793a55cddfced058d1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063786, "uuid": "2885ab61-0457-4a1d-8f05-78ed44956b81", "value": "T14233D63B53E98054F2AB92B56E79713658BBF47C50B4B10E03218D2D2F22E795EE432D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063786, "uuid": "88eda4a2-f3dd-4516-aba0-8dd5c9a8bc82", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063786, "uuid": "8ee98c87-1bc0-42ca-981b-4d0f9516b781", "value": "1536:kgHuyRAgH07ooz0Izks1DYDbm/pZ+r3ZV:PR7U7oyzkAcUZ+D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063786, "uuid": "91c1d10f-aba6-4c72-b071-a04ca09b1b01", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063786, "uuid": "6524b325-7f73-4216-b602-e719d71da374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063786, "uuid": "7dc323d5-f7c6-4e36-b26d-3b83706a5bc4", "value": "2026.05.28\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982751a8-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038680, "uuid": "8765b3c6-1ba1-4abc-8553-91d63ac1dc78", "comment": "Malware payload (Mirai)", "value": "b64fad9e1f662fc1e1136fa9c2cd636d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038680, "uuid": "bdc529b3-5a19-4c47-9f63-082d4f89c050", "comment": "Malware payload (Mirai)", "value": "8927b93a4cc38c705cea2e5fee28fb9782ac9896752c3731e9913101a407a65f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038680, "uuid": "bdf98d48-9115-4d68-84fa-e31d6af76abe", "comment": "Malware payload (Mirai)", "value": "7cb3fec2edd955370dff24114f069516e5491fd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038680, "uuid": "97236827-970b-439b-ab43-f7bb3e349203", "comment": "Malware payload (Mirai)", "value": "609235278cbc47618e6ac7f426e9573e9dfeda7a22c2efbc00178a228c25ec78cad4d09f2d39ad124015ab17d492442e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038680, "uuid": "270c3042-f27b-452c-a2f9-9e171814afad", "value": "T158634BC9F983D5B6F8970930107AFF639DB3D6BE21A8DA43C3A455369D12502F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038680, "uuid": "e9327685-d3dd-4686-b467-bc1cc0a146f5", "value": "1536:TtWvgqA1sTb6vF7lOvZOWsIyq3XkZSQ2:TtDqA1sn6NJOvwfIyq82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038680, "uuid": "104029d3-47ad-4a73-9388-b7f8bc7e20c2", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038680, "uuid": "028f5df8-27b8-45f7-9961-bf20c1fef852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038680, "uuid": "f4d90a23-6a66-4b44-8395-0ded0f24982b", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cb561f-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055824, "uuid": "08be803b-5eb8-4361-a903-cf4a8312e1be", "comment": "Malware payload (BlackMatter)", "value": "bb27ae651205876a2a9bf5bba295a4a0", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055824, "uuid": "427f42e9-d794-4bbd-b086-36a5c278dad2", "comment": "Malware payload (BlackMatter)", "value": "89dc341bbd176fbcee31f54884c132faf7c847838609f330249f634b99fd0a0c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055824, "uuid": "91184a32-6d95-4620-8226-2dbea4b940d4", "comment": "Malware payload (BlackMatter)", "value": "fbfcfcfcd55f35f3988a3b9a1ad0c9e0b1d4020e", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055824, "uuid": "4e89d9eb-840a-4d82-9d2c-5a31de624877", "comment": "Malware payload (BlackMatter)", "value": "0908a82d9d45537417ae32df28c877d643c484edbf97c94248186d0b51908ddb0142e416900da9774eaf64d6ea43593b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055824, "uuid": "12f5a442-66bd-4e8f-acfa-43869e36acaf", "value": "T173E37D21F223D0B3C87718F12736B572B39E8E6C19A56847EAD80F59BC648236F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055824, "uuid": "814b4530-2183-4399-a6b6-fffbfe13f85a", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055824, "uuid": "c2faaec5-6da4-4097-8b92-0b59129eac21", "value": "3072:A6glyuxE4GsUPnliByocWepNPRY2tX5utsQa:A6gDBGpvEByocWe3PO1sQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055824, "uuid": "d1264a96-eccc-4f5c-ba2c-7c6829bc8c95", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055824, "uuid": "74b02e93-2a83-427e-a0ff-48387459c201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055824, "uuid": "eb20ee31-713b-4081-89df-9276d530415d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b59629-5b60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780060421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060421, "uuid": "62da3735-d005-43ad-81c4-8170abdb1841", "comment": "Malware payload", "value": "debec7b5edb07d903f9831c7ed8672ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060421, "uuid": "aae8d5cc-58d6-430d-98cf-b347c9c33337", "comment": "Malware payload", "value": "89f1d78417f3be721d58344f419dea73429b64a549897ae52482d8089211f41e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060421, "uuid": "834017f6-9c60-4ad5-a6ee-7931d6c125e3", "comment": "Malware payload", "value": "e6de1cb3bb740c18b30779cfee3795d5881476c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060421, "uuid": "4d1d39ea-db48-42cd-8b33-f3bf3782c582", "comment": "Malware payload", "value": "92891e995e4068029e59d67e3ef9985e46dacaaa3f21fb4866090138367f286d7ccdd3dca1cb45e40b8f7c54a8d47b8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060421, "uuid": "55237492-a358-4c47-8c7c-f8a373895aa3", "value": "T1F6E7330372ABE87EE4680B3756A2B245D8F7E6645423BF274BF5899CCF264500E7D390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060421, "uuid": "14c45d06-4147-4203-bb66-272b3dae6c24", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060421, "uuid": "f7dc32ed-5514-4f3f-b04a-5897dfcddddb", "value": "1572864:1Lfdq0kYguEhAzArDM7iK1zlGGeMqrz87x6fZV3MIMsuwdcyFk5:1LfqxnWzA3siMGGeMEqkZVzMPwdcyFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060421, "uuid": "c93d40cd-c237-45f9-b5bc-930801355a3d", "value": 66099312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060421, "uuid": "c28557e5-2be1-43c9-be83-41e0485dfca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060421, "uuid": "35d9b53b-0e6b-4c8b-8ff6-cc4e0de1f7b5", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ec431d-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043101, "uuid": "b62427dc-7500-4174-972b-ce81ddb73ae9", "comment": "Malware payload (ACRStealer)", "value": "330cba96ef071d59cdd09088da35ebc9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043101, "uuid": "150419c6-4b33-4c98-bf73-1a81cc41bfa9", "comment": "Malware payload (ACRStealer)", "value": "89ff4418a28e5c804ca2a4fb486f5dc67a17c6b3e97ae231566cfc313b809376", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043101, "uuid": "771fc41a-5815-46f1-9ae5-48a6f5620fc9", "comment": "Malware payload (ACRStealer)", "value": "a49005e1fa08797df9da61cd20592a212ca74f4b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043101, "uuid": "844adcf9-acc3-4ce3-83b3-45707ad42823", "comment": "Malware payload (ACRStealer)", "value": "40b8212a0c1c9da70bd636ff11f02627069eef290a7c9cff4e07720d642a2f8a51a3f81c96ae3c33ed4f3d493e55f43d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043101, "uuid": "825119db-8e30-4776-b28d-66b9dd51aabe", "value": "T1BA265B07BCA108E9C4A9A33989A356527B35B8491F3263D72E60B3B83F77BD05D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043101, "uuid": "fb279988-4df0-4aba-bdc9-cfa6c8d1e44e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043101, "uuid": "5269faf1-b57d-4285-be40-ff31797b99dd", "value": "49152:FSdlKaOk6UFAC0RHFCXGQNeFOpiRS5Xdv13wskQ:FAY02Q0MXTgskQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043101, "uuid": "fa0c2d37-a351-4cf5-9c6c-f365e142fab3", "value": 4844160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043101, "uuid": "159249dc-c209-4d1e-b762-58e627a332fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043101, "uuid": "2870f35e-8111-434e-8918-2f8f1438ff61", "value": "SecuriteInfo.com.Win64.Evo-gen.47669452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9218ac39-5bb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780096652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780096652, "uuid": "45f5c659-309f-4250-b7e2-3edac4cee14b", "comment": "Malware payload (Mirai)", "value": "9b2e608d0e5e3275ed2e6378bc580379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780096652, "uuid": "665fd24c-8d0f-4a05-a56b-fc083bb6cf15", "comment": "Malware payload (Mirai)", "value": "8a4092c2dc7f5f179e7ff962f2658404967789e62ec67a4800d195e8cf3928ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780096652, "uuid": "b49454e7-f73b-4446-a3ef-0add0b590490", "comment": "Malware payload (Mirai)", "value": "62f36700059697548ebf04f19356a2b18ef4b5f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780096652, "uuid": "8f9067ba-43aa-43ee-b7a9-a8c621e5087e", "comment": "Malware payload (Mirai)", "value": "7fbb87f275ed16a3ef9dc08fa80fa07b1eaa9956cc708cb88947af4817cb4f1af830d9392b388de4b1a7acae71ac15f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780096652, "uuid": "3ed8e7bc-fcbd-47c0-866b-fe8c02bb6d25", "value": "T18EA63B077A2CEB0ED658313499B1CA946B291C9642D7E81BA351F319E9B307C6D6FCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780096652, "uuid": "e229e762-1d38-4195-90a2-16ecb793c49c", "value": "49152:/ngYRin1itbzxnofrYlfON9iqzNKN7T9CLrd0fhPjyBmevK0mIPPVMHYD8kGrYh+:g1PKM9ozBS9pHjEWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780096652, "uuid": "69322900-9762-4b7a-bcf6-13578f1695f1", "value": 9830593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780096652, "uuid": "d7167197-842f-4b7f-bda3-5cd36b053a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780096652, "uuid": "48eaa8f3-53a7-4b45-acca-532be401ad21", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e4b9ff-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038596, "uuid": "4723a0ac-b9f3-4079-b788-51d695f32ff0", "comment": "Malware payload (Mirai)", "value": "ea13a4d53639e87bbecef32da883a039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038596, "uuid": "aa563396-0756-4027-bb84-412f55dd9614", "comment": "Malware payload (Mirai)", "value": "8a8456a52bcd361559ef9575782abe42f775baa5fbb9b1fac515ce5e0aa85d41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038596, "uuid": "7be02378-db62-4a42-94a6-370b04d14a18", "comment": "Malware payload (Mirai)", "value": "e2a3e8698ca9fc09b99a8ae344e5db22f49a6d69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038596, "uuid": "79ca84c2-be94-489c-98e4-5ec51ec7cfcd", "comment": "Malware payload (Mirai)", "value": "d07584237c777337f4c7ec3aff9b914ee32ae60fcd93b388f37f45930528702dc5b0ef9b0efad06a3c45e9be03bd38b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038596, "uuid": "a9f95aa6-26b9-4900-887e-b591e5972e5e", "value": "T1BA03E1BC1219D226C8316C77D97107C16C988674D1E3A41B89AF8A6CD7763C8FB8938B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038596, "uuid": "df8e5ac4-8d2f-4aa0-b8e0-b51fe6a19ba5", "value": "768:xGPjXBOTsh1aqh3kosh+IkLpFw71qB7IuszFKwMKBJgH4M9q3UELyP:0LYptVh0whqFIlQ/WLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038596, "uuid": "0ac9e90b-2655-4c5b-8fa0-1ab23d9556e0", "value": 40340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038596, "uuid": "ac255619-b78b-444f-b749-49252fb7d734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038596, "uuid": "e0769e80-7d0b-4fd0-9386-d95db262387d", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c331b935-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780092869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092869, "uuid": "661ace76-5a5e-451e-abc4-4981e7040478", "comment": "Malware payload (Mirai)", "value": "ff7853e029803f90addbfcccb9100847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092869, "uuid": "2c7985f7-0fec-481c-8732-acd415a0859a", "comment": "Malware payload (Mirai)", "value": "8baa624a66783672302951deb5e16b5eb83006436493e4ac04e399fe2bb163a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092869, "uuid": "73c0f8a9-e37d-43c9-a4f9-875e4d003323", "comment": "Malware payload (Mirai)", "value": "dc2ac63b4b5b14aafdb7f863b2f9f702aacd55c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092869, "uuid": "91fdec65-865d-4358-bb85-fef45acbf075", "comment": "Malware payload (Mirai)", "value": "2c7cc5ef343e8a9a551732601fdf20eadefa4ec54d7fda58d4ff39522aa8d3a4fa77f6c6a8faf50212d2b942bc6a4955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092869, "uuid": "1e68569a-2fe0-445b-bd43-367676f45b97", "value": "T1DCE23B49FD419F05D4E0627EFE6E624D33335B68E2EB32029E109B242B89D1E0F77945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092869, "uuid": "23b0aac0-4ef3-425b-bd4b-d3d53ece261c", "value": "768:mln9ERmdIEWoyWKUIcu8FPieLmINu1tiJa5o9kwmseJ:mlntdIENUUIcnFPieLmIN+tiJWnsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092869, "uuid": "eb20f6ad-489b-4ea1-a340-b471e1ddc4fa", "value": 32408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092869, "uuid": "2d9d2b35-d469-4253-8a1a-8145e65b76c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092869, "uuid": "35ad8149-31bf-436a-a206-1f68398d0494", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087bfc23-5af2-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780013099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013099, "uuid": "67425b81-37c5-419a-8969-49d399cf8438", "comment": "Malware payload (LummaStealer)", "value": "d3493063d2f8d1f6d1c1d69893a67d71", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013099, "uuid": "bdf3c5b1-8c94-4ccf-8659-0a61bf7ee8b6", "comment": "Malware payload (LummaStealer)", "value": "8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013099, "uuid": "6ce83e82-d5c8-41bd-a466-a293d5b13823", "comment": "Malware payload (LummaStealer)", "value": "42c0c76b28357dc5a64cca1654f9c4f965379d4e", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013099, "uuid": "8eb466bb-4a22-4a6c-a6d0-213866474625", "comment": "Malware payload (LummaStealer)", "value": "4f66e24e1d5de2877e914c69859431b71bdf171b4deb882a66b3b5227e1ea120d20f555b9b95963cd6659695a2f24b23", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013099, "uuid": "3364d8f2-72b5-47ec-b30a-9e2f62e3d239", "value": "T1CB268C51FD8709B2E506233249E762AB6738AD054F329B9BEA44777EE9732C50C33346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013099, "uuid": "8201c36b-2f34-4827-a8c2-470e7e6395b6", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013099, "uuid": "aabb0ea2-9e06-4583-9254-d79d1c4ce0e5", "value": "24576:ngFVlPGgCg/Lo9oWlbllm5rbD70RypFp0GG+B57WsKZKdk9a90NtDGqLb5WLCK3i:noVjWbleKkkZfySb5B4FgG8bsOoG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780013099, "uuid": "ee6a8944-78da-436f-9d26-94ffd40a72c3", "value": 4645504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780013099, "uuid": "a5938b9c-329a-4d86-9cc0-34be1f36c3d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013099, "uuid": "3632eb7f-952c-4722-9a3a-59f0ad2ce958", "value": "vibo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11c2dbf-5b29-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037058, "uuid": "d5417c72-daf6-4cde-9aef-4e4085becaeb", "comment": "Malware payload", "value": "0d5b30a7d84e7508fcf17394d66d2957", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037058, "uuid": "ac8ec2cf-cf0a-4c41-8418-1f379898f5c7", "comment": "Malware payload", "value": "8c1aafcc15427a2757c51ee4db9617d34358e441fa36f1ec0671948645105c28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037058, "uuid": "714b47e5-6712-4229-91e7-87c2bf1967c1", "comment": "Malware payload", "value": "3db63eba27fbfc77fac9b3b3904df9d2e4a3b3bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037058, "uuid": "8c3bcf1d-5a17-46d9-98f9-2dd9ba5920b8", "comment": "Malware payload", "value": "fca2c721c34ee8235ef27865a7c26ec03052a3a5712239249da626e62ee5dd7264d895f815ac8685f958812c25d4c952", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037058, "uuid": "61bd294d-b381-4b0d-b86d-05adb2ac9be0", "value": "T154C64A07E89145E4C5ED91308A72D263BE717C885B3127D72B60F7682F77BD0AABA740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037058, "uuid": "1abb0b14-fcae-46c4-86ee-9eea3567ae9f", "value": "98304:x3Jzd922L6uY+iTqNDoThjZaX5eMAW2uyQEU:xc2LXY+iuoTfsnGpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037058, "uuid": "05129f3a-a260-43df-a819-40700ce51b0c", "value": 12247224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037058, "uuid": "ecf36aa5-fc36-4a14-9f2d-dee95e351b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037058, "uuid": "778d76c4-4075-474d-b68f-c612302fc481", "value": "npc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6952ac-5b47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780049749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049749, "uuid": "89a66521-35f0-4095-8b2c-007fea88b7de", "comment": "Malware payload", "value": "6df6900db4183c3880700e85d4d0fc90", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049749, "uuid": "f277ebad-e8c5-4ca3-bbbb-b32375808128", "comment": "Malware payload", "value": "8e0088d6057633def891cedfc4749ead4137cc7cadd88e77617e53bf0fadde6f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049749, "uuid": "46fa1676-199a-4fa7-b7c6-af14793ef847", "comment": "Malware payload", "value": "c24f8b56d22849aada7afbf7ec29c10f9a4eefc9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049749, "uuid": "4cd97b22-e780-44f2-92b3-786d6423bb00", "comment": "Malware payload", "value": "e14b5f75b14504d7475adf5d59af4bcdd754f97fb423cb6f0858521e652ac8c93676a09372b77e6fda7b3c9e6f7a62ec", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049749, "uuid": "c01ee515-bcaa-4192-9134-4595243f0c27", "value": "T185C3294CBA0ACACB099A35ED788BA1ECBC17071DD2F963C4BC25875278E6160617F5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049749, "uuid": "d09fac11-d709-4b20-8368-fd5f62e21a60", "value": "3072:nMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMa:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780049749, "uuid": "c169d65b-9250-4d71-9184-3693fa16b6b3", "value": 126122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780049749, "uuid": "af185899-ebdf-401e-940d-945fdd045a44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049749, "uuid": "b84fd836-a883-42c0-b9b6-9bda892b5ede", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69899b54-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038602, "uuid": "e023c18c-5ae1-4b8d-acff-9bc7aa8ab43e", "comment": "Malware payload (Mirai)", "value": "46ecfb7d9687435ba30a0b5c75e0819d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038602, "uuid": "2226daf5-6e83-484a-8dbf-2ede96ebf1fd", "comment": "Malware payload (Mirai)", "value": "8ef01995e900bd0209e553ed4d35ff2920c8046407930fdfb3e109e9555f36d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038602, "uuid": "f183380e-6401-47c1-9213-f1a489df9d77", "comment": "Malware payload (Mirai)", "value": "105f97880c051bb7efa76a758a29840033c16aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038602, "uuid": "d40f150e-31c1-459c-b53c-eb5b9825d1de", "comment": "Malware payload (Mirai)", "value": "b3a617465c4dd0c0a64e6929d496bf22e51f6bacc5010c9590df02ef3e5971651ae2ceb2478052438cfd10e87638f695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038602, "uuid": "315895da-8118-48f0-a928-61e47e3c8293", "value": "T10AF2D00BD5CCC2C7E75F023B98BFFB0F2561C21D1B97A5169AA850222C41F4A976D5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038602, "uuid": "b1e733ac-69bd-4492-9c3d-c78863fa2def", "value": "768:VzbGjwng3vdORRd5c6VobQ5g7pTjGZ+VFXnbcuyD7UHQRjX:BdnAqKyABznouy8HyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038602, "uuid": "26fa581b-e512-46cb-b9d4-08df595bbdef", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038602, "uuid": "36c5cdc7-3a92-4db0-85cb-bd1fe7e4db8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038602, "uuid": "e74b4931-c636-4fbc-b540-d03603599c3d", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078ee007-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058624, "uuid": "6ff28d14-eec7-4cbf-8281-54225878a698", "comment": "Malware payload (Phorpiex)", "value": "452addc0ae14d7fc8c84442045a72147", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058624, "uuid": "6358e068-f5d7-46a4-b9b9-7651435506e7", "comment": "Malware payload (Phorpiex)", "value": "8f257c0e8cea430559676f2f30d96a90c8bbdf54041314e3960750421b66e29c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058624, "uuid": "3877d25e-1649-4fec-8d07-dd79c36b63bf", "comment": "Malware payload (Phorpiex)", "value": "d20f49629daf82e1c240852d0055230be761cddb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058624, "uuid": "4498e239-869c-4a42-930f-bfdb44722760", "comment": "Malware payload (Phorpiex)", "value": "deb8fae66726ee61ec56d0748edcc88d099314a0db2dd8b6a4298ddb352d85fb5926a0bee041e5e405196f8918d7fe93", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058624, "uuid": "e9323702-6d20-4c64-b444-e3cb40035d95", "value": "T195824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86E6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058624, "uuid": "40c47204-3775-4a7e-b304-42738a31053b", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058624, "uuid": "503d7786-5ea1-454c-8136-9b1dcab60503", "value": "192:VIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJk:XIblVP4Y/2N0bLu9JgPL7Nyav8U9c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058624, "uuid": "385aece3-91ac-44b5-8eb7-ffe8830a10a0", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058624, "uuid": "6edba55a-3b09-4122-bd69-acaed0450e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058624, "uuid": "18be7aa1-a38a-484a-a2d3-e8ece1fd346b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0724b0f6-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017392, "uuid": "e48a8197-52f2-4ea8-a9d7-ea0c4cd4ff0e", "comment": "Malware payload (Mirai)", "value": "53802a0296ba2cf9032334d12e78b338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017392, "uuid": "1314d1ac-61e6-4e2e-ac06-89750ceaf267", "comment": "Malware payload (Mirai)", "value": "90306a9eb55a348f17e74e11300de7a8e317f1c17c34a893fe3cff31de5aae81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017392, "uuid": "8082225a-9e53-41bd-bacb-223481cc9d27", "comment": "Malware payload (Mirai)", "value": "c82fbcad97620149c6dbbff856abe9146ff54f97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017392, "uuid": "7bf89986-9616-40dc-96e8-13b2699e93ba", "comment": "Malware payload (Mirai)", "value": "c7da6a1bdcf8e3684ca0cc0ed5a1b6f8eef40a8f1819ef57e001639ed48ea5394b24b62425a3a27823af189194a9c81d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017392, "uuid": "19559e21-f291-4e63-bc12-b62f1ba140a6", "value": "T1BF832981F54B80F5D80B8C7050ABFB3FDB32D99901B4D65EEF956F32DE67941A106288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017392, "uuid": "2f171018-43e0-4788-92cc-d1d46c6a873f", "value": "1536:E4pFZJMIedWI1f53BgVu6Ga1L0gQcpSc9w4hHNiTQKdg+:E4pFZ5edWI1f53BgVu6Ga1LQoNthHNsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017392, "uuid": "5c605dbd-9570-49cd-b6b2-7765ad439e04", "value": 87056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017392, "uuid": "4ce7a90b-e613-41c9-9d46-448748fa27f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017392, "uuid": "c2df4b1f-bccc-40f7-be3c-5b886dcfe588", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acacfacc-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "bf190f72-61fa-4574-b8bd-d9ba60922990", "comment": "Malware payload (Mirai)", "value": "814f302d0fea5e0d22638903f18559da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "7f08016d-8fc8-4885-8074-c9c25f26c63e", "comment": "Malware payload (Mirai)", "value": "904f922a5d8d3ae7d6469d79462ddfa182e14f52114de9c8224c6dc31dfdfd2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "d7ae1828-c138-42a0-a197-3b1e0cd8cf83", "comment": "Malware payload (Mirai)", "value": "37f3a408bf8ea3d9f6f12a423551d875bd51d17a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "ba103e5e-bc6d-43b7-ae00-a81d91a01742", "comment": "Malware payload (Mirai)", "value": "6cb7cbb212bcdd9993c9e5e2ed0bf54b1faff9bea309e4d31f61011b32aef2d6fae5e9fa7c8ea8f07b9781d7698f9032", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "9b18f734-a0c8-41a6-bf12-ece264a38450", "value": "T19282DF3061AB74F4DBE14430FEEECEC2971A0BB8D0FC369216586F78894210651F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "6f8ecaf0-a3af-4901-914b-f912b0ae7bfe", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaIhymdGUop5h5li:2dV0P6+kom0tVAoNvm+to1Is3Uoznli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048593, "uuid": "7e779eeb-e73c-48f5-8794-63c742c89415", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048593, "uuid": "fce1d5ce-86f8-4f97-99d6-6f9f65b9876a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "6d0a1eac-9476-4cb3-acad-7a54e40050bb", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f704b51a-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780040987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040987, "uuid": "2a519c2a-2050-4694-85ab-00c43c2311b3", "comment": "Malware payload (Mirai)", "value": "2bc944283530012848115b06a7f5cdca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040987, "uuid": "76a40a25-8de2-4a6b-ab30-f18743f58036", "comment": "Malware payload (Mirai)", "value": "90e1d27c710e3fbe455b2a047880acd076410a246a019fdd6ce8007610ec1748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040987, "uuid": "93c444cc-339e-478e-82b8-ea2c05a3180d", "comment": "Malware payload (Mirai)", "value": "24055d64d7de13340abb1741cd13f9f330247073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040987, "uuid": "82ca8988-4368-4d27-a593-7d73d7743cb9", "comment": "Malware payload (Mirai)", "value": "aed99796908fc0f2de256698ba5db179b96f52afe6c57de81161740e559744eb66de547835b8185e3233512822118336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040987, "uuid": "e4b7edce-3513-44a1-b4dc-049b5514fcc2", "value": "T112A3810EBFA01EF7EC6BCD3B45E41B05248C651A21A97F75B930D818FA5A50F0AE3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040987, "uuid": "59a2af21-e189-436d-bab4-614cdc8ea8b2", "value": "1536:VmHc8CWGWQY/9WqyUjsd2lbUBNnBAj0m+Ax+RdZUTb10976xgK:V0WWGWQeWqyUjQIbU/n8GdUMigK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040987, "uuid": "505d8fb4-a673-46ef-9887-7295ce8d93b3", "value": 102540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040987, "uuid": "9770bcc1-a1e4-418b-8635-e991ffe00277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040987, "uuid": "b38d85d4-4c53-4811-8560-20550b38f9fd", "value": "90e1d27c710e3fbe455b2a047880acd076410a246a019fdd6ce8007610ec1748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8949e683-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055835, "uuid": "99eae128-9791-46b8-a467-f754ca78d5dc", "comment": "Malware payload (BlackMatter)", "value": "d2870ab62deb1c3ab83a6ef3e1fa8de5", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055835, "uuid": "a542f0cc-5146-4589-9e32-3ef722c2b32f", "comment": "Malware payload (BlackMatter)", "value": "91e39f6bb60a3860e6d1dc1fb711a8865281407614d5d106d03678c8723f2ddf", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055835, "uuid": "5e56a9ae-a1f8-439e-8dae-8f60e8ea2111", "comment": "Malware payload (BlackMatter)", "value": "30d3cd2b83257c732630e425271ad6383368e424", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055835, "uuid": "823e71b8-7528-4d3e-bb4e-9e86896168dc", "comment": "Malware payload (BlackMatter)", "value": "eacbae230918f555c160d4784f97af75bc53fca38c83e47eb499a6fc8eaee67213c513b9394df7aae688e2b2c29203f9", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055835, "uuid": "33fee684-ed29-48b2-9e0f-b7c4232e91e5", "value": "T125E36E21F112D0B3C87718F13736B572F39E4E2C19A96947EAE80F99BC648232F45597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055835, "uuid": "1cdd90c3-945b-4a9d-828d-b4527467340e", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055835, "uuid": "017d7bc8-47d5-4f18-9604-037f9c3c9ddc", "value": "3072:y6glyuxE4GsUPnliByocWep5fAHjGhLOt:y6gDBGpvEByocWePADGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055835, "uuid": "3457a7f7-61a6-4e5f-9d20-3a36c93d6888", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055835, "uuid": "a78f609f-6acc-468c-a501-4bd516b9ca7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055835, "uuid": "7df55055-8b01-467e-9db2-3c6847a2d5a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f0d1f-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038652, "uuid": "e92ed3b0-7983-48b7-bdc1-6f2d692029d7", "comment": "Malware payload (Mirai)", "value": "404f3d176d92d1b5ddb8ce6ac1d00379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038652, "uuid": "1e684651-9090-4ede-84f5-546026c254b1", "comment": "Malware payload (Mirai)", "value": "92378005bfd186df0499f024e6234787961713220e0743970f847f84911a3e47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038652, "uuid": "4a25dee1-376c-4c4b-99ec-53d37fbc592b", "comment": "Malware payload (Mirai)", "value": "70accaf977720a3b4907855b45672fc887c3caf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038652, "uuid": "042b04b9-d88d-4cf9-af43-b979966043de", "comment": "Malware payload (Mirai)", "value": "8b756cfa6a28b9c993d6181e420ef9b2027fe1449bd7e4ca6e2c0dd0cd03e4c7b18b678f85411228d4f09f4e7bf22564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038652, "uuid": "530e4fb1-4fa2-4daa-b4ca-8a57fefc4cb1", "value": "T181132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577136C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038652, "uuid": "08d76f3b-0ed4-4f32-8d94-560871302306", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCwjoOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038652, "uuid": "34edc837-c3d6-4c8e-ae9f-3dacb9cbc8ae", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038652, "uuid": "5b4ef290-2234-4154-8c51-438454370e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038652, "uuid": "e8ed5143-037d-46b5-9db3-eede60b4f8c9", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f6db76-5b63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780061677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061677, "uuid": "8ef725e1-db08-4add-8761-be7661f0bae4", "comment": "Malware payload (Mirai)", "value": "5e3bb171d58eca338e5b2e3785f75ff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061677, "uuid": "cfc7f1e0-8f23-4ecf-bbed-11fb12be2a23", "comment": "Malware payload (Mirai)", "value": "9239380fca957e4698fda0aaeafa5c4e04185a1ca95456618644f25d2e038f35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061677, "uuid": "eaa1b236-6060-485d-bfa8-235d7aa7602e", "comment": "Malware payload (Mirai)", "value": "c17fb63fe76627c7f3390f79b559590e8136a5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061677, "uuid": "f8de7b9a-7809-4e28-800f-43d3e21b53a1", "comment": "Malware payload (Mirai)", "value": "866e6cf9f515e5cb6b715f6fc70bfee8e896f9e300367fe0735a81f473e896cf0d9544eee35db44d54b842acfe7c74c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061677, "uuid": "ca01eab0-1001-4406-8cc9-b540c7afde2c", "value": "T1AD4302DB545D93B2CF3646F8427A80F0BA3D5C86E0C992A3C9A1F2FD541A5B1FD80C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061677, "uuid": "8b3f85ed-27da-4428-b416-8f96c39c1a9d", "value": "1536:dKuILXVgC3zopwDBeMTFfOYAX/sd5TUYaR7y:dPS/3zuw14YAUdeNR7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780061677, "uuid": "4eb08beb-178e-4fdc-ad11-836eff69e689", "value": 55340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780061677, "uuid": "c5c464cb-669e-465e-aa67-ea45c8d59218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061677, "uuid": "596434e1-014c-4b77-89be-394652722bfb", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9f30bf-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780047436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "1cfae4aa-47a5-45f9-9858-f2618530a8ef", "comment": "Malware payload (DDoSAgent)", "value": "18d932cb0bfbbb0cc2ff98bfaae1b8ca", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "37c8458b-b365-459f-8ffc-97bc005e9121", "comment": "Malware payload (DDoSAgent)", "value": "924b9da4aa36543a16144b85f2244b84911c95a6deda7c07abb9de7154942d63", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "4de4f79f-b8c1-4674-9d4f-890c99ce6825", "comment": "Malware payload (DDoSAgent)", "value": "c67d4155e8022a46e2bd1e64105ef5afa26250a8", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047436, "uuid": "3d32899d-86e0-4893-8911-3c66a8d900ad", "comment": "Malware payload (DDoSAgent)", "value": "cfdffc0145c10af696c57c2ef3e0d63af8368ba396886672c59be6ab279ac0e9ca4469d7e19903cbe5d86c40c0f9aafc", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "5e48106f-7494-41c8-aa92-c6cc9a2279c7", "value": "T1BE861905ACC53BEAC42C5E7444EACA5622B06D140AF2463626A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "abc10e52-f9ce-476d-b79e-7a43b658c289", "value": "49152:Wmh6x9ZndcJUTuvFg0CQhB3wBAb5CrIE17Il8ZkFcz5E/:huLQhEfImDOFKE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047436, "uuid": "5f282e13-be2f-46a7-8fdd-e2b7cbc07af0", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047436, "uuid": "630bcd56-98e3-4ef2-b371-a4cae0988de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047436, "uuid": "80d63231-82c2-499d-878a-ed98756b2202", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eaa75d-5b03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780020395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020395, "uuid": "1cbaeef0-d4d8-49ac-99b0-ecb7dceb1ff0", "comment": "Malware payload (Mirai)", "value": "af684e447db362b9f59bdfb84c9bea38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020395, "uuid": "44f99c6d-1174-49fd-b22f-b145f0081c2f", "comment": "Malware payload (Mirai)", "value": "92f23742ae54e5961819c2f7e0a6b6e92799bd04f43a816501f3f3a91c407af2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020395, "uuid": "56a84e81-3580-4326-a649-fbce1170e58e", "comment": "Malware payload (Mirai)", "value": "632d9d1553f14d1e554d4a2e0536acf0ef233902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020395, "uuid": "c2b00fcb-8d66-40bf-9132-9913371f774f", "comment": "Malware payload (Mirai)", "value": "82677d54798be4816b4dd7c1bcc1d4f0f4713f77b10939a3132679aa0dde84a89dbc89dab17fc4e52e97288885b1d784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020395, "uuid": "9a808035-f4a5-45c1-b611-532b8c5db592", "value": "T186E2E0DB10392FF4C176E5BA2D1781A4B9A2BE67161A17174D5BF06E5CFA5402C00FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020395, "uuid": "b3d448d9-59d8-45ba-80b0-502d15e4eab8", "value": "768:wIw9SMAeqmpyKa6X/Wo/eywTlo5P4FokE2upMLVolofpTx0dWf:ilAeZRaI/h/2S5m3mMLVBNaWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020395, "uuid": "3ee4fec6-38bc-4110-89dd-39348307a183", "value": 32816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020395, "uuid": "b759cfe6-bb1b-48e8-aff7-92411c0c2833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020395, "uuid": "882b9ee0-3d58-49db-873d-aafc41665743", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95281adb-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056714, "uuid": "1caba390-e83e-4dac-b595-561cf0e1d820", "comment": "Malware payload (BlackMatter)", "value": "fa817e9ae156e744e9bbfaae53344292", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056714, "uuid": "8d73d086-d6a2-4007-abf0-15e4876d76b7", "comment": "Malware payload (BlackMatter)", "value": "92fc7f45d4968df95bc082220680c9ebd6a381a9467f77493878af031454d633", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056714, "uuid": "b4124657-926b-487f-af2b-471cffae3e5b", "comment": "Malware payload (BlackMatter)", "value": "4f5cc8f2b6b3c0e9caf65e95615b21e39c8df3d5", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056714, "uuid": "3f8d8f23-72d8-4dd3-9078-adf32e0ca117", "comment": "Malware payload (BlackMatter)", "value": "86a5d9b90789c845622586d10409c299a8abf99d840009b693a016df8702777f957724ca1b2a7c41908b962cc559b7b4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056714, "uuid": "65b311f6-b930-4b99-b207-42bd4977c140", "value": "T125E35C21F222D073C87718F137367572F3DE8D6C19A96857EAA80F59BCA48232F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056714, "uuid": "576f0d87-ba7d-45ed-963e-d8c32cda9104", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056714, "uuid": "df82f4e1-4621-47da-8289-9f7f98d55850", "value": "3072:p6glyuxE4GsUPnliByocWep3ciMuk4nzE0opyvU2:p6gDBGpvEByocWeWFhx0yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056714, "uuid": "b5165cce-73ab-4ce3-a534-bceb73a4968e", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056714, "uuid": "31e6f309-1c9d-4a3c-a57c-d0de9d8c06ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056714, "uuid": "2c134c3a-28e7-4474-b85d-4e39df40ef43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17ec3ec-5bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780098450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098450, "uuid": "6ae64a05-f6c7-43fd-aca7-84a2a2f4523e", "comment": "Malware payload (Mirai)", "value": "fb407947060d496e95a2a99667eb7718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098450, "uuid": "3b1dc59a-0d37-4ae8-a7c1-cca8ad957d56", "comment": "Malware payload (Mirai)", "value": "935111dacf15036b9954f324e309f00a5e258bd0da9e44e8fdb3b2e498ac3b28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098450, "uuid": "6295db2e-e6b4-497d-afb2-4edf7beff969", "comment": "Malware payload (Mirai)", "value": "6acaf7120aad8ba4764ef4f87578fffe8ca15814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098450, "uuid": "87e03d3c-dcc8-45b7-86e4-364705426dbb", "comment": "Malware payload (Mirai)", "value": "fe3a05d232d161cd7112f6a9527eba8d1ecd8f88cef4ce90981452f9e4c076c2bc936348d16d7bdd8a3267e14d266dd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098450, "uuid": "b4bcb44c-4eea-456f-bd12-8c669c8f287a", "value": "T1FD961997B9D24942C5E83A37B8BD80C433A31EB99B8B12565D04FD3C3ABE5D91E38354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098450, "uuid": "d29b43a5-9f86-4f2e-aed9-f2ee36a4ed2a", "value": "49152:kQgi8qtBFyjygfcj7Irta4GabECYtTix1tWQg0FBBYbU8V5E6:Xgi8qtBIjygfc/Irtloi1tWQg2EE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780098450, "uuid": "3ec30c76-8f9e-4334-adaa-b4a7746638ab", "value": 8716450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780098450, "uuid": "7ae72a1f-d44f-4b3b-8bda-649ac2069cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098450, "uuid": "648ef3cd-b80a-41c3-8696-b49a73a64478", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f83c2f-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047018, "uuid": "fe127719-bb86-4147-a618-5dea5608977f", "comment": "Malware payload", "value": "0855a0e51ebad7a098f9da392b9c60ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047018, "uuid": "0450ece8-0fe9-47b5-b949-76ba9a6c29f9", "comment": "Malware payload", "value": "93857f301171f489e5ae835ed0eee1a8bbed0a8a99debb7170f47934f9c9ecd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047018, "uuid": "233d0b4c-e749-43ce-80d6-a44651f5703e", "comment": "Malware payload", "value": "964cd0e121d5d054cd548c030919e22cb2d7a4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047018, "uuid": "21651356-f38a-44ad-ad51-f77c9bf39531", "comment": "Malware payload", "value": "c7e199fc6096a7f865bce9e7fc2953a9b54767c27c383cd7a31897c27cf3231566eb2382c8b115a34912795032ea981d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047018, "uuid": "5d7b9c69-bc62-4d6b-925e-af70574ce9e6", "value": "T1D944D65B6C9550E4C5EEE235866AB602BD7030A4073837DB2FA14AF10F26BFD5A7C364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047018, "uuid": "f0d8f5c9-3843-4184-9622-6d4d79165537", "value": "3072:REpPAiMEGpbqTP+xcjLiXBzfeFEs+E3IGOgruheIjySwEfzXOp6IXvumACdsV:1FYz+Y898ZzGe4gEL+p6IGmACSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047018, "uuid": "91844593-fa8a-407e-bf66-6e28bafdd67d", "value": 276314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047018, "uuid": "51269ec1-e514-4766-af76-181f825eb5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047018, "uuid": "d0064836-54be-490c-a9cc-a1e6b59696c8", "value": "SecuriteInfo.com.Trojan.GenericKDZ.118007.31809.23817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3cbc71-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056699, "uuid": "9e857536-9b21-45a7-b4d1-57ca1bfea4a5", "comment": "Malware payload (BlackMatter)", "value": "115e584c09344a8139fed9296f0ee070", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056699, "uuid": "4a34f5d5-3a7c-4eec-ae86-e05d42e384f1", "comment": "Malware payload (BlackMatter)", "value": "93da3f615d041dc37a4b3db4a3d0c60bfd3c3fb1fc3ff4d5b764c646b629da7b", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056699, "uuid": "8d6c4626-2339-4eb5-9f89-73155882ca22", "comment": "Malware payload (BlackMatter)", "value": "f0f6723c5baa8cd77f53428072e31fa6206eaf48", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056699, "uuid": "685bda45-26a3-43dc-898a-f2d78c9d339f", "comment": "Malware payload (BlackMatter)", "value": "81bb15bbbf40f3274735f85f8086f9bbc1e8090c7f3db1cc2e8b3324442afba232caaa2bfe94916a84aab05ba267d70d", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056699, "uuid": "9fe51c16-9977-4c95-b1a1-6a8a87f278de", "value": "T110E36D21F212D0B3C87718F53B36B572F39E8E2C15A96847DAE90F59BC648232F05697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056699, "uuid": "7fd947c4-5a99-4334-9fba-43bebed64546", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056699, "uuid": "bde525cf-a67b-4c84-a89b-25b639c0dad1", "value": "3072:06glyuxE4GsUPnliByocWepyYRb8vPZToVTJZxUTR6:06gDBGpvEByocWer0OJZqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056699, "uuid": "8fd3b29d-ef1b-4d24-92d8-05c10140799f", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056699, "uuid": "176d68e7-957d-42fd-8ba2-5536ba6e6767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056699, "uuid": "5ddb1ddf-5d20-4055-a4f2-4289241afd10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb91d5b-5b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019924, "uuid": "c6c3f8a3-d1d6-4524-b277-4e1bde726b0a", "comment": "Malware payload (Mirai)", "value": "637253addeb3ac002c0380de91d88ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019924, "uuid": "6a8adc18-965e-4f41-8836-e336242cdbe0", "comment": "Malware payload (Mirai)", "value": "95f4af40626b905b286df4611a811826801ef2a014f934e289430adb2f3dc874", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019924, "uuid": "43349d7c-0e1c-4075-a1ee-dc147841633d", "comment": "Malware payload (Mirai)", "value": "6f8774caa9ffc015d52843482394fa8426005bfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019924, "uuid": "8b20c1f2-8662-4de1-85a2-b9a9e591d001", "comment": "Malware payload (Mirai)", "value": "2f9521f53cad4da9aa72a4e0c481a4278316e9b2af0668020f38ccf9098626984138b5a5b9dd6864bae6eb9548134d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019924, "uuid": "bb66b0d1-e00b-49ca-94af-aab2d6447793", "value": "T17CD2D0E8D7DC3DA5DFFA6C689D989AC16FCB1AEF7760CE806191EE20002919072426C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019924, "uuid": "80e0ce31-6c02-4aef-9912-4c8f3b9ffaae", "value": "768:G0pJuALSI6VJh/RpJE4YM4ZbDQbd6+RBX8zpud9KbFF54uVcqgw09Z:xPuhIUJKMGbDwd6+RBstudYbFb4u+qgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019924, "uuid": "67ae774b-8aed-445d-b5e5-8dd18c408a05", "value": 30276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019924, "uuid": "0467502d-d3d4-4194-9e68-360971a2f83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019924, "uuid": "ea2f763d-a933-44df-9643-2cfafe9b4c7a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc483d7-5b15-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780028405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028405, "uuid": "9e05a750-c89d-4a3f-8202-05542b14e1e1", "comment": "Malware payload (NanoCore)", "value": "d30bd57fd039689b2196eca1874ceb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028405, "uuid": "6d1bcb33-5986-491b-a4d5-b72ed1a497a4", "comment": "Malware payload (NanoCore)", "value": "96ddc50677b32d42f224a09f7c436924502c8accaf2c5af2aa9706bbc1ae6910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028405, "uuid": "64ac2bdd-8abb-4977-a505-709d1c903b7f", "comment": "Malware payload (NanoCore)", "value": "33fb08178d7ad597f8ab5cb07282d0da254f6267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028405, "uuid": "fc241276-3c6d-4dd8-a8b6-e2219c56c691", "comment": "Malware payload (NanoCore)", "value": "868d78161c7c5b2340e74e0f83e1b54f7c6df15241178ce67130eb3c636180f10199062c3f6d701b4c534f5b4531a548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028405, "uuid": "af4b80f2-e474-4739-9f30-d22a1357abed", "value": "T16D14CF6537E8492EE3DE867C701242029379C2E398D3F3EE28D461B69F663E44A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028405, "uuid": "79708d0d-3575-4d13-9ad0-34b9b99ff4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028405, "uuid": "6b46d833-7241-4ea4-8e81-d07dd4678065", "value": "6144:MLV6Bta6dtJmakIM5n6fA+eXcTTacsRy3Cj+E:MLV6BtpmkSuA+eXsaDCUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780028405, "uuid": "09c2047b-81fd-4a74-b551-c7fd8a95b8a0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780028405, "uuid": "44ee79f9-f09c-4d53-afc8-248262dab1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028405, "uuid": "4179a798-72ee-4905-a6d1-ba6980175855", "value": "cash-win.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b325b3-5b14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780027882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027882, "uuid": "ae9ef8f8-1ace-4e43-b583-e25098200c04", "comment": "Malware payload (Mirai)", "value": "2f883d2116eb8796f39bf38838999eb8", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027882, "uuid": "d055edce-867a-4284-8021-2cfb19fcfccb", "comment": "Malware payload (Mirai)", "value": "971fc31afa7bdeed18ba5717ca77d75438ee31e97c6a8ad893963068341779f7", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027882, "uuid": "6e8a50a3-9f0d-4356-919d-0a14dd69cecd", "comment": "Malware payload (Mirai)", "value": "aedf57aedf39d28b02f7293a477742beb3a29b7d", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027882, "uuid": "3450c97f-e6f6-4add-a501-7bb99965506a", "comment": "Malware payload (Mirai)", "value": "e7064d8ddae67622ebd8f291a053c80bf6ee722f8bfd534ed79375827778ecda6772edcb34e9ee5d441c3b5c080d8700", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027882, "uuid": "a2d589e3-91c3-479e-b86d-1bcb3281b57d", "value": "T19BB32A45F8505B17C6C252BBFF4E428D7B2A1768D3FE720399256F30379B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027882, "uuid": "2a155a18-5da3-421c-8f1e-8343058a200e", "value": "1536:rSA0nJ8HeyJ4V04jTp7FkyjOq7E2AsQkslCtwywovqUV5vuuKoSpXkZv5:mFnJEJ49jl7K1rR7e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780027882, "uuid": "4f6dd0e6-35cb-4f89-b40f-86712d55a8a7", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780027882, "uuid": "fb5c55b3-805f-4cf5-af36-a9b55e8fb97d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027882, "uuid": "2f728fcc-fda7-4e62-95a2-f20642945610", "value": "971fc31afa7bdeed18ba5717ca77d75438ee31e97c6a8ad893963068341779f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd66576-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780073697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073697, "uuid": "7c3521fb-61a7-426a-97cf-a994ef025164", "comment": "Malware payload (Mirai)", "value": "db1fbeac73e2cd9b7af8f6012d58a9ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073697, "uuid": "222d8ccb-5e4a-4097-828f-a1f046927671", "comment": "Malware payload (Mirai)", "value": "976d5228c2e03975d889c569c33b6b1eb0e44bf8e51a39681a9cff75d9442647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073697, "uuid": "bc696148-243e-4179-a32c-43813e5e3fa0", "comment": "Malware payload (Mirai)", "value": "2ebc085b7ce16ef8baf5c028b559f9f7af675e1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073697, "uuid": "2474a29b-2c21-44a7-aec6-e731c1f412b7", "comment": "Malware payload (Mirai)", "value": "a6e29d50375c6276df05b2f9216cd4971f6080e384677b6a885d08aa93886fe2f5cd65ca71b7d0e0fcde133186849571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073697, "uuid": "e2581baa-6090-448b-8d56-8ab92249256a", "value": "T138F3885E2E228FAEF26CC73047F74A24976D23D627E1D684D2ACC1141F6029E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073697, "uuid": "7c1b19cf-9fa6-4981-a843-23bb0876c0f9", "value": "3072:t4cEI7hCnD8LNUw1nID2tJt3riZpgHnSl:t4cEawn6ID+L3QpgHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073697, "uuid": "67876150-2219-4a7f-97c0-4d218ba9eecf", "value": 169120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073697, "uuid": "289d8495-d600-476b-9d7a-f33fca93a5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073697, "uuid": "2654cd24-1ff5-452f-b431-7165fd58be35", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf4f76-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018312, "uuid": "acb32f85-d04d-4c12-a3c0-5497cd32a29c", "comment": "Malware payload (Mirai)", "value": "a637f7729ac52279724814878fe8ee77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018312, "uuid": "6ebcb390-dd02-44c7-b114-0a3fbbe95024", "comment": "Malware payload (Mirai)", "value": "980aaa4a95ab10e0f172f0cb6bbb886062c85d5b7d5962d890b4e501d24e58de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018312, "uuid": "27a7e122-7241-43cb-aab1-9236fa201511", "comment": "Malware payload (Mirai)", "value": "0453dfed66094d73a7e04c8d86e9fa839f27a866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018312, "uuid": "c0ebe422-91e4-42a0-bb92-86309f50f885", "comment": "Malware payload (Mirai)", "value": "c75c14c9c5b6a75714938c4c09e1885f045021608544a1ecf59afe1c91d4d434dcb976994a3b3fe37e856aefb939fad1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018312, "uuid": "3345f7fa-d014-4783-b799-057bed633e2c", "value": "T14E731892FE81D951C5D529BBFA5F42CC339307ACC7EE72028D019A30A6DF5694E3AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018312, "uuid": "fdd1642f-a80a-456d-ab97-6232bece1fd7", "value": "1536:DaerNxDRykNubaJX0utdrp/x2c3V4ROTHMdaYD27:LfSOEQX/xvF4KBYq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018312, "uuid": "ddbb01fd-e3de-4bdd-9230-c9573cbfbcae", "value": 75748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018312, "uuid": "7612bb69-760c-49a0-9a82-717027a34080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018312, "uuid": "6fc0f4e6-ee05-4889-9ac7-61cd3d90b596", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9b5d00-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780089100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089100, "uuid": "1088a0cb-53a1-454b-87c3-0d146f21f0c5", "comment": "Malware payload", "value": "07d90a655a6680fbcf8ccb035cc47ac6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089100, "uuid": "5e8e5d27-8db8-40a9-b8cc-0fc6d2083b57", "comment": "Malware payload", "value": "99109dd47ccef9ad44084cfffe9a26cafb7f7394ae3b38ff5a683d78e6d38ef0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089100, "uuid": "9410f332-0fb7-4448-a333-cced0c5c9b71", "comment": "Malware payload", "value": "438fe6e5f56dac4e0bc9c08fa1b36b4a79985811", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089100, "uuid": "3506b624-0c53-4d5e-8bc6-b48b2711e8b6", "comment": "Malware payload", "value": "577d542cf761276009126cdf773b1ff0682ecf48183f9018a301d37de8829e5b7e1ffb4af293affec94a66edb2ccffbc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089100, "uuid": "a0d5f7fa-c349-4b35-99c1-0f27eaf46635", "value": "T1D7136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089100, "uuid": "78bfc95b-d3b4-41a3-95cb-e26b2696920e", "value": "768:sXRWNGxVs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:AlxTcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089100, "uuid": "561725b3-4e6c-4ea2-9605-037f12fd3ffc", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089100, "uuid": "876cae46-27f2-479b-8514-84759e77d22d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089100, "uuid": "7fd68fe7-9f8e-4da2-a35f-3bac95d5f092", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61e5a0d-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780040986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040986, "uuid": "701bd73b-5b3d-4145-aee1-ce953450094c", "comment": "Malware payload (Mirai)", "value": "a0177269645abf56193ed275f738cdc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040986, "uuid": "c3c85158-76d5-4e9f-b28e-a00b5ede5266", "comment": "Malware payload (Mirai)", "value": "99c63f90317beec9f1017d5a5951cf43143c848331cb3f41f481a0c8e62d2ec0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040986, "uuid": "27408fe3-b03f-4325-8bd8-b9fe5d6d674c", "comment": "Malware payload (Mirai)", "value": "5aeded6519ab133d1f76a73ee2ce7bb17651c478", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040986, "uuid": "ee78476b-edb4-4a13-afbf-efa2dd2c5399", "comment": "Malware payload (Mirai)", "value": "b74d54e0c41587b72b0e92f33b84447d97f401ca51c31bdd7ec2a0f304a98db0b4429056b1bead3082f6ab829877a091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040986, "uuid": "03d6e91a-7a60-4886-87dd-65f6a21ced38", "value": "T1DC73188678969A1AC6D1533BFA0E82CD372573CCE3CE7207CD119F6176CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040986, "uuid": "1383cb72-30a5-4e42-9a04-de7fc24bfd78", "value": "768:p9JkFJ/u275Aa567ouWo58Vo41oqs5I7KayB1WRh5mKWJGWbMNyHbKmmK4lqekn9:3exuXR87V1Wac+h2lM07K900zZPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040986, "uuid": "c8c7b3fb-0841-4196-857f-ed830fd41323", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040986, "uuid": "730220bd-d703-47ba-b58e-d537329328bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040986, "uuid": "17e1a79f-d548-4647-8cd3-4742c7aa2a80", "value": "99c63f90317beec9f1017d5a5951cf43143c848331cb3f41f481a0c8e62d2ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352ce708-5b98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780084471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084471, "uuid": "dfb6bb5c-5304-480e-a64c-8da774989b94", "comment": "Malware payload (Mirai)", "value": "34ad813a81201fc79191c536c64790f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084471, "uuid": "fe659722-65d4-4fd1-aaae-eb503b0907f2", "comment": "Malware payload (Mirai)", "value": "9b1a7f7713da9688b0ee16b5976a8557a467cc7a0101ada306e2eb298f7cc71a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084471, "uuid": "ca073a15-6570-4f55-bb24-2be0e3f13b1f", "comment": "Malware payload (Mirai)", "value": "5a4fa098a5883873b2a118c261500e228d8eef59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084471, "uuid": "593a6e9a-9b3b-4267-8be8-60bd6247699f", "comment": "Malware payload (Mirai)", "value": "5144881253d1a3d4cb35a2726ce9c5101fc8a36bc222a6b930836b554837aa0db3a11a1a260e22bc7736b16544ebac9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084471, "uuid": "9c7d1f56-6979-4415-b01d-5acb77bba24e", "value": "T1984187F80082437C7DF19B3ABAA9404D77E5A29BACC6DFC164F434A6864DDB03C90599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084471, "uuid": "04c672cb-d62f-4870-ac2c-99bfaa681154", "value": "24:ItElsM90soossjjN3s09sgdqsy1jbscKs6QscBs8N2:iEeM9Zo9sjjN80mgFQQcL61cKK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084471, "uuid": "3d279a7c-8c53-475a-a582-74a0cdfd6584", "value": 2067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084471, "uuid": "a4bbac42-04fb-44bd-aeb6-80c5a6ebe9d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084471, "uuid": "7b43beb3-a1f5-4f4e-94a7-48a07b922cad", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157d5397-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047051, "uuid": "f35157ff-d853-41f2-a854-9a15c4390fd0", "comment": "Malware payload", "value": "245ab8a5a805a0d9e08f7f3478baea3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047051, "uuid": "2cb5b769-a27b-41e5-968d-41870b455b31", "comment": "Malware payload", "value": "9bd8cae28e75623a1e1d0c94419edc8f922c5967c935549adfbab47b6f12c810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047051, "uuid": "74907650-63ef-4887-84f8-d4b40391e4ce", "comment": "Malware payload", "value": "b688114d49bd6fb73fa6ff39bb137af3294b01d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047051, "uuid": "308f8839-669b-4076-bea4-c25f97ee251b", "comment": "Malware payload", "value": "ca748edae12d93fe2a30fd3d191262c0041c9b0766da18fe00b2d15143561046e7689b492d662d1c215f82371f184d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047051, "uuid": "fa00b9bf-8d54-4833-95df-84687f289630", "value": "T16947DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047051, "uuid": "809d2a05-7df8-46d4-8982-bc901ff9b764", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047051, "uuid": "6d5d3faf-803f-4f5f-80b1-8be0d687d963", "value": 24674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047051, "uuid": "87c2f685-da35-4354-8ac4-28058fbb8723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047051, "uuid": "073d8e89-fcd1-44f8-b246-2108b4c7c5a1", "value": "9bd8cae28e75623a1e1d0c94419edc8f922c5967c935549adfbab47b6f12c810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a4b7cf-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780057601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057601, "uuid": "2095bd47-788a-4cde-b695-bd2767cba56e", "comment": "Malware payload", "value": "589e14e6df01e0726433704ed1f3932a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057601, "uuid": "9e4839a3-4bc2-4d97-a81a-c656df42c440", "comment": "Malware payload", "value": "9ca2ebb826a8d0de58eea5a1afb5f6f76adb3938feef9604725508452b0a2e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057601, "uuid": "957ebda3-2bc7-4eea-ad2a-a202ff413a11", "comment": "Malware payload", "value": "fac681e2094d6ee9f399b063609caf86deb701e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057601, "uuid": "82707450-ec8a-4f26-97c9-4b0c7141a28d", "comment": "Malware payload", "value": "fb4fc04ce48da798f76da3ae1f59ba035fe632d389309b8e3c1778013f97972d59cf7a443e12d03edb36ead48994eed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057601, "uuid": "335142d1-51cb-4ae9-b858-e37418969c83", "value": "T19CE57B5AAC9005EAC056A3338DB762927BB5B8080F3367C72E50B67C3FB66D49C79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057601, "uuid": "cec1bd20-8ece-45f3-b7cb-7beb660d98d4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057601, "uuid": "2b19ad93-1c3c-43ea-aa24-4405a9a30806", "value": "24576:ACzWh4KSXUif6YDSz2eMsG0JIOQPzvM+3twmGEJWkafLBele5ZK2hgBWTB:ACKh4rX/yYDNeMGKN9kEJWRH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057601, "uuid": "cc356a63-4b45-4987-b6c6-0558a7f14b82", "value": 3220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057601, "uuid": "0f21d388-f910-454b-b34b-553987367c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057601, "uuid": "6b2f6723-b413-4c3d-9772-bc8c8787afe6", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77361669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc349f4-5b7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780073241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073241, "uuid": "07fd51f0-1c2b-4b51-84da-247d4b8763f9", "comment": "Malware payload", "value": "4aaebd3595d2bfe3e7b63f185c07f144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073241, "uuid": "35bd0f82-e164-4598-bd21-fa88894ae266", "comment": "Malware payload", "value": "9d0148c9c2b1bab51cbcc07e193a6db93faa02a5a3aac397a40fa51c8017adad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073241, "uuid": "22ed48d2-ad5c-4be9-8475-94a2bf8f9493", "comment": "Malware payload", "value": "33d415295bc6230b4d2e8a728e884bcf2536fb4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073241, "uuid": "9b1aabbe-d6de-49dd-b0c5-aae4d73063d3", "comment": "Malware payload", "value": "cfcd122280fc52c26d64717264eb0d22286c8ecb3ff6eae4a20ce8627cda6ad4da81e1473fbf9d6811e3f807d2c6badd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bk[b]", "colour": "#AFC057", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073241, "uuid": "0a511e50-2b43-42a6-8acd-cb6eabceaa34", "value": "T148834987B3A134F9E0769B38CCB24651D376F87606729B4E47A4019A5F732D19E38B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073241, "uuid": "d82d71cd-c07f-47f6-a4fb-c9a13f32db9c", "value": "0d2dae88c385e9c37ac62898b0e07224", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073241, "uuid": "3aa47fa6-bbaa-4c5e-ab28-fdb91db6d2a8", "value": "1536:ST3y3Bb6+wJLfkPdDoKymzwNmKrGJ3977V8M4FsW4dE0UcD7+K:STwJ6+wJrgdDoK9qmKKnx4qEdcDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073241, "uuid": "26d0ac97-0a80-4c96-9e2a-5ff8a92f551d", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073241, "uuid": "513345ad-5883-4f50-97cb-ea8d98e3bc95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073241, "uuid": "83e0f6b9-9f2d-4605-95be-0b05e9eb0060", "value": "\u63a7\u5236\u53f0\u6d4b\u8bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caee87b9-5b5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780060240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060240, "uuid": "c3665366-9d3a-4c9a-aa6a-38c5cd04206f", "comment": "Malware payload (Mirai)", "value": "9ff21392b6d4b089b478b1013d0234da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060240, "uuid": "45c534f0-3bd6-4151-bd48-c6cb5f29a026", "comment": "Malware payload (Mirai)", "value": "9d27e77c4a3859313fe4dba4c5f8583293c451797736f2c78832820116c19629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060240, "uuid": "3701488c-1d65-4fd2-8a99-0a143b523d4a", "comment": "Malware payload (Mirai)", "value": "5d9a7d7482333a9404b761312773bf6c8d99a14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060240, "uuid": "dd2410af-2672-41b5-b6df-b68362d205de", "comment": "Malware payload (Mirai)", "value": "5f98fda420f894f3d5e9c016ea267d892c1d2bee24ec23370f2de52a3a554892c2d1f1cf8b688c30e641e681786b4e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060240, "uuid": "53e14b0c-a396-45e8-8538-98c588a8b2cc", "value": "T1F9157C2AB2B3F5BCE017C03447DBCAB25535B07526312DBB36C4DA352D66DE12369B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060240, "uuid": "26cecc07-cb93-4ab9-950b-e07e1b0606bb", "value": "12288:aZChCuhNggQ4Ux0/dMHzZbqSyHas7cbdFU+mlDF8VIv58COayUHMvb+HX:dhjhNgglUxVNp+Dj8VvoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060240, "uuid": "e08c101d-c111-4842-be49-f5af1aec0b43", "value": 949272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060240, "uuid": "9f43ce13-0a96-47b7-b616-8ffaff82da7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060240, "uuid": "ba3655d8-9233-4ae2-8b43-4e1a37699f06", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1612121-5b22-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780033971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033971, "uuid": "1b80b48d-5527-4cbc-99e2-0eefe2bbbb44", "comment": "Malware payload (Mirai)", "value": "791ba034ecf4b775747c3c0f23c8c576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033971, "uuid": "d2e4396e-aa80-4045-9005-3b0e9802d755", "comment": "Malware payload (Mirai)", "value": "9d66f2f0d67c4203596f158610b70c201c4c6b9a9a724dc08baa1573d64a7f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033971, "uuid": "58489a9c-0330-4fff-ac21-2617d79c6ef4", "comment": "Malware payload (Mirai)", "value": "a3d1fa664cd863ce63b5e190f4a4527c5f61f705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033971, "uuid": "7eb783eb-6427-4016-b972-8c71c73876a3", "comment": "Malware payload (Mirai)", "value": "81a34b5d858d14b4321374a8496f36fb351d79adfc5288e586864a4f5a7f5a7f3ab83677e4c9ad9455584b1e562b81a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033971, "uuid": "329fc697-6e5e-49d2-ada2-62122ea6de9b", "value": "T195245D46EA408E13C4D217BAB69F514A33339764D3EB73069D286FB43B8679E0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033971, "uuid": "a19dba3f-3468-4197-a387-9a9af92bab7f", "value": "6144:0znyai4Qara4OYZGOWkRGtJdecbuPNM/9N/Eiy:0zyL4Qara4OYZGOWk0jd26/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033971, "uuid": "142782a3-6e51-4071-890e-0af14d5ab99e", "value": 224445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033971, "uuid": "3eeafccf-ab91-4016-8d4a-8957989b6488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033971, "uuid": "5539f510-4810-45aa-a3f9-e2c7174806e7", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbde6af2-5b40-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047008, "uuid": "d6d91674-ed9f-4cca-b11a-08b925c0f9bd", "comment": "Malware payload", "value": "981479927bb028f29da218cf1decce4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047008, "uuid": "aedfd7b0-d181-42f7-99f1-f51c2e129621", "comment": "Malware payload", "value": "9f7ee895f02870f62073c267bcb21bd85b063dc51c4c8ae1916d8f49670a7402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047008, "uuid": "0980dbf5-8515-4c4e-9776-5be94db47dbe", "comment": "Malware payload", "value": "c4da7c4b72e176ab6c642d1149cf35ab140672b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047008, "uuid": "92964752-f1f9-4ebf-b4d6-64c6b45b61ac", "comment": "Malware payload", "value": "0b18a7f7dae417e5244947fdf9debd11a2f9491fec43d28d5a7a0372e3a957ef3e787e13425c8a3b4b860b29901e62dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047008, "uuid": "bdce3a78-d2fe-4415-8432-30a4d72e8ee3", "value": "T15DC419A0ECFF10F5E60294369A6BE27F662523091B38DDC7C6D40F82D9A7AF11533526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047008, "uuid": "7c3b736c-18ec-47c1-8f53-505d1733d9af", "value": "12288:gY+qy1SBQkzGCcx1ZBdYzvU56DyDpbOcn8J2iychcGJDrOSe9sN:gY+qy1SBQkzGCcx1ZBmg56DydbOI8J2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047008, "uuid": "6b490b20-94cc-4ba2-9e51-e5091e1db16e", "value": 571706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047008, "uuid": "8a33a40a-fa47-4256-89c6-c557ae59c922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047008, "uuid": "28855a16-6227-46bb-9a43-9d22ef46fcfe", "value": "SecuriteInfo.com.Trojan.GenericKDZ.117971.8222.19358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d232561-5b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019630, "uuid": "62948353-8641-4d33-a7ff-659e3e5c5eb2", "comment": "Malware payload (Mirai)", "value": "3b071b746dd884c28396f096e7831bb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019630, "uuid": "f77a321d-367a-4944-b9fc-ec8afaa4a717", "comment": "Malware payload (Mirai)", "value": "9f82e17f61a275e1045cf21e328ecd6493a7a167529b416b0994ded6831e90de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019630, "uuid": "3c253a57-d9ff-4449-b3ec-284238978dda", "comment": "Malware payload (Mirai)", "value": "b1da3e3df36220f497051359b5c14aa22bb8c54b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019630, "uuid": "a80c2982-ad73-42f2-8e0b-92945bbeaebe", "comment": "Malware payload (Mirai)", "value": "2f355e66aae6d326ceb801d4cfd06ff01ba8edd5c23c973740340ff751fb746d434b71a9d9dc0924122bfdf8b067f5c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019630, "uuid": "4cce68db-9f25-4b65-8782-9a07fdb22462", "value": "T176C35AC1F683D0F5ED150AB530B7BB368972D53E112BDA82D7B8AC31AD119C1982B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019630, "uuid": "3c8daeb4-02c3-4e61-b654-ea161cccea8e", "value": "3072:BKIeKCGNl3BuzAiS4xGJZAhEhZktf2+KZRkCXlW:BKO38bxGrAhEh0BUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019630, "uuid": "3bc07e56-f46a-453a-ae5d-a081f02109f8", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019630, "uuid": "0304ae56-05e4-4b4e-8b78-072e65096fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019630, "uuid": "b77ff748-23cc-4970-8fa1-6034b798f6ed", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2183b9a8-5b9b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780085726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780085726, "uuid": "a81aade0-02b7-4a2c-ba96-34a4df829436", "comment": "Malware payload (WannaCry)", "value": "b6ef2ea24b1a08f3c8ad1183e5dd3d54", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780085726, "uuid": "80588580-981c-4849-809f-009dd2adc629", "comment": "Malware payload (WannaCry)", "value": "9fd34898fb5ed155db6ac61e7c6777cb2ed7fd6308a772f897303a47c7459aa5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780085726, "uuid": "23201930-cd9d-4e76-a076-a74b662ec9cf", "comment": "Malware payload (WannaCry)", "value": "c6b6236ad11eb7c237c195ea34d85370744bd0ea", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780085726, "uuid": "0ff08b7c-32b4-4e2a-be28-58710793c7ab", "comment": "Malware payload (WannaCry)", "value": "91acb6b01bc00a1377b51f61a825563f08d3b5ae2f8ec5a3c23e0b995e35c440a68e60f893a3c3004ab52a2a70e76df6", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780085726, "uuid": "bf07a78d-6f03-43c6-a8f7-7b9e81f36c1c", "value": "T19736235531A8C0B4D107153488EBCF61F2B6BC2A17BA664FBF904A3E2F23B91D715B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780085726, "uuid": "3724d6d4-0163-4b63-b00f-39286656e53e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780085726, "uuid": "02fea55c-cfe1-488d-994b-bdaad9c94e87", "value": "24576:jbLgBbLguriIfEcQdIvrYbcMNgef0QeQjG/D8kIqRYoAda6626WgkQg6eX6SASke:jnsnpEjbcBVQej/1Il6kQo6SAARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780085726, "uuid": "b170e534-d8e9-4eff-ac16-9fc004222eb7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780085726, "uuid": "8d5b278d-b4db-4260-b377-40c1ff231c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780085726, "uuid": "fc880260-da6c-4108-9ec9-02dd940513bd", "value": "9fd34898fb5ed155db6ac61e7c6777cb2ed7fd6308a772f897303a47c7459aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc52222-5b77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780070283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070283, "uuid": "d2bd4e3a-fb48-417d-8a99-352fc4ef40d5", "comment": "Malware payload", "value": "6bbcd6701ac11e90a1bb20f31b1215c1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070283, "uuid": "a375382a-140f-41dc-b5f6-3fe3905737cc", "comment": "Malware payload", "value": "9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070283, "uuid": "1cceaee5-c41e-463d-a49a-e5c478d99f72", "comment": "Malware payload", "value": "0a7503dbc5296d1cb559404bb857a98aea77aef7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780070283, "uuid": "5e6fc70b-5643-45d5-9289-08e530fcdd5c", "comment": "Malware payload", "value": "a18d7b62133c1d05092fe37da3e419c869a75da16059a1ec97e8ba5b43ec343d239839564dcefb6f29853e9e7d638d52", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070283, "uuid": "08a9e593-88bd-4694-9733-fce40b759d7a", "value": "T1C7C62345F7D89E2ECC7340364F6B673655496D63C74AC243C978325C28BBAE48E81BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070283, "uuid": "267f1f9d-7847-4ee9-ad5d-dbf3193e0c9e", "value": "196608:JRveC75GmFAEeLuf8jYdkT825zgcnnY+rc1OYV8+ZpBCXJgDXnvyTs8cM:JRveQ5rFzeZ3YAztlr8NHtVnvyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780070283, "uuid": "39dc24d3-950e-48b9-9220-74133e4e4f3f", "value": 12503895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780070283, "uuid": "af26ecc5-1a96-4a84-85ce-cf2eb94ab6d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780070283, "uuid": "ff9889ff-0060-43dc-a5e3-6005edcc21c1", "value": "9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68869b73-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038601, "uuid": "7a870d70-574d-4608-8e3e-a82c0c7b2171", "comment": "Malware payload (Mirai)", "value": "2b44f8e70f9a5caf3fd7207de8e13a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038601, "uuid": "a672d871-bd7d-43e0-8122-c611af24321b", "comment": "Malware payload (Mirai)", "value": "a0144ea706f5ed851450803d3bbb41ebce27a5e179411c71fbb8e8b6acf08355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038601, "uuid": "3651b488-0279-4f87-b5de-8cae283186d5", "comment": "Malware payload (Mirai)", "value": "be21a058db265d437ee791cbd5dac52c74e86b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038601, "uuid": "162bdc27-4974-4319-b074-e9adc90fcd94", "comment": "Malware payload (Mirai)", "value": "056dfe1dc7037b67b092d38dfeb389e5784871a0f9e3c605e85544f0aef559f3f323bde73df85380912fee120492e865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038601, "uuid": "700ff0aa-aa36-4ace-935d-5148b71ebf7c", "value": "T16103E19865D324988FAC08F690BE16B10E5020C97B667B8D3B5A1CCC767289BBB5D478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038601, "uuid": "f8376bb2-d314-406c-a90f-e62483606230", "value": "768:5hpGLq2YEQh5q10MxYWt/y/1tgPUcDp1ueIifBXWj:HpD2Ynjq10Qt/U893w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038601, "uuid": "a45dde57-4bb9-43cd-8592-af8713b2b334", "value": 38648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038601, "uuid": "c55d8491-1940-4ed4-ad02-e6c17ab66039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038601, "uuid": "7548c476-6085-448a-b551-7f232f0c3329", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049c4b98-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037574, "uuid": "f3d27276-0e74-4cc4-9970-f62363fb20b7", "comment": "Malware payload", "value": "7d4c8f463129370e92c6b80003b7617a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037574, "uuid": "226740d8-78cd-4a00-bf1a-a0e662f99d8f", "comment": "Malware payload", "value": "a27bda8928aaf0601341d9121c429a501a74260dd37c89754c2bb4288fda572a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037574, "uuid": "842a321a-66ea-46b6-9f1a-cd0361635313", "comment": "Malware payload", "value": "4e1a7acb43f53f5feea5c67c42f5e8f463aa1352", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037574, "uuid": "c064f4fb-2da0-4484-8e28-21364b1457a0", "comment": "Malware payload", "value": "a90c20f56632a7ac50341440dc30b20a26ab405ddf5c9d047a17f0d86692a7939e32964439b2780f2d41a3e9be5c13b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037574, "uuid": "e01c9ec3-6c58-4a6a-b15a-7fed3575813b", "value": "T18BA6BDBB6DEC361D3000B1C2F48521F1EA525336DBDE12D9B8F924327AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037574, "uuid": "e559026f-dec3-495e-b5a4-852dbb825200", "value": "6144:5ubnYpscL3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfpiwpN/VwS0msFJvXiESUWj9:TPMey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037574, "uuid": "bf86d58c-2145-4d23-9301-b6b8ac0360be", "value": 10142852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037574, "uuid": "0ed3bcf9-976a-4701-a698-16ac522c4a80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037574, "uuid": "edcaa7f0-0bc3-4e8c-9a6e-bbfa2545a9fa", "value": "Update_14.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9adb62e-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018658, "uuid": "b1f40de2-4c42-4988-b7fe-14aad7469cce", "comment": "Malware payload (Mirai)", "value": "cbce5f8fad3ec4a45789e022f1c87b5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018658, "uuid": "eefcc12c-f515-4277-b415-03f5412c7e51", "comment": "Malware payload (Mirai)", "value": "a327aae8368e26f29127572d346c565d00f2309398c14339775ca6d7a074359d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018658, "uuid": "20854704-877a-4d4f-a1a2-37b68736debf", "comment": "Malware payload (Mirai)", "value": "0a75a6a533ac1f4583147381859504fad10d42e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018658, "uuid": "7f4b6e8e-c376-40a2-8a7a-3a0065beebbe", "comment": "Malware payload (Mirai)", "value": "943403181a6b2ca5b63a3cefe4e095d3f3df48087c95df762d7231eff4ab15340c621d5b6eed00cee3aa3aab987c803e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018658, "uuid": "2b82928f-c6a6-44bf-9a28-b90401b170c9", "value": "T167738E408C1DF973CBC6A47E4E480A10336B7CF42568D74A1A25B68EDD49A58AFD1FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018658, "uuid": "3531efef-a094-4828-9c59-0a96a4122fc6", "value": "1536:qzJrNiiGWaGbXr32vtpBDJZtCOEAm+TZZDEd2aTBcSv2DnSK9:qRwxWaK7MVJLCpqFSxunS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018658, "uuid": "7b930500-93b4-42c2-96b6-c40c999be55c", "value": 78232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018658, "uuid": "627d4317-2deb-42b8-9926-cdc3ead463bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018658, "uuid": "bb4287da-0cd2-4913-9b25-08a6063464c6", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b2eed8-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "403269be-32db-43f9-9a84-22d9a2aa6efb", "comment": "Malware payload (BlackMatter)", "value": "c48fcaaba360883a8150ce3ac7f2a0bc", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "ea8680e3-6ab8-411c-9a74-19b868b8f7a3", "comment": "Malware payload (BlackMatter)", "value": "a397bea4c70bf3264348c88fca652fcbb2d421832672fa58a790af67bf419469", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "4f08608d-0109-4887-ad54-559ca38f61e4", "comment": "Malware payload (BlackMatter)", "value": "34c4d32123e0ba10891c0e0d697637b9c534811d", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "3cfd8114-f6cd-4dba-b4a1-acd731757a75", "comment": "Malware payload (BlackMatter)", "value": "80699790a7f93411cd61f2711813bd5225dfbda7e24cb00ee9e3e7c235aa1a2aae3c667072943626dd4da6b598bf968a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "0474b029-1574-4a2a-9576-1440a6ba726f", "value": "T1DCE37E21F212D0B3C83718F53736B571B39E8E2C25A96847D6E80F9DBCA58236F44997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "e1248dc3-e552-48b3-8ed9-3c6d4216aa17", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "7bf88cd9-f9a7-4b7d-9f9f-87b11b469645", "value": "3072:p6glyuxE4GsUPnliByocWepBw5V2DijnwqQll:p6gDBGpvEByocWej8u6nwZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056695, "uuid": "95baeb61-1d47-4c54-8251-9521aefc2b39", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056695, "uuid": "f01e1ed8-ab54-4bb8-afde-b56dbb58c08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "5cedf8a7-b98f-410e-b7d7-8910aa3dba6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740d0f6e-5b42-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047639, "uuid": "02b8e588-96cd-4f30-8fa7-cfb08c54f7e2", "comment": "Malware payload", "value": "cd14c3ee6db1e328667b8a69ea2a36e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "mining-launcher", "colour": "#FCD4CC", "exportable": true, "hide_tag": false }, { "name": "mining-proxy", "colour": "#574A2A", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047639, "uuid": "f8054966-5546-4161-a0b3-990e2598e402", "comment": "Malware payload", "value": "a437ad7a5250390bce355a1957a3584a68df7efc3006e2f2bcf052845bc32ae8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "mining-launcher", "colour": "#FCD4CC", "exportable": true, "hide_tag": false }, { "name": "mining-proxy", "colour": "#574A2A", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047639, "uuid": "c5d9020f-63fe-4ad3-b8e3-cc98f41cc363", "comment": "Malware payload", "value": "648d9826624fafebdb026720dbcc9a33948f6494", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "mining-launcher", "colour": "#FCD4CC", "exportable": true, "hide_tag": false }, { "name": "mining-proxy", "colour": "#574A2A", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047639, "uuid": "a5cbe90a-fb77-4972-8631-dd395bdaf169", "comment": "Malware payload", "value": "67cdfe2154ee2377197a3450a8ad2a85d79d2a12bf6ac84e0b0c82ba67637cf3d84085920e5e29431e2a00de240606f7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "mining-launcher", "colour": "#FCD4CC", "exportable": true, "hide_tag": false }, { "name": "mining-proxy", "colour": "#574A2A", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047639, "uuid": "cade5eb6-21c9-4b61-8f43-bd2188d720b5", "value": "T1B702DCD272F06A6FE489E03B624BB3908273BC2514B73F46D770A5351D1A214FE13524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047639, "uuid": "f1c33074-aafa-4aac-b674-031e9f647919", "value": "24:GJ3VTu3hdQqVupE0HoooH4qLMGZ8TqQAh0R0VQQUG/+kP1A/l7APgs0D:GJ3VTuR5u+rVhvVVQ3G2eA/l7A4sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047639, "uuid": "691a4905-46bc-489e-96a5-899dd02bce0f", "value": 8752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047639, "uuid": "49dc1682-5c25-4373-9bb1-1d8682602799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047639, "uuid": "9efe2971-964d-444c-b4b0-c8cc3c47811d", "value": "xmrig_launcher_91.84.118.236.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e79ded-5af7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780015531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015531, "uuid": "79440a45-68a9-4b95-b5a1-9bf41b28cd47", "comment": "Malware payload (Mirai)", "value": "c5089634cc8751269c5892f032cc851b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015531, "uuid": "28fd45d1-b923-426d-9dc0-d8f6018fa593", "comment": "Malware payload (Mirai)", "value": "a523fe48191e94d49e7fda958c56577894c01cf45759350f5cb6fe73a49ae38b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015531, "uuid": "947a87bc-f05b-461f-a5ea-4336e7da3519", "comment": "Malware payload (Mirai)", "value": "2c188076fc15c025527b370bb83842964285ecfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780015531, "uuid": "baa297bb-4ab5-4091-96ea-6d3958447ecc", "comment": "Malware payload (Mirai)", "value": "20833533b7d9ef9a500da758497d6ff79e48396f4b6b6b5c78683078d1fc80d1cc65633536b0e35c305cd78a4f58cffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015531, "uuid": "568e2921-306e-40f0-ac89-7ac3969f1065", "value": "T1D763190368A081FCC155C570AF7FA53BD623F03E1135AA8EBB947F267A4AD211E1F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015531, "uuid": "1334d973-8ed6-4175-8fa4-a6c9f915d27b", "value": "1536:RgCa8F1GyhS3oDsJvo1CQP5mzW1/ZLZ6uz:RgCa8r4o+vo1TBmzW1BZ6uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780015531, "uuid": "3bb58b65-9d5d-47bd-b73d-444fbe41c1db", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780015531, "uuid": "ad2130e7-0e34-4b28-b246-f72a1f66ce76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780015531, "uuid": "c40d5acb-ec86-4c0f-a3d3-edde4f21a444", "value": "proto.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8408983-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780047432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047432, "uuid": "ce2e99bd-67f4-43ba-a6a8-d88843416b27", "comment": "Malware payload (DDoSAgent)", "value": "1e1be71af5a9f1d9c5e4e4b0f205f7a7", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047432, "uuid": "20198b7e-2e21-401e-a7a5-0c421ae0e3d7", "comment": "Malware payload (DDoSAgent)", "value": "a558135af9987d04e2dce14a121ee833fbc679b6a2eb1481a456583469b9942f", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047432, "uuid": "d8c77110-8731-4747-8af0-d1297fb92721", "comment": "Malware payload (DDoSAgent)", "value": "0cb7c791627d954c3b029b0a218dcbf2d8920456", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047432, "uuid": "cdc1b98d-1f1a-4f0f-801f-94f9bb93f0e0", "comment": "Malware payload (DDoSAgent)", "value": "e76bc2b1722b80cba7b81bf08558c4494170ef6c5064c05ae5fd7810879571d5e01740a99be4ea1c7385b3514bd8f4b7", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047432, "uuid": "1f50a90f-95b6-437f-b305-74a466285fea", "value": "T186767C91FB48A136DA460A3248A30B70B3915D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047432, "uuid": "c6bf3a45-fbfa-43d2-aa5b-73329175c229", "value": "49152:vIxfpNZ3DNYZX2N9hRtwdGtmu8QZIyUp5mIBi1q8PwyESHMEwO2HHUt5E6:i13R/N9JuGthzwtqq8PsSsEwO2nUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047432, "uuid": "c5452626-4a3a-409d-a18a-dd47ad2eae23", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047432, "uuid": "8a551873-f9dd-461d-a3f2-3e8db0235a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047432, "uuid": "69f9012a-cf10-48e6-8477-135e1898ba70", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4890333-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780016502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016502, "uuid": "2dea0da7-a74f-4a2b-874a-2656d604e13f", "comment": "Malware payload", "value": "3328d198d4d2deaa001e3110892819c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016502, "uuid": "c37f1666-1d9f-454f-9402-f973ee28b914", "comment": "Malware payload", "value": "a65eb77fc63484b9b8f3233b90572eb40b0aa2074d7a43ab7b9baacb230553c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016502, "uuid": "773213d9-354b-4c80-92d7-5fe125174ac7", "comment": "Malware payload", "value": "e98e28819bca652907bc195ddec6f82634edd14c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016502, "uuid": "1c44c2be-aa4e-4cb1-905f-f731347ce422", "comment": "Malware payload", "value": "049f0fff5ed2022b461bec7b92f9c9abfc6f4f412f2a7e113931a90346b6c00cce81848ae44010592b45423332b70ccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016502, "uuid": "8b2723a7-1b25-466a-8154-95067aec5779", "value": "T1DD07AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016502, "uuid": "ac4265c2-cbda-4c40-add5-f9c28f486858", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQg:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016502, "uuid": "b06b55a7-fa48-4184-8062-4f5f84b3b7c2", "value": 17498112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016502, "uuid": "03652cdd-88f4-45f0-9307-ffd64aa4b189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016502, "uuid": "e6ffa8bc-0bd7-4921-9b5b-246fe833af46", "value": "a65eb77fc63484b9b8f3233b90572eb40b0aa2074d7a43ab7b9baacb230553c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e3c309-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089094, "uuid": "279d1089-9baa-428b-93f5-273425925588", "comment": "Malware payload (Mirai)", "value": "a5bde9aa95857ef97e1b0c199dd866de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089094, "uuid": "1a8df9fb-ec90-434c-9e7a-644c7fbd4ce3", "comment": "Malware payload (Mirai)", "value": "a685313f3a72b5ad36df2c040aefab162bfd50c5914296a64bc298502091f00b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089094, "uuid": "c1550b9a-87b2-4327-91be-98f2e0d7afab", "comment": "Malware payload (Mirai)", "value": "60d2ba937a9fb4ec640c7861ad1d29a3724a3026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089094, "uuid": "02c54f43-fa74-40ba-9293-0354be8aed8f", "comment": "Malware payload (Mirai)", "value": "2c6b22f2b4940f2228960ce3e3fee45e6d4cd54f88ce345fbef4f291f98ce75bfb7f71b025708692da7186fb23fa6188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089094, "uuid": "36438377-b8da-46df-8d47-bab147f690bf", "value": "T138F33A69BA0F6C41F2C2C3F9DA8C87E17E1735E3C6778DB1690152EDDBA39D98980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089094, "uuid": "570a7d76-587f-4623-9700-9b7bbc75f540", "value": "1536:OssaGUZphTPHiVznbcLlfbS6nI4b1J7gT9YXaYoyizQMGWEn5p5M/LW:NEbcLlznr/7M9YqYoyEQMGWxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089094, "uuid": "69095a3b-25a0-4925-ae7f-b4a37f4a5877", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089094, "uuid": "1858090f-1b39-4be2-b90f-e0439dac9281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089094, "uuid": "e228e79a-be66-472d-b80b-7f223e013532", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb50046-5b64-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780062394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062394, "uuid": "77145fec-38fb-47db-821e-bc1eae4c2b15", "comment": "Malware payload (RemcosRAT)", "value": "4a40b6494d80287a5660b2b0fe881ddf", "object_relation": "md5", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062394, "uuid": "baa22b52-435c-47af-9c90-76e4ce75da72", "comment": "Malware payload (RemcosRAT)", "value": "a6ccd89558c4b5cd2fec2512b846e14620be2cb3489f85b99203a9e4b9751d6a", "object_relation": "sha256", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062394, "uuid": "2b998aa1-59f9-42ac-bec1-9412e0e5cda3", "comment": "Malware payload (RemcosRAT)", "value": "67f28f3897dcf58f8a281ac2ee2e14cfffe1d36c", "object_relation": "sha1", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062394, "uuid": "b7455fdf-0d4e-40fb-8370-d770f623d1f1", "comment": "Malware payload (RemcosRAT)", "value": "84b4863e7a141a39f58e382e68d9cb842404e46330001ee597e12a8bb6c1b2069a12a362eace5d75048bfebb81ff6c84", "object_relation": "sha3-384", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062394, "uuid": "226f8214-5226-40a7-bea4-2406b7e3342e", "value": "T14DB2C023870BAD8BC6EA817C408B5E152F0849668B3E5BE387FC519DFD714886D63542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062394, "uuid": "76002676-e2dc-42ca-be25-3111262ca0a2", "value": "9101de1775a541d31c617d880d867c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062394, "uuid": "ea2e21b3-19c8-4c17-b7c1-988d9d38a71c", "value": "384:CnMsglUZg+Ji5VdDLb8qcmgxvXqK/5qDgf0/QXh8oqWV1Il:iM/U2CacqK02Vr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062394, "uuid": "2f404de5-7a1c-4fc1-8f29-86d0d288c9f1", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062394, "uuid": "4451537a-55d4-4757-9526-714ee86d53ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062394, "uuid": "5cd98a22-4952-4c64-ba53-61221aa6cfbe", "value": "eastvillageeatery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20fc829-5b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780059877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059877, "uuid": "07f58c80-07a5-4061-8fea-3493cac65726", "comment": "Malware payload (Mirai)", "value": "5f8b6737c61ffa7333347eba9d086d0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059877, "uuid": "bccd3c6e-17c1-44ec-9303-9257c68f9deb", "comment": "Malware payload (Mirai)", "value": "a7370d4f898fa86576d9d5e5e3a938654fb44e084e06ac42d26437193d68e45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059877, "uuid": "c4e47117-fb41-46f6-9efc-d9aa938c0da1", "comment": "Malware payload (Mirai)", "value": "8c7524720672473e906b5b2e21c960dee5a67f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059877, "uuid": "cd7c5659-317a-427e-9f9a-2c8e9dd838d5", "comment": "Malware payload (Mirai)", "value": "1e16d29b1d81d69715a571a723525a6c982badf281ed0648775aca353b0fd7c0b8b15c53788d956d3e0d16ad0c7dd66f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059877, "uuid": "aa89231c-c19d-4016-9a84-76cc0ec4e442", "value": "T155C339A3C8656F58C628D5B0F0718F796B63A921914B1FBE1577C2B88083D8DF6493F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059877, "uuid": "1b391320-28c4-4bf6-96a0-edd3cc7c93fc", "value": "1536:CL/hwCi49axvTb0RCEKfow87XmqiUZCQCPlTWAwh0AVWO3F8wx:iWC5s8RGfe5iUZ3IlTWThXWsFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059877, "uuid": "157adb11-09c2-4d38-ae75-dd7a082078f1", "value": 118552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059877, "uuid": "a8c61619-0554-4513-ad97-e9a76f251c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059877, "uuid": "fc1960b1-85fe-43af-af2b-3d5ed4aa21a1", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0ad1a2-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017699, "uuid": "3a4aca6b-7ebe-42da-9be8-7c3d0bec6aee", "comment": "Malware payload (Mirai)", "value": "c20901c038f491ea1c6d251f28c9455d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017699, "uuid": "1fa7b655-ccc9-456a-ad9a-798b4dba4e56", "comment": "Malware payload (Mirai)", "value": "a9a20a596454219b6861dcf485d6b9bb606458af1f887816ea182a729eaa12e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017699, "uuid": "02375006-53ef-427e-b592-5ad3d8ee575d", "comment": "Malware payload (Mirai)", "value": "b7bc6c78790a176c990151b66d14d5706cc9c48d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017699, "uuid": "0f19a0fd-a166-43cb-8660-dc48193616ac", "comment": "Malware payload (Mirai)", "value": "41aa95e0072488f0251d2148770e61fc54326ee0267e6f1186742e92186a63cbfa619820beb76ee6238118b3e4d593ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017699, "uuid": "ffa573ce-fb7f-4393-87e3-19587157adbf", "value": "T128D33AC2F58B81F5DD0B8C306067F73FCA32886940339B99EFA59E35CA379815616399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017699, "uuid": "0267a96a-1fbb-4731-8f8d-6c38e0571778", "value": "3072:0ob5Fj8YrtqHjvNJeLg71Cbri0drCtSCyXN:95Fj8YrtqHjvNJeLrxpCfEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017699, "uuid": "ab90a4cf-9ce1-4c76-94d6-32938613e853", "value": 132372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017699, "uuid": "13707a5c-d9a1-41c9-b78b-ae3eba3d00a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017699, "uuid": "ab99bfc4-a27e-4cb7-92e1-d671f53ac8fa", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86645f41-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039080, "uuid": "20f354a2-d7b2-4fe6-8108-2285de5683cd", "comment": "Malware payload", "value": "4949fa2cc7375013e05e080be7a819c3", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039080, "uuid": "6966c5e1-cdec-42b5-bcc4-f1a1c7c65b17", "comment": "Malware payload", "value": "abb4b4b988a870008e4834c56b16b654760d4e436a0b1c0e0c6b4f387b5cad92", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039080, "uuid": "9644a512-0c35-494a-aa8a-b48f70e43e80", "comment": "Malware payload", "value": "1e4b01d44608c38cebac330c5fdfc7a55f4a6728", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039080, "uuid": "a4b0e347-5544-434d-b344-657fd3630e84", "comment": "Malware payload", "value": "48eb94fe4e24f30f96413a1c77358d44549c7ecedc2eb0b85d507e8b1ad5faa7171d3d331a9dad8ca125974bef8d43d8", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039080, "uuid": "8b1d522e-21ad-4f5d-ae0f-44d888bf3192", "value": "T189137D6566843C24AE9988371D7E2F0CBDB983E5310851EDBFCB3CF58C49A9CA60871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039080, "uuid": "e056798a-6b98-4c16-9346-834670c66e10", "value": "768:vx6rDTPjHu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:v0r3fco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039080, "uuid": "dfeea1f3-5335-4394-8405-aff13023286a", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039080, "uuid": "2e336495-244a-41c8-aa9f-aef397644e80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039080, "uuid": "7bd98322-dd49-4bd6-990e-abe15034581e", "value": "abb4b4b988a870008e4834c56b16b654760d4e436a0b1c0e0c6b4f387b5cad92.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99f5ad8-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089095, "uuid": "06eb8319-1a66-4d9a-bacc-decdee894c35", "comment": "Malware payload (Mirai)", "value": "e57934ab417d0495a8ce2eb03f6581aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089095, "uuid": "c7966cfe-31f3-408e-9f54-02e5b37f3f99", "comment": "Malware payload (Mirai)", "value": "ac0fa0ac1a0e8e7f17328b85565988fc635f3c6298219779071ac06b0176a082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089095, "uuid": "25d29eb0-f039-4ad8-a97f-f8d3f8aa95d3", "comment": "Malware payload (Mirai)", "value": "126d7c00f4abd9c6f76d003fff7f2497bbd65527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089095, "uuid": "7cc09330-a1cf-4e33-9b67-499ae89f45e7", "comment": "Malware payload (Mirai)", "value": "afcca5d6419b5dd9b68a49e2e06824794e320063fd9715cf3c6acb848538f5d39b7013783505d5e9ded9a9d34d686e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089095, "uuid": "bd9b3c7e-8650-4857-a533-01abdbbbf6c0", "value": "T11B23F1638D4EFBEDC9B5E6F456AD52D1AE319C0E8087183F40E172F6AD776501F02292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089095, "uuid": "4c67cf6b-26a9-49cc-9321-9b1dc8f1c9ab", "value": "768:TTLlsV8HAasaIZ1BErjmjmX4U9AjP/rexFWSswqB0AoTRGgDgiFOE3nhp4A8T:TTLls4RslZXkjmRUIKxFWNSTRGPiL3he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089095, "uuid": "8fc291ed-44b7-4658-8715-aeacf8bc7f26", "value": 48068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089095, "uuid": "93269fbd-2237-434d-98f2-b0a6fb8ae217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089095, "uuid": "1075c9ab-9ab7-49cd-9dd9-4baef5b476b3", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209b0db2-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780073699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073699, "uuid": "d834d9ec-a3d9-4823-ad08-53e475cce70b", "comment": "Malware payload (Mirai)", "value": "f6607aad7a3dafbaada8117ac1ce9a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073699, "uuid": "206269ec-f769-4217-b630-42171dd6b03b", "comment": "Malware payload (Mirai)", "value": "ac6ca48fc22a7389ae29fd8a4b8d9b0d278c02cb50b9092f07aeef1edb768724", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073699, "uuid": "116faffd-1c1d-41cb-88ca-8fda42e2a069", "comment": "Malware payload (Mirai)", "value": "429af9f265e2d1300cb6a45cc1112f1e98222481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073699, "uuid": "a08c3cfa-ebf4-4bf5-b39e-81f4dd932acc", "comment": "Malware payload (Mirai)", "value": "afeabb375ca62301790a638aa0ef6a14f2a2a7b5cee3ebaeaf9d50bfd1396b3e0c34e072a2017dcce4938c2155a3fb86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073699, "uuid": "6680995c-421f-4eb9-a8bc-0892c4476d22", "value": "T17AF3D90A9F910FFBDC6FDE3702A9074635CC654722A93B763674C928F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073699, "uuid": "cdb46713-3972-4e09-a762-2246f88b2038", "value": "1536:Qa/3MzuD/6ZfkOCPT+QDxvYzyHdz8md7MmAHxnPcKtMeZsUNhQTTcXqIW3BBHb4w:p/MzYXOUH9d7J6JPX3ImEBB74SuKic5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073699, "uuid": "42c57467-20d6-4212-983e-c7f524efc23a", "value": 169120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073699, "uuid": "8d5f43ed-b754-423a-81cc-32411ae5cb30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073699, "uuid": "aac6ba14-608b-45a0-8144-a3f5da109ee6", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f60cee2-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037619, "uuid": "f8d89532-a81f-458b-a372-63256e2f1d48", "comment": "Malware payload", "value": "71dcfd9ec38d62b6ac74f4cf9d04073a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037619, "uuid": "6c88f01f-4939-4e6f-acaa-32908ba96363", "comment": "Malware payload", "value": "adc5a0b48efb808930acadd51091509e481512446aac030a367d4577be861eb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037619, "uuid": "abf992ec-bd42-4b89-a284-c295eba54990", "comment": "Malware payload", "value": "04bac29db8ae937cc6f31c18b76f9434ec8ef8ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037619, "uuid": "f785768a-0410-40d1-b2db-b12b65737a62", "comment": "Malware payload", "value": "d9de9a69a094bc62c5827533483dab6ce9af1cc851d3b2b4e41449c37111329c854ace2264adabc2edc51d330a4e6e20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037619, "uuid": "64e25b27-f5ad-4749-83db-fd71b9fc0c37", "value": "T13E76CD6BADDC361D3010F186F48525F5E6621336DBDE12D9B8F828337AF6896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037619, "uuid": "9d26bfcc-49e6-41c5-80d9-4ec349f3f1d0", "value": "6144:nubnYpscX3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfslwpNhVwS0msFJvXiESUWjK:lPCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037619, "uuid": "637a501a-931d-4fb5-a9d8-d9e4e1f3094f", "value": 7761938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037619, "uuid": "33b2b11c-f291-406e-a0f5-8ad1f1b62f40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037619, "uuid": "3d57c6a8-f322-4c0d-a067-47c1a3982273", "value": "Update_23.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df1f8f7-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055790, "uuid": "d69d9648-a5c5-451e-9173-24e0bf37a6ae", "comment": "Malware payload (BlackMatter)", "value": "ea66cedf1e1725489eee72e13927f52a", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055790, "uuid": "b50c0f91-d85c-406f-8250-a72116f8d051", "comment": "Malware payload (BlackMatter)", "value": "ae02bd22cede04bdb3d48b0e32a9611c9352f28e2ddaf56af55112fdb8b2cc17", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055790, "uuid": "da76aa0f-40f4-48b7-9860-b44407473867", "comment": "Malware payload (BlackMatter)", "value": "25d243961e01c2bea799bcc0efe2dcd0800d80ee", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055790, "uuid": "5a592013-e8b4-4e2b-bab6-678831d3ba3d", "comment": "Malware payload (BlackMatter)", "value": "cb2bd606fa8dcdf8d458d807e2b9635777a525c3bf1050bbc1130226c928267ad62b24f80e554d72b31711c5f93b43c7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055790, "uuid": "b80009c6-7971-49ec-8679-865dfb224c96", "value": "T1DAE37D11F212D0B3C87718F13736B5B2F39E4D6C15A96807EAE80F99BCA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055790, "uuid": "40f52bb6-a823-447a-aa6e-1baf85a747f1", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055790, "uuid": "18ce591d-9966-4436-8eae-30bcbce14324", "value": "3072:K6glyuxE4GsUPnliByocWeprHwJVVH7B8dtD3PR:K6gDBGpvEByocWeByHH7B8jz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055790, "uuid": "6b1239c1-145c-4ce8-9665-f70ee5fac87d", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055790, "uuid": "ba54c70d-d8b2-4015-ad0b-54aaf6887e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055790, "uuid": "9e2ea1ac-2a06-40c0-99d0-fd5e8050e80a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93933047-5b62-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780061436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061436, "uuid": "c795b278-815c-4688-8e96-e5baf7c025ff", "comment": "Malware payload (Mirai)", "value": "d4c8565c732f31c7bc648cb205b75b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061436, "uuid": "1051bab6-d8f3-4968-9077-d9cb6c0882de", "comment": "Malware payload (Mirai)", "value": "ae1577c08a0f0edf0208d31087e8a7037fd12fd992876a4e795782f7c026aca3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061436, "uuid": "504a244c-1cd9-44cf-86b9-5a5de4401df7", "comment": "Malware payload (Mirai)", "value": "14005728e8beef17932137e67bf39c48b961d93b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061436, "uuid": "33067e86-3c8c-40e9-a675-62a034867d8e", "comment": "Malware payload (Mirai)", "value": "75900dcd634459f398b245971621ff61bde7bc70136c7841a619fb8969f2f108489517a3e6eec80770d6edf95bb32bf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061436, "uuid": "8f046634-12e6-4e76-a51b-7510cf7fdcff", "value": "T1E3D33C06B30D0943D2633EF4373B27D193DFEA8125E4E744251FAA8A9271D325589EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061436, "uuid": "1e6ed1ec-e32a-4919-984f-a14e568c2eca", "value": "1536:0bBt0ZRDxS2N8wfOkpWzaruphCSpFjYggfsnBXrwvA9y65dhvGqVp8spvkcTSp59:0bBt0ZZx7ah4gIsl19Xc313", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780061436, "uuid": "c08314f5-1a72-43b9-b3d9-467fe1d31653", "value": 136412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780061436, "uuid": "ce111738-8a84-4b5e-bf81-4f047ceb74dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061436, "uuid": "c33b3e61-b2b9-4c2e-bb5a-c9701cafc879", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1175c3-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037534, "uuid": "367fa5a9-0242-4e26-b830-c8232255503e", "comment": "Malware payload", "value": "0e4a5c02d08dc03ee0049cff4d61e2e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037534, "uuid": "d3f6369e-ff90-49a6-9936-4da6e9096508", "comment": "Malware payload", "value": "ae2e9acd01f8461549455df96fdfef3a28e8846839e596d8ea15c2ea8e4198ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037534, "uuid": "b8f64c58-6fe0-4ee3-9b2f-e910509d5f34", "comment": "Malware payload", "value": "cbe738821eb020b4d0897231d2960b10de2c4ddd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037534, "uuid": "dd3156c5-265a-4bc8-9780-983f0a98c030", "comment": "Malware payload", "value": "23e4e100ab35b500a94e19d2ceed0ab3fd308a911a71540bc073920f718df802b62273c964f8268d09a5f87948704489", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037534, "uuid": "bfc6ee7e-c97d-4a0d-87a7-b77ed86193bf", "value": "T15AA6BEAB6DEC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037534, "uuid": "61d47a95-34b6-41a5-bb16-831d7eea19d3", "value": "6144:mubnYpscw3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsX9wpNdVwS0msFJvXiESUW0:xPav6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037534, "uuid": "f9054566-003e-44f1-bd0b-ca53fc3af2a6", "value": 9618490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037534, "uuid": "5294cd4e-1b47-4e99-a99e-56a02d76f375", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037534, "uuid": "9420e471-af32-4ce8-97b9-3619b1baf1c7", "value": "Update_3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c5aebd-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780057599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057599, "uuid": "a5abdbf5-fc96-4ab3-a956-00312f8d816c", "comment": "Malware payload (ACRStealer)", "value": "65ad0cd29cb98f65c78cd7d732ae3575", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057599, "uuid": "45c40112-e865-464e-945e-98c14da27178", "comment": "Malware payload (ACRStealer)", "value": "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057599, "uuid": "b74d6036-0e7b-455d-af21-3ab367af7290", "comment": "Malware payload (ACRStealer)", "value": "aa115272bf870525396531665186cc5f6d2dcf18", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057599, "uuid": "3c5cd3ad-cae2-44ca-abd7-0c685df92e9f", "comment": "Malware payload (ACRStealer)", "value": "fe11174b45b952a6779dfbc049b3a35dad40f725cf3caf6f2181bec7f4c577e5a9fcfddc53d60ae14e68f8e830befc6a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057599, "uuid": "731fff32-1122-4fc5-ad84-62930d0e8a45", "value": "T1B1F58D5A6CE149FAC09A633289B362917BB4BC450F3223D72E90B63C2FB36E45C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057599, "uuid": "c9535503-c5fe-45b9-a2d6-23f40e16ae3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057599, "uuid": "83c70116-fec4-4546-b4ea-4abb73904cd4", "value": "49152:E2ruy20xzPWUd401IJzgG1NWIyuDMXSFH:EVOxgzgG9yuDMi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057599, "uuid": "2b1e615c-0578-4c59-9e7f-e01a2f41eaf9", "value": 3361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057599, "uuid": "af8c4475-5422-40fa-a584-e0d93f213712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057599, "uuid": "f7221976-c0f4-4cc2-958d-f6bfe0137cc1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84695786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2a5312-5b01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019679, "uuid": "08e20ee7-9ab9-4371-898b-bde2dce4c04a", "comment": "Malware payload (Mirai)", "value": "57dea380fd972499413bdf30049ce2c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019679, "uuid": "c2497cc7-9c79-40a2-b071-dd7a47871f31", "comment": "Malware payload (Mirai)", "value": "aea0d395c98e0365d25a66cf6ea98c9ed00f9b5fa6f4de8485b5a7dbdae19bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019679, "uuid": "4c9fe325-be84-47af-afe9-782747ba7792", "comment": "Malware payload (Mirai)", "value": "32e809a6d614b8484236fbc308e3e4b3a115a5f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019679, "uuid": "db4ebf5e-5722-4003-91d9-29b5bf000e69", "comment": "Malware payload (Mirai)", "value": "d1f7557a558cb33833c4a80b001752dc02347669ef2b5baba459050b1ad2bb587c6299f5b1d7bd5eb583727fe70ab3ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019679, "uuid": "8d1ed488-057e-4460-84d1-c649304f4bf9", "value": "T174B3940E7E258F7DFBA9823447B79E269648379636E1D181D16CE6023D6030F741BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019679, "uuid": "e84b6eb7-c699-401e-86fa-1b3c535b5a90", "value": "1536:GdWzeRGcRZuGGqr7GwCJtc6X7Qqz1VJK1d/Be6NKBwfw3+jTBDeIqaFW63yw+Ww:GM1GbKL3pX7QSnQ/BSSf7jTBiIqag6bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019679, "uuid": "58cf9fa3-9a56-4214-ae80-46cb49bbc972", "value": 113448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019679, "uuid": "f865d231-9526-4d53-a61e-2d6f8b5d57e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019679, "uuid": "8d4f313c-897a-499e-8de1-ba9cb8c8b8c5", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0a3ce8-5b80-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780074305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074305, "uuid": "ce155023-1c0a-4618-aea5-298bc94d9e20", "comment": "Malware payload (NanoCore)", "value": "61b9700d712c3aaafc92e5e5026e51ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074305, "uuid": "6bee3c6c-4572-45da-b659-c310883faa5a", "comment": "Malware payload (NanoCore)", "value": "af0834ad6c8954004a06f9d267e4c8f1f1b0a07f5ac6ac5bea0c3231db6b9c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074305, "uuid": "4942feb6-afd2-4e2e-ac73-1be1e8a2ad4a", "comment": "Malware payload (NanoCore)", "value": "45ecf667116405778941e7d418ebac99913f2cec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780074305, "uuid": "53716f52-d7cb-4440-8ab7-f83aee2c8658", "comment": "Malware payload (NanoCore)", "value": "3ca0dff76bf9111c9f72674124802af667a0b874c6c1d43fa7354283369ed11e7def2c61ebe82a10e5abffb99c89ea31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074305, "uuid": "e551c2c1-de83-4c32-8536-8f88fc745014", "value": "T12A14CF567BA9492FE2DE867D712202129778C2E3ACD3F3DE28D455B75B223E406071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074305, "uuid": "a8b14758-344d-4670-b3a5-d582e058cca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074305, "uuid": "c5447043-9b18-4c5f-8030-c3e66e162a6b", "value": "6144:MLV6Bta6dtJmakIM5dO3JM1fMKQqa7FPp0k4W:MLV6BtpmktGpC78W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780074305, "uuid": "bff42921-3897-4e51-b741-1ff26b8f5ba9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780074305, "uuid": "30ff2afa-a01a-48f6-831c-78e87bf1eab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780074305, "uuid": "e040d5c9-2235-4c44-a883-b6e222a7df4b", "value": "kem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49b7955-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037493, "uuid": "5c241611-8697-48e1-9628-e3f01d22efa1", "comment": "Malware payload", "value": "8e7a0c6f12e0ac9272f800e3c2dfa5b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037493, "uuid": "1697a8da-d69d-4829-b8b6-c87c4fc5d217", "comment": "Malware payload", "value": "af4313e419edc4c30356ace47af9cb11a70c8b836451ef5ab8414d0bac91fd3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037493, "uuid": "eaa75195-5757-48df-9e4c-fcd8e70c546f", "comment": "Malware payload", "value": "d1f9002c3c86451f7c54f806ea55ac46e8866475", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037493, "uuid": "2eb4fabc-d13d-4bcf-8b63-a0b0252b4d79", "comment": "Malware payload", "value": "bd71da1e3f153322758fde9e71ed53704e5c4c57fe225bc273b73f3aec0cd111821b4cdf16606192d1d6fa6331b10ea3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037493, "uuid": "d7d0fa61-c3d6-4cfb-8db0-1b62cd88c93c", "value": "T1E496C0AB6DEC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AF649AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037493, "uuid": "f2cb46e4-5a39-48dc-b13b-45afb4f7fcc0", "value": "6144:vubnYpscW3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfEbwpNiVwS0msFJvXiESUWjt:qPkXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037493, "uuid": "09d6d485-ec0c-46e5-a548-82e99c3dc6ef", "value": 9363483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037493, "uuid": "b782047c-cef9-4194-8e83-7896ec1c192a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037493, "uuid": "602ba4bb-70f6-466c-946b-0d2b6b89e0f7", "value": "Update_10.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e09bc3-5b73-11f1-a769-42010a9c0008", "comment": "Malware payload (Xtrat)", "timestamp": 1780068760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068760, "uuid": "ac38d656-d2c4-45d0-a427-8263acffc1c8", "comment": "Malware payload (Xtrat)", "value": "0d9ddbea1760ed3deb58a174a576acdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068760, "uuid": "e2e28211-31d1-47b3-b301-a97abd449579", "comment": "Malware payload (Xtrat)", "value": "af8500a2fc2b2b5649cfec5ac941f5607509ed951236f915c1609fbf34891428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068760, "uuid": "62a636b2-203d-4ecb-90db-fff7c7a91eaa", "comment": "Malware payload (Xtrat)", "value": "5e07a9680efdbb2383845db4ed3e0e1f0002c34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068760, "uuid": "18f2c303-808e-4c15-9c74-7c4e7bfc5f96", "comment": "Malware payload (Xtrat)", "value": "9c494c769370d12539d90a745893a78d4b150761af98f1811e205917f982973885347369b113ab393c0f7f481f324b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068760, "uuid": "8ce4e24b-4272-4a08-97a8-1657dfeb96dc", "value": "T1A2132A12A7FC4972E0225FBC4D4D8265F02B38311E73E45AF5AA1E0E49793D23A1DB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068760, "uuid": "890ac48d-5f91-4b68-b344-49b389a1c79a", "value": "2043b2d5739b8130f603669f6c5b5944", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068760, "uuid": "e21081eb-bb43-4369-b281-90de69f7ca92", "value": "768:jE9hghdN12Ozhiow2Gkm6+c3//UxC9PIzoB:ju+zMOlw2GkmS3TYoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780068760, "uuid": "aeb47b8d-7dcd-4d95-8037-c2508cfd4168", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780068760, "uuid": "3b3414a5-62eb-470b-98d6-c0bd6c7c2523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068760, "uuid": "76231e04-9287-49dc-9125-38e4812af37f", "value": "eastvillageeaterys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52e6c0a-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038702, "uuid": "56b8ab94-dffa-4d3d-ac63-7e3fc9dc5d09", "comment": "Malware payload (Mirai)", "value": "0262922a1102cf55ff856d6fa1205258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038702, "uuid": "f41d59f2-b44d-45e3-a979-c203f93d694f", "comment": "Malware payload (Mirai)", "value": "b05968cdb8279c7ac74ec23b0e16fda6f1e85af533caf0a008817e03d2f3def4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038702, "uuid": "504a4354-842f-4a83-8980-bae0c3ad0c55", "comment": "Malware payload (Mirai)", "value": "5e62fd0f6e3274ae2c84e0407e8a7381d921f698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038702, "uuid": "3417bcbb-2095-46ca-b6e1-ca2eff34e13d", "comment": "Malware payload (Mirai)", "value": "b245fc2dc6d5908fbbc3d88d0a13167f5a84a33a27561f6ff3850c0a19f615f434e15164f79499d25b41925097b09884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038702, "uuid": "227e43dc-8fe2-4866-b891-41056791541d", "value": "T1FA733B56FC814A23C6C1127BF76E468D3B2653E8E2EA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038702, "uuid": "f5dc877f-6417-4b8a-a9bd-ccae3d68db5e", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vN/:uB/VBBpCO72RDRZN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038702, "uuid": "6722f7c2-65eb-4120-8564-30d4ae394c18", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038702, "uuid": "b9aada2c-8132-4bac-8a72-b4c1545cf9bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038702, "uuid": "4262bb18-36f9-4ce5-b814-784b056f999d", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed234c4c-5b15-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780028515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028515, "uuid": "2b86b2e9-a3a7-4bad-81b2-7a59897bc2c9", "comment": "Malware payload (SalatStealer)", "value": "9c32bfa539718f099aa3c49baa1a8389", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028515, "uuid": "9e483a59-195c-4ed8-b71c-518f177a4994", "comment": "Malware payload (SalatStealer)", "value": "b07d5dcd0cb2b95480328ff64456f811d917763b53f0e3403969093383a90014", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028515, "uuid": "241ad27f-eda2-49b9-a207-06445ce91b22", "comment": "Malware payload (SalatStealer)", "value": "38f7bc971c26a06f8663bd4c3e372f2702895279", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028515, "uuid": "4bb6c687-0821-481d-957a-4acb8f6b1afd", "comment": "Malware payload (SalatStealer)", "value": "d17e42ed53dd018390f52a8f121a0cd68a5228a897ca608269971f137ab14e56c762831c4ebd1605cd5dc81c645291b1", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028515, "uuid": "b90edef0-6b53-4c3e-9790-f4e71b21acac", "value": "T1ABF533920778D608EAEB0F749923E19F087983D020EF3D5E1CDA94264772AF63E75C65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028515, "uuid": "8c872e04-a765-48ff-a71d-c8093d1bce3f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028515, "uuid": "acb6a678-d31e-49a9-8041-09b80a2a5a59", "value": "49152:ZK4IN5+8b5rTVemRI36Sf7YSIXRSvOL/YS+yqUyZHhpBB3bUz5fZnK5q0FTirmR:tXyqnjmXRAcYtL/B90fZWq0FTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780028515, "uuid": "a748e01f-e8af-42e1-9a57-d9efbdcdbb91", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780028515, "uuid": "7233db83-1ca4-49ec-b7de-64e7a5d0983c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028515, "uuid": "f0dfeaeb-aa5c-4ec3-83a3-7e18bc55dbd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace57a75-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016811, "uuid": "6e9ab887-d073-483d-9343-662b03dce076", "comment": "Malware payload (Mirai)", "value": "72f725a3fd019125e03c78fd39a20458", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016811, "uuid": "ed4ac3be-58c7-4adc-917d-71ebfea7a2ee", "comment": "Malware payload (Mirai)", "value": "b0e49ab3833200dc2b677e000ffe0dd0deda363079479fab142b4c2a6f9b3179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016811, "uuid": "73cd31d0-da2d-4467-8f1a-36500095e9f0", "comment": "Malware payload (Mirai)", "value": "5b226d76bf9c09e89c16c45ab3826294658a8cc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016811, "uuid": "f3187890-72d2-4ba9-a1cb-ce0d3fa8db2c", "comment": "Malware payload (Mirai)", "value": "e3289602c7fe3d26c95dfda49bd2ad811137444b819eef954b3c4f3f33c023953fa238efc81cbdd5dd52a3a9ec895421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016811, "uuid": "9e24abc0-28fc-4b73-94de-838eb0f8d43c", "value": "T1B6F3E80E7E215F7CFBE8823457B39E64A34823972AE1D585D16CD6105E7028E386FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016811, "uuid": "a5e8777b-d493-4956-aa5f-4046c1296a0c", "value": "3072:LdmSChNff9brg0153pZBjw0DKEfD9QlLB+yB1i27WJGGCDigbmdi:LENrrJ153p3jw0DPfyl8ai27knWydi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016811, "uuid": "ac7e02f7-6f7d-463b-aa69-c01eb4b60291", "value": 168136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016811, "uuid": "d47fd381-c805-40b1-92d3-12fe2c5eb4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016811, "uuid": "196b23d6-535f-4b9c-85e2-2d75783d7d0e", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203ecb89-5b72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780068115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068115, "uuid": "560e14e5-fb75-4235-86a9-9237ba18bb16", "comment": "Malware payload (Mirai)", "value": "845236f14029661d85fa8abe96ef5bb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068115, "uuid": "5ef6a4ae-2b77-4305-a355-12f4ff3f2786", "comment": "Malware payload (Mirai)", "value": "b1cb5667b8f244d7c4f2451d2b7a5698f48a412ed7e5b9650e8c607e51160dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068115, "uuid": "1ce00568-4986-4eef-a3c1-60e0dcf25d61", "comment": "Malware payload (Mirai)", "value": "7cb360b4ba98b8a0e70d9465b9cb3ba685db8770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068115, "uuid": "32325c3a-dc01-492f-94f6-e9b0ce494e64", "comment": "Malware payload (Mirai)", "value": "5e408ecefd37298c90ac32aeedcd6113374e5a010a1750be9016d1cbc3fb92cd80426480efcd09722f902b79e231a2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068115, "uuid": "8ad352f8-4857-410f-8e66-de6fe1a1d029", "value": "T1DBF318C7F900D9BAF809E7378853080AB130B7A104926B776257357FED7E198147BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068115, "uuid": "803b55c5-71f2-4f5c-a615-c3e2f5daf7b4", "value": "3072:1+B1LnuN3lttftyxAduuEJCtUvotFWew7GVfjbizLyko1JGO5:UbavtLyxEuuEJEUkzw7ZLFfO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780068115, "uuid": "a7996f94-f36d-480f-8dd2-793e08836020", "value": 161656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780068115, "uuid": "3a2dc6f2-1b26-460b-beb9-244ce7b84b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068115, "uuid": "79d82af7-e305-41c2-aeca-2f49bb9d2d6b", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01378be6-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058614, "uuid": "f6094c94-cba2-4bb6-b194-a75d0442554e", "comment": "Malware payload (Phorpiex)", "value": "fa46278c9a91586550930b7c7130672b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058614, "uuid": "d4bae90c-068f-4977-bd4a-5e0f4ec8b240", "comment": "Malware payload (Phorpiex)", "value": "b221a625be886002e3a18c1302bf5a564d45b706eac539d9d04494cffbedbd95", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058614, "uuid": "1e36cb54-8e60-487a-8c14-08808a679947", "comment": "Malware payload (Phorpiex)", "value": "10cfca9a968a4ec3c51c8ca66f8b506d5a3b21a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058614, "uuid": "db100a4e-760c-4c6c-b0d8-bd4b68491d09", "comment": "Malware payload (Phorpiex)", "value": "2bc5f50948ce795a2150763194d2c66bf068c03befae8d602f62b3ce4929361c2d851ea5969e277e24327b747945c23f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058614, "uuid": "e28b6323-0415-488f-8023-934bd512b3d0", "value": "T1A5823A0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058614, "uuid": "8b32ddb5-6fe1-4583-9915-b62dd3ddaf41", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058614, "uuid": "6a2cf3f8-8ce6-4e11-ab8d-06940dd937f4", "value": "192:SIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJW:EIblVP4Y/2N0bLu9JgPL7Nyav8U9ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058614, "uuid": "a489f49a-651d-46e1-ab82-e1c0365a9565", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058614, "uuid": "544a1422-fe02-4d56-9e10-754016f98e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058614, "uuid": "91483972-f701-408f-a1ca-7f0c4daa433e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00faaedd-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037568, "uuid": "16584356-f37f-4ed0-ae9a-3ba6fb26b87f", "comment": "Malware payload", "value": "95336f12b52b48d3b66e861966d5c400", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037568, "uuid": "83d488df-6a84-4a5b-a930-9a8ab26f0ceb", "comment": "Malware payload", "value": "b23bb560a20c587c6888813fc06a53d4eac46af78a3813fdeefa6b6667176024", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037568, "uuid": "faad6695-6d66-46c8-9aea-6ed898dda68c", "comment": "Malware payload", "value": "46168352a0f0d24d4f5ecd75bddb8354dfc83642", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037568, "uuid": "ba0b33a8-06d5-4716-9705-bbf76a55fa33", "comment": "Malware payload", "value": "f375d6ab772c364216175c49b54dd9127bcb7f1894565d52afd6d8c0bfddb01945e3f016f01de66d2a408720883a1d2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037568, "uuid": "50d9bf94-a744-4c76-b0a8-3f3faecdf7bb", "value": "T1E186DDAB6DDC361E3010B1C6F48521F5E6621336DBDE12D9B8F928337AF649AC02D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037568, "uuid": "69097618-4b57-4b8e-a82e-88395483247b", "value": "6144:yubnYpscr3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsy9wpNzVwS0msFJvXiESUW9:KPLe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037568, "uuid": "7ed9eb23-a064-4cc7-a7da-aa870fa75ac4", "value": 8416260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037568, "uuid": "9c15a013-28c1-4c97-9f89-895aafb22f2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037568, "uuid": "915f3656-b237-47f6-8635-1541b6861375", "value": "Update_19.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd82dcf4-5b8c-11f1-a769-42010a9c0008", "comment": "Malware payload (LimeRAT)", "timestamp": 1780079572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780079572, "uuid": "707bb945-e253-4191-95f9-41184711ec08", "comment": "Malware payload (LimeRAT)", "value": "4013d87a47cb55caacfb433c42f1fac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780079572, "uuid": "27840a0b-83c5-406b-95f0-5ee44178071f", "comment": "Malware payload (LimeRAT)", "value": "b29cf2fc83f2c5871baf6d54b9593dec38a09208818482ec5f94947745ca7f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780079572, "uuid": "7db76765-a9cb-43ea-9246-a33bbc61b9e2", "comment": "Malware payload (LimeRAT)", "value": "e7c80bc35746813ab99c8419ee466ea505400777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780079572, "uuid": "b91b50d7-1f8f-4dd7-80d9-3da070613e5b", "comment": "Malware payload (LimeRAT)", "value": "dd7e44722012cd4abeb7720948803eda960c4cbada5e8a95b062e8d072d287ba0e69deade97e895740a18595093a2d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780079572, "uuid": "2c78ea6a-5c7a-47b0-8462-2b5dec7824a9", "value": "T16DD25C043BE1935CC2ED49B94BA2755E0E715A0B4A37DB1D0DC898971A67BC94F80BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780079572, "uuid": "17b14804-b9f0-49c8-a6b5-424aec2a277d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780079572, "uuid": "83fa31c5-8cbc-4079-86db-c7704153e108", "value": "768:Yty4UixJE1HJkk5NnvGuc0Ew4AxmF15AY:YfUixJcJnzvG6WAx6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780079572, "uuid": "4a1318ad-8155-44c5-b3ab-c2e6bdcc553d", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780079572, "uuid": "e2bb42a7-54c8-4936-aa79-27f961e310f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780079572, "uuid": "76539f8c-d840-4e69-ad45-a4e730da1967", "value": "detail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a93548-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780047016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047016, "uuid": "50a9438f-67a8-4cdf-af2f-7018c09c33fb", "comment": "Malware payload (LummaStealer)", "value": "07b72cca0d888c1082d72b4173e86e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047016, "uuid": "404bd153-3956-457b-8610-35d9f87737bd", "comment": "Malware payload (LummaStealer)", "value": "b3ffa06a189a3454d74ee20e24d7c6a4c49673c360d9fc7cc0423e263f0fcbf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047016, "uuid": "86c990a0-6a7a-4237-beab-4bec5fd15bf0", "comment": "Malware payload (LummaStealer)", "value": "ac723e7652d514f74299b61ee38aec09050c373d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047016, "uuid": "a405ff15-7b68-490f-90a1-02e0fb39ea74", "comment": "Malware payload (LummaStealer)", "value": "f7f1032c8be7bc033c3c5768fc06c8218a570318748d6ae368560123b25df89f4a3b22b17edd1a566d89be69c72ef1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047016, "uuid": "5e3424cc-7a06-4ebb-b7f4-872a0072ccbe", "value": "T157D58C51FD8709B2E506233249E762AB6738AD054F329B9BEA44777EE9732C50C33346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047016, "uuid": "64858fbb-cba7-41e2-b033-626b638e530b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047016, "uuid": "9e83106f-f0be-493e-ba4f-3aa6b2312b72", "value": "24576:ngFVlPGgCg/Lo9oWlbllm5rbD70RypFp0GG+B57WsKZKdk9a90NtDGqLb5WLCK3a:noVjWbleKkkZfySb5B4FgG8bsOoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047016, "uuid": "7f1e37d7-7b1b-41d9-aea8-54ce9a17f29e", "value": 2944978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047016, "uuid": "2d9311c3-6985-40ec-8a0d-30e5e872e947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047016, "uuid": "47958b23-6379-4ac6-b995-5e2fd56193b7", "value": "SecuriteInfo.com.Win32.MalwareX-gen.12515945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c47437c-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037640, "uuid": "de2d9195-b7b7-414e-926a-c2d8197a874f", "comment": "Malware payload", "value": "4b5c0fa791819de7b47f728601104ae1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037640, "uuid": "a490bd17-bd16-49e0-b861-081376faaa27", "comment": "Malware payload", "value": "b4d2dda66b99ed120f83232168035aa60ca72ff58dd05201b14f8189b82d6236", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037640, "uuid": "98a57b03-3e90-487e-9185-93f68eb88205", "comment": "Malware payload", "value": "735b92f1803f975758bb61e51b1b747646d8e136", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037640, "uuid": "51053fcf-42b5-4e47-b2d2-59e29cf8b320", "comment": "Malware payload", "value": "0acf0df5d066af5d30e99c8da5ff5a3a4fc5614dbd62f58fb0a2f0da2d3dc3c3647149ead88f1a4c4910170f161fe242", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037640, "uuid": "298c2c51-ec3b-49de-8286-76b2d53ba859", "value": "T129A6CFAB6DEC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AF649AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037640, "uuid": "b649c3d8-5232-4106-8259-06f34662fda5", "value": "6144:4ubnYpscZ3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsMwpNAVwS0msFJvXiESUWjf:WPDT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037640, "uuid": "b4b2f165-7356-40af-b91e-e1f06c0bbaca", "value": 9527277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037640, "uuid": "6c0549b1-c394-4aa4-8c8f-8c2817b92e7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037640, "uuid": "aeebad4e-62cc-4984-9b59-8eb38a2fd7e9", "value": "Update_21.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50be82e7-5b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780056170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056170, "uuid": "8277f7ea-f245-4974-9a67-b5cccd845062", "comment": "Malware payload", "value": "330f841c8c69c6fb5c046d65c066def1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056170, "uuid": "6993806d-8dee-4310-8318-8c9155284444", "comment": "Malware payload", "value": "b4fbd27b262a642624bb4772f9c44dd6f4b43806b4f5d7d1d5569f142fbf7c46", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056170, "uuid": "2c229ed5-e3c8-48ec-b7ab-2abe047c2fae", "comment": "Malware payload", "value": "48be40b83c7715c9df09fed8be54addaa71deebd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056170, "uuid": "9e98ce54-6903-46a8-b495-7c9c69ac8803", "comment": "Malware payload", "value": "174bdb686474a86b7f44ee8eb7a87654f84411c91344efa84eb0ff54d80904c0959ab71c67b3997972c90c9cc5db4da6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056170, "uuid": "a040f4ce-3630-4dcc-9c6f-64cce2bec363", "value": "T1043533CEA98B56E5187FB22973E2227FA4CDE3B89750D2857D083D08D74A7DF5C1204A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056170, "uuid": "d9fb120b-d62d-4819-a033-4d7cbcb825df", "value": "24576:z2Curr53wUQ8IFg9mTHQ+u//p7YScvn8k1Kyp:6Qb+9eQzR7ikk17p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056170, "uuid": "47862dc1-c5f5-4692-9207-9ed4f8eb9748", "value": 1060601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056170, "uuid": "e72069da-ee25-40e1-8ffc-accfea2e72fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056170, "uuid": "55ae873b-5967-4a30-820b-eb20c90bdfa7", "value": "stealer_upload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac92bec-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037584, "uuid": "83e00dd8-e413-4b03-9c26-43ecc70c776a", "comment": "Malware payload", "value": "9725d639c0e225435acdc93066c3be9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037584, "uuid": "dd88865d-2ed8-40d2-9e18-ff0cde99c9d8", "comment": "Malware payload", "value": "b53d6a322a6e3c935e10e363df1b18b7a911e944e4648c6b1e9abf2d703e918f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037584, "uuid": "566674e3-f1c9-4cc7-a153-95168846df53", "comment": "Malware payload", "value": "3ee479a334409f948c69ff4c5be98dbe96754a11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037584, "uuid": "9d87e7c7-675a-4582-a91a-ed6172fc6e44", "comment": "Malware payload", "value": "b1d6fa2a1208ca9af214d01366ca010f9e18ee5949cd73fa3d5564f28693b44423964ae1e6f344832ea50e06b6f2e5c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037584, "uuid": "0b645f9b-5b27-49d9-930f-7fa6982eeba6", "value": "T10996DFAB6DDC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037584, "uuid": "e0a45505-198d-4636-bfd2-e804a9e4cc5c", "value": "6144:gubnYpscg3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfs4wpNPVwS0msFJvXiESUWjS:fPnj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037584, "uuid": "51a6ec4e-4780-4451-8ca1-5e6f4e6f8ea1", "value": 9169520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037584, "uuid": "e8fc4545-2794-437e-80f9-35da2fbb8eb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037584, "uuid": "ab94fd3c-a132-4f9a-bf34-168dd8ea080f", "value": "Update_5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbec714-5b42-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780047605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047605, "uuid": "375e0c94-fac3-4991-bd0f-bb185e35e353", "comment": "Malware payload (NanoCore)", "value": "d365a73d1b73fd74ddabb87c8ab135ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047605, "uuid": "faa0b019-573a-4975-bc0f-c8253617603e", "comment": "Malware payload (NanoCore)", "value": "b5bbf49baec35490f473b8ab0b2933f1479fda2625fb30a4892455368bb1b499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047605, "uuid": "02e3047a-7811-4632-afc0-38ce1a64d072", "comment": "Malware payload (NanoCore)", "value": "21da20b07de4d68d08e763ed5ed17b9c15036997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047605, "uuid": "c8cd13d2-eb0a-4519-9fb3-0af013890dd0", "comment": "Malware payload (NanoCore)", "value": "40ef233e8493c25a8c93d3ef052cbd54249c58293f42edb1376d32ac75c731beda3eb1db30ed6b707f3af44473d33bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047605, "uuid": "67694598-0f23-4f5a-b8fc-57f65d73ca9f", "value": "T1DC14CF6537E8492EE3DE8678701242028379C2E398D3F3EE28D461B69F667E44A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047605, "uuid": "24c13e3a-9baf-48e8-bd58-026f4f632a0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047605, "uuid": "29ac9404-8d7e-4441-a172-43e58a143e1d", "value": "6144:sLV6Bta6dtJmakIM5v6fA+eXcTTacsRy3Cj+M:sLV6BtpmkyuA+eXsaDCU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047605, "uuid": "89ceb001-0814-4188-9d58-91c8145a6d40", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047605, "uuid": "14cfe202-805a-4cc5-baec-a9305240b9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047605, "uuid": "c8da1adf-174b-484c-a6d8-76196c942b9e", "value": "nega.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68a610b-5b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780035805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035805, "uuid": "7e91834a-8bb1-45ef-ac39-c774954182b6", "comment": "Malware payload", "value": "e8c30e962070c325004f80b3c4fc3546", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035805, "uuid": "38b877ef-e4da-4014-86a7-69a941daa6c9", "comment": "Malware payload", "value": "b62dc83e91db6431a0937c7b3835dc38cc475c7f9d7c2ecf877d73c2ec9320be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035805, "uuid": "60477fc1-9aac-4b7d-8ae5-7a3d2191ffc0", "comment": "Malware payload", "value": "23ffaff69a3cd4412b263587df7f10227baea845", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035805, "uuid": "b846e555-b850-4c69-a0ca-8525bc392a7c", "comment": "Malware payload", "value": "bec2b3e9407251bf0a9b56deccfc2c3dfcd2699ca8d25c61d44307fca4d59ad96d88157feecc25181e9d8a9a5186cbc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035805, "uuid": "5c05db4f-cf29-4f20-992d-060deb961b50", "value": "T1B80199EF343234721F5385E65C1391534D76C33F5BD05DA878E56B3409AE020633022E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035805, "uuid": "db1f371c-34c9-45ad-909f-88b97a0d3e87", "value": "12:SCny997dG3BCFr+Bnx8jiFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:7QxdGxCFnm1EDlgNjTidGXhGIBFVR98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780035805, "uuid": "fe86f2b1-b141-4e06-ab79-0cbc46dd446a", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780035805, "uuid": "a2ebc354-1227-472d-9f65-506ce9d6e8bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035805, "uuid": "e82c6d5c-aa67-47ed-8c79-7a522ef1b877", "value": "loader (3).sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5e1ecc-5b03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780020706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020706, "uuid": "48047908-10dd-4d0d-849d-77105c80ccce", "comment": "Malware payload (Mirai)", "value": "71447310de35f0f94e5abfa0d6a8a4b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020706, "uuid": "ea0c7aac-0315-4266-94dd-f56ce5577a3f", "comment": "Malware payload (Mirai)", "value": "b674f05abd17be787aded551bd3bb8c610797863897cc447ff8f940dc68abb84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020706, "uuid": "966bb35a-1bd1-47cf-b5c7-6ed3f932f1f3", "comment": "Malware payload (Mirai)", "value": "afcc748039086884541ee390c312a3bf81a1ff10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020706, "uuid": "f40cc26c-053d-4f48-a262-727319ad1c3b", "comment": "Malware payload (Mirai)", "value": "7cf9abbbc1d9a2bf94425d40aba35904b0a9a312ae1b7bc5fb9ce6fb974b7a76148c0547e15b7e839922fab4e1558cac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020706, "uuid": "b305639f-902e-4894-b8d8-09ee8967b20f", "value": "T1A4D3AE9BB34F2450C82506F41BC75BAD3A2325018D6B96F63C6E363E6B379DE68063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020706, "uuid": "0707be61-fbb4-4ad9-a0d9-1c963676d9f6", "value": "3072:M6qttxRDJmpwoRg5Rh4io3eOlOTAcgoCzITAmPFq:TqJbzouh43dIA6CzITVdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020706, "uuid": "a61ac579-0cc9-4f6e-a539-e1c3ca289a87", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020706, "uuid": "18f33fc6-d8d9-4780-8a33-79498cd3ee7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020706, "uuid": "05f87ec4-e0b9-4614-9339-f6dce209dc90", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edcfa33-5b99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780084970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084970, "uuid": "83971282-725a-4be2-b712-854d3de9af28", "comment": "Malware payload", "value": "d17b84492bebcc249cd36e612e18432b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084970, "uuid": "6b205a05-24c3-44bf-b8f3-c73631b7ceb1", "comment": "Malware payload", "value": "b6ada6b76b7fbe8bf4c524bfbab2343a075daae2fbe9758b37cc3c63b578c66b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084970, "uuid": "abe8f44b-32f6-4b57-9eec-8640334e0fdc", "comment": "Malware payload", "value": "f2efe24534e4dbe2103e5b5c4543f078c77b8a38", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084970, "uuid": "ed0ace93-6015-4a21-9055-72c4d604bd9c", "comment": "Malware payload", "value": "2a3ea97414e927d795b023ee51ec018e197e64f96aaff7069260dc04dd400a9f04d759fade3b841d72a8b435a2b1afa9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084970, "uuid": "c172c0fb-b863-49b4-a7ff-3bb4e56a7e71", "value": "T1B647334E7C026F1961B2E06B5E8DE5583CFA027FAEC17F0231A6B547DEC05C6B12946B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084970, "uuid": "3ec73a2f-e6cc-49f3-b857-b575716142bc", "value": "786432:aoJ2MCABSIJm7J55qACuhW3D9/ACN5xiiCbM:a5Fh5qhuE3pACN5xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084970, "uuid": "c6d6903f-334a-4168-803e-8e682f091a31", "value": 27030939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084970, "uuid": "3deee0d8-250b-4d8f-804d-dccaa9473c65", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084970, "uuid": "a3ef2254-a569-44b6-85b6-599c39cb78d4", "value": "2026 Ohmycream Skin Wellness Campaign.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a940562-5b5d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780059300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059300, "uuid": "82be5f04-b3b4-4b9a-acf5-5503b95d636d", "comment": "Malware payload", "value": "07610274a4cae72b5a37514621e7ce0e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059300, "uuid": "f48f2a4a-10ff-4b26-b08f-b73aae650216", "comment": "Malware payload", "value": "b6be096ff404b726dcc090a2bc462841afd712ec9b3c745aab24a95f943a2a03", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059300, "uuid": "9e32f9d0-96d3-41f5-bdba-dea1c944a505", "comment": "Malware payload", "value": "ea92ddd47a31d81d5769cdb0ec6b466b929f2229", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059300, "uuid": "4b1ac6b6-316a-4e2a-ae1d-e8a503e6f626", "comment": "Malware payload", "value": "3f2118bc7a6e269659ad8a08b5c5eb75f579f1b7565ebf1b838d998efbc6caa7731cd5bcabd8c82ca830d1894e565e72", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059300, "uuid": "547a9312-e995-4e15-a228-1d29644e9412", "value": "T146413B76C225AD07C437A4B33192958D2BDA02E2E1AB246D04DD270EDE617F4D85D4B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059300, "uuid": "be211222-7f29-4885-b954-5241ea37ae2c", "value": "48:91+E7GT3LOHzH9Hxy//kdb7K7qJ6g+MYdZ2Km9TBUM:bpHzTy/QKmJ6g+MYdZ2Kmz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059300, "uuid": "8055a2a5-e609-4838-831b-3820117f58ed", "value": 1881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059300, "uuid": "35b8e699-703a-458f-8761-6e89fa58a29f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059300, "uuid": "e8ce4ac3-fba3-4d77-840c-868609935522", "value": "Autenticao-EI6L5W.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cea718-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780036428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036428, "uuid": "08530f6d-12e4-4248-8e31-16be8a3356fe", "comment": "Malware payload", "value": "fc19fd8691abc10d57b26d0c588d82d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036428, "uuid": "046bc726-d78e-409d-b3f0-e58846f01acc", "comment": "Malware payload", "value": "b6eec6603c9ab5b34ea281c1e36021536f203d3670f7cfa26897058d5835bdc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036428, "uuid": "b2260a59-bd44-425e-a085-4f9e16fba7a2", "comment": "Malware payload", "value": "e3c9a7e6c8a6ccfe2c3647d011726e2da18d1e0b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036428, "uuid": "0f199466-e020-4bb1-b0ff-157b825ec812", "comment": "Malware payload", "value": "688a4f7457c871242d69792b7048ca3a639dd0fae57c738808014d4c74d3fe68c410a203c7c733f666a1c92870296f7d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036428, "uuid": "7ddac021-0708-43d2-9b57-ececd9ed72c2", "value": "T1D8137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036428, "uuid": "dbc695d5-c9f8-4271-ab39-845ca161f5ec", "value": "768:8+19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:8+mcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036428, "uuid": "63785aed-f118-4858-9e97-4f2272a38637", "value": 45498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036428, "uuid": "9c816758-91bf-4c57-8abd-9f1667e2764b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036428, "uuid": "b920fd4a-6e70-48da-b516-c4e0d84c75a0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679123c6-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038599, "uuid": "390d24e6-fc0f-476a-b1a8-c23cbf74ea62", "comment": "Malware payload (Mirai)", "value": "b66c1bf6387adc5507760ef6d4e5056c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038599, "uuid": "4eecbeb5-eb2d-4175-b552-c5066782169c", "comment": "Malware payload (Mirai)", "value": "b82dbe6ed452a59ea7a7f7cf61e61d3815a3707580a5bbd7d5c3be3176161c63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038599, "uuid": "c1fdea34-985b-4715-a72c-0107432bceff", "comment": "Malware payload (Mirai)", "value": "1269a328b1745d0852819530876333b9a97e8573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038599, "uuid": "b7967d48-6d5f-454b-9d3f-183ce951b071", "comment": "Malware payload (Mirai)", "value": "d37046eb99cb3ee2f243b9a0ff071cfaccfb3167572827d219681e38894a76e7d36ef8133a51b8d8eaa8167c955aafa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038599, "uuid": "a4385288-af16-47c8-984d-7c1aab816f15", "value": "T139B3AEEBF64715A2C85243F013C79F8E3E2323909E57A4E76D1E267B15760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038599, "uuid": "79d9285a-a07c-4503-b9d0-1fec59afabc5", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJy/LWW:6fIw3e8ZE3MYlphDgJyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038599, "uuid": "88688785-035f-4b60-a25e-973f72ebb45a", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038599, "uuid": "eb024534-1b37-47e0-afe2-70e81fd0400f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038599, "uuid": "bc30803e-1254-4e79-99b9-3fae86f5f698", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fca8fa-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048666, "uuid": "2dc766ec-cd1a-46ad-bf31-6a59ed13d2e3", "comment": "Malware payload (Mirai)", "value": "54851395c96df5c1ad9e7842887b3e70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048666, "uuid": "7d83e131-5335-4cf3-ac35-dd39afd274d6", "comment": "Malware payload (Mirai)", "value": "b8f02f48c4b50a142d6fd9aa180a48e2208285769cbdbbf5399348bd77a9ee5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048666, "uuid": "1a39dab6-1353-41f0-a5e0-8ef38bfcbbab", "comment": "Malware payload (Mirai)", "value": "030e6f235b8486a57d98aab3f0419455586a0707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048666, "uuid": "effd585e-3a37-43d3-bcd0-5851d7f07603", "comment": "Malware payload (Mirai)", "value": "47012ac7ed5ba5155056e113246d7be743d974d78c25d431ffa171220efb011803f4a3dc384fade93ad048b3cfc1c432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048666, "uuid": "f01fd394-dcd3-4897-96e5-896a850c6506", "value": "T1C1334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048666, "uuid": "ab71f66d-fc93-4afd-b7fe-3e0d7ddb42d2", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwN:ivW3jdQGqt7Y+Z+zN9cGgI6bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048666, "uuid": "544ba633-957c-4f29-b0fe-648e8ac4a2c7", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048666, "uuid": "ef58558b-747c-4216-9d86-0a00bc775581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048666, "uuid": "9cd43a23-5f5b-4431-a9b6-42b996fbc921", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001c51b2-5b6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780065484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065484, "uuid": "297d4da6-dc72-4e77-8585-a0d2d4fd01f9", "comment": "Malware payload", "value": "9e54da9c8788c1525cce8ce77686df14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065484, "uuid": "3300a85d-c29e-48c1-b345-16753a65af28", "comment": "Malware payload", "value": "ba5bdf352cc59a453b73291fb4cd0c421c5948c1fb673eed47abce38c03b85e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065484, "uuid": "ea6dd4dd-0d1d-4e73-be00-c5adf3c8f582", "comment": "Malware payload", "value": "097a057d6802868ad401ba75bfecc2914699a86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780065484, "uuid": "3e1a5a79-ea88-4f32-b078-ef4449b01a58", "comment": "Malware payload", "value": "5c0edce6cc6d8dcdc426929a67aac7a7335ae300c57248f187df915d4aff04d95dc3575f04749d12d9c5a110235d8a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065484, "uuid": "a8610c22-22bf-4f04-a56b-7525f6dd36ab", "value": "T10A357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065484, "uuid": "7dd3e8ac-c677-4601-bf4f-8b49b245eee0", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065484, "uuid": "e0789baf-d6a6-42b8-a801-b21bb3eb01c0", "value": "12288:AZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwG7vPqItNquB:Acb4M06WpoPrwEvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780065484, "uuid": "3d6cf6d9-6fac-4b14-b183-ed9e88f493f3", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780065484, "uuid": "a6a932ab-b07e-427b-8545-b6f080467ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780065484, "uuid": "7c0c55fa-dfed-473e-9e36-3275e9e1de5e", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db90d9fe-5b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780035787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035787, "uuid": "0015530a-41bb-4630-b913-049ad9fd0194", "comment": "Malware payload", "value": "4ee404d9d0e692d3830b2ec1f43e8b13", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035787, "uuid": "88ef9c14-138f-430e-a493-5020df2745c1", "comment": "Malware payload", "value": "bac16d1f3c80f84dbc7076b7d015cf3fdc2141b9ac776ee45dd4543188d4b3d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035787, "uuid": "63e3c4d6-a4bc-42e8-8abc-ebc3703a195f", "comment": "Malware payload", "value": "12f6d0bfc9e7cdb2403fede55a6d2dfe339b76f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035787, "uuid": "72a14621-348e-4e20-b73d-89f101d61639", "comment": "Malware payload", "value": "59b932eafa9f1fa7f9dd2eb351364a495909a1ccdf0616165f16a3912406f3aed5bf60788c9c93fd61bcac5bd4c4fe2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035787, "uuid": "8d4d662c-accb-4051-93c9-35247a002f91", "value": "T16A21FBAE8022BD199841111028159C10DB41D6F0CC9AEE5DB420B3DE45F83BA853FDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035787, "uuid": "f9321107-baa8-490c-a7e3-10fb56b2ea89", "value": "24:olbrtOWSfPzDI+VSjm8HL1TEKuflnijQ1SgDbR+QnSh3R6iTpkiJJ3WUz0LqAvBi:QEWclSj5r1Tmfl8QHDbpSlw6kAJ3WU0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780035787, "uuid": "d35092fb-fe13-4022-8040-0f8f1328c008", "value": 1349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780035787, "uuid": "6ddbd5fb-d463-4b0e-a8f0-ade8aa97b58e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035787, "uuid": "e1a5ab5f-02ce-427b-b342-de38794bd192", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78318a1f-5b56-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780056236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056236, "uuid": "a45ad2a9-6721-4864-899b-dd56852045fc", "comment": "Malware payload (Phorpiex)", "value": "7c485999f498dca74db475c3e26bf534", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056236, "uuid": "07a18d4b-b156-4be5-83eb-a01e54bde36a", "comment": "Malware payload (Phorpiex)", "value": "bb0a84401c30c261c5e4d2f28b8e9ccea9742c586c254c10625c50a57000eb49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056236, "uuid": "d81f9392-3411-4b89-9ef1-335188992845", "comment": "Malware payload (Phorpiex)", "value": "1d65c002145a12c72e34b01fc3afb34703af7575", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056236, "uuid": "591ac72e-5fbe-4fae-8fb5-926afc781274", "comment": "Malware payload (Phorpiex)", "value": "3805344b8be44e83efe3d95a7e920d80d78c35c57b7383731165bc7b2c1a30fef9a88559c7a482ca0d2594b79b65e37a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056236, "uuid": "e741de3c-ab65-4dbf-a2ef-173e208a229b", "value": "T1DA824B0FF9418216D1E210B452B5867BD9799C72338458DBF7D08A9D0BA86E6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056236, "uuid": "0e0a2ba1-a8df-4b0e-8952-e620c93e7b03", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056236, "uuid": "53cff0bc-c359-410d-852c-b8a31fa9f43c", "value": "192:DIISCngTBvblVPT0Y76fI5qaNleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJE:FIblVP4YAaN0bLu9JgPL7Nyav8U9cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056236, "uuid": "6c2f643f-71c6-4bfb-8021-81f478a6f4bf", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056236, "uuid": "2dd120d5-2695-4204-8eb9-01e3f6d1315e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056236, "uuid": "0ee5d43d-d4e2-48e4-b602-d32ae6146273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f9bc10-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056682, "uuid": "cf95da5b-4e44-449a-bed5-505bbb1b76a9", "comment": "Malware payload (BlackMatter)", "value": "47f6f28de47358645aa7ef0d00b89f30", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056682, "uuid": "ab0120fe-107c-4752-92a3-b10ed9dbd405", "comment": "Malware payload (BlackMatter)", "value": "bc93fb67cf4dba8c35e91b551ca3190db25ffa4a36f821bc5a6b900927470fb9", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056682, "uuid": "a3c7c458-f9d1-4407-a947-8f1eca033af3", "comment": "Malware payload (BlackMatter)", "value": "006e7880fc79ce189c4eb50229ac772494414619", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056682, "uuid": "10cb0689-fa50-4104-9266-0ae5582a54e8", "comment": "Malware payload (BlackMatter)", "value": "103f94e267f3756a70527686e53048d48d65fc14d39a97d558f0ffda43f384d52dcccd1f3657bc4aa4218e9ea46287ae", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056682, "uuid": "6e5fbd5d-6b93-48e2-90e3-ce5cf9c8bc0e", "value": "T14FE37D21B212D0B3C87718F13736B572F39E8E2C19996847EAD80F5DBCA58236F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056682, "uuid": "b199172a-d30b-465a-85e9-c94ecc92e7dc", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056682, "uuid": "f05807f2-7180-40c1-a485-65e817bcd81a", "value": "3072:s6glyuxE4GsUPnliByocWepBnUDBikIzLjlp:s6gDBGpvEByocWennUD7KLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056682, "uuid": "1a0e8182-457b-4f2f-b1ed-fb15e4426cc5", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056682, "uuid": "9688c69e-2e6e-4e79-92ef-7c9175a5a5ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056682, "uuid": "1b9db0fb-cf37-4c2c-9671-83050decbabb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087e3b2a-5b16-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780028561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028561, "uuid": "5ad5ad6a-a2a1-49f4-abd7-e1ff32bb0950", "comment": "Malware payload (SalatStealer)", "value": "ca30d17ced13131fd5766c9f86d2ac20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028561, "uuid": "ac60b086-1912-4026-b0d0-2d90453ddbac", "comment": "Malware payload (SalatStealer)", "value": "bd6dead7f5a0ec516608de8ad004564e6df2dad24549536739283f44cfde1ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028561, "uuid": "4fdda551-a804-4dec-9bab-208adbc38a76", "comment": "Malware payload (SalatStealer)", "value": "45e04f861fa62ab1c20938dc648f512e003415ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780028561, "uuid": "029c24d3-e782-4b3e-957a-ae925c596280", "comment": "Malware payload (SalatStealer)", "value": "72d6103cf842ee230001ebbb5b0c3172167aae3dde40a04cf0dc98b116444cc577805acbf2f4be8601c2e5b23d3267c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028561, "uuid": "52c58f49-bfee-446b-aa1a-c76ef168d392", "value": "T174C65B11FADB95F1E903183141ABB37F23315D048B28CB9BEB547B2AF87B6A11C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028561, "uuid": "c5839f58-e867-4be1-a97a-5c873bc5aacd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028561, "uuid": "e1bf09a9-a353-4c52-8e05-fa7a33ef65a6", "value": "98304:M5L+G8grxcCqRUmIBFbU/b6L49433HNHXEmO/:lGtQRUmIBl0b4Ws0mO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780028561, "uuid": "977c4c3a-1f96-4564-b0c0-6c9dd7f52956", "value": 12573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780028561, "uuid": "4d44d0bc-e27d-452c-898c-37eff8b962fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780028561, "uuid": "54d85e47-c554-4abd-88f2-6eb83ca1f601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd05966-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "25fd818e-b70a-499f-8cc5-7d5d3ceba085", "comment": "Malware payload (Mirai)", "value": "4588810c710fa2abfbbc5f4f0beed92b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "266c1231-804b-46aa-b5b3-bc7048058325", "comment": "Malware payload (Mirai)", "value": "bd940cbda3c4d2fa564dc83dcacbc4bdd58b14091e29a3afb6400b8d38161251", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "c9658042-fb87-468d-8126-d9b01338585a", "comment": "Malware payload (Mirai)", "value": "ea61b62efa9c3bf5fb6c88b199b6292109b8893e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048594, "uuid": "7e5695e7-6a7a-47c3-b1c8-dd69d0815cc5", "comment": "Malware payload (Mirai)", "value": "2b22f7be9422fe43f821da8a538247593178230af3f03d7712d5ae00bd1c709657d6dc0c44855ac106ce79bc33ee8372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "87a1d292-bee0-420c-aec3-81dd2393f368", "value": "T1AFB2C0CD61543084CA8D7C7C278D4A664F6CA1D0BAED9B25E354CD98B3BEA8B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "1af3d92d-1982-4651-936e-ed5900685b69", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpmZqSWvG:4QlS07FUXqIYSXQKquqqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048594, "uuid": "e0cfd491-6990-40f5-a249-9e4c39c80607", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048594, "uuid": "eb79e271-2eba-4981-9a76-5fa8a34b48b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048594, "uuid": "ecb88510-eeeb-4669-9b63-1d58c2d4da06", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9691cd-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038606, "uuid": "6ac579b0-366d-43db-8267-2e7b9fcb4d44", "comment": "Malware payload (Mirai)", "value": "ee675109f79f08edc0381775c0239a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038606, "uuid": "0acd1a24-1e2d-4037-8742-77da07cf80ca", "comment": "Malware payload (Mirai)", "value": "be0be213bfb806a30fad68ab43e9b25834b835cccdb9109e98a8693a81fe3c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038606, "uuid": "928772a6-7b4e-413a-bc3b-79b3131d02d6", "comment": "Malware payload (Mirai)", "value": "63d79c6903194024bb68b70c28c0a1e2adeb44ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038606, "uuid": "746991d4-100e-4538-9c7a-dcd7eb34e144", "comment": "Malware payload (Mirai)", "value": "310a2d41e11eb9b3ce70e1e8383609a7cadeafe0c91170b8eaae326a089c0974b0f2927ad4bad6fc36d38f26d3b9916f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038606, "uuid": "5c643c73-9b9e-4563-9bdd-510631f9aa75", "value": "T1CC639E16D82109A9C28685B471ECCE3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038606, "uuid": "98567fbe-22f7-4ae4-80a0-8fae5a827b98", "value": "1536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udj:dWVkwgAYugsz9xznsxrdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038606, "uuid": "9c089732-e5cd-467f-99c0-71aa65ae538d", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038606, "uuid": "d1afede2-3ce6-4020-9976-04aadc33f72c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038606, "uuid": "5846919e-04a7-4680-8973-ee8a49516ffe", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14815461-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037601, "uuid": "07319e75-5774-4155-9743-007ccb721cb8", "comment": "Malware payload", "value": "8f6f848fc4773e3e3f5b9782710b2316", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037601, "uuid": "98a672d4-97b0-4d74-8c59-fd9c533a163f", "comment": "Malware payload", "value": "bf5c69a56fc70007f898f34ecc1395c3766069af5592da2eaf69c02ece396982", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037601, "uuid": "a3065ef1-0218-43e6-8580-6f82f6ccb2de", "comment": "Malware payload", "value": "7d9f1af45421092a05cd21376104c14dff2dc21f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037601, "uuid": "7c68a762-66da-481e-8bf5-ce1b3f0f4391", "comment": "Malware payload", "value": "badf1225769913c4705002986f601446ee4b0b260d46f69df17bce0d5b1e5c8f742e73d9121451e53a35c9a66c662382", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037601, "uuid": "f905908e-a649-4169-8ff9-b85851714a0c", "value": "T19596DFAB6DDC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037601, "uuid": "bc07d0ae-7921-48d3-b151-0fceae61e004", "value": "6144:9ubnYpsc+3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfbD9wpNMVwS0msFJvXiESUW1:UPpb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037601, "uuid": "8833a583-01a9-42e7-97af-be258663e901", "value": 9265120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037601, "uuid": "a696c84a-ecd5-4acf-a581-b9f6a6914dfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037601, "uuid": "4f815ed5-1dd0-4fa4-accd-43fedc28c621", "value": "Update_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3ecd2d-5b2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037614, "uuid": "41e0dbe4-c9b9-4c7b-9311-9f0c4a6b1a11", "comment": "Malware payload", "value": "5c87f94763a518be09d3566aadc611d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037614, "uuid": "49cc6257-bbc0-432f-a018-bd92d1a364b1", "comment": "Malware payload", "value": "bfc9e6e703793e0fd480b98a95351d1b3b5c64bcf6ecf0afece8064a8954b316", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037614, "uuid": "e7634fd7-1f22-46b5-96df-8b1d131fe05a", "comment": "Malware payload", "value": "a33334cbd19f422efb3f60426b4e5f1ca037d719", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037614, "uuid": "620d5fe0-2904-4dbe-b844-37415227db55", "comment": "Malware payload", "value": "7ed251d08e3f22c999a2955ff129a1e956a2fa739331b680cf58ec8468bfdf76e6f62c543f090950c01607728b39b0a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037614, "uuid": "379afcdd-abf2-417a-a113-10930fdb50ab", "value": "T13CB6BEBB6DEC361D3000B1C2F48521F1EA525336DBDE12D9B8F924327AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037614, "uuid": "fa8745d3-53ed-4cd1-8eda-b186aef61e62", "value": "6144:rubnYpscL3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsowpNWVwS0msFJvXiESUWj6:NP3kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037614, "uuid": "cb3ef5ff-2e39-4454-821e-71200ab9d226", "value": 11086748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037614, "uuid": "ae6947f8-d547-42ec-8796-0a84dddaf30a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037614, "uuid": "ed5ba060-16db-44a7-b22a-e6f985ebef8b", "value": "Update_4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f22664-5b73-11f1-a769-42010a9c0008", "comment": "Malware payload (Xtrat)", "timestamp": 1780068695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068695, "uuid": "723ca313-44fd-46ec-a5c3-758d1a344cfb", "comment": "Malware payload (Xtrat)", "value": "6623ded5d0339f3275b05c8df3257518", "object_relation": "md5", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068695, "uuid": "b59bed0e-5eef-4e70-a153-cef7896dab56", "comment": "Malware payload (Xtrat)", "value": "bffa9209a6fac3a4a7ff7b42f235ea38976a89e925356b9c751981f418e2d775", "object_relation": "sha256", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068695, "uuid": "03e7b732-f103-4348-93f9-61f82dc81c1b", "comment": "Malware payload (Xtrat)", "value": "31d73157cdf85b012526bdabaf6170c62db8abc0", "object_relation": "sha1", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068695, "uuid": "a938cceb-5085-49a1-aa8c-831aef39be86", "comment": "Malware payload (Xtrat)", "value": "f6c9c51291b705448621d802eaa5fbef51cce99b087f2295b0d86f41c3006111a34b15dc61697dd4178aea046b9a422e", "object_relation": "sha3-384", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068695, "uuid": "f5639a5b-0dac-4929-a762-edac2db90ab4", "value": "T1A992E171B6528C93F8E24FF2525AE14D9728743448EE8B6C5F32071BBCB78142BE255D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068695, "uuid": "6b57c098-0a10-46dc-b6a9-875729535491", "value": "0cbfef437419d71a55a704236c98a733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068695, "uuid": "c7b40b36-964c-479f-9e0f-726d24dd4886", "value": "384:BHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSnz7YdoB5KYr7R:kZfuHUvwDKP6kMpO7YOjKY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780068695, "uuid": "3ee5be55-8fcd-4a7b-a5b2-4437145b5f93", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780068695, "uuid": "3f828e70-e3b1-45b4-9cfa-87ae359a2fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068695, "uuid": "f5d346eb-969c-4ff4-9c28-c58b74a9a5b3", "value": "eastvillageeaterys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f17c5da-5afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016976, "uuid": "4eac021d-3ad8-4d23-a0ba-6646d699576b", "comment": "Malware payload (Mirai)", "value": "bcd937b54429002ca9e513a2932dac8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016976, "uuid": "83d29bf4-7707-4607-81f5-6883bc9bb594", "comment": "Malware payload (Mirai)", "value": "c01dbcd308e00a24bb96e00997ab678e5caa39ac1313adea4498a3111d0a1708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016976, "uuid": "f8b4d1b9-502d-410a-b607-348fe49ebf73", "comment": "Malware payload (Mirai)", "value": "0d6299958f4f0d02da3096a03d03d65beecc3cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016976, "uuid": "d875dd33-d745-434d-83f2-61d35f85a4bf", "comment": "Malware payload (Mirai)", "value": "be7f18776dcb96738eb29258e5f7349f405e16fcdde5e5aecc4334a783233df291ac87e9f69b9fcd5d0dc883559f6a26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016976, "uuid": "40c84dbd-7d57-44e8-9888-6664de862437", "value": "T1CAD35B42B7180983E5575DF02A3F37E583AFE5A110F0B689790BDA0A8175EB7254AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016976, "uuid": "c8ffc4e5-69e8-4564-bd8d-469bb5c47f2b", "value": "1536:ylY9+mHnTAMCw2o4wTH8a03XElDD1oGWLRxSjCyqT9+l4LVDO2tLKhx6sj/f7:yG+mHn/4wTH8ZX6olLW2TYlU4j37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016976, "uuid": "64514a49-ff59-40f0-967b-b3e5acc5e77f", "value": 132672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016976, "uuid": "c069c088-2ada-40a1-8976-d8ea738e4f0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016976, "uuid": "aaad3b91-6a9d-47f5-9548-685032d2e3e6", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadffcb9-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037504, "uuid": "d25cc58a-3184-4bfb-9837-18a4f739cfe7", "comment": "Malware payload", "value": "1adc9b781de06834d71f7b3f3cd873d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037504, "uuid": "e0c7cbf6-36b6-48eb-ab6b-f278a8cdf369", "comment": "Malware payload", "value": "c075aeba57f002acf9e317f9bde29914031090de3444718af334a39d8cf0651d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037504, "uuid": "03855915-ee73-4874-8919-d14472e25252", "comment": "Malware payload", "value": "93c53a5e68b982908c1eb1ee129a088754a0b65b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037504, "uuid": "f049ecc6-c8e3-465c-844c-3aef7d369eff", "comment": "Malware payload", "value": "8b8e2b0ad960a05b314fe07d6015236344070ba67db4e951ac11fa32241755b2661299c7bd651079a5a6290b3bbc52ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037504, "uuid": "64c65075-30f3-4296-9dca-e2dc30dde2c6", "value": "T19D86CD6B6DDC361D3010B1C6F48521F5E6621336DBDE12D9B8F928337AF689AC02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037504, "uuid": "84e08a64-79e9-4153-aa7d-d3e6e4bc73ea", "value": "6144:WubnYpscq3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfw8wpNLVwS0msFJvXiESUWjD:hPP0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037504, "uuid": "b91760e6-8f95-4d06-b141-6f4e972b6448", "value": 8055201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037504, "uuid": "90297675-c644-4a11-80c4-9b22bc4cacfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037504, "uuid": "b9190198-bb28-4f20-babf-62dd07fd0b72", "value": "Update_17.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1023536-5b86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780076947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076947, "uuid": "25520d04-c031-4cef-b8c1-9a7aab92943c", "comment": "Malware payload", "value": "f6a5313863556ab855734514b67a5ebc", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ghost", "colour": "#EAC2A2", "exportable": true, "hide_tag": false }, { "name": "prilex", "colour": "#788E96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076947, "uuid": "f1c5a3d3-1311-4429-a367-f7b7810a4cc3", "comment": "Malware payload", "value": "c075d110a7199591cd6392eab013a54e1ab56533ebec867191cb5cae45d34977", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ghost", "colour": "#EAC2A2", "exportable": true, "hide_tag": false }, { "name": "prilex", "colour": "#788E96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076947, "uuid": "7d0b9589-d09d-4b65-86bc-6e00b00daedd", "comment": "Malware payload", "value": "15933d84130b6a1a4039e43e7e7878a3840198a2", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ghost", "colour": "#EAC2A2", "exportable": true, "hide_tag": false }, { "name": "prilex", "colour": "#788E96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076947, "uuid": "6ef7a4e0-dd18-4678-9a01-b3910a6b36c7", "comment": "Malware payload", "value": "f33e0aa75a2c13886d934e77f156698227fecaceb321c4592bd83d8ea36e300acf0d0623e78154a314f6978d8a1911fc", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ghost", "colour": "#EAC2A2", "exportable": true, "hide_tag": false }, { "name": "prilex", "colour": "#788E96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076947, "uuid": "8d936abc-5189-4a73-ac78-31e7950e57d5", "value": "T1BA751923B7E2AB26E52D25F61EC7CEE626E278051F47E10F3580233B5C72D214AA5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076947, "uuid": "0334d2f9-b5a4-4a98-b0dc-38b11b93dc20", "value": "84c054e3c47656b4a6303d9c60a5ba4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076947, "uuid": "923e7b71-0af3-497f-8727-388443103c92", "value": "12288:Fw7RLRua3yEO5S6K/cPcobEsyAmxm/oGcdYRjLWadL3kNA3j5Zip:IRLAoNc0zsyAmxm/pcgLWadL3kNjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780076947, "uuid": "945c5413-8f33-4fef-8ef9-28b9f047a7e2", "value": 1556480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780076947, "uuid": "19ff21d0-09a1-4151-a8b2-b2d3833077be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076947, "uuid": "79639db8-846a-42fd-9ab4-b63e34581b5a", "value": "microsoft0lesystemmcas-6.03.9048.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94390666-5af1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780012904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012904, "uuid": "4d16e4bf-3b4b-4198-878c-81301be60a68", "comment": "Malware payload (ACRStealer)", "value": "a66825de9e99384d40e27eac97f694c2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012904, "uuid": "4ffd93c8-0ef5-4502-8f36-80855c94c117", "comment": "Malware payload (ACRStealer)", "value": "c0a47856e9f60a5be5ac0cab0b92452198a3f10b6f98dbcbf1d153927915809c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012904, "uuid": "8e77e915-0f03-451b-af48-635350ea4b84", "comment": "Malware payload (ACRStealer)", "value": "1268ea235907270470e8cdbbe91bcca590515ea3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012904, "uuid": "3c14dd59-b585-4953-bc23-21e3d54dd999", "comment": "Malware payload (ACRStealer)", "value": "69411b573b6ed3e27f54e639f5413eccd7a83aaaf780adc3482bd14a33902a80c03f59f3f8277124ba0f21e674483a4e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012904, "uuid": "d4f5de3f-1954-4e32-a223-0acf1503a0b1", "value": "T1AF768C43BC8064B6D5A9923189B692D17732F8890F3127D33B15B6BE2E737D44E36368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012904, "uuid": "8b67dfc9-0c46-4a54-a178-cb237d478fdf", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012904, "uuid": "dcc0e221-e1dc-4118-b3d2-e3fa741fbbdd", "value": "24576:7+jE3dR+V7mOJIeAoLMUOH017iYfo8vWQY29b65jQ6OgLP88WngmODsWD159:7+o3m7zqoLMUO4fo8KAgLPIWD1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012904, "uuid": "b94f1cb2-d806-4479-964d-15e4de272ab2", "value": 7256192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012904, "uuid": "30193bff-31f3-4e2f-8cc8-af3966643258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012904, "uuid": "f1a2d6db-3856-4053-aee4-886635ef5ceb", "value": "OnbuD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f8d8b5-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "1f563dd3-351b-4db5-aa06-043efd26da3b", "comment": "Malware payload (Mirai)", "value": "6741f6d9aa25d052eec764afa1f48b47", "object_relation": "md5", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "39129c9a-20c4-4361-9fb4-5e6e47e61b2f", "comment": "Malware payload (Mirai)", "value": "c143c91e6f02d11ccab9f8459fd07f9399b6982acf190d17029d9d4c2b5cc28b", "object_relation": "sha256", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "b1964d01-80b5-430f-b028-88d3906d2e85", "comment": "Malware payload (Mirai)", "value": "1a3c0fec42da0240d96520a6c11526d2272c4eed", "object_relation": "sha1", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036563, "uuid": "2c513bbc-f301-44c4-82e7-6efacdb60f89", "comment": "Malware payload (Mirai)", "value": "98c7459ed2d67de9cda631df17db2bb0c5e9db7ce38108cd5bf5ca5d6805bf32527201db91af6770ea966faa52a52158", "object_relation": "sha3-384", "Tag": [ { "name": "31-56-209-72", "colour": "#4F5A5D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "72f9fdb4-197b-4293-a019-0c2a3239cad3", "value": "T109333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "ab59fe78-17d1-49cf-950b-2eed654f2fcf", "value": "768:jw5A3X1eCZWUJ2SNpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98WN+s:jwkt3NpOzwLMU431ANA0BLBCqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036563, "uuid": "016cc10f-75a5-4a80-8d0b-8f4c5f659c25", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036563, "uuid": "c79f7e2c-5da8-4918-99e6-f89f361fb672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036563, "uuid": "321a57e6-f290-4e07-88ab-bdc82d68ce47", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae8965c-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018311, "uuid": "ad895c51-6570-4a9e-b184-9f57de3492a6", "comment": "Malware payload (Mirai)", "value": "c13a038e1ef5e495f2fbd121b47ac82a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018311, "uuid": "b6d03ed5-f724-4e9e-a06a-16437f034daf", "comment": "Malware payload (Mirai)", "value": "c1992ff1cd3987bbd5d3691948afbcc50efb8c129e2ae5f4ada485519577d1f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018311, "uuid": "020bc5cd-7e6c-4efe-bfee-3997f1805dd8", "comment": "Malware payload (Mirai)", "value": "9cca5702e7801477d8fccd7d784a4bd362aefe87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018311, "uuid": "6a778dc4-152f-4e16-aa8c-e124d3e2b56d", "comment": "Malware payload (Mirai)", "value": "dc42c33df8952d93f20de85fa5975b9879eba2ebcccbaecb61b5b51d8f2e466cc3d83db5abef9fa70a44ed8061f455c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018311, "uuid": "0c90cb94-5ec4-4f4b-933f-3a3396888891", "value": "T1EFC34B43B68044FDC449C17453BF7A32D826F86E023A7297A7C4FD263D4DEA1262EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018311, "uuid": "075e42e4-30b2-40eb-8475-14bd22432d30", "value": "1536:EKhMoU35nVqA3sUkO47uh2MGUCTueLdWAdOrUIW7W3hpN5mQ5NZqDXDMNHxAd:9hCpn3sUouheUCTue8yOk7MhpN1wDax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018311, "uuid": "de9f5923-3dfd-4633-bf5d-74fb8b000eaa", "value": 129040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018311, "uuid": "55bd86bb-4702-4239-bb90-be7a319ba6a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018311, "uuid": "4a7fee3b-0bcf-4e86-b12d-5009a30d20f3", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d7ada1-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780057598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057598, "uuid": "601f1f6d-26da-42b9-bc53-e4bfd994e8cd", "comment": "Malware payload (ACRStealer)", "value": "113cca1e7a7a9e7ee88a9495a9080c6f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057598, "uuid": "8a84ef45-fcd5-4d04-b127-d278f6c30263", "comment": "Malware payload (ACRStealer)", "value": "c25d942315b926dab7c1a3aff907891b0f3c7db6ff809d3399b6af6c4d389c67", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057598, "uuid": "8b0d6fb2-6459-40d9-bb55-3041bf65e177", "comment": "Malware payload (ACRStealer)", "value": "881b931f2a80604184934db7b4f68adb4f2cc506", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057598, "uuid": "b8a099d4-dcf8-4bf0-9429-83861ac33fd0", "comment": "Malware payload (ACRStealer)", "value": "207a138584ff1f3796e01344b022e54a58e2403dfdff9d30b63e47dbee13a3f232ac47aca0a29110f2897d9b883eff71", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057598, "uuid": "94a35578-b870-4174-a033-19adadf4d143", "value": "T114E57B16BCA009F6D49A63338DB762917BB5B8490F3223C72E50B6382F767D85C3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057598, "uuid": "f3d8c158-f61d-4cb5-87aa-76e418dd2bb9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057598, "uuid": "497f9c89-eb99-4f68-a53f-613852d3b2b0", "value": "24576:Sc54tasZwqCvsBI7aC/u/i5klxdtWh5ioUGm1Eg8MgMzOu5fLBele5ZK2hgLATB:Sc6taiwq9BIOaUi5klxdo+U6V8M97HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057598, "uuid": "ad90de98-2f70-4db4-a7bd-cbcb61428840", "value": 3220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057598, "uuid": "c05e055f-694f-4ddf-a5b8-d8e7b50cf0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057598, "uuid": "e9194f8b-cdf1-4530-94d3-fa12831f5937", "value": "SecuriteInfo.com.Win64.MalwareX-gen.66743651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d157afd7-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048655, "uuid": "21e947a2-aa7c-4f59-9934-7cbb545d9d8d", "comment": "Malware payload (Mirai)", "value": "4b934b72c82a2c3fd74823d58ac19351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048655, "uuid": "ba1163e0-9b65-42ae-be45-05286d8168bd", "comment": "Malware payload (Mirai)", "value": "c376c4e8a21cf863f479434d8178434cbb5b665c3cb1a7a7d0e03edd4da02204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048655, "uuid": "b7f5d208-38c2-4fe2-8cf9-bb1ab2eeaf33", "comment": "Malware payload (Mirai)", "value": "e893d1fd0ba39678276213e70a6aa48de6cf3644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048655, "uuid": "6fc1dd57-78cf-4ef5-8a2b-174c2ff03aaa", "comment": "Malware payload (Mirai)", "value": "02a5ec2f5ee45665a12d2613c381f1ec787e9ade1e906a9922294fef6add3cd330875ee08a8ca624ad2d2b835f866b14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048655, "uuid": "9a994172-a793-4029-a230-8160e9a93252", "value": "T11B431891B8819A23C5D4137AF56E56CD372023E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048655, "uuid": "43dcf5e4-ff13-474c-a3e8-15dba810b6a7", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048655, "uuid": "618357ab-c7b7-4c76-a3d0-dc99e7b16997", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048655, "uuid": "7e8a12b7-129d-4f24-be53-0d9da7218b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048655, "uuid": "dc56c386-d2ef-43f3-b5e5-9baec9d5fa2e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc43541-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058635, "uuid": "ec29f64f-5be9-4ab3-89a4-4862b629f472", "comment": "Malware payload (Phorpiex)", "value": "bd8b6c532975921a9a0e3611700a591f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058635, "uuid": "8bc95af8-9f2a-4eff-881f-aad18e42c036", "comment": "Malware payload (Phorpiex)", "value": "c3b1b4e4eab9589b9132c57cc6dc9f26b93fee922b78923780cb79ce705f106b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058635, "uuid": "e21f0739-e183-4d9f-bc71-d86a92dc1950", "comment": "Malware payload (Phorpiex)", "value": "7854cf19f7f32069ae84be79d47478be95efc4c1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058635, "uuid": "9d6a0d0e-ac4e-4dff-af19-f0540cff2181", "comment": "Malware payload (Phorpiex)", "value": "01f5475edc38632099a1536cb6dec8cd3604751c152e9b4b840c9dc8e4d6892ca508ebbdceb7ab8c6451957b7c8cfcb0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058635, "uuid": "52136962-1f1b-4beb-b717-5f66a4f84728", "value": "T1E8824B0FF9418216D1E210B452B5867BDA799C72338458DBFBD08A9D0BA86E6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058635, "uuid": "ff94ba43-1c4c-4bb3-a67e-a58b841672b4", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058635, "uuid": "63784017-9e79-4732-8b22-3c4554d40124", "value": "192:BnIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGW:BxIblVP4Y/2N0bLu9JgPL7Nyav8U9c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058635, "uuid": "f3d5345a-4ccf-4288-8f20-7ddfcc616bef", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058635, "uuid": "3bf3ebe0-d05a-42c8-a0b6-0d971dcc0224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058635, "uuid": "3aff04c7-6793-49f7-8d7d-5bbb13aa58f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda9a395-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037562, "uuid": "1c6a039c-d365-4628-8ca7-4172eb75be21", "comment": "Malware payload", "value": "f365cca731d009e90929cb65b00ac6ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037562, "uuid": "711890fb-9e3c-4970-af89-03aa42f134bc", "comment": "Malware payload", "value": "c485dd9c6d810f36618315d661ecb801f4ef8d44ef9946876a4649ed8c23c15e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037562, "uuid": "e5d12f24-bc2f-4a34-a8bb-bf3c17499d70", "comment": "Malware payload", "value": "503c3324f1e9858b4700f18cf523a82503e943b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037562, "uuid": "8dec46e9-b948-4c78-9603-575832a0d54c", "comment": "Malware payload", "value": "2617f1e677080da954dff6f44d3ffa490d9e6e022364eaa157c94fda713277e53116f7527e3373acdc9bfa456a355bc6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037562, "uuid": "9839e6a4-94ac-40b5-924f-2f0c4bb3e2af", "value": "T15E86DDAB6DDC361E3010B1C6F48521F5E6621336DBDE12D9B8F928337AF649AC02D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037562, "uuid": "537a7814-fe39-403c-b5a1-469d9126b734", "value": "6144:bubnYpscU3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsd9wpNWVwS0msFJvXiESUWn:IPoF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037562, "uuid": "8f5b07ca-1ea7-47e0-9841-2db35a0eb42a", "value": 8150621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037562, "uuid": "65b447a7-2761-4906-b06c-c1b126f76479", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037562, "uuid": "00777426-56d6-4444-9723-0fa2350f1916", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2ecd10-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048648, "uuid": "3da1d65f-c877-45b8-830f-06aed8f5a4a6", "comment": "Malware payload (Mirai)", "value": "ddb04bd4f94a4217e045869bc4e9c88a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048648, "uuid": "e6da7332-738f-400f-93fc-c024bdc542c0", "comment": "Malware payload (Mirai)", "value": "c4b587c4ad30aa78ae1be54463778d7f421fef56d6308684c03681d034880c74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048648, "uuid": "2ee3f145-1f62-4aff-b70e-6f13dcf61b45", "comment": "Malware payload (Mirai)", "value": "1f4fce7a1feb2d18f3f5bb8d6cbab7b01ec53a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048648, "uuid": "ed53d2d7-f6b2-45bb-8d91-5a251d7c0db1", "comment": "Malware payload (Mirai)", "value": "be8f4ca4da5ee7671cc22bbff4598ab8b1027cdfb9b568d6df7e33cf4f21af89d11f8966b19a6e4cd8b6d74a2617ff8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048648, "uuid": "7c76c6c8-463b-4fe5-8ac9-30f96ad3c402", "value": "T18B630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048648, "uuid": "28e0eafd-05ac-4820-8ad0-f01feb36ad10", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048648, "uuid": "98115b70-928e-4829-aafd-6bf9596f57b3", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048648, "uuid": "26801c0a-5705-4a1f-a2e5-c132a4bd36b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048648, "uuid": "e13b6abc-1b1b-4ca7-8ec5-3219e62e384c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96f0fb6-5b66-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780063298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063298, "uuid": "ccfd72fe-4607-4441-80f3-920143febae9", "comment": "Malware payload (Mirai)", "value": "a9f4b4c99cf65c2187f024696aea81bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063298, "uuid": "25b2c151-ca5f-4d9b-aa23-99b692455152", "comment": "Malware payload (Mirai)", "value": "c4fadfdcd471e66515d5426839eb93f5f04ce85a061ae629c7ef599892034f12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063298, "uuid": "33f1eb46-cadd-450d-94ff-959d2d0f51f7", "comment": "Malware payload (Mirai)", "value": "e5bf852a2ce7fb2e3194aec83e04a53e22809708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063298, "uuid": "323182ca-c955-4ce2-8c99-f2e6cd1db783", "comment": "Malware payload (Mirai)", "value": "66741faf7c42f4690ab4f6f2a658a8e98cfe2b0850c0e50d1a7869ec599f3575550346e90050e54535836b6d0eb1117b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063298, "uuid": "11e55735-38cb-4081-924e-71ddd0453f19", "value": "T159145BA9BA0F6C41F2C2D3F9DE4C87E13E1735E3C6768971781212EDCBA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063298, "uuid": "b41fc4d7-4113-4159-8c3c-d48b619e3a06", "value": "3072:habPawJBEFaFKw7zZjrIvXO7+38DUmJ78MhMnoq:hqPagBeaFKwPZgv+7+sT78Xnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063298, "uuid": "266c96c2-38dc-49d6-b2dc-1cf941bef6c5", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063298, "uuid": "780e6f59-3591-4b8a-a523-fc2837cdce71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063298, "uuid": "5c3e3f32-bfc9-4d32-908b-163b3b45b481", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac2c563-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038604, "uuid": "d19d865a-f70a-4518-b560-7cd97bf89bb0", "comment": "Malware payload (Mirai)", "value": "ecc51f35453cdfa81498c07b81e57ba5", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038604, "uuid": "ba3b5cf1-55e9-4753-b04f-6d57defda4bb", "comment": "Malware payload (Mirai)", "value": "c56521ea32ed31b9b1cd4f1e54dad0d8cc66b4e7b430a7dd4232cbb8c05a5e46", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038604, "uuid": "27bc731e-0d84-4768-a2dc-39876dca426f", "comment": "Malware payload (Mirai)", "value": "7ead8ff27ac74a02ed31a295b32584d45c41bb78", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038604, "uuid": "f3ae3f22-3ce3-4ca4-991a-a3444731bc57", "comment": "Malware payload (Mirai)", "value": "636920474a2ed6e54c991262c2f9c61f39dde40ff4b39ae94ef880856fff4d99ddb08b4502633883f1ede8c69293c505", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038604, "uuid": "3dd5660f-59de-4deb-bd2d-fb2209be9dc8", "value": "T14C762711FD8B54F2E9030D3105ABB22F67325D054F25EBE3EA407F2AF97B6911936289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038604, "uuid": "06422f7b-4826-4583-a404-3700d52b486a", "value": "49152:R9QheTiNIcQPRBuFNniZD8M7422LOs37ozlZwjQzg3zuD8LJ4AUDyEAmCLpF5En:77iCnuTniZ7IOuUzkjQct4DQEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038604, "uuid": "4229d509-d8e1-439d-83e4-1a759c72d174", "value": 7233720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038604, "uuid": "767d93ad-e68b-4fc5-b608-a4424f5ccaec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038604, "uuid": "f97ed753-160b-416e-9a1a-c1c43edb9627", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad976427-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "0a66681e-8629-4b87-ae71-c5805c241779", "comment": "Malware payload (Mirai)", "value": "0dd300a9da3fcdb74b79b11a53939a14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "8975d01a-004c-4c0b-afaa-b482eac90944", "comment": "Malware payload (Mirai)", "value": "c5dd75ed2465781df3a9aa79a8b8b3be2bce9da13fc1e7fa259611d969f589b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "4fbf8611-145f-40a5-bd25-878865cb0bfb", "comment": "Malware payload (Mirai)", "value": "f6c5bd515c1b1d9761d6ec9503f6d255859632fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "72e35573-ba95-41fc-b2a4-89bed8c815c1", "comment": "Malware payload (Mirai)", "value": "1fa9291006a465c5a594bb24faf61de0bd416ec676053680ac35eac33d0ef7bdde4e5d2decd24e96a970faba360d18a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "d3b5048b-e453-4a09-8319-e5068f0fe10a", "value": "T1A6432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "b31d9664-53cd-4bb1-80ca-0f6b78fb1976", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw2:RqtmZPuutfbltZFBSJsBcfDSTFI+BE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048595, "uuid": "9d60b484-ec22-4198-9cf3-49b060060f32", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048595, "uuid": "6b811d0f-7129-4e8c-ac2b-c14af1110d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "10b91f70-6393-4094-b4c5-668a5d396f4b", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66db7b09-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038598, "uuid": "3c5ef6f5-b14a-4e11-93df-64be3ac264fa", "comment": "Malware payload (Mirai)", "value": "fec2fba4c55f77917f8252b1c974753f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038598, "uuid": "0d243868-d730-431d-ac21-7f0b4f6f49ff", "comment": "Malware payload (Mirai)", "value": "c5ef3b135e2a0e79c30e8ca119ec94f1e4eea402d85968feb61ffb3e47e02318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038598, "uuid": "a8dab065-6ab1-45d3-93f9-00f258d7ba82", "comment": "Malware payload (Mirai)", "value": "232396270a24985d5cb5e310875cf5fffcfd87c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038598, "uuid": "a95708c7-8c94-41c0-b2af-cd599577cd3f", "comment": "Malware payload (Mirai)", "value": "b5303e1643e3045c5ec87256e21285e048000dd6413edf91f8168d7f788347283a46e862bd179b831400a0ad6c73d990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038598, "uuid": "71a5685a-2e54-4367-945d-db7024428ddd", "value": "T1DB5302D26440D1F3D75503BB69A4D843FFA41BBC65DA30AB256A9248A1E3D483CD7BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038598, "uuid": "c12cef3d-836e-4f9c-a97f-bdcc5456dc2b", "value": "1536:CVQSmwtMJXmejtESGuLTM5Tfv83KJ2crl2EWyt:CVywt8XZeOLgTX83KHl2EWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038598, "uuid": "13254cdf-cd60-4751-aef2-f00c886a251d", "value": 61844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038598, "uuid": "19d4a9ae-858d-45da-9c9f-f70867b67bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038598, "uuid": "3a88d17a-f207-48ad-8f5c-2548890ec260", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed43c0eb-5afb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017348, "uuid": "f8fbb641-fa6a-43d7-9ae1-cadf8cb533c5", "comment": "Malware payload (Mirai)", "value": "993edf24e465b30da80b822176d0f0bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017348, "uuid": "993ca7d5-99ea-4e92-9e30-f6ceaa4fcd70", "comment": "Malware payload (Mirai)", "value": "c60ac1c762197dadbea95d4271ccfe5910f1fe414384ab37b3b06906102abd2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017348, "uuid": "f46b43fe-ac8a-4b8d-ab41-710c351ef2d3", "comment": "Malware payload (Mirai)", "value": "1f42f9b2fae87e7f481c62548b6619626ccb3e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017348, "uuid": "8d96f803-07dd-4b04-86d5-54243e04fc8e", "comment": "Malware payload (Mirai)", "value": "251f92bc48ab4ea811f8c8af06bf66c5d1501b4ec1af757040b3c18a3beeca85cf08b3f8758ac99cc9b6a4110d2bd10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017348, "uuid": "83d40089-33b8-469e-94a3-9023813ad52f", "value": "T145C2E125C8D158D8C761D831E6B6CB47FB4A86FCE0AEF1B106D142F9A68821442E6FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017348, "uuid": "4909c1b4-766d-4ac9-83f7-9a3f893febd0", "value": "768:oUpSOiELcQuNnykBSsSNm6PhhZmocofj6s3Uozz8:opscvJyls8lfHcozzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017348, "uuid": "3b29d153-cef6-43ff-8f2e-eaf39bf2509a", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017348, "uuid": "3b0c67f0-2a36-4757-abc7-2c2c2bb2a834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017348, "uuid": "d5ee9593-23a2-4a8a-8c0e-9466615d6ff4", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad782a20-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "de90e6e7-0f13-4e33-aa4b-f40b63e41d7b", "comment": "Malware payload (Mirai)", "value": "7153e9dd57e3ac20f0b99df49f2a819d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "0004ce30-cdb1-4673-b8df-3570e5cc2e59", "comment": "Malware payload (Mirai)", "value": "c6727a89b0fd9e8c5e795632d4754fcfb4526e82d09d8322e340a1e70e4bf606", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "def7045d-7fe3-4b08-85c9-d7871f2a55ba", "comment": "Malware payload (Mirai)", "value": "8796df906c2a92fe31020b6fb737dcff1ec25f2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "2828ccae-0578-4701-a00f-26b4daad43a3", "comment": "Malware payload (Mirai)", "value": "0efaaa9d0b60b89cf185fd4163b5ae9b4d7f8ce437a17b6ff6cea1f107432dc95e0a19f80f4c7ccf54814816a5c8f502", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "194a29cf-0fd9-421b-b0bd-f00774628524", "value": "T1ECA2D025D345AEF4DFEF9D9492C2C2C276F543C7279AC8E240FEAF016506056BB48C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "f651b86f-fce4-4f35-b3a1-1fecd20220b5", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5xpM4uVcqgw05VxJH:9RxsSVsMD6xiJJE5zRWNPG4uVcqgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048595, "uuid": "55562041-209d-43f1-9fbe-d2a38ab5f8f0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048595, "uuid": "ba6eb910-1c79-43a0-afe7-f2782d87fc5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "d7dd1731-72b6-45f5-8e45-5c3e59adc1c6", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f01bcb4-5af1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012815, "uuid": "f0d49d4e-b203-4944-8c6b-c04751fd10fd", "comment": "Malware payload", "value": "8597cb6b265e92dfeeab9bab0f16ad20", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012815, "uuid": "eaf8c9e6-021d-48d2-b7af-12955aafaf97", "comment": "Malware payload", "value": "c7795617f086b70cb12393ce7c39af29f0b9f3c0860302903c7c7786870365e1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012815, "uuid": "5a81058b-2a03-4e07-9394-594c91cb1bda", "comment": "Malware payload", "value": "a237648ac2770a5703d94c12f45c47d357c79936", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012815, "uuid": "993485a3-0904-4ad6-bb23-b97acf06454f", "comment": "Malware payload", "value": "8d04f7c3c214d4390be1f27ae0363acb5dd2a0fb01ce3e91b18c53e83d723f68b9e0eaa29a5b465621b7ca5e73cefa3d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012815, "uuid": "c6685a10-26ec-4743-a959-f1a4a01f79ed", "value": "T1B3A30341F7F94119BAB72F442AB946B8497BBF92253DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012815, "uuid": "49bf3e53-6262-43bb-968f-ff653544adc7", "value": "768:Rz1V6rre2Xkot6Jjr1Vnc+dH+3NNVKY3wNXByiVa7cDpU919HyjgBq8F1fzrqAnJ:Yr3XZ5y51TsOKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012815, "uuid": "a2f36446-d05b-4f54-b0dd-ea53d9b337ee", "value": 105988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012815, "uuid": "6b1f4fb0-0cf1-4450-afd1-b6f57e0541cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012815, "uuid": "86a2775b-f4a8-4f12-b8c2-77dd8f7d4a0f", "value": "rtexto_da592141.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab14668-5af2-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1780013344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013344, "uuid": "a1c2e500-adb1-4ac5-bef1-b15f464cb0b9", "comment": "Malware payload (GhostPulse)", "value": "737ee8a48901c3dbba6f688cfc403076", "object_relation": "md5", "Tag": [ { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013344, "uuid": "af7025c3-e16e-4ba5-b318-5cb252efb15e", "comment": "Malware payload (GhostPulse)", "value": "c88a5bba3b32d6c4cfe3c2d33ea8eb5ada10314a8e049ce02d5cda94abd5aeb8", "object_relation": "sha256", "Tag": [ { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013344, "uuid": "0f76f15a-fc48-4b25-911d-35ef735b9863", "comment": "Malware payload (GhostPulse)", "value": "cd59de09ff580f3776b0f87c5fe8c264c242d95b", "object_relation": "sha1", "Tag": [ { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780013344, "uuid": "5f52be8d-0bf0-43a8-9531-9a0ed1d4c8dc", "comment": "Malware payload (GhostPulse)", "value": "cf9c73268258f1c61ab54373afdfcd9a5722edfbae25c7c31ee2cfffe8724a0521aef284b6a474ab8465e09ee4a931b3", "object_relation": "sha3-384", "Tag": [ { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013344, "uuid": "2ed808f3-b82d-439f-9f32-f78e1ce9baa5", "value": "T11D6633627B48A8B5C27693338F48DF5904BBE12567412F0EDECA1F2A8CD397265035ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013344, "uuid": "5bc5dd6c-3903-44f4-a2ad-60427defa6ea", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013344, "uuid": "807fb1fc-8975-41e1-84a9-b6a1f7ebd5b4", "value": "196608:+pHifCagaFYdb5dXbt403a8S0DbwC6J4SGYlo:+pHPaRgh32013Ylo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780013344, "uuid": "feb7b8cc-9e0e-44b2-ab11-2f71df027edb", "value": 6605191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780013344, "uuid": "3b357751-ec6b-45fe-bedc-1f16a16d809a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780013344, "uuid": "1d6db4b2-e52e-4c6a-b250-d44bbc1b9860", "value": "vwAht.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98168ba5-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056719, "uuid": "662c9b16-06c9-4f58-8bc5-e923d3122462", "comment": "Malware payload (BlackMatter)", "value": "9e02551b0c49a8682a79e60fa43f7884", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056719, "uuid": "4fa25197-9fd2-4c0c-adfb-f5237f6dac83", "comment": "Malware payload (BlackMatter)", "value": "c9417d4683324c34c7b976395c01f79150a626966e27144244214423aa64ccde", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056719, "uuid": "abeb7c49-0276-4513-8cbd-af63450daa7d", "comment": "Malware payload (BlackMatter)", "value": "80d8bd527a016af5d152bcc40a96711c9eb5a153", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056719, "uuid": "f0423b47-10dd-4e7c-b600-2ea7140da2b6", "comment": "Malware payload (BlackMatter)", "value": "4f1a6d8a775621eb5d4022b53eb7ecf3de7f11e42efc13342d03de183622e3bd2fb15fe07c741d2067987c377a3579e8", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056719, "uuid": "ceb6b779-64c1-46e2-a978-308b2163ce34", "value": "T163E37E21F212D0B3C87718F52736B572F39E8E2C1AA56847EAD80F5DBC648232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056719, "uuid": "25865a4a-284c-4f10-b1e4-530a595528e0", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056719, "uuid": "90482125-453d-4938-9099-36c7633e1cd8", "value": "3072:N6glyuxE4GsUPnliByocWepFWOL2OBK1vgaSz59nlhCx:N6gDBGpvEByocWeXL2Os1vgJ9nDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056719, "uuid": "c26c7454-b186-448e-b0d9-d7a5ad84615d", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056719, "uuid": "e64c4bd3-8e76-42de-b9ce-2ca6337ed60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056719, "uuid": "4aa2a7f1-6243-463c-b4ea-2e164fd67a3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa690cb0-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780018659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018659, "uuid": "8028bfc0-2333-435d-9f36-a14adf30823a", "comment": "Malware payload", "value": "d71fd07145b051ac97b5c4a57d2404cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018659, "uuid": "c2ce8ee4-c7d7-446a-b8c5-dee7b464b5f9", "comment": "Malware payload", "value": "cb3935f816e68e16a096dea0cf44b687632a1b16fc11f43154626a22bfb69b61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018659, "uuid": "e8530f3c-62ee-480a-bedb-4e34c105959b", "comment": "Malware payload", "value": "d40467ac71cf94c4dcde96828ea8ddcf63af6479", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018659, "uuid": "97cbbac8-d86e-428b-92b6-c42ea15b5d65", "comment": "Malware payload", "value": "c7f7fb850b1bc23d0a354fc61795dcbfc41b0de927d2f90465bf0bf6b0c7ec6f626a3e2b3f11e7213f7c49ab2776d92e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018659, "uuid": "b46808c9-34fd-416e-a441-5b63d9a56279", "value": "T16F137D6526913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018659, "uuid": "52025d8f-7965-4bef-91c4-f5cd00f409b9", "value": "768:oXRWNGxVi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:8lxtcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018659, "uuid": "11d8bb37-c016-4d11-8126-4aa2b94a954e", "value": 45518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018659, "uuid": "0281ab1c-e38c-4c32-bc75-0bae050306b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018659, "uuid": "98ae9573-8573-4991-8bf0-ca0320f4b881", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033c3932-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058617, "uuid": "567fd523-a4dd-42e9-85d4-7b6a50208112", "comment": "Malware payload (Phorpiex)", "value": "02f1ab4773767360c151cc903560415f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058617, "uuid": "68fbd82f-e56e-478b-80a5-7a0670ec5e74", "comment": "Malware payload (Phorpiex)", "value": "cbc590012eba8834dd1a984de7b17e92bdf616d06be1f622c42b41ab73844000", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058617, "uuid": "56e1956b-9520-46f7-b726-764ff7c25f32", "comment": "Malware payload (Phorpiex)", "value": "e59da3c41cf90258d61baa96c80ccb0dbeb276e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058617, "uuid": "a08fdd74-6cff-4544-b0d5-599919ca6a87", "comment": "Malware payload (Phorpiex)", "value": "83a2abcbf2066732637b6854694bc29279a1fd95ce4732bea4562cbf7ae5bb92fd3a91368347686362a962301cbf880f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058617, "uuid": "3b9d38a4-7d18-4b54-9c6a-20fed41b68e5", "value": "T145824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058617, "uuid": "fe27240e-52c9-42ff-9672-9dada0a5a325", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058617, "uuid": "0febdb4f-26ca-4c0d-9c13-445290297886", "value": "192:qUIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGI:q2IblVP4Y/2N0bLu9JgPL7Nyav8U9cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058617, "uuid": "15295981-40d0-4ebc-9ece-b1b9f492992d", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058617, "uuid": "3e7abea0-a50a-44d3-bfdb-902bcb77b7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058617, "uuid": "a9ae08be-8b99-4a0a-9c00-b4bde73529f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fefd6f-5ba3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089107, "uuid": "b28b883f-e38c-422a-ab7f-0fb291a77073", "comment": "Malware payload (Mirai)", "value": "c8cf2df84fa790f6df4ac0fa833de2dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089107, "uuid": "641dfcd4-0bcf-4361-ba55-9ef4e13c6763", "comment": "Malware payload (Mirai)", "value": "cc39b770d4557969d538258e162a86c7698d86af53665a105d648b0ae0d85de0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089107, "uuid": "2bcd3a3d-83a2-4673-87a1-47c393d3ccd3", "comment": "Malware payload (Mirai)", "value": "155980e30e9b2a4cc9acd7e0ee9f2d7b134eb657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089107, "uuid": "106e6e45-1ce1-47fb-976c-23cb089bec9b", "comment": "Malware payload (Mirai)", "value": "c8f3dca0b1fbe6d375fe584a07cf35298bdcb020b368fbcdf567f6e8d119fb08f90b894f72d95459948a95830dd83605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089107, "uuid": "ae818a55-a9d2-4ab8-8577-45ab8e0f7134", "value": "T147A338A3CC6A2E58D628D5B0B0B08F791B93A960914B1FBE69B7C7758053D8CF5053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089107, "uuid": "e2936cbd-4e3b-48aa-af47-b7f2629199bc", "value": "1536:ZL54C+mCZCwdKOoh77KFDT6f7XSep1WiQOg/0rFknC0I:gsCZcOKGT6rSu1Wp9c5+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089107, "uuid": "81bce35d-a715-42d3-8690-006ebbcccc5b", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089107, "uuid": "34152ed4-72e4-448a-b312-f682400ff309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089107, "uuid": "e353c76d-a763-427a-a4b0-f89a523106ff", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f33751-5bae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780093939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780093939, "uuid": "a5c65c29-d01d-4bfc-afdd-999aec454ce3", "comment": "Malware payload", "value": "a9d82f670350ceb3f353aadeff5af10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780093939, "uuid": "5885bf5b-8191-4fd5-a76a-ceedfe57f61f", "comment": "Malware payload", "value": "cd723423a557260337c5da110ac26d4ccf74b4fb518a70c15df7c6e211a39099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780093939, "uuid": "4759fa8c-e30b-4536-926c-06e46ecd6959", "comment": "Malware payload", "value": "dcc7b167f83d966cca34c056b0864d8602bac23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780093939, "uuid": "d49b0954-cd58-4b09-bb27-ba8433837134", "comment": "Malware payload", "value": "b1772aabecbed653215237ba43cda1da3c48eef61d2bf6f56585195c39581f21a014f77ac88e98234ad990336c770d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780093939, "uuid": "3aaed094-facc-4c02-91d0-38269bbd1555", "value": "T1EEF75016B6058D8AF4769278548B4FA0E372ECB18AB1933723B8772D2FFE34C5E91544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780093939, "uuid": "3c58d990-c053-4345-b8cd-3fff21995b3e", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780093939, "uuid": "504f5b03-2207-4c27-9ec0-1d72da7644c5", "value": "196608:SK7zgcx/RDhMea5LRN3fMArDr5nzFo5fMJP32:DRRWLR9hrp49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780093939, "uuid": "50d0ffa3-ca55-494c-89b0-da337a8519d6", "value": 72068904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780093939, "uuid": "78442abd-80e3-4893-89e5-23109f6c70c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780093939, "uuid": "cbf8127e-3f83-4aa7-8e56-c46701cc7417", "value": "zky868643801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ccfc1c-5b65-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780062881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062881, "uuid": "3223f65a-b934-43ac-9612-e5a4e3749ebc", "comment": "Malware payload (Formbook)", "value": "693eb138eb8d1c36a1d2efd6f6a93f3e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062881, "uuid": "d8aaa297-2490-45ac-bb1a-5938e747b830", "comment": "Malware payload (Formbook)", "value": "cdc6e7817adde2c04cbfdf3e5742743d3ee021a435f167bbcc522b334ee22a70", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062881, "uuid": "815d4edb-7654-4380-8d7c-f83fafaa40e9", "comment": "Malware payload (Formbook)", "value": "37bdde750df96462eb863c2248f6a46160a61907", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780062881, "uuid": "e0242550-2133-4e64-a6e2-0f58a3458092", "comment": "Malware payload (Formbook)", "value": "0bfe3641655feaf2bef6a45763a0044727dfc6270d4f8f8fd4382c53edb1a20884cd21882e831960860eb578f175c881", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062881, "uuid": "de136c02-35bd-4889-83ae-085bf1c69908", "value": "T131153350196F510CFAAF1C36710869A8BFAF90818AEEF185C66C08396D35E7B3D5139B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062881, "uuid": "f10e2a33-3091-44df-999d-2550fbd73ab7", "value": "24576:4Me4ezTYKj8gJxLk2JlnvH0Pmx2+FnDCU2wgK6q:4/4Y78CLk2bX2+5O3oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780062881, "uuid": "563f3c13-5ebc-4b6b-b0b8-6ed050d90d26", "value": 896080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780062881, "uuid": "3a3781d6-0d2e-4c12-9ed5-beb425b9e7b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780062881, "uuid": "49bacc59-4e38-49c6-9f94-fd7f9b6dd523", "value": "MT103__162,024,40_Febeuary-May 2026_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a78867-5b26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780035833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035833, "uuid": "6ab4ab05-a7b2-4f39-99f4-cb5cb5cd6315", "comment": "Malware payload", "value": "ae76043078f4a11ad15b9a3fc7ddee5e", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035833, "uuid": "3b76bb36-5360-42bf-9370-e94c89fd60b1", "comment": "Malware payload", "value": "cde4a0380727cc1dc03593b0caec55f7f7b3488f1f56ea9096698e6c19729ecf", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035833, "uuid": "ef94fa30-5b9c-475f-8938-0860fbc8a34c", "comment": "Malware payload", "value": "966293535d0ef3b25425d5ddda99f0633da3de34", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780035833, "uuid": "f3139ba3-1a78-45d0-a6bb-a194b8f445ad", "comment": "Malware payload", "value": "771e04ac645976e54229cc74d40b219182d743472c67e8548af9eb4b5d9e3020ed30de41fa629648513315ae90741edb", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "SHub-Stealer", "colour": "#F105C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035833, "uuid": "8ba00cbb-8a1a-44b3-ac88-ae2ca942dc26", "value": "T179210A22EF959B06EA01D3B1F6152CF90D49FD0A983E3547C1DA31890D079679BD29C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035833, "uuid": "e4801617-ca5e-4611-b176-605ddc146020", "value": "24:9OOlgv5nub8LDDydInoDJEonzkLK6dB82KFEttprwdXzCAlx:9poYb8LDDvkEonAfdBmFEfpr25x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780035833, "uuid": "421a379b-93a6-469c-b9fe-6c46a929df89", "value": 1210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780035833, "uuid": "a92fdd06-3f24-4090-a653-8dfdb32af8c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780035833, "uuid": "2d00fa72-2206-4f67-87b1-bf72906f48a5", "value": "loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc40ebe-5af9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016463, "uuid": "e0505fb0-1fbd-41d5-b9b2-5a7f4b00e2f1", "comment": "Malware payload (Mirai)", "value": "7970959bb89ecd3fb6b5f46010c1421b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016463, "uuid": "fb9ff3bb-c67b-49bb-9d0b-53ac5c9cc740", "comment": "Malware payload (Mirai)", "value": "ce53bebf146c0eb2198d3fc94faaa84ad9aeb858899c692e2894d6e413aab476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016463, "uuid": "642f69d0-1af0-4e2a-b942-d953164a0f64", "comment": "Malware payload (Mirai)", "value": "59344f4217c01d72fc922e493791c4e1bb76cd90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016463, "uuid": "d99d83cc-e51c-464c-9831-5547dc26433d", "comment": "Malware payload (Mirai)", "value": "cd44b5b06ea3964e11c5898fe712929bfcc28a11914d36e1306f858105497d7a09e37267b5b2a55d2f2a0608b19e3c5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016463, "uuid": "a38fbbba-55ab-4d53-9436-b5f032a25c34", "value": "T191831895BC828913C6D8137AB5BE54CD375223F8D2DE3217CE214F2136D992F0CBAA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016463, "uuid": "2c228031-7a14-40b5-b017-0dd5e7be0ab2", "value": "1536:jvM0evCYNs0Ox1mRdh6nxCdDEM5xucqq+PVj+Jf+VExmn8QVw0NwmqSUaKBzJrqI:D8dqMDqqqQcqSUaKzJWo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016463, "uuid": "2e96194f-0465-4c3b-a095-a149710f5bcc", "value": 87892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016463, "uuid": "9ed3bd6b-6e13-4f85-9e6c-9ccd2c491207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016463, "uuid": "f2391edb-bcec-4d48-8d92-2faf5379c995", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5768c643-5b20-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780032988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032988, "uuid": "ef779583-f640-4232-9582-8a62124bac60", "comment": "Malware payload (LummaStealer)", "value": "62b48aa4c3be32ff24a4b53acaad94eb", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032988, "uuid": "56c3dd28-1484-44a9-91c4-ce26b673ef4f", "comment": "Malware payload (LummaStealer)", "value": "cf018bde848f9ff756f653a778e4a73ea10c9ef47f4c49e1b062523b31a9e172", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032988, "uuid": "50bcb7a4-5508-4adb-aa14-d28f4095b66b", "comment": "Malware payload (LummaStealer)", "value": "aa1edbe453ef9ef0cb64e95602d7a76862f9f209", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032988, "uuid": "279a98a8-2b07-4abd-af7f-121a37dbba3c", "comment": "Malware payload (LummaStealer)", "value": "0bdca7f80aca9dd2251ac87a0398cf270fd604cf3df56c41ffbb4d25e139fa89f684969ba93c0ad0a5b9c28086e4dd26", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032988, "uuid": "5579b727-e723-4a7e-a63b-6c1c3cee5480", "value": "T16AC57C00FCD719B6E40623728AA762AB27399D064F329797EA44777EFD762D50C32309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032988, "uuid": "0c29e69e-b865-48a8-ab39-51a006c00dfa", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032988, "uuid": "93a52835-d198-4fbc-acdd-a69554ce2f38", "value": "49152:tbLf6J44F4KSnasi4/LsmJK6HBzbsO4iM:Nz6JP5rsi4mLOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780032988, "uuid": "f515e368-0ec6-461b-9c3d-0643a51bf957", "value": 2535936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780032988, "uuid": "148c8fca-d8ac-47a3-b394-0e18d0d91df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032988, "uuid": "82f2e0b2-f29d-40cc-b53c-cbad9014bf6e", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b92f14a-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056671, "uuid": "06201502-aafc-408f-bcae-6f59719a26ab", "comment": "Malware payload (BlackMatter)", "value": "c3a162efc59f8766f1883f46364344eb", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056671, "uuid": "3189f578-2561-4067-9588-9bb2fa4a3699", "comment": "Malware payload (BlackMatter)", "value": "cf3befb087ca768d1dcd4eee9dc75c9adb1ca26bce74865c9005da1c2c794274", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056671, "uuid": "36058004-11d9-439d-aa43-4acc4781b154", "comment": "Malware payload (BlackMatter)", "value": "a970139fe1fcf9a9be2d51ab744ee645b0141873", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056671, "uuid": "38e2f2ff-aa85-489d-9563-8b117d4a7ecf", "comment": "Malware payload (BlackMatter)", "value": "e2544af3edcc2ed1f475472804b3f39731b4eb3418ee40c5a5a1106c6cc3d036013dd1fce771e6a0f911c58b496f5c0b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056671, "uuid": "0d6eed40-f0bb-4aac-9684-8b074f5a4fe6", "value": "T124E36D21F212D073C87718F13736B572B39E8E2C25996907EAD80F9DBC648236F45A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056671, "uuid": "f40d6567-b911-4e9b-a7ac-750809c9e554", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056671, "uuid": "7c592ea0-ac9b-45c6-a2b4-ad154c1fae79", "value": "3072:S6glyuxE4GsUPnliByocWep9vu9qzcPoNGRl15:S6gDBGpvEByocWeju9C0oNGRl15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056671, "uuid": "f08bbb73-8fd8-48fe-8380-376f7cb1ca0b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056671, "uuid": "c4d6abe1-6f24-4fa8-b87c-721cf4bf9ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056671, "uuid": "7e766884-69c4-4fdd-811d-37a98a44faff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09878a9f-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058628, "uuid": "983ce092-b464-4c80-b5a3-11377fd46156", "comment": "Malware payload (Phorpiex)", "value": "068fe2a2f795e1206b070e33dad7254a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058628, "uuid": "d803f087-ef9c-43be-82cf-a05eb8acc2ed", "comment": "Malware payload (Phorpiex)", "value": "cff535e6dfde92026a6bb293423e472d8a5bc24732dd3034c1fe54118a395556", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058628, "uuid": "5a8b97cc-a99c-4d1f-ae6f-0bc43aadc557", "comment": "Malware payload (Phorpiex)", "value": "408d0ade20acbce20a5fb41158fc2b5dd36b56d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058628, "uuid": "f9198383-4055-4b93-b446-a995f92e8e9e", "comment": "Malware payload (Phorpiex)", "value": "acbffbcee3965049749a4d47c1632de32c801c80606e0c3ee2745420195577922a5f9a309fad5acf51d3a654bd324297", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058628, "uuid": "39bedf2d-ba17-4dc9-a155-c44a7dc9886b", "value": "T1B1824B0FF9418216D1E210B452B5867BDA799C72338458DBFBD08A9D0BA86D6FC3316F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058628, "uuid": "dbc0bcb4-253d-49e8-8c39-40d4478fcafe", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058628, "uuid": "79a650ed-7f41-44f7-a6fb-baab969e0b61", "value": "192:gIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGJA:KIblVP4Y/2N0bLu9JgPL7Nyav8U9cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058628, "uuid": "0b780520-a0a9-49ed-97db-0377fd1fe918", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058628, "uuid": "2b4320d6-ac0d-4599-8769-af4fc171997a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058628, "uuid": "b6912f3e-39fd-43ab-a89d-8cc3dc2d1e10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61326d4-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048663, "uuid": "f4a9b98f-6f32-47f1-940a-938cd9ac4ec9", "comment": "Malware payload (Mirai)", "value": "81174c364842e627464beefb59e4678b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048663, "uuid": "b6aad5f5-bbbb-4c08-afac-882e8a05ebaf", "comment": "Malware payload (Mirai)", "value": "d157b6505220f50d286020848830814a51b32cd58a82cd77ee51b2ebfb54e2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048663, "uuid": "428c8c32-4399-4862-a6cb-631e217ee932", "comment": "Malware payload (Mirai)", "value": "7c930f1686ce51801b889fef97b0c4cf71d7e0ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048663, "uuid": "4507a1dd-dc64-4301-9701-7744d7d481b6", "comment": "Malware payload (Mirai)", "value": "5e02c6fd5f125468881b5eec30defcad73e49a528961656d3feaff18db5942ecade4e646bf31de81ce0cba95bced7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048663, "uuid": "e6af2d05-5992-4869-b4b9-f4b6bc68dba7", "value": "T1D573A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048663, "uuid": "d68b9070-3029-4d68-b61d-4ebc9c3cb6ca", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStq:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048663, "uuid": "af7d537e-c227-4c2f-952f-23aacbefee65", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048663, "uuid": "fca3f7fc-7bc8-4bc1-845d-6c909b11ad66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048663, "uuid": "f2f529a9-1eb3-4fca-bbd7-eac3084c1323", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb6e55f-5b2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039658, "uuid": "05bd1db7-99ed-4af6-b56a-ac2e0f977288", "comment": "Malware payload", "value": "6e7eee2dbfa0a08e766c03252aae2bdb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039658, "uuid": "049af766-6f46-4f61-8767-1676622505e9", "comment": "Malware payload", "value": "d38fc9196a43e3c8c82c9cb95aa72875dcbc6cef75bbaa3015e97bdcdb6de5fa", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039658, "uuid": "4e3df37f-6a10-4932-bd70-154509b610d2", "comment": "Malware payload", "value": "a805c48913a17e930185641c46f6a5c91d7aee66", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039658, "uuid": "ba794fd5-60ac-4e0a-bae5-e1101969d278", "comment": "Malware payload", "value": "d8724bb8c9b82af7137e1a7d57957e076384721707164ad70b912fff37edc8ce978bf308f87b25c7924c3ae4dec19bc3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039658, "uuid": "47aff40b-550a-43f2-a5e4-e78195051a9e", "value": "T1F6F3122CD921419CCF236A7BB94822C172AA26F0B974538E14EDC12B33F743547AEB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039658, "uuid": "6e5b11fd-d06b-4619-a6b8-325e14ec0962", "value": "3072:+9uLxZJBrEgS2QREYRHTksXWMCMcQrHFed4IdrtMku32:FLxdzQWYVXSMcWHUd3MJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039658, "uuid": "19b8004b-3015-4f4d-9991-ab32cc87af51", "value": 171365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039658, "uuid": "85d15302-3174-4f90-96c1-c7cb1ccc409e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039658, "uuid": "36790947-2d99-4d0d-8213-5752c148342a", "value": "Invoicef.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3c70f8-5b56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780056409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056409, "uuid": "0a44a180-d0f0-45c3-8e6e-3342f7375000", "comment": "Malware payload", "value": "7db09d4a0cf201e043d5115ce1f71ba2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056409, "uuid": "c1b07dcc-0ebe-4974-a281-f38972c258a4", "comment": "Malware payload", "value": "d404db0018fb47e534f88f5a997b586e02955442fe53bcc28ab23354b08320b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056409, "uuid": "60602a50-20be-49dd-a380-e320612764e9", "comment": "Malware payload", "value": "3e908847661e2444c89a595bb1bce734adeb7eee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056409, "uuid": "c31accc4-ee75-424e-867d-d0c474fa371a", "comment": "Malware payload", "value": "3c3f08b1c154b3e50c8eaee269ca0d6ea7144a4518cdf9f2e5202a23979f2596de7c68da1a5ef1f8cada9e1210626161", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056409, "uuid": "d8e799b9-cc30-4f1b-995e-ea26ce5db5a0", "value": "T194E5F6986B05E347D4BC033502DB1B296228CA6575C3F31BBB9ABDF46E5B2F6940D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056409, "uuid": "722d8b2c-c4ef-4390-b258-505e49c466ee", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056409, "uuid": "aa3c42b8-f308-407c-bb16-657e61f3bce1", "value": "98304:OroGMEvavqzuiQiwlj//1Jmimy5xKacM:OroGMEvBuiQiwlj/GsKacM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056409, "uuid": "0ca10391-6d46-4eaa-a05a-176c7e10ad44", "value": 3175424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056409, "uuid": "173ea900-cc84-4104-979d-59f37509bab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056409, "uuid": "0ac56910-9435-4419-abc2-d5d05989311c", "value": "stealer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e8070d-5b32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780040989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040989, "uuid": "f4b60333-8e82-4e5d-9a18-821d9086aee1", "comment": "Malware payload (Mirai)", "value": "492c88026db9f674fc5f2e94658cf2f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040989, "uuid": "29a0d9d6-c10e-41bb-84b2-7d09f3a57c50", "comment": "Malware payload (Mirai)", "value": "d503c43061b795982f53851e66ae2679f6887c2897453b6a6c8d66b5cb4a8cc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040989, "uuid": "fdeb3a67-a4c5-40ef-b99a-f1679daed40f", "comment": "Malware payload (Mirai)", "value": "2f836f37570d007318ad8e5b6a0b03677d6b571e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780040989, "uuid": "17967e11-a527-4710-9f11-03018ab59309", "comment": "Malware payload (Mirai)", "value": "a1974c29d0debb6178b028022d5548d7ef6343e17c72c864040c6fe5f47b18d476c4d1d338c58727f997641bdd9cf8b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040989, "uuid": "d5a9fd9d-4b83-472e-b7b3-cb7d4f85fd56", "value": "T1C6A3850F3E554FBDFB6E873847B75E369245239626E2C140D15CE9002F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040989, "uuid": "b4b6df3c-355f-4f14-9ec2-44d05aae7a22", "value": "1536:uoZm1d9O9hdZIzHcUhFthyrBSevws8dR+DHxJFc5RNNI9byVmmYvClDomQsV:uoH9h07WSevw95mmYvClDdQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780040989, "uuid": "7d7a48bf-ce4c-4f51-8afa-f791ed3ba493", "value": 99228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780040989, "uuid": "033d0e06-99dc-4b4c-a791-e9981bda70bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780040989, "uuid": "adaa48b8-9ea2-4cec-8e21-6cf1d89720e2", "value": "d503c43061b795982f53851e66ae2679f6887c2897453b6a6c8d66b5cb4a8cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b2b13b-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048660, "uuid": "2a4d8198-5eeb-4e5c-8ee1-412e2fa0a7f5", "comment": "Malware payload (Mirai)", "value": "69cbe7c296532e0dda0af9a718cdf7d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048660, "uuid": "6f611584-1c0a-4211-891c-7d46100e3c32", "comment": "Malware payload (Mirai)", "value": "d5e259cca9bcf31b635d1fd29958e56b3d72b058bc6a35dea9a8e74a6dddb2b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048660, "uuid": "6d733fc0-30c0-4737-9857-82aa1d72d1ae", "comment": "Malware payload (Mirai)", "value": "4bf5017ad8a83040ba9a1282436175b57ad83ed8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048660, "uuid": "350c2ef5-3ec4-45d3-a921-e733b77a55d7", "comment": "Malware payload (Mirai)", "value": "6c670633854c10ee898ca6e3924c181467fade98270b657ed75090920b37a1d02447283f1aaae63ce915e96b03167cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048660, "uuid": "25f99066-26e6-42b5-abc0-d4594051c9ff", "value": "T10463951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048660, "uuid": "333f6cff-5193-4143-b14a-83e39c43e7ad", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAm:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzdL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048660, "uuid": "ea384eb0-9816-4560-a7ba-f6c507818064", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048660, "uuid": "d89105ef-222a-4a32-9915-094f23e04d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048660, "uuid": "a3c448b0-70eb-481a-bba5-b491812558fe", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e7c3ff-5b36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780042297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780042297, "uuid": "d208f5d7-48cd-4423-8250-ed6c24924338", "comment": "Malware payload (Mirai)", "value": "c141ffa7d892eb54692a71cd167ec239", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780042297, "uuid": "1f80779b-ac6b-4311-8061-f0c939422869", "comment": "Malware payload (Mirai)", "value": "d602aeb44313cc07b6e0f9877efd66198fdf8fb0e29d23cfead06da93331a40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780042297, "uuid": "14588087-24d2-477b-9699-2dd3fe3c0b44", "comment": "Malware payload (Mirai)", "value": "dc1093579f8b5ad94e43b7b74930cb0a8c1f5c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780042297, "uuid": "626bcbf9-4c6e-4e80-829a-6cf8fd63be84", "comment": "Malware payload (Mirai)", "value": "b372e2868e08ab0cec7929dcff242e25408ade06d49f80c4f8f699ca9945649e7aef3764d9514591940045f9cb2a1d9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780042297, "uuid": "d5bc4fdf-e680-4152-ad0a-8991ac679f10", "value": "T1B9736D89F793E0F4DD170671105BB77E9734EE121034DE6ADB94BE72AD32A12A11A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780042297, "uuid": "3c72ad6d-2f42-4f94-a79a-a4b6865e8ac6", "value": "1536:s/adpGDvkKaV805bS20mnoSjGnmENUA31fMA1iHk7DTjr:AuKvnA805bSXST2id0Dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780042297, "uuid": "87169abf-f66f-4135-9610-b551b5c905c2", "value": 78632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780042297, "uuid": "05c45d37-1ed5-4550-b6e2-b11f87653ee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780042297, "uuid": "7b893a63-e95a-47d4-aafe-e09de8443fed", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005985e3-5b03-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1780020387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020387, "uuid": "d2cbf89c-324b-4b05-819b-c35f5a3ebb99", "comment": "Malware payload (MeshAgent)", "value": "a4156a2240642fc1f3973e8bc342642b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020387, "uuid": "373982ed-e7c1-4c7e-80b4-1901180ff297", "comment": "Malware payload (MeshAgent)", "value": "d65f14e5652a4330354826925dc56937334163656f24dd10f112c15bc7559de1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020387, "uuid": "ac5f701a-f354-4f95-b6fe-e3b81b27cca0", "comment": "Malware payload (MeshAgent)", "value": "04fdac322f7c0974f7b49f6b265462f2db5e0b41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020387, "uuid": "de975c1b-d837-45b2-8ba7-0cfc295ea76a", "comment": "Malware payload (MeshAgent)", "value": "190951c7518640bb0e9ebea44ad10e975ab5516e173b8e8f84c60271f65add0d3da6cd744be824a714d8d075a93d950c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020387, "uuid": "acd30b8b-87f1-4b7e-b5de-f699476fa6df", "value": "T188564A03FCA914E9C0AED23489769552BB71BC891B3127D72B90F6382F76BD06DB8354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020387, "uuid": "f51d9f97-003d-48b9-b2fb-9c674e5ef32c", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020387, "uuid": "d1415db0-8f27-46a7-96e2-dd132cc09054", "value": "49152:EB5WfwxRvXTJmkmAyVRMD5SYwFaPkV7Hqbbj++08VMhJkKQK1K6WVC5E:EBYIzUsE0/+ZtWOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020387, "uuid": "7fa611fe-e39c-45ce-8fad-3def5272c4ab", "value": 6115328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020387, "uuid": "686739ef-eaf0-494b-8c9d-2a02280c4e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020387, "uuid": "184f5fd2-941e-4d0f-915f-e93a98ac3144", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b2018f-5b52-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780054398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054398, "uuid": "a4956dee-3f87-424a-938c-b6cac5cb7b27", "comment": "Malware payload (Phorpiex)", "value": "dc4b5d77d528348ad8c00aea84fddf76", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054398, "uuid": "da785566-7b45-4143-b76b-06ceeb9291e8", "comment": "Malware payload (Phorpiex)", "value": "d69d4497aa86ebf8e32ed15ecb21a3bf37aefdd23e517646680d62a718772647", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054398, "uuid": "5a53dd65-40fe-4fbc-823a-9720059e0f36", "comment": "Malware payload (Phorpiex)", "value": "6fc0ae562fa631c14e5b1fd1df08df8c5ca36ce3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054398, "uuid": "5c41c435-9977-4a4f-af29-a87db00fd56c", "comment": "Malware payload (Phorpiex)", "value": "85ba2984192f2597d193cd4826943401ee876a0f0d831bb406db26ddc2a50977c9612d94ed595c758c58cd3266e0a83e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054398, "uuid": "ab4a3278-35b1-4dfd-85bd-e1f29be7d296", "value": "T1CAA20805AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054398, "uuid": "89d44884-12ff-400b-b8b4-7894fd420120", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054398, "uuid": "3cf318a3-ea91-498b-a7d6-505e4003f4fa", "value": "384:Cu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:CNuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780054398, "uuid": "a406da62-2eda-452b-b536-10bd0d28e30a", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780054398, "uuid": "f8071e31-81d8-4693-8ac7-a741e4074f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054398, "uuid": "c547c623-1c45-4946-a65c-e7e9d458a1a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0081d9-5bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780098228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098228, "uuid": "3f0219e0-f8ad-43f5-8928-d4f8feb8be6b", "comment": "Malware payload (ACRStealer)", "value": "0f4dceeda5108a3de206b1f981fb4a34", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098228, "uuid": "8a1fc460-80ad-4a43-999a-13b70b9f6f94", "comment": "Malware payload (ACRStealer)", "value": "d6ea35c41477647b36f48603de3668d1d95b3ea87188626203dbcad9d35d1a01", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098228, "uuid": "0ec32c19-8ea5-4fd8-a305-9404d4cd8312", "comment": "Malware payload (ACRStealer)", "value": "fcde9d78bfe2e028e70d46ff7843d9437481515f", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098228, "uuid": "524a2cd4-3d57-4769-9dfa-595635ac1eb8", "comment": "Malware payload (ACRStealer)", "value": "9459c887b241d20be1d0e1fd085d91d1fb01554cf98d2994152201715aa2d835286eb39f7aaeb08c3663c46555076318", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098228, "uuid": "80339316-5d2a-4bdd-a0ef-b1d23a990ccf", "value": "T113F57C5B7CE049FAC0AA533289E762917B75BC080F7223D72E5076382FB2AE45D75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098228, "uuid": "fc81ac5d-2677-49bf-aa58-d8f8542394d3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098228, "uuid": "74900656-114c-43e0-a767-2100ed2c80f4", "value": "24576:TMhhBBDR3tNRlDP9PICIN6ePb/nF/VQsflHYgedbyPKq0s/nBele7tK2tbWQMmJ9:TMHBJRZlDPxICzePb/xVTDeuS3OXS7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780098228, "uuid": "06e137fa-ed40-4ce7-a29b-970751b820e6", "value": 3361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780098228, "uuid": "50c92f24-591f-4d84-8bd6-9c146c585d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098228, "uuid": "6beb2b50-3d35-49c0-b851-9c672c18a6f5", "value": "SecuriteInfo.com.Trojan.DownLoader49.48333.10691.1217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0d8645-5b5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780060239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060239, "uuid": "8bd68d75-4668-4f02-ad65-ead14d480acf", "comment": "Malware payload", "value": "5b2a85028286e8b4918e9921a97696f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060239, "uuid": "14be99d1-ddca-417f-b3a1-714b3d9c383f", "comment": "Malware payload", "value": "d6fab4ee888d37bfbf3c2d59f97c93f6d0e07763a6d8eaeb2dc6c17be04e2e93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060239, "uuid": "34472c86-2093-4cc9-8410-6e1da0f23d6b", "comment": "Malware payload", "value": "35494f1bec2cefbbbce0fec4584cf737aa4cc9df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060239, "uuid": "91ef9919-182f-4419-9541-cf1c913ca61e", "comment": "Malware payload", "value": "ed7ef38a9937f9180c9593488c9c2ca2d633b0487719c618e036db0b6f1d45551b7751da991257f7c06a132df6dfa51f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060239, "uuid": "3cde5564-6446-4edf-83dc-4b6d3107d06d", "value": "T12BD02B6C04F13913A1384A02B10712D1A71090931530D274F1145330787F5E0BD8670A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060239, "uuid": "e9c38918-1609-4206-9f62-c48000be2968", "value": "6:z8EUTA4dMZnutBAkSWC77/5FFHcP/v0PVOjV8GBHBV:YEUTHWZV9F7VFFHcP/vBHjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060239, "uuid": "c382efcc-ba92-468f-ad1b-55ea1bc820b0", "value": 256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060239, "uuid": "25c75d98-2234-4cb6-bdfd-8b3559f8b1b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060239, "uuid": "7e6d131b-1a91-45a6-a6d0-9634f70d36a8", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1e994c-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056677, "uuid": "8abd6e1e-4845-46de-8c95-a2be484d8f8e", "comment": "Malware payload (BlackMatter)", "value": "9a09e701d79bc9048160d861dbafcb18", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056677, "uuid": "886cffaa-e1b7-4a3f-b86c-1db6addc1a24", "comment": "Malware payload (BlackMatter)", "value": "d715b248f71cd6ba4fcc78b89e9184ff5f0a04b9d02790bcbc30e13c040d3973", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056677, "uuid": "767c078b-6ef8-4895-b8bf-0a444c3cfb71", "comment": "Malware payload (BlackMatter)", "value": "06dc8b0505092d93c9c4fe60de0434d93321d7a6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056677, "uuid": "11436ac9-e3c8-4b1c-a497-63cef9596e63", "comment": "Malware payload (BlackMatter)", "value": "52c56b122865e6ebc1d4588d6da4d0c6759c397c3d581ec622d074490af373ea2e3ee0b136e4e911eed9095a7a8e549c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056677, "uuid": "303f3a17-4fab-4dd1-bd25-d659416acaee", "value": "T137E37D21F212D0B3C83718F13736B172F39A8D6C19A96847EAD80F5DBCA58236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056677, "uuid": "a9e73be6-c5b0-45eb-b646-70dec362cd95", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056677, "uuid": "5bb6816c-185d-4173-b529-15b835c1f202", "value": "3072:s6glyuxE4GsUPnliByocWepWLl1F9Z2uOyIk:s6gDBGpvEByocWekLHROyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056677, "uuid": "582ef3d4-bdd3-4ad7-9882-1d9a00d1e014", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056677, "uuid": "de79a2c4-9438-450f-8a15-4378eb10eff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056677, "uuid": "a3eb30fd-3669-4e27-b179-332d2470542a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cc500c-5b61-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780061032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061032, "uuid": "661892c1-c632-4b42-a815-4932b49a2e59", "comment": "Malware payload (RustyStealer)", "value": "b5d4e31af5c0ce24d8b1e257e3107675", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061032, "uuid": "8677a936-80c7-4033-88c5-7f8bde4c106b", "comment": "Malware payload (RustyStealer)", "value": "d7c9efe83a46acea1c8a012e0ac0b697c3b6bc282d192d2b07cf2361d8fd8345", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061032, "uuid": "19104b8b-015f-4a73-9beb-bb41d976ef6e", "comment": "Malware payload (RustyStealer)", "value": "7981d11ffcee35bb7d13904e5efd43d238326b67", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780061032, "uuid": "a228f449-a3fa-4e80-9339-001d763688ac", "comment": "Malware payload (RustyStealer)", "value": "8118c7c5e1fbd925ca1ec45efec467f652b86a9f56628b972ba3fabf8aca1f7d7dee9fd8f762966ba725f9b37cfa6e22", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061032, "uuid": "ee595e62-48a5-487d-8b44-22c9f6e1ef38", "value": "T117764C17BBA655E9D1BBC4349392523BF93170DA0B34A6EB45C0462E2F22BF49E3D344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061032, "uuid": "15da09ce-16a9-4984-b6e1-77c8df3e7f8b", "value": "fc9e7b5527c41aa73160ad4689a75c33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061032, "uuid": "701c703d-fc5e-499d-9936-57047e46bc0a", "value": "49152:9M584zCbQxOdkGtexoc6xLqnMKD8bnGfc93iCdFZvw6ieZJwvv14ZEtlxipcLZbX:KrgrJ5uScv14ZslW1L5KGkGG3++h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780061032, "uuid": "61cac881-1e42-4fd1-97e4-a22012af79b2", "value": 7255040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780061032, "uuid": "5ad49a36-3ca1-4fd4-9612-d94378e05baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780061032, "uuid": "5865d237-add8-4432-8262-0309a7ee854a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399a2e3-5b68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780063879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "df33a21f-12a6-48c5-af1c-c6f6dc539e65", "comment": "Malware payload", "value": "9b2e4acac71b9daa92fde55e4a3b56b7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "05af15db-e526-42c3-968f-1b84c91c9f37", "comment": "Malware payload", "value": "d8a6366c9fbf5a41c82774f1e499aebe1a9bf9b078331f5a2c174ca0785c3b92", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "2bbd1e44-5dd6-42a5-92e7-da2286fbbfa7", "comment": "Malware payload", "value": "f735ce168c8135dfd8800041ff0ba647c06230e8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "52d9fbaf-96ba-47dd-8e15-6ec2ebf71c8f", "comment": "Malware payload", "value": "734e7900e15d07c992be1d872581ba99a9ca45be4eb6da16b0d27381bca14dfa1c9bbbff9eb84973dab1dbd73cb6e609", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "75af8bb4-0fdb-4b48-af3b-a02f4e4334f7", "value": "T11D955B1BACA109E6C49A63338DB762817BB5B8480F3223C72E50B6783F767D45D3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "c8210e6f-d1fa-4df3-9655-6c602017d3bf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "99e8d85d-d802-43de-ab74-85e4f6797073", "value": "24576:gc58li5AOmBOa3nqfiGe0TOHF7WwG0cljYMxwELfLBele5ZK2h48YT:gc2liyOmBJXqfiyTOHxLaQeHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063879, "uuid": "72bd647e-8417-4891-af00-8d5a285404bf", "value": 1979016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063879, "uuid": "ff116c67-5cee-4961-9632-4501d2d5be58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "41b504b8-4147-4f08-9a27-5451c5d0d9d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dffe305-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039066, "uuid": "82b4a32b-7520-4671-88bf-da14ba9a595d", "comment": "Malware payload", "value": "43fa568f0b38ccbc6e9f2557dcc0a478", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039066, "uuid": "9fb22d64-ba38-4867-9607-8f0bd23f2f9e", "comment": "Malware payload", "value": "d8c35972101923e509a4d9b0b159c6cd5110811d09f8ce8e98d4defcef91c682", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039066, "uuid": "738a5695-c415-4276-8711-ee057e3583a6", "comment": "Malware payload", "value": "2340903010447c53373a171de66ccc478475618b", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039066, "uuid": "94827f17-87c1-4068-bbb5-fc59b31091f2", "comment": "Malware payload", "value": "58448b86976004070c1a0343a3b4c0ea2128286c30fd916edd64ca16db7a675657958aea2b3a997e038ac569359bfe3d", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039066, "uuid": "b92df874-059e-44dc-8aa9-daa63bef8825", "value": "T173136D6526953C25AE99883B5C7E2F0CBDA983E2304491DDBFCA3CF18C15A9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039066, "uuid": "49b991ee-a3da-48f6-9c1b-ae31b6a9d3eb", "value": "768:Q39NyXsZztCW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:eHusZuco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039066, "uuid": "6406ce47-e23c-4562-8ae2-7029c8b9212b", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039066, "uuid": "b9ce4418-eafa-443b-b95c-0ba107e318dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039066, "uuid": "7fc3883b-86e0-4f6b-9c06-8663d6b967b1", "value": "d8c35972101923e509a4d9b0b159c6cd5110811d09f8ce8e98d4defcef91c682.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee1eef-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780039011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039011, "uuid": "0606363b-0810-42a3-826d-94888ee44e6a", "comment": "Malware payload (RemcosRAT)", "value": "768e2f4e6136a4fcf24ad55e1730e8d2", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039011, "uuid": "0c811594-258e-4a7f-964b-0ed7c49a43d9", "comment": "Malware payload (RemcosRAT)", "value": "d9950b1564b0d38cbaec507c8e1cdc41df08d8a638e5f050ff71cb5ceed84867", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039011, "uuid": "2037d0fe-87bb-4f9e-9911-bf7dbe143386", "comment": "Malware payload (RemcosRAT)", "value": "bc78796ef28abbdad9511270eb4cba2a462dec5e", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039011, "uuid": "74bbee53-4e98-4d9e-81b1-52db4f95f72d", "comment": "Malware payload (RemcosRAT)", "value": "08fb080de9a397f78e1edc4e311c72e6c372090f9eace5d272b6eaaee5b7daaae11f01c27604044abc984a79fc88b201", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039011, "uuid": "aed54859-94d3-4061-8044-58bace964c22", "value": "T10393D813FA4AD0B2E46591F146426F31CEBCBC3636492173D38FCA41AD79892D416EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039011, "uuid": "2aee0a39-d0a8-4bbe-ac3a-90cdb45508c3", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039011, "uuid": "b9369ece-14e9-42c0-971f-af9c96a1068a", "value": "1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6hrV:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039011, "uuid": "99df4d70-7a98-4053-ba28-cb295f7a8fd8", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039011, "uuid": "bfa3f309-3cb0-4c2d-87bc-45a13d1af689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039011, "uuid": "00d2b431-3aa1-49ff-8dd6-2c5b81102f12", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eed9fd5-5bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780098231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098231, "uuid": "63d4369e-0826-4eb6-8d91-d05015c8ee40", "comment": "Malware payload (ACRStealer)", "value": "0af0c4558314dba020a85abeb286705d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098231, "uuid": "1713b213-c5b1-452f-bc9c-7daf16d33394", "comment": "Malware payload (ACRStealer)", "value": "d9aff50ce278f481649acb776de0c2350c410249d97781cb33da92098fa330f5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098231, "uuid": "7ce037ed-d8d8-4c85-b13e-7f4499311bda", "comment": "Malware payload (ACRStealer)", "value": "8283633b80996bfbeda5f011db502f54009dd5c5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098231, "uuid": "7e1ee466-a2ad-4e4a-bb92-9dd8e5730141", "comment": "Malware payload (ACRStealer)", "value": "6d18bd0112c522b24a1b713e999c718a90238a5951e72aa622e82f6ea5420438e0d6ec36ce676e2c6c8271ac44f02528", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098231, "uuid": "9c44f293-760f-43c9-93e5-ffe5f1faa311", "value": "T18CE57B16ACA109F6C4A653338DB76291BBB4B8581F3223D72E50B63C2FB27D45D3A744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098231, "uuid": "15f0816f-4237-419d-b128-d612aae8dd7a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098231, "uuid": "8edf834e-6a3b-4f70-a89f-b51e2d1dfac2", "value": "49152:NSifJ01lmr/L0XOYH30rGE8qh0xrKgj7wcHQ3:NzJeWPVhYXUcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780098231, "uuid": "6f87c40a-ff2f-4a26-a8ce-f085f7edfd75", "value": 3220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780098231, "uuid": "683cfc36-8790-4aa1-97e2-162d446453ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098231, "uuid": "76ffe836-8ba7-4b5b-9e34-7da1935fb198", "value": "SecuriteInfo.com.Trojan.DownLoader49.48332.21363.7609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e29190-5b24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780034575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034575, "uuid": "93e2b165-5758-4f92-80eb-bcc520d85458", "comment": "Malware payload (Mirai)", "value": "369eae2b38207e5784eb10e243d7a6fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034575, "uuid": "2988ab4b-7401-4e61-8740-07ab8a7a7c11", "comment": "Malware payload (Mirai)", "value": "d9de7eafb02a7d6d1bde6a68afae1e0f21d1db24e3aa579a911d0e78c5aa6e9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034575, "uuid": "b7236370-7745-4615-a009-a4543ab02be1", "comment": "Malware payload (Mirai)", "value": "bc14bd94f515510c073a5c701fb19556de5414af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034575, "uuid": "c2626476-ce99-49ca-a8f2-503d6bbdec43", "comment": "Malware payload (Mirai)", "value": "3be6428701beb63fa561f02ace84dfed0b800e7d48ad11a8beba7b1f0abf415e19214365d4007506cb3dd1a1b35080a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034575, "uuid": "ab9e8748-8794-4a0a-ab1f-c5522718a7d3", "value": "T17604881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034575, "uuid": "6067cd0b-fa98-456a-996a-029e294187d0", "value": "3072:jg57RM7LHZwbq1YSBan1yvbysxr1uGS7I:jglRM7LHZ0Bqyy1BS7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780034575, "uuid": "1cb4fe2c-0168-4335-9c6c-cf79e9cc4880", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780034575, "uuid": "0d4de756-905f-4fa5-aa13-936950904bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034575, "uuid": "1b8d2b99-6b83-4e5a-8250-855a740c0ae7", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8606a3eb-5b85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780076446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076446, "uuid": "44d3de7f-3a6b-4d3c-b729-3a6c5c87053a", "comment": "Malware payload", "value": "e5d94c0ddc8b37fce170bf09e0f262c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076446, "uuid": "eb646bb5-d4d8-4417-aeb2-253250677e61", "comment": "Malware payload", "value": "da554223b34fccacd6d67451b98dfeca28b665a954071f44ccea6b06fd2bd3f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076446, "uuid": "dbc4ebe9-f81e-4705-af63-a93439f3b041", "comment": "Malware payload", "value": "d25f6e21b303210f5e0d96e111eeb5ead8f609d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780076446, "uuid": "70435998-905d-4bb3-9c9a-14a8520b8a58", "comment": "Malware payload", "value": "bc7e7f54957d913dad0979160cc7e450734628dc90e69241ae491b37d6692d082f17600a82ce7a3b6a85acbde6f88444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heuristic", "colour": "#FA57F3", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076446, "uuid": "9e2611e6-0fb1-42f4-83f4-bd058f2b7282", "value": "T1803623266AEF6858F059F5BA0FCBD77EAB89F9E9214B4B3B2144530BCF406513E01871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076446, "uuid": "7a4b9403-a684-4aa3-a2fa-249280ab9148", "value": "119e763b3e9f61f135735e7ca0d95306", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076446, "uuid": "31375fec-24de-42fc-9a65-527ca0bcd36f", "value": "98304:VxUthd1Dpf1rAZoTT9DFNu3yNQExc7BbD/VOtkdBejzah6oQCcMWL+K:8tBhpAZ8NxRGpDCkd0jzK6oHWL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780076446, "uuid": "44f63eeb-d39f-4f83-92b6-4854bbbb7a82", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780076446, "uuid": "0ee963a4-1ca2-4627-9866-bc2b4507b52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780076446, "uuid": "5efb1b86-ebc7-482c-a814-1791d37ef236", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u97f3\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe07217-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780058638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058638, "uuid": "d402ff15-3475-46b4-a71e-004cf2df0ecc", "comment": "Malware payload (Phorpiex)", "value": "49f5b01153b33dd3b733097d703b6074", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058638, "uuid": "268f6a93-ab51-4c5a-81fe-8ba634814445", "comment": "Malware payload (Phorpiex)", "value": "dc2936ea921e2cbc56b315d1c08d2c3e1ce4f4e22524c9bdee12a8ea2e037e5a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058638, "uuid": "ad10bbda-19c2-4559-be3f-72ae50b5f926", "comment": "Malware payload (Phorpiex)", "value": "78f410df86aa586c95521c0ac585be634c69b4f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058638, "uuid": "0458b61f-7a05-44cb-8cdf-8d8e25bd24a5", "comment": "Malware payload (Phorpiex)", "value": "9f77464d8abc4654ba67cffa2ca4eca58b9df2a8d15c971eed91b3781f32affa9b86f783d9c1739b52b355574cfb75ca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058638, "uuid": "5015aefc-0d60-4083-a0d3-b84c8f9440c7", "value": "T185824B0FF9418216D1E210B452B5867BD9799C72338458DBFBD08A9D0BA86D6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058638, "uuid": "6bed9aca-01e1-4495-9769-245673337d0b", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058638, "uuid": "0e2dd773-0043-4282-a3c2-0c7afca82fa5", "value": "192:/RIISCngTBvblVPT0Y76fIkq2NleQY9T4KUSvu9zw+ggSmOiMbO5Ot1EdkF39TGW:DIblVP4Y/2N0bLu9JgPL7Nyav8U9c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058638, "uuid": "989c9881-0ff2-4cfc-8220-1bc512ef7642", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058638, "uuid": "e066bfc9-d130-4322-af57-45c07700f96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058638, "uuid": "f7fcdd3b-a8dd-4e09-b0d5-973f3826e014", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad28257e-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "39653bfe-0109-4fc9-9cb3-7c637c036e71", "comment": "Malware payload (Mirai)", "value": "cf23533028cc47f3476802e92c2e5cde", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "57ab11b2-323f-4999-aca6-c4bc3b42cad4", "comment": "Malware payload (Mirai)", "value": "dc69038f83d3ec23e4e5d77c61b581b07d16bdee56777c8ac61254cd23e0d4c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "8d2938b3-c9f2-459a-9a2b-cefdf6e1f178", "comment": "Malware payload (Mirai)", "value": "dd749f7225d2743a486ce96d7540c5ef37fb0918", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "b2b57b28-16ef-49f2-8f02-238f07bcbe58", "comment": "Malware payload (Mirai)", "value": "d66abc8a60ecaf3789ef84d8b3cf1c68128bc932523cf2713358bf63a02fe850fc983b8dd12157efe59510e2d768f96e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "acd71763-32bb-4ea9-af97-f42a47a51703", "value": "T15814C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "605d5acc-279e-44c5-8b9d-8efefb3bbbfd", "value": "6144:4f6eQCbeoufx44df2dp06GtCqjYW8nY1j20WI:Vely44dfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036568, "uuid": "b772d049-8ee5-473d-b931-709bc5585be2", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036568, "uuid": "0ccf74e0-9c00-4619-bb82-d5a4dba9ad84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "16bf3d4e-bd63-48e8-bcfa-455d54fb3961", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab05b503-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048591, "uuid": "e352cde1-d056-4f44-81b2-ab14e145a68e", "comment": "Malware payload (Mirai)", "value": "1cacdca7ba9b41a5ffa9229c00ec3635", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048591, "uuid": "69db2a0b-5a0c-42b7-9fb8-31d436cc3ca8", "comment": "Malware payload (Mirai)", "value": "dc7ee9cab7b34054b067e281afa0f72a9f710b5608d2135506558bcde26fbb96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048591, "uuid": "e7a6e1e7-6884-4a82-ae4c-168145ec36a5", "comment": "Malware payload (Mirai)", "value": "00e067850380ec30f6f9e979d26ed538715822f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048591, "uuid": "a94541e0-7e51-4933-8b33-f4f9ab8efc21", "comment": "Malware payload (Mirai)", "value": "1b0c543d5359a02e55ce4c342a6c8eaba2e6a55968a33ab360e2374e8cea699777f150cd736eb9a24d254512e4b63633", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048591, "uuid": "a9d6c298-0b72-44a3-8a19-e8a5b9184f04", "value": "T1F9C2D0E07726EA31C420AC3DE53A4D8A3A51067C91FF393664158D399FC1A9A63F48A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048591, "uuid": "c0fa0356-1e88-4435-ae94-44a215504b28", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrI9q3UELu2:PKy4qfqoeJdXWgxLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048591, "uuid": "bd5ff446-3d2d-4ee9-bac6-a94e0a961d9c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048591, "uuid": "33911fb6-3062-4bd2-b6a1-c1a80f17670c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048591, "uuid": "0bef0dbc-a1bb-499e-ad8d-553770793c1f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e599ecfb-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037522, "uuid": "1657935d-1d63-41ac-88b2-9c9c1936f18d", "comment": "Malware payload", "value": "651f8e314d3a8c421b5b1a3fa590da42", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037522, "uuid": "30a5a516-8738-41bc-949f-acafdd36c402", "comment": "Malware payload", "value": "ddcb25ee4715a186558c8bf9540929049d9d69e0fe23d15ef885e71327d217a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037522, "uuid": "b6c48769-e4a1-4a27-9b71-a2a2b2d5d932", "comment": "Malware payload", "value": "0a70405ba562a28595bfd89e734469700765e043", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037522, "uuid": "7d6d7a8a-e91f-49c3-8287-95bcf9548edf", "comment": "Malware payload", "value": "13de519a4d5b9cd3a3e2a71b94fed21b2715460f3e1dfc1a86ad248ffbbecdc199a1e1766c99aa7c2e56f3b0584dbce7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037522, "uuid": "26109147-6723-4bf3-83f9-f19dde2d616c", "value": "T1AC76DD6BADDC361E3010F186F48525F5E6621336DBDE1299B8F828337BF5896C02D786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037522, "uuid": "9ba94902-e743-412d-b55e-0e786025d732", "value": "6144:uubnYpsc43SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsR9wpNpVwS0msFJvXiESUWE:bPUfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037522, "uuid": "85a1a47c-15cd-4831-b77d-5e7a40a84103", "value": 7563833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037522, "uuid": "523a7ea1-e2f9-4ba0-a7e5-ef9e3f148dbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037522, "uuid": "365d904e-f706-49f6-8384-9ba625552943", "value": "Update_7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b859bd-5b5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780058265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058265, "uuid": "fcc87c99-3c06-49de-b796-e219f7b53491", "comment": "Malware payload", "value": "cd87b217f84b573f274f678adeb748c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058265, "uuid": "9ee330dd-d151-4d72-ae54-9df1fa11b9b7", "comment": "Malware payload", "value": "e03366927f0fca9ed37d17d0884810a128e9c936fd55d3b642e74a9a8c076219", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058265, "uuid": "5f3a84ad-0369-44ab-9ee3-671f2433dd83", "comment": "Malware payload", "value": "2313ad56b6b9e0d43e73c7d64b961c38fe3bcfb2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058265, "uuid": "e15a1991-d0e4-44a7-9e40-4c983672e3f3", "comment": "Malware payload", "value": "1da008cb6d02abe52549f30e0dc2a58d9cf8b4d96f896e9516ca54989a9e7231d729feab4b81c896647dd11b05a7b095", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058265, "uuid": "ebb006f9-7b06-42a4-980a-7565286e01d2", "value": "T15EF0DD55AB6287A5E722C3F6B1C2FBDAC28728808246FA5209C90A9148042A58891370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058265, "uuid": "dda9c258-362b-4046-9baa-3c8acf1a4800", "value": "12:5jQbDxgV84SKYrecKoaSuUc2Z8NrwA196Zf1gbTxgVPaa:9qS84PYqcKoaSuUJZedUfkSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058265, "uuid": "70bf6cb4-e356-41d3-b5e8-aef35ddbdf06", "value": 615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058265, "uuid": "411a7d29-7f59-4731-b356-7eb96749e686", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058265, "uuid": "7ffc35d8-c9a6-4a84-a755-2e96216e864d", "value": "faktypa298896.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f735e82-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056651, "uuid": "ba368591-e50f-4600-80d6-565105007163", "comment": "Malware payload (BlackMatter)", "value": "90444b81b105945fb5ac8a19195b4eb4", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056651, "uuid": "86cc019b-7bfc-4e65-bde7-83f36035f52a", "comment": "Malware payload (BlackMatter)", "value": "e040fac4e5b29fbe7606c2d39372935a8aee80a3167c7521efabc7c3e002a242", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056651, "uuid": "5b451b47-e2a1-42d0-81a9-1d87c9030c09", "comment": "Malware payload (BlackMatter)", "value": "d5f7e2001fb5c34d448dc1bfe0b3b147145689a7", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056651, "uuid": "25886f1f-43a0-4fc2-ba27-012e8ad7b641", "comment": "Malware payload (BlackMatter)", "value": "fdee1ad0eaa47c46a22034c56a82df8cd0b1c36437cbe44e7635e8398f5e82ff3474508c79039512fbbce0ebdb3ce048", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056651, "uuid": "abbc2548-8684-4b1a-acf6-97c0f9e2ab48", "value": "T14FE37E21F212D0B3C83718F137367572F39E8E6C29996847EAD80F59BCA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056651, "uuid": "6588d612-ecbf-4209-b184-cdf79269363f", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056651, "uuid": "906bc10c-31fb-4079-a1a3-43d21e1def0b", "value": "3072:q6glyuxE4GsUPnliByocWepXgbZggCheU:q6gDBGpvEByocWeNgbZbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056651, "uuid": "44a6e372-5190-4139-84bc-d02b9e6f8b9d", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056651, "uuid": "2fd74d6c-e1dd-4ca4-9540-0b592fe349d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056651, "uuid": "ea8eeae3-2e13-4867-bf9c-ed0c2f141f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75d63ca-5b41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780047430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047430, "uuid": "3fd9b230-9b06-45cf-96ad-236d2c965cad", "comment": "Malware payload", "value": "e384ab7928beb337660cc8bc8df0d99b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047430, "uuid": "eb971c68-52f6-45b2-a12a-88c36856730e", "comment": "Malware payload", "value": "e06721afb9d6fe0e0af0a5b08c3e931f5f24ad63f0ab0b421899830536dfc76c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047430, "uuid": "98c43757-31e7-4bde-89e4-156247a4fea5", "comment": "Malware payload", "value": "7ea327dde2ff2268b14ed0912c3facb804f828b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047430, "uuid": "0781ac4e-3c0a-4765-9ed7-7364e2860415", "comment": "Malware payload", "value": "8eeedc64b1cb76534bc1737595e6f4c647f41b93bf365b9ef88ea95f6130643843ffdacb9a3e663f79176f9a8cb29b1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047430, "uuid": "5074951a-3b83-4422-9ef2-1b0443c5d4a7", "value": "T10E01DD9B61B0AC3078B5C93CFD9786F01047141768452D0D709F7E04EF2CA4CF6A2656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047430, "uuid": "ef9a609b-3273-4383-b44e-4a161d3737c4", "value": "12:Izzfsx80+alp/LeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TalMHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047430, "uuid": "d4440152-1150-4d25-8acd-8eaac6ed244d", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047430, "uuid": "74f8e778-451e-4b64-a3ec-a940d7396f12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047430, "uuid": "a5d108e0-707d-4580-878c-7d382fb397cf", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35513a-5b5d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780059088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059088, "uuid": "a6ca098f-a79f-499f-a751-e7b9f41590ea", "comment": "Malware payload", "value": "b2076d728f5e6b3136871f8575f5be7f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059088, "uuid": "89c1302b-01ae-49ab-b0e5-6ee2f1f2427a", "comment": "Malware payload", "value": "e072e113a0f1681610085c6d9ec6c156d7de1b853fe935b78c2f8484d3a3fba3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059088, "uuid": "d5b90709-1df5-438b-95e0-e32521f06791", "comment": "Malware payload", "value": "380e74d8ff6a1979ac7f38a74af83a8f3b265c3d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059088, "uuid": "cb1ff926-b918-4dd6-b4fe-15a0611aec56", "comment": "Malware payload", "value": "7e59807f5833ac660a4d0b64b70dc1bf36617841094a6cc3627ab25fd7b2487d52116d82a1a6df355ea3cf2f987d50b4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059088, "uuid": "a610f91d-5c51-479e-b5cc-9cde83e72f19", "value": "T1BF0120215AB451C0C6B5A637502AAB84C0A2FC43CF2877FC80012CF8FD30395D60F59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059088, "uuid": "408d840b-77e1-4a70-a010-e13aedb053c5", "value": "12:8eid0oSnGWVUSeAg4SSno6rWs8XSWrN0niA2XNULk5fQjjnk0CElO6hQzdqJfzL1:8LsvJfSuir9UYlQU0CafpyXuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059088, "uuid": "9b6ab7f4-f562-4f1b-8a05-3fb0b2af3aa3", "value": 841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059088, "uuid": "05441587-0064-49f0-bb78-53cbf482ff58", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059088, "uuid": "4151559c-c6f5-4d40-9bd3-d30c1bb3341a", "value": "statment.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1672e2-5bb8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780098229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098229, "uuid": "61101eac-ceb7-4e77-afb9-8e016f6e1715", "comment": "Malware payload (ACRStealer)", "value": "1ed95a06c8079f7dcec191521083e622", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098229, "uuid": "d0182fd3-94d5-445c-a261-9a1d84fce441", "comment": "Malware payload (ACRStealer)", "value": "e0ad30d3587be86f17733492d4b774601356ff5b5e09c17f536704a4ced88f9e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098229, "uuid": "1c9b6931-42fc-4e1e-9bcf-34da6c3622af", "comment": "Malware payload (ACRStealer)", "value": "4ebff376201bc71d09bc292c1846959ca5290e50", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780098229, "uuid": "5323ce3b-332f-40f8-9cb6-1e68b5c0fb80", "comment": "Malware payload (ACRStealer)", "value": "cf9df6f4480774ab278f4f3b404f4c96eab1406c34811db4465eb233a5a37f84241810d8a328b7f1eff509ba9a662594", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098229, "uuid": "a0093884-c051-42b4-a819-b6ea7d331608", "value": "T175E56B26ACD045FAC4AA93338DB762917BB1BC480F3223C72E50B6782F766D49D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098229, "uuid": "6cd70747-5b35-44ec-99b5-0a02db946dbd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098229, "uuid": "8bd92717-78a3-41dc-8a7c-1fc230dd19c9", "value": "24576:G3JEhQPDxpQzt4ADvqoq88/4NbB4U35M3BLMbFeKfWOr8HdfLBele5ZK2hgTyTBB:G3GhQ7xyhrDk88/49uU35OIWm8tH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780098229, "uuid": "cad6a444-580d-4d00-a2ae-a0036af9f038", "value": 3220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780098229, "uuid": "67090a89-b0b7-4a8c-8d9a-113290e3098f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780098229, "uuid": "bd3320e9-c5b0-456c-9e5c-45ef6655acd1", "value": "SecuriteInfo.com.Trojan.DownLoader49.48334.684.15613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1aafc0-5b73-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780068591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068591, "uuid": "3db084f1-481f-40a3-b849-b709fae5ef6f", "comment": "Malware payload (ValleyRAT)", "value": "87ef9c0a88c9a76cf89fc51c9ddc7bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068591, "uuid": "f758ff71-8abf-449a-a9d0-90e7167aafbb", "comment": "Malware payload (ValleyRAT)", "value": "e0d2f36b23d891d4ecea1348306ac3465677cf94239f65c8e729a830be7ce86b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068591, "uuid": "acb47ce1-0079-4a06-8c7a-589239e6db6d", "comment": "Malware payload (ValleyRAT)", "value": "84c276ebb3a0ae56ec83cd017f6a04ded0adbd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068591, "uuid": "7bbeba05-f8f2-443b-94ce-78fde25bef24", "comment": "Malware payload (ValleyRAT)", "value": "9db796e7a53417fef9f44a19d2f6862e58742ff0a7815d39ea6a8c06d63e72c6ae5946a2d7bcb37db19ca7646c92108e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068591, "uuid": "b94d9504-9757-46a1-981b-79f9f13b12b0", "value": "T168957C06B66541FCC09BD278C61A5657E7B17C86172097CF1290BAA62F73BE21F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068591, "uuid": "dce068d0-0f6e-4dfa-aa90-fcd4b7ea3f1a", "value": "49ea913537e8846d169d32fce7302ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068591, "uuid": "ace391bb-b9ec-4674-960c-5c7dd9914157", "value": "49152:m/7E4O8OBQOH7D1dCKAJg6PwcVPPbL7MyTt:mAJ9Sgc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780068591, "uuid": "c28ce433-f6bc-4453-89ec-98964b20771f", "value": 1941088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780068591, "uuid": "cae27ef4-0393-4a94-b196-b2be068ab4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068591, "uuid": "72ca20c0-a078-4b10-b605-735ef097e459", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecc5bfd-5b53-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780054771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054771, "uuid": "38a940c4-f557-43a4-a86a-bf4f75f3e4af", "comment": "Malware payload (Phorpiex)", "value": "b3911d56041b86efb64103c21f25ac85", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054771, "uuid": "9644b914-8ba0-4e67-b349-12bc69665143", "comment": "Malware payload (Phorpiex)", "value": "e0de4e3c9dee9877c78832ac9ebe3fbd2de45026896d6fc2a5ca12f6b588a29a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054771, "uuid": "5045704b-f88e-49f5-8bfa-24d6fd97cd80", "comment": "Malware payload (Phorpiex)", "value": "83f50a003946bf563c28a87a218dde4c84518382", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054771, "uuid": "6f7c02e7-1c50-44ee-998f-a5c193423d9c", "comment": "Malware payload (Phorpiex)", "value": "60fbead9974baf8bb5136564933f871df2beef70abba97aa1c9be773ccb418c0eb26344f93851bae937e543a9166ca48", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054771, "uuid": "e6515ee6-5c5e-420f-a85a-7daef8c135cc", "value": "T16DA20806AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054771, "uuid": "52d6bf08-2a94-4bd3-98e2-8a6df4165b28", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054771, "uuid": "14a97085-b0c7-490b-a1f3-9a0dbe11f623", "value": "384:Su1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:SNuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780054771, "uuid": "7d6ce46e-aa81-4a29-8e42-85b0971f0825", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780054771, "uuid": "c99befe4-4a85-460e-9f88-7200b7fbbf28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054771, "uuid": "a541065c-1933-409f-b47c-c77ea6bf09e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94408d26-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038674, "uuid": "75755af7-d77c-497f-ae67-d6dc67fc6627", "comment": "Malware payload (Mirai)", "value": "dc55833dd4610563c58a53297c00bf8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038674, "uuid": "a53f365a-d804-463d-98d6-4649b936be30", "comment": "Malware payload (Mirai)", "value": "e1c8a2fb632c2ff06e7e898bb249236403ac0a2e92a323fec266bc3f650df38d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038674, "uuid": "724ea2ea-583b-406e-bb5a-340533877451", "comment": "Malware payload (Mirai)", "value": "92b7c278a52a8d419a978f0481e15868a9ec099d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038674, "uuid": "a8278b2e-9298-4e46-8aab-dfd1a1f5b692", "comment": "Malware payload (Mirai)", "value": "7c24f20dbddb0fb9ff182e2cbfd87dda64cabce121021ddee606c6d8c7b3175c4259a240ca20f33992b49da6ecd010d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038674, "uuid": "ca1b18d0-5ccc-4696-b8cb-118730ed80ef", "value": "T155A3C509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038674, "uuid": "81d57ae7-33d2-4cb4-bdca-0a2291f83d5f", "value": "1536:JxODm3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7qyr:J0DOpPRWu8ERZ+0u8vjhhqyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038674, "uuid": "f0c954c3-f277-406f-97f5-792494e86e16", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038674, "uuid": "21069bee-2f95-4ece-aa21-3cc12141beda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038674, "uuid": "6f3194d1-1fec-4e9f-bd59-f541b464f426", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73749b99-5b42-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780047638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047638, "uuid": "23d59149-61b5-4aa0-b385-b53dd75ab695", "comment": "Malware payload (CoinMiner)", "value": "38260596704d742a36fd21642a89fd2c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dota3", "colour": "#794FFD", "exportable": true, "hide_tag": false }, { "name": "mdrfckr", "colour": "#F784D3", "exportable": true, "hide_tag": false }, { "name": "Outlaw", "colour": "#E615B7", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false }, { "name": "ssh-bruteforce", "colour": "#30900D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047638, "uuid": "29b19f7f-1797-4252-8b41-b2ce43bbb5ed", "comment": "Malware payload (CoinMiner)", "value": "e20b8e1d8337cec11d40db7580f42460abbc2b60ce0938bf2c746a32e0747421", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dota3", "colour": "#794FFD", "exportable": true, "hide_tag": false }, { "name": "mdrfckr", "colour": "#F784D3", "exportable": true, "hide_tag": false }, { "name": "Outlaw", "colour": "#E615B7", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false }, { "name": "ssh-bruteforce", "colour": "#30900D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047638, "uuid": "693a1470-bd8f-4f03-8762-d9b911d7266d", "comment": "Malware payload (CoinMiner)", "value": "cc88d65077d3d3128d94aaa0dead1d6a759dac5a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dota3", "colour": "#794FFD", "exportable": true, "hide_tag": false }, { "name": "mdrfckr", "colour": "#F784D3", "exportable": true, "hide_tag": false }, { "name": "Outlaw", "colour": "#E615B7", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false }, { "name": "ssh-bruteforce", "colour": "#30900D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780047638, "uuid": "75891f79-fc4a-409c-96d2-af7851df2988", "comment": "Malware payload (CoinMiner)", "value": "fd2094452211e44921407ff54c6eedfc3401d04c05ce7b198d34d77a25f4a2aab3c58cc7c794300abdb29d6d59fcb4b2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dota3", "colour": "#794FFD", "exportable": true, "hide_tag": false }, { "name": "mdrfckr", "colour": "#F784D3", "exportable": true, "hide_tag": false }, { "name": "Outlaw", "colour": "#E615B7", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false }, { "name": "ssh-bruteforce", "colour": "#30900D", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047638, "uuid": "099822f4-72e6-45e0-8c71-2bdf086508e1", "value": "T1DB64231E8DF92FE617F9B124B34E55A2599214E066144BCB36A3CFB3F46D0EB8391870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047638, "uuid": "1efe4327-a714-4199-a574-ef97af397cb2", "value": "6144:1kR7o/wGrxvjYAJ0VDfxG4iLFsHJ5AZ7noTOB6TN3GNa84QECWuoH2/dDWKJP:yR7o/CAJwZGBQ5CqOBHaZBw5VDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780047638, "uuid": "7c263403-3425-4836-8e60-d2559df866a9", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780047638, "uuid": "41ce2608-b95c-4caa-9335-bcc3d3542002", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780047638, "uuid": "42ce4a42-096d-49f2-a38d-c09a13b8e43f", "value": "dota3_82.156.212.174.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb252e54-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089098, "uuid": "dae2fd2c-4593-4d77-aac4-d8a44f5ecad0", "comment": "Malware payload (Mirai)", "value": "decc03caa3827d6cb0577d4b29332c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089098, "uuid": "fb6964ab-5d6a-47ac-aea8-b9f1bf837f40", "comment": "Malware payload (Mirai)", "value": "e2542debca5a511aa354fa38329b819194c7a044191f70e0840ac678a8f1baff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089098, "uuid": "f1e226ba-c8d4-40bb-a484-7a1b5e4b3966", "comment": "Malware payload (Mirai)", "value": "2a63585f7f0611b8dee70c4d060fe0cfbcd61b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089098, "uuid": "e908391d-f552-457e-a41e-795283c2dc8f", "comment": "Malware payload (Mirai)", "value": "f3475d562d4ae89bcd5eeaa9798c1841e3f4ad445b3b74620da543e26b724173e520e339e6b2b8aee9e5ac681499998c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089098, "uuid": "2e2fa2a4-48f3-4bc0-a635-501fc4a4449c", "value": "T162C39DA7B24F1491C42647F81BC79B9C2A3325019D2B5AE76C6E333E1B776DB18063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089098, "uuid": "447162f9-ec39-4bc9-baa9-612d4a7cbbab", "value": "3072:UpoyR3BBxVn0khNzSTzKesR9q8idOg3Cn8ygtNn9NqK:Upltn04NzaCU8ifCnUttqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089098, "uuid": "aff93d1c-dac3-44a6-8b1d-daf943376834", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089098, "uuid": "d412b65a-1d9a-44ee-9da1-edda4d08f1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089098, "uuid": "1dd4d89f-70df-476d-9fa6-48bf2e226a66", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d318c817-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048658, "uuid": "945aa085-b164-4170-9344-050f422b14a7", "comment": "Malware payload (Mirai)", "value": "02e2d0d70219d80d55d1baea26dbe4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048658, "uuid": "f99fb02f-0621-4955-bff9-f186052d5587", "comment": "Malware payload (Mirai)", "value": "e27c27c5b454df4b5374dbae917d1f41f82385bda6e6fce63b2eaedebaace454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048658, "uuid": "a10a3ffe-274c-4ea9-ab13-d5548c813bd1", "comment": "Malware payload (Mirai)", "value": "735f4773840736ff60c7d78a37f8a56c11491073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048658, "uuid": "b2c3df10-2576-4469-a2d1-ecb4c62e9639", "comment": "Malware payload (Mirai)", "value": "09307d305e89cc3d6b2fade30e4b98c5f5059dfa6db604a7cc2ac185cc0ac4aebea7f447fab0f5af1e844a091fc63301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048658, "uuid": "6f48ee6c-00dc-4485-ad20-502beecbf640", "value": "T1A4230891BC819A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048658, "uuid": "c38eaaec-05cf-44ec-a8b1-34be96601b0b", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THL:5DmKF7Gxyk8cqoHAmWurAufsG5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048658, "uuid": "448e2000-7984-4c18-b2b9-992ae308cfea", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048658, "uuid": "0119b4a0-5c74-4d71-99f4-1423abc64fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048658, "uuid": "a4e99f49-15e7-47a4-9f36-aa15372401a8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ecb192-5b14-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780027993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027993, "uuid": "4aec8a63-4196-4786-a560-44b7812841e4", "comment": "Malware payload (Prometei)", "value": "76fea57d69a0c1bc51bd7a3d68f7f70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027993, "uuid": "54649a58-347d-4b9d-bc03-ec0f9546deb8", "comment": "Malware payload (Prometei)", "value": "e28850d5d93537bcd1e1c43785da36233c03629d2f52d09fc2d08469a479932f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027993, "uuid": "b442e80a-e811-4803-9683-8a1887aeefe0", "comment": "Malware payload (Prometei)", "value": "a99e861f7aa1a0037b23b8d643eacb178ad6b840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780027993, "uuid": "2a57d1aa-1466-45f7-80e3-a5ba03f993e3", "comment": "Malware payload (Prometei)", "value": "d171d2625238e3b34a514fcb94b161d660768c01ae31fa65b1c3d723e60c0fc315363e88760386beef14c245c789a081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027993, "uuid": "7260be70-530e-4068-a5fb-0c731a9c7dce", "value": "T10C13D744B8505B1349D6A2B7FF8E43CD7B261B99E3DD33039D153B60379A96B0E3A242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027993, "uuid": "781ef485-5148-4a05-ab6e-1af125920ec0", "value": "768:ycJ74xnu8dMPaJ2PxZlF2SQ+25Egw4VgoBiMsTEyku38M7xVy6Ou4B:P8KBP98SMw4VgooT047vy6Oum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780027993, "uuid": "2745d367-e335-4304-a5b5-a17dfb835780", "value": 42560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780027993, "uuid": "bbd194be-6b9e-4116-a671-0c782b2d54c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780027993, "uuid": "82e0ad53-a023-4e76-a45c-daf0d8602029", "value": "e28850d5d93537bcd1e1c43785da36233c03629d2f52d09fc2d08469a479932f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dec9b45-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038610, "uuid": "4d294f9a-7333-40e0-8085-b8e2288bb557", "comment": "Malware payload (Mirai)", "value": "dae6a036c220fb286c9341d5343f847b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038610, "uuid": "9efe25a2-e8c6-41d9-9018-435357bcc3ec", "comment": "Malware payload (Mirai)", "value": "e29f245dec20f3ae2a1948e6883c8ae66eff299a5c7324c6974784c03914171f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038610, "uuid": "4c1ea168-7165-4d01-a5b3-8abf66cbd5bd", "comment": "Malware payload (Mirai)", "value": "95ce6d4a8f33dc76fe5c64bba7c0b4e50abc9346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038610, "uuid": "c1a39a27-29e6-4208-bf3c-85805d3b8427", "comment": "Malware payload (Mirai)", "value": "f87a4b9226d41dc8242e1d8314d169d0e618b860488df749e53c1a721dd09a3661f94818a1ccd178e7bb4fb47af61a53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038610, "uuid": "d5b978b7-543a-4464-b128-8563b1564882", "value": "T11FF2E160F55438CADEDD58390DD5D2C87BF68FB533982BE16AC04F01190D82BA996EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038610, "uuid": "175e67ab-d614-4cd1-97a1-fcebba0f096a", "value": "768:b7160aX0xrq5uHZEUZxhIvTyWKeB/SwvY4uVcqgw09K:b7160akRou5EoxqyChc4u+qgw09K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038610, "uuid": "062bd824-483a-484a-b4ad-5582c0794caf", "value": 35100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038610, "uuid": "cfaef067-bcf8-4dca-8cc7-a7a4f1603913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038610, "uuid": "1dd7a03c-ba4e-4013-8072-3208b9acb4f7", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab59bf33-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016808, "uuid": "24ae694d-6640-4060-9f3b-0cb0b1c441eb", "comment": "Malware payload (Mirai)", "value": "b5812e2aaf2461f2af9d055bc0f656e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016808, "uuid": "e6af75ec-4bd2-4786-af71-7973c902e76d", "comment": "Malware payload (Mirai)", "value": "e31acbbb46e89cc73df1bd0d970ddcdbb60956745c701258f68e625c1b92efe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016808, "uuid": "9ffbbccb-311e-4f07-8a96-ac9b8a22a2ca", "comment": "Malware payload (Mirai)", "value": "0e50d965b520674a8b85e2699e18cae532f7a997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016808, "uuid": "a8ca8363-690a-4d98-b0fd-3b57c30ca4c2", "comment": "Malware payload (Mirai)", "value": "e8a2992a4fe72af75704fa75a6faf2fcfbdcfbfa4baef0bbfdb79f4b97465981b8e7117267e897952bb16e98fc982a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016808, "uuid": "aa6d725d-1ae2-46c8-a7e6-3a77eb4e6c09", "value": "T13573E652FE81CD51C8D938BBFA1F46DC3343076CC3EE75029E16AB2566DF1994A3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016808, "uuid": "d8e0949f-34b9-46a6-9401-1284c0dc6a0c", "value": "1536:vUorNxK+AO9l1ga73ffSlwp7ozIja6deFoURrO427:36cF735pd+6deOUrOL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016808, "uuid": "33172c7a-c051-4790-8b4d-9aa394157cd5", "value": 77580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016808, "uuid": "96ecb38e-2b2f-4c1a-8b04-0a325c6f7e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016808, "uuid": "6ed00047-4f4f-49d8-82c1-792377c251e5", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db1f872-5b21-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780033509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033509, "uuid": "3c1836bd-e994-4038-b9da-19b979ee10d6", "comment": "Malware payload", "value": "2e83b32ef732c656853a3e3eb2bfa13e", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033509, "uuid": "96c0e50f-68fa-4d04-8a6b-342692c6ea50", "comment": "Malware payload", "value": "e3fde18679125e0a5f003b9068ef101a3ce4c4980488b32796cf1aff654d9041", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033509, "uuid": "44674614-55d6-40c7-b824-be19398bb556", "comment": "Malware payload", "value": "2100f993ae0cb4337277af147d54832c391392b1", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780033509, "uuid": "95c32070-0257-4486-8fdb-fbd0b44b6f88", "comment": "Malware payload", "value": "1d4c1a82d3e145a666e6dec6e31ccad76225ebf0fb3df8e07e02d083592dc4200f6b8fd7c0b004619eaaf73c10233399", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033509, "uuid": "ee5a6de6-eeac-4f8a-be63-086bf2853e49", "value": "T148027662DCAE184DC363443150436290771B79474F810979FB6C93D1BFA9E7D7270AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033509, "uuid": "38df29a8-916d-4653-b53e-a8ff19b9742d", "value": "192:OH9Sq78TZExaNyeJCFy8AiEAXioYAzlf8GfX1oAk3bLa:OH9P78TZE1eQlAIioYCF84X2AH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780033509, "uuid": "9963cdcd-4ccd-4f53-9eaa-c699d193c21e", "value": 8352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780033509, "uuid": "c964603c-b9a3-49d2-ac62-2d1395f9af13", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780033509, "uuid": "a6286f81-a52e-4a97-87b9-ac3e7be02d28", "value": "boss.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbf5fdb-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048652, "uuid": "ad3b87c4-7a25-4f2b-b8f9-425a59fe8e2d", "comment": "Malware payload (Mirai)", "value": "83d405e897522a30b83bbb1d0caf05c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048652, "uuid": "34a5b1d0-a628-4802-96e1-441adc5b0385", "comment": "Malware payload (Mirai)", "value": "e4902d5374b672d554d5bd8459c6c93befb36e24f689fd55131822a52237d39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048652, "uuid": "bb5a66ac-a8ea-4247-aef0-6122931f438e", "comment": "Malware payload (Mirai)", "value": "b6b8a23a3f826c647a4b8841e29f24775ecac6c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048652, "uuid": "2d51f694-5bac-4297-8d8e-8d9410469b1f", "comment": "Malware payload (Mirai)", "value": "82dbc3fe6835f4f6107c7628e9a554d51d8c232ce32b38832d2b07773bee564b3008a24a4012a532e862c09a44f3c688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048652, "uuid": "954dae02-4dd2-4f4e-bdb1-e179c7627565", "value": "T16BC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048652, "uuid": "f71c4455-a6ef-4c43-a514-dd8a5e0702d3", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHosrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIsrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048652, "uuid": "915346dd-07ad-4fa8-bb34-bc325c6ddad9", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048652, "uuid": "cdd70f6c-2de1-4cc6-a8d6-57fcb9417da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048652, "uuid": "50153e16-b93c-4337-9883-df0fa64723d7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11736c9a-5b53-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780054775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054775, "uuid": "23d64d3f-44f8-4ab9-a980-f5527c1f933d", "comment": "Malware payload (Phorpiex)", "value": "cb5ac13573de1f86295b8294852d5dd1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054775, "uuid": "1297d5c4-73bd-4656-bc27-9fce431ac13b", "comment": "Malware payload (Phorpiex)", "value": "e50d0e5abf23d4cdb1021c0db51572a785150f0a797fbe57b203b54c26c086e1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054775, "uuid": "e09d7c95-3d0c-43d6-a3e1-f3d7866beb7c", "comment": "Malware payload (Phorpiex)", "value": "09714139aa12e6d7ae43ca726a75ef3d4af5300f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780054775, "uuid": "02789a08-b5b0-4707-a224-a49a81a00586", "comment": "Malware payload (Phorpiex)", "value": "f2bc90eea06d52e392552aa20912b9da7c92d950682bd1a9c6720869fd22603fd4a2cef06dc64cda43a36216308130d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054775, "uuid": "e2bd1091-f3c9-4cc3-84f7-ea42dfcbe104", "value": "T1A7B38E1030C1C432E566117988AAC7B98A6EF8710F756BD7FFC406AD8F366D19A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054775, "uuid": "85d189ee-4dfe-4e7b-aea1-b9e144a53f2f", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054775, "uuid": "52973c4a-25b5-4b82-a75c-c983b109d495", "value": "1536:djKtSmJd7d52Dr59gzmkVa8S9rL2sFTfEcvSn0Mv3fx/h5Km26E8Yj29:FKtS2d6oS8S1LFTfHm3fx/h5Kmuzj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780054775, "uuid": "ef6105fc-25e5-493b-aa09-08d5942e6298", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780054775, "uuid": "7a0adacb-932e-4b06-9b54-6bdab6dcaf28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780054775, "uuid": "b64ae89b-3f19-43cb-a402-764166d35359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e33f3d-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780039151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039151, "uuid": "46799f84-db94-43b8-9662-e17e49e0290e", "comment": "Malware payload", "value": "0657947607db32c48a9d85e2df7150fe", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039151, "uuid": "9269e94b-507d-4dd1-a63c-ef158e442a98", "comment": "Malware payload", "value": "e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039151, "uuid": "8929900d-98bc-4e47-a820-3e1f3980fbc6", "comment": "Malware payload", "value": "87a24e4466f8a29b48b2031564ae8caf00b86d28", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780039151, "uuid": "c284118e-0df8-4fed-b0f7-3c5c66174b10", "comment": "Malware payload", "value": "fbbe99510770f844264fcd46f60d26e17b8ed95ab19a331769276d97243c274617a4c867152bbd4c5a39b394b04093e4", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039151, "uuid": "26dbf0c3-3d7b-45f7-82a6-dfd095b456b3", "value": "T18A138D6956857C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C09B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039151, "uuid": "40e7c6ce-89ba-44aa-82d7-cd344a35c9de", "value": "768:bq+K9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bq+fco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780039151, "uuid": "887aa5ad-0cc6-4f41-8fa1-d1fb29ad70fd", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780039151, "uuid": "d34db3e4-e554-4763-8dd0-3f861f43adae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780039151, "uuid": "34c22726-88f6-45a6-b5d2-bb2d8b3b6163", "value": "e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c529bba-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038607, "uuid": "28661d11-da5c-42a0-84f7-b0ebea50ee6d", "comment": "Malware payload (Mirai)", "value": "0916fc86c24a649ff398e862cec1dade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038607, "uuid": "e274b4f4-49cb-4ca0-960a-a681ab70296e", "comment": "Malware payload (Mirai)", "value": "e5e0909e0894708ca368a7c56651018c00c406339de5ebeeb89cef71db115880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038607, "uuid": "a1abe4eb-f5df-456d-8b2e-0f715fc37251", "comment": "Malware payload (Mirai)", "value": "f37f458d6603fc920a993216909dd4b651ac607f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038607, "uuid": "1e3a4e56-82c3-4ab4-8712-102bee4e9aab", "comment": "Malware payload (Mirai)", "value": "90b5eb28ff8b26bb24daaf69454a8a0d87508e8263332177dea54ae9804ed79e6823f0ac3a16829fe35ff3053eb3f579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038607, "uuid": "75963eb1-94a6-4a56-8189-4bac58e7f05f", "value": "T17A83198BF800DD7EF80FD6B74463490EB930E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038607, "uuid": "243311e7-fbbb-4e16-a637-335bda7880f6", "value": "1536:XQOjxmw2V2xAYV8a2toPuYAht8f489k0rTUhrIpu1HT7ot4O9I/nPaED:XQO4Q2Ldht8fsnrCupQ9I/PaED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038607, "uuid": "609d4e5b-b18a-4496-974f-e5f0fb4c11d8", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038607, "uuid": "6a7fe29b-84ea-4b3d-ab77-379f11d1f240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038607, "uuid": "e0e663ba-8048-4b26-b95f-fcece5c47bee", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6bd8ae-5b2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780038933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038933, "uuid": "a4291867-c3f1-4961-aba8-198891e8ac71", "comment": "Malware payload", "value": "24879cc2b4174fd711b88199e6c99940", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038933, "uuid": "69243dfd-dbe5-4938-b6d7-6929bbc814e3", "comment": "Malware payload", "value": "e5fa7ff50d1b425e3c861c945ad4b5be327d4830e36aed38592559b6e31ec31b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038933, "uuid": "1f62ad3f-1a78-4af9-bcf3-6138bf84de0b", "comment": "Malware payload", "value": "8a9c2037b07336013087ac1ef9375de9996e0760", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038933, "uuid": "7664e779-a3b3-4a41-893d-20e06982652f", "comment": "Malware payload", "value": "15120df0df3b6f5887a499144b8a80716a3c69c35aca631a2c18224c090680c6bb73b2ac8d44a03b3291c1928cc7c309", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038933, "uuid": "25c7b175-436e-465d-a453-059d67e620e9", "value": "T1D7137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038933, "uuid": "1a8bb488-7e84-4c8d-9292-001b7610f8aa", "value": "768:7+V9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:7+Gcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038933, "uuid": "95549081-e9b5-4b61-a09b-2b6518147d79", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038933, "uuid": "4e7c9a34-284b-41b1-a119-e77a2146a763", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038933, "uuid": "226c37d6-71bd-46b0-8b2f-e43e5a9b2e9e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fcd12b-5b55-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780055810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055810, "uuid": "7c721a2e-d263-4891-a7bc-a971a4c51a0d", "comment": "Malware payload (BlackMatter)", "value": "10486806995e97f0d197ff0e090863f2", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055810, "uuid": "c188ff24-2a6a-4cf6-a72d-0fd0c4aedbb1", "comment": "Malware payload (BlackMatter)", "value": "e67dbabcd48b1294883b07d7724f416a77963c79aaf9d81bed9d7e2d0dcd9731", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055810, "uuid": "cc70389c-3503-4ede-b79f-59268af10483", "comment": "Malware payload (BlackMatter)", "value": "83ba91f5d9f999aa40617a65a0e8df930301935b", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780055810, "uuid": "2127498c-7a94-4975-9497-516350b66ac6", "comment": "Malware payload (BlackMatter)", "value": "02db10dd2fc98f93956497f5ad545bd68870f7caa2c719e83d8b004c01f05266343119b4066243df749cffe93764cb09", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055810, "uuid": "6e24966f-4200-454d-b80f-f485751a7c65", "value": "T132E36C21F213D0B3C87718F12736B572F39E8D6C19996907EAD80F99BCA48232F54997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055810, "uuid": "a798834f-9566-4920-ab12-77dfe1c81ce9", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055810, "uuid": "bd0676f0-30f6-4b39-a0e7-47696ed39d9a", "value": "3072:L6glyuxE4GsUPnliByocWepEa2mi40h1duzJoatFErAt:L6gDBGpvEByocWeKP34TOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780055810, "uuid": "f4d006df-52d2-4989-b69f-e8381886e32a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780055810, "uuid": "9fa75c25-3b65-48f9-ab9c-a2735aba67c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780055810, "uuid": "0440f215-4529-4829-8a84-7ea6210022f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a793e9-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780056695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "507fc8c6-850f-4da5-898c-269611b89414", "comment": "Malware payload (Prometei)", "value": "5a50692be4e0dcf9f59697fce073b10f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "b208dbbe-5d2e-4e69-923b-3bc31d8616c6", "comment": "Malware payload (Prometei)", "value": "e6ce5dd2d422c2a0657d1315d12c836e17a6636e378b3c6c1ed57bf1bfebe469", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "7c28fe13-afa9-4964-bfde-b711b69dd4b5", "comment": "Malware payload (Prometei)", "value": "68e05b05f39ff26a209d30738328ed5494b8c2ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056695, "uuid": "b4808469-2ec1-40a5-9ecc-4ef326c0337c", "comment": "Malware payload (Prometei)", "value": "d8896851df3d1f08200db9abafa50951e9190a9239b7bbcbc1db8c5f931219aba3d0ffff645e25aa4cd3d68f003164b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "c85ae9e0-bf07-4ffd-9d8a-9f0701004c7b", "value": "T1849423F4C3779B9AC5872A758B7AE381D674BE555BC70849B3ADE9330138322A750C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "81fce995-52c5-4c23-8049-5eb81574989d", "value": "6144:3584cmYYMg0EzyNP34/Aam6xbQJPlViUWxUzgFjVyBXH/0r1HTUcm6hE+:35843YYXyi4am6OPj7WaaVyJH/0ZHTB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056695, "uuid": "f9e963ee-0af0-4d1a-a198-8f1a9a091098", "value": 436122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056695, "uuid": "5fb8e76b-8977-494a-86dc-1f244f4302a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056695, "uuid": "b5ffa55a-b19f-4974-a9b6-cca2e134ec2b", "value": "e6ce5dd2d422c2a0657d1315d12c836e17a6636e378b3c6c1ed57bf1bfebe469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f719ef9-5b23-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780034210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034210, "uuid": "bfc4f9ad-e9d9-4adf-a509-af8dd6b8a368", "comment": "Malware payload (Mirai)", "value": "664b478c4edafe1e34a14f4ee7aae372", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034210, "uuid": "990e6b2c-df5d-419f-9958-a294efefa561", "comment": "Malware payload (Mirai)", "value": "e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034210, "uuid": "a25133ab-9abc-403e-a93d-20acbafd8c98", "comment": "Malware payload (Mirai)", "value": "7635841bcf3393fa891464a5161afca5704fc45f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780034210, "uuid": "4b151ca2-2937-40f0-96d3-fd1b97d2c3fd", "comment": "Malware payload (Mirai)", "value": "6065a003ac28e6c6cdbe475c496ad051de70502dfbe7532a61b67046cfb695319e9169f1f81bc35785863e18c4782e87", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034210, "uuid": "70e1d6a8-5241-486a-860e-bc068ce7460b", "value": "T1F731A1EB22A090B3C46DED46FB9580C5E04846C3D1E6EFBCBCBC6526489814CF1B5B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034210, "uuid": "ff1cf2ae-c958-460c-828b-7b32eab1a269", "value": "24:ZQAOJcQLrQkQPQJIQ3QvBpQ88QCNI4QSNI/Q7KPpQrKP8Q5nQIqQuHpQ+8QRXQw:ZEccrBioISGp3836KKPp8KP8+0BHpp8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780034210, "uuid": "427202d1-9649-48e8-9141-48302de4292f", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780034210, "uuid": "c7e28168-9ff2-428c-8da6-5cb9cf0fe577", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780034210, "uuid": "0636eade-8cd2-43cf-bd94-03b731b94a2e", "value": "e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ceeb1f-5afd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017879, "uuid": "c60e346f-42f9-4dca-b86b-b9895a479267", "comment": "Malware payload (Mirai)", "value": "d85bf38836ab68c7221ef237bcbcdb7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017879, "uuid": "6b50a2ea-b6e0-4bc8-a301-c525c3330f57", "comment": "Malware payload (Mirai)", "value": "e7793ee88f5f49eaacf19f8cf69736d17804d259f68f3ddaf542b41bfa28f321", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017879, "uuid": "7481f10d-5315-446c-9b01-cc062680adb5", "comment": "Malware payload (Mirai)", "value": "35439319248b54aa54ce3d611774f067a31ef2e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017879, "uuid": "242fe9f1-9107-4295-8b42-7f1b6e8000ca", "comment": "Malware payload (Mirai)", "value": "e3d3e25093387dfbcd92a7684548d30fcade8ce3930043c97292c6f240a23ff1f34398cc1fd5a46ca7b0ddfac2328e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017879, "uuid": "0b201e09-a6f7-4196-9bb8-1959b29cbe81", "value": "T197E2E139D0D59A44F83DA13C0C9E7ACE2DC0F638920986E66F986CB7F94AF745A18741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017879, "uuid": "5a67774e-3258-4785-85d9-bcfede033a09", "value": "768:cVZSJaWlDy4/il3V5QieKxf6aDA4HQ9enbcuyD7UoQRjk:sibd/iTFxiaDA+Pnouy8oyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017879, "uuid": "4dc4cc25-8452-42b0-b094-2bb1a5b9a3ca", "value": 31304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017879, "uuid": "10fb0e88-8001-48b3-a284-5fdecfc891be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017879, "uuid": "146330a1-412a-4d4e-9b5e-678c662db335", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899bfdb4-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038656, "uuid": "4a518df3-cac3-489b-98e0-c9a422777f9c", "comment": "Malware payload (Mirai)", "value": "c199a0aa35331ca44853bf7b4db14022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038656, "uuid": "c1e38b33-f7e5-4158-821b-bd4b49846429", "comment": "Malware payload (Mirai)", "value": "e932cb84733a4edb3560a7912424500b2e263efe8cc22a927a5dbdbcf2298f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038656, "uuid": "14f6cc1a-0477-4452-9bee-037691347746", "comment": "Malware payload (Mirai)", "value": "2834a6a065c8cddcd3010b30c13c88b287380204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038656, "uuid": "34484784-fb57-4f8c-8761-5175c9ed71c3", "comment": "Malware payload (Mirai)", "value": "f6775c81ec9ae835619f75ba47d24d5752e8ae5e93f9a0ca456bc05dbf95c55fccebb09d4fb6feb6e00fe2b6cd649b1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038656, "uuid": "5c78b579-3066-4c49-9c10-1b032295ea95", "value": "T191A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038656, "uuid": "ab90c1ab-4840-4c5c-ae48-d57f5af11f06", "value": "1536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeXNY0:lZzTJa1rZ62yqPy/ULWzjeXNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038656, "uuid": "de960b28-8d1c-463b-904b-8be107717775", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038656, "uuid": "53e20214-e75c-4223-a3f4-f6e9cc776468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038656, "uuid": "46866b94-4d39-41a4-b40a-ff42cc363207", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589d7e2a-5b60-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780060478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060478, "uuid": "98d2ac1f-5c7c-4a75-87c6-654ecf7be633", "comment": "Malware payload (Mirai)", "value": "d6c1f533575d7d36d8300d546c76b80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060478, "uuid": "1cfc98cb-62e6-4234-a120-6f27f45d985f", "comment": "Malware payload (Mirai)", "value": "ea7e3c066df00078c761ed29dcde1a0f5686ff5007aed56a560e3a30665fb510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060478, "uuid": "dc303192-3e3f-41b8-9580-3c52baa6a807", "comment": "Malware payload (Mirai)", "value": "836158521fa0cf2448bc984a2194351c970df9cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780060478, "uuid": "6d246572-b94b-420a-88b6-1ab024b8e890", "comment": "Malware payload (Mirai)", "value": "40351a6afadb1d682fd7e5c51943b553793149fd7ae9fd24821bcb0906e75c46581b52afdb9762540a7646babdb5a8af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060478, "uuid": "e33f2a4e-a1cc-4979-9882-2e7d02486d57", "value": "T1EA04995A6E228F6EF278C73047F74A35A75D23D627E1D684D2ACC1142F2029E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060478, "uuid": "9ec3dedc-34b0-4d0c-a4f7-2a340ab49c86", "value": "3072:eW0mDjx3zF1a4UuJ17HDnoKTJXPFO+1uM98TCHUCXC:eWhjJzZUu7Hrn/Oz28TKUCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780060478, "uuid": "16f9350c-5a4c-41d5-8e9e-3fe143fd012d", "value": 181556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780060478, "uuid": "eb1faae7-ae5a-4c60-ab81-492f80bc0714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780060478, "uuid": "3dd62a0c-da75-43e3-872b-f1418a3441a0", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cbc404-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780057596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057596, "uuid": "8ef80dd6-e1cc-4967-965d-dc09148516f6", "comment": "Malware payload (ACRStealer)", "value": "65799e14b66324cebbf0c33f48570ebd", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057596, "uuid": "10a466c0-6c40-44b6-8730-52ad3dd7514b", "comment": "Malware payload (ACRStealer)", "value": "eaa52e1968c4b8f8beb2fe508e9eea9beedd66964850e2383d2b56c5a3f98f51", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057596, "uuid": "135bb0ff-f174-4481-8790-1c1b246d39f7", "comment": "Malware payload (ACRStealer)", "value": "3eaed6aac003a3e9b5d2ece332e21d37200e9bdc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057596, "uuid": "ca9fe49c-2591-4f8a-a5b9-4a23222be3ca", "comment": "Malware payload (ACRStealer)", "value": "ede2531d41378a1943d80ea3161693f19749b535f81a1ab293694412377709002896a89570013108ed61542708fa6664", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057596, "uuid": "f94d521a-aa3c-441f-9674-e89afac849cd", "value": "T172E57B1AAC9005FAD4AA63338DB762827BB5BC190F3223C72E5076383F766D45D3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057596, "uuid": "ad488c35-f3ba-4781-9719-6f909119e22c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057596, "uuid": "a807915d-1116-4e75-8126-297cf442d624", "value": "24576:s88CKgOqp3h2kFWafxl7/T4uTlTzihcNDTd0hNaS9+9R0fLBele5ZK2hgDVTB:s8vKgrp3MkFblDvziyNP2hNabzqH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057596, "uuid": "d460e962-c022-4d0a-95c5-421745297fd0", "value": 3220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057596, "uuid": "1c785ed5-33b0-4997-91b1-517a9b78954a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057596, "uuid": "85b9687a-97e0-43e5-a931-d48becc58034", "value": "SecuriteInfo.com.Win64.MalwareX-gen.46438258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a775a37f-5b59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780057604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057604, "uuid": "68148bb5-35f2-4d6f-aaa7-60f678ae1f33", "comment": "Malware payload (ACRStealer)", "value": "9f5782bac3e38e4695670ff9dad6320f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057604, "uuid": "6907802b-d75d-4277-bd13-27950900e587", "comment": "Malware payload (ACRStealer)", "value": "ead52049a68c24e8538cd7763e59414f4b6561d458fab3bafd719543ce037025", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057604, "uuid": "07d20501-a24e-409b-9d81-fb020218c4af", "comment": "Malware payload (ACRStealer)", "value": "894cd0b6e61fd32aa516e0d89e891e66d56dcaf7", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780057604, "uuid": "d9b0459c-2dfb-4027-9286-1527154d5238", "comment": "Malware payload (ACRStealer)", "value": "4ea39d15c24a6a057109fe31add17018c9bc9e06d73965a8107d784d93038027e4b1c64a3cdc64b5ee93a85c56ac20c1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057604, "uuid": "89d6bddb-16d5-4586-a3af-8ffc2d4293cf", "value": "T178F58D5A6CE008FAC069933288B362957BB5BC150F3263DB2E51B63C3FB26E45D76744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057604, "uuid": "25cd65fe-2cd7-493c-8def-4eb56f096343", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057604, "uuid": "abaa2878-faec-4c11-92a9-325d69cbf688", "value": "24576:tOcZLUjDigkb7QFP6HC49RiciQ8D1zb5X10HSEqkhFy/nBele7tK2tbumcMTB:tOoLWizQFP2bC1tU9wXqFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780057604, "uuid": "17fb95cf-8785-415e-9a33-200c32273a06", "value": 3361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780057604, "uuid": "fd6a43de-3370-41c4-9747-62ad7ce706c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780057604, "uuid": "33196dcf-4e55-49a4-a8e9-9fddfb5b70b7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.45267131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7b5060-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "1bb5b5db-2c9d-4fab-ac56-dbf2fa5efac6", "comment": "Malware payload (Mirai)", "value": "f5bc00d2d97c475cbf501b072d90a733", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "5fcae51c-7f1b-4ef3-b733-29c395b09bda", "comment": "Malware payload (Mirai)", "value": "eb4ba2065848b7d53a013cec0f5ea9def0864c828f59ca873397f769beecc681", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "5aec0453-1782-4c58-8e7b-9b552f9b3bc4", "comment": "Malware payload (Mirai)", "value": "e5487d6f8f1aea3228edcc7dd0b353501a533416", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048595, "uuid": "dbbaf465-ddb0-4aad-a9c1-b7ed2979d202", "comment": "Malware payload (Mirai)", "value": "2cd0f44585ba7f23fd910f86cde7867c58cba2e6e4917c769dfcfedb85001baaa3f761ceaf5c0b026c338953d8d546b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "8fdcb94e-52f4-48f4-a3dd-272f8501af25", "value": "T161A2E029BF58828BC832797455D9F5D21397FCA1F29DCC5E2940C15FF0A33A96434E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "b946305c-7f68-4c35-92bf-e0daf34cb711", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTi:798o08kxofBE+ZkXaITbp2F2TWul0c5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048595, "uuid": "310cd6b9-4a80-40fd-9a3c-0b74a21fc9cd", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048595, "uuid": "72ff4f9f-1d15-454c-9ff5-8e0eb76e1943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048595, "uuid": "98c655dd-0d8d-4590-bc05-388a82c8bde5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c20e2c6-5b1e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780032003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032003, "uuid": "89aaf7e5-fabd-4506-9650-a53f80f8d7c8", "comment": "Malware payload (AgentTesla)", "value": "201a7d37e296d943a22366325f891404", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032003, "uuid": "9bb93316-2140-4a25-8c0c-585658f6c7cf", "comment": "Malware payload (AgentTesla)", "value": "eba13078dea9e803b9120a45cd0dfad589f1defdf0f86fe84ae77fe63fff5300", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032003, "uuid": "af8b0249-4444-439a-a866-157d451392ee", "comment": "Malware payload (AgentTesla)", "value": "21130d3df3d0833233a01296abbd0955a0a82b24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780032003, "uuid": "fa2163bb-6513-428b-b214-52199201bcc0", "comment": "Malware payload (AgentTesla)", "value": "d3f6b50529af1019c1251bf6e75d73e221473743ba67eaa9f49ea615914f89f55a326de534f7f88809066303b0bbc2ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032003, "uuid": "da5948f1-5033-4c7e-ba3a-e0bf02747533", "value": "T184053A3DCC64412FE173C529C999055FF8825A0B232CEA0754C72B9BAE7398677D329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032003, "uuid": "5f3d4cc8-e799-43a3-b2ed-9a4c880c30b6", "value": "3072:m9S8C00zrNsYvb+NlHgIl+h38UgLwhxwf5RqKfFxZALB4VhyL5lJ0zN9luLlUFSV:702rNvvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780032003, "uuid": "ecfd91f6-1220-45fa-978a-48c75f0bf95d", "value": 849326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780032003, "uuid": "d32b51cf-bbfa-4d28-b3fb-d22e3c9e6a64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780032003, "uuid": "d1d61d55-593d-4388-a39c-62ce96314de6", "value": "Purchase Order 386761 SN 0002842747 DOC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2389ab35-5b03-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780020446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020446, "uuid": "ee360e15-8714-4649-aff3-2fde8151b5ad", "comment": "Malware payload (Mirai)", "value": "a2f0fed713497a3356716329711f06ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020446, "uuid": "4e481ad5-a8c6-4d99-9dc7-40da5e03ae25", "comment": "Malware payload (Mirai)", "value": "ebc28cd8af4051c0cdcc8e3d33363177e4b2b00ea6eb7837645db809ea0f76e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020446, "uuid": "230bdf0c-7ca2-45d4-aa7d-2996053c3e4f", "comment": "Malware payload (Mirai)", "value": "cc3b42d7a638aa9698ce279f0a68c5f6bb31673c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780020446, "uuid": "13a6f25a-a8b1-40ed-8189-546be08c65ef", "comment": "Malware payload (Mirai)", "value": "17851a29eb4ae01196ad6b398ce5af64c0b4d9f25a5a9b2718f18ad046b97cddae99955e0c85d0cd377a88de381ff8b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020446, "uuid": "3eae1631-2b1f-404d-8cc4-bbd93be5f2a9", "value": "T16F832907FA8148EDC04BC134437E7E3AE825B5AD027C72B767E8BE263D4AF60552C995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020446, "uuid": "a3bc4a4a-047c-438f-8593-1d46d23e9b91", "value": "1536:0jtbWWQreWsRp0RTW5pvZbzeg56shgd8Q5Kq5em:CtKZrePpCCpvZN5lh/Q5KqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780020446, "uuid": "347546f3-0da8-4924-b011-bb6c876af4dc", "value": 87296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780020446, "uuid": "737eadd4-71a3-44a6-b3bc-bc6f902fdd50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780020446, "uuid": "1a53a82d-a750-488d-ae67-962d0a03ac36", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200821f3-5b73-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780068544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068544, "uuid": "235c607c-5ce0-4f55-8479-569441ab6afa", "comment": "Malware payload (ValleyRAT)", "value": "06b0ae8b7743e7694863ef4babf7cb7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068544, "uuid": "282e3c4a-c8eb-486b-a458-aa7c96101eb7", "comment": "Malware payload (ValleyRAT)", "value": "ebc4125de161e10c8ee1a5b95a8e9163b71a10856e6bda7295956e0babeae231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068544, "uuid": "3c12274d-5e78-47e1-8b3b-05a4d7c8131e", "comment": "Malware payload (ValleyRAT)", "value": "bf243dd431b1c27fa7c43d3237b30e0615969c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780068544, "uuid": "4e89de8a-c306-44fe-bdd5-b19d64035a61", "comment": "Malware payload (ValleyRAT)", "value": "1a1a46042bf60edf5c9bb3591cb47e480e9a34464536ecf5275c60fda8dd912a2bd2aee5f562cd9450046db088305b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068544, "uuid": "dc82ce33-403a-4fa8-a1e4-da22abe8d186", "value": "T18AC6DF21725FC42BE16905B15A2CEEAB913CAE360FB054D7B3EC7D5A17754C20236E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068544, "uuid": "eb918115-e440-4f6d-9be8-d9ee75354208", "value": "6d5e13c0269946a5a10390c178d8e9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068544, "uuid": "b92f9551-f63b-4c8f-824c-66b298a5a314", "value": "196608:EE+JqHlyDSixHM9WB4zEDhn7lQ2jt8W6J44NdKICooUNQYSLTmWJW4JUWIDwy2NV:t+JqHlyDSss9WB4zEdn22jt8jJVNd6oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780068544, "uuid": "3233cf79-3d5f-44b0-ab44-7a7c8d075451", "value": 12295306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780068544, "uuid": "0687917e-4451-4f69-9545-f2e507966fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780068544, "uuid": "3ccf87d4-cfc3-4ca9-87f9-1014900aad76", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587v\u6c49\u5316\u8bed\u8a00zh-cn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec469ace-5b46-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1780049559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049559, "uuid": "695a0a62-31fc-45df-af46-2946ca8b2f59", "comment": "Malware payload (SantaStealer)", "value": "d8ec97854b938e8e8f3bc1dca3dae7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049559, "uuid": "849f2dab-d0ac-4965-9ef1-dc91552cbfb0", "comment": "Malware payload (SantaStealer)", "value": "ec95bcf427c8082f97928eebd0084f31fb008c19cbb27670afedfb6533470d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049559, "uuid": "bf17c6cf-1b7f-4be5-8818-9069014035d8", "comment": "Malware payload (SantaStealer)", "value": "b4a4fb87b62170d13ccdddfb14107672ae0fa569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780049559, "uuid": "9c68a560-506c-4bab-a298-1b66f5b59b03", "comment": "Malware payload (SantaStealer)", "value": "30cb23f60888598dde161485caf0a1589ba24df5e9bc402bf02d9b1b0f0b03f5d7fc30ce72d4e2447ef23b3454ccfea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049559, "uuid": "1809b973-d41d-45d9-ad23-9f9c45d965d5", "value": "T191969E1AB2B501FCC0A7C1798A575D13EAB2740A03769BEF16E089652F23BE05F7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049559, "uuid": "018fca95-504d-4c18-926f-dd0dfebd60a4", "value": "c66cc2e6c5b62b77f7a13b99fa56f197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049559, "uuid": "0086a0d2-feb6-4442-b81b-80e60ca251a7", "value": "49152:cZqcf+bzMUhfXTJlUqVuJqx/FGdfUfWTJ1ZqQGDSp6jr0S4:DNfXTL4hzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780049559, "uuid": "8d058a02-edc2-4d08-b024-cb26b3acfc2e", "value": 8956723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780049559, "uuid": "8c40cc22-957a-4f99-b604-1d8101f1dfb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780049559, "uuid": "13521041-9e20-463d-a49a-e1301c816aae", "value": "9BRIMp6CcY4y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233f597b-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780073703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073703, "uuid": "405647c3-8c0e-44ab-94ee-5a44ce66678e", "comment": "Malware payload (Mirai)", "value": "d582c29c845a39c0e7679db149721a7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073703, "uuid": "5e379475-8543-405f-bd04-44dd9846ef20", "comment": "Malware payload (Mirai)", "value": "ecc03583851fec3fb490758a83931a7ba5b38f6fe1a4fb6455db2f87f00a7778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073703, "uuid": "cb39e132-5f7d-4820-aa2a-fc8695dad71b", "comment": "Malware payload (Mirai)", "value": "8ff2cdf895f52df6ea8185bbd167473ce327170e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073703, "uuid": "abbe3058-5446-456b-94a6-cb701e706acb", "comment": "Malware payload (Mirai)", "value": "5045e85eb9f599602d0523e46312836d28bebe052355ca613a597244565b7bbd6dc2d612869016ca40ea95377d7e4ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073703, "uuid": "19bcc740-6751-4774-a61f-17dca9578346", "value": "T17C24D91A3E228FEFF16D877047F34A31976966D617E29684E26CD5102F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073703, "uuid": "5bfe2d8d-fad3-4e86-82af-f6570ddf6873", "value": "6144:24cEawn6ID+L3QpgHH0NQQ2nutCLLYg3XPUXRWW:fJn6ISrUNQQ2nutCLLYg3XPUXRWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073703, "uuid": "25351835-d2ba-4483-bdc6-9780c2951732", "value": 216041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073703, "uuid": "d3da5ea9-9677-420c-b748-93843abf7a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073703, "uuid": "5885a81e-1be5-44ac-b2c7-904cdee6fe1f", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c068c867-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780092865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092865, "uuid": "14c73684-cfcd-49d7-8898-f617f653d9f1", "comment": "Malware payload (Gafgyt)", "value": "75c47082f54964605f3e8274a71ba591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092865, "uuid": "7845e545-a07f-48ae-98f8-18f1ffe3f3d8", "comment": "Malware payload (Gafgyt)", "value": "ed2086fe81c6e399af73ff2d8f3d951c9e084219fa3b721498e694a8ec69f472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092865, "uuid": "c25fc1c2-9f63-4459-9f1d-b6d728d94e4f", "comment": "Malware payload (Gafgyt)", "value": "1e23da7b6c1d9fdced691581b6dd6b5690fa237f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092865, "uuid": "88ce7382-2ccf-495e-ace6-60c714cd8b0a", "comment": "Malware payload (Gafgyt)", "value": "99d116b084130a797082f8fc845823c49db843df158016dd3f69558e3079bc9b2f00860cb28b360a9653cd8e6f689e8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092865, "uuid": "2ce8de2b-f611-4d76-8ffd-ba3d39215134", "value": "T1E0C2425E2E229FECF758853946B34F70935933D622E5E784D6ACE8000F7424E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092865, "uuid": "6d4c4a5e-54e8-4824-b852-283bd4fd5692", "value": "384:1py6uHasnZLahgWXAZ9nQMqHWPHlBhO9S9GypM6fy1m/3xugmMGY6sCnUxQ:1prnAD7TzO4oypdCY3LRwUxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092865, "uuid": "2c365df5-ef5f-4873-823a-1b4b488c016c", "value": 26652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092865, "uuid": "0f973f0f-12db-4d0b-aaae-37bb6bbc22fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092865, "uuid": "952cfaa4-24b8-4ddc-96b4-8ea2ce1b6dab", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3971ec4d-5b92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780081901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780081901, "uuid": "326434d6-892d-4c40-8b1c-f24f8fe59437", "comment": "Malware payload", "value": "ac17c10cf6f76f7a9a4d6cbe0c6aaabe", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780081901, "uuid": "95a27af1-8956-4baf-ab58-24eb591415df", "comment": "Malware payload", "value": "ee19fac454414e0f89dba6ce4af43e9bdd63b012c880429c7dc814271eeb50bf", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780081901, "uuid": "565bab38-0648-461f-a88d-f20d673bc0ac", "comment": "Malware payload", "value": "20a835677a884999fbaec0a060be6cb44177eb7e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780081901, "uuid": "2976c000-6cbe-4670-9081-d2f4c229d2fe", "comment": "Malware payload", "value": "00509b7ca457cbd1a29519a5b335c5027dd0a553685930604071ca46309ef302a5f7398fa1179ef2abe7385bb3a5bf19", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780081901, "uuid": "17fe60bc-cb52-489e-88a2-57fb19bbab2c", "value": "T107F5CFCE527589F49BFD6241963A0B2787B043D11C838582A5FC4B603D25FA769CAE3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780081901, "uuid": "a468972b-f49f-4e26-ab52-52342fceb4ef", "value": "24576:oUhVtD/hcR1tzrLSQqGSf1TMyehi5qLJQ+CmF1KhPC8ZDTe1/y+tx:o11t/LSXGAMDvtn4CADq1/y+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780081901, "uuid": "d73fef73-029c-4856-b6c1-5b6e8e9be11a", "value": 3614239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780081901, "uuid": "3076e189-70d0-4af3-a89a-c2331c34b98d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780081901, "uuid": "3da67518-6243-45bf-bc69-2d40e5dcdd3f", "value": "lStarteijX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da8eeb9-5b5c-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780058688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058688, "uuid": "7c7048fa-cdc7-4256-a075-697ca17f6d5b", "comment": "Malware payload (CoinMiner)", "value": "8546833e180eedf14987af12d5c82c55", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058688, "uuid": "5d969756-ebe8-4f87-97ef-b3021507e88e", "comment": "Malware payload (CoinMiner)", "value": "ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058688, "uuid": "199178b5-f2be-4fe6-abac-070693560118", "comment": "Malware payload (CoinMiner)", "value": "b138757f499c91659ca5f86f6f1f1a1f8445b877", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780058688, "uuid": "a0d1c448-dc19-4c4a-996b-1b4ee44c38f8", "comment": "Malware payload (CoinMiner)", "value": "be114c5ff77fca597d08151bf5a42b79c30fad310ccd15a8b53da8c737f448f21acd796b951305a3b54a281c820eb991", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058688, "uuid": "af580efe-e493-4172-88b1-026aee6da82a", "value": "T1CD320A2C7E494331D3A448F858794347653C1223A787E3EFF777A69E4AA63498841E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058688, "uuid": "dc805bf6-192f-496b-a929-22ae2a834aed", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058688, "uuid": "43866396-f82d-4e34-9ab3-78c8e669de27", "value": "96:1OdfcooYz/9PYz/mUJQsBat7dC/FBD42x+ZQXLCOZzVTw3tCO3PFJxGE9mZ2FFhW:1toPWgsBGyFx+eXucQPFJxTEZmFhSCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780058688, "uuid": "c7c4793c-974a-4c69-96f1-e0c702ada17d", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780058688, "uuid": "13adce10-46db-4e33-b202-912ded065754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780058688, "uuid": "dc606da5-05de-458a-98a4-0f807a085b13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa61d93a-5ba2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780089096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089096, "uuid": "fbfd4aa9-865b-4148-836e-ca2bca89671c", "comment": "Malware payload (Mirai)", "value": "1456de40c85b600b721c91c05c589198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089096, "uuid": "da2820b0-def2-49af-9c8d-560dfbeac335", "comment": "Malware payload (Mirai)", "value": "eeb09fe2a2cc1163b83f389f2b59662c5840fbd898f8fdd163f08fa7674fc651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089096, "uuid": "77b51f77-b65f-46da-ac91-76d7c89dd492", "comment": "Malware payload (Mirai)", "value": "5075b079488521ef3382e8fa706381890dc49ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780089096, "uuid": "867c32dc-bd26-418f-919c-5853972e0751", "comment": "Malware payload (Mirai)", "value": "1caba59ff996a4c2b07e63fb8e9edafe0a6523bb5f9054b6051ca6c2d386410d1f2bdb789f26499efb30694d7f6cc479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089096, "uuid": "738ef50a-6404-4a70-9ab1-89e6edfab255", "value": "T1C1D3AEABB34F1490C82506F41BC76BAD2E2315014D6B96E63C6E363F6B739DE68063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089096, "uuid": "02c12195-e30f-4edd-96b1-045fdcb44122", "value": "3072:UxOr5hH0RmpoJDnNSsJO3jHxoUs6mDgJCQiT2tYmAdq:EOd2zJ5SsEzGU/mQCPytYVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780089096, "uuid": "f5a5f620-1778-4207-91de-9baac270b43e", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780089096, "uuid": "4f7039ee-a64b-41c9-9c4f-df33b1961917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780089096, "uuid": "90f8bc17-cd41-4fce-93c0-d050ff60e157", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c093d1-5b5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780059636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059636, "uuid": "c5d7a738-21f1-4bbf-bec2-53e1add06688", "comment": "Malware payload (Mirai)", "value": "c4c7cfd233b00dd3ee137965dcda4c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059636, "uuid": "a5b72388-2626-4c78-9108-b140ae3c512b", "comment": "Malware payload (Mirai)", "value": "ef5a28d646b6e8e23d4f192e511d42f3d1ced842a503397f05e5d8abcee59ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059636, "uuid": "22fac990-1558-4ea8-bd5d-85e0ddd5e023", "comment": "Malware payload (Mirai)", "value": "58e3784e1de17912b63a27706ca7fa4d9da8a23d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780059636, "uuid": "2a94bb4e-0da3-4efd-8bb5-ee9fe78d75f2", "comment": "Malware payload (Mirai)", "value": "d22e1c4a7ffd21d348a196c41aef1eb009e1de7e40c03dcb356f4d44cf3cd8914c29ac92aa6b8c28649b6487c4a408a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059636, "uuid": "f7752662-55a7-4734-9211-8707a9f03afe", "value": "T15A734B89F783F0F0DD4709B1106BF77E97349E125024DE5ADB947E72AD32A12A11B62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059636, "uuid": "95d0c28a-f97c-4395-bb69-1ddc6bdcb276", "value": "1536:PjM3IDSl/yK02rQx8WFa9noJ8v3QUs31fMQ1yAxsVqbr:PTQySrQx8UJhi9/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780059636, "uuid": "630329f3-c447-4f85-970f-8b2b2ea47e14", "value": 78588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780059636, "uuid": "5740673d-cff0-47ea-a099-f859b98a854a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780059636, "uuid": "5f52ac86-789d-4918-9541-e11a917b41e4", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d123ce7-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038608, "uuid": "6411d326-605d-4869-af32-47436b7fc76e", "comment": "Malware payload (Mirai)", "value": "35b9ba8126ce527dae86998e814f80cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038608, "uuid": "c9007539-460d-4386-96a8-3e6eb1588ebe", "comment": "Malware payload (Mirai)", "value": "f01124b657c9b751f9f4e613f683fb249ea7bcd71b2c4f7f5dc56b7ecd1ac636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038608, "uuid": "e4335388-b876-4524-9f97-5a38ff6b3bb2", "comment": "Malware payload (Mirai)", "value": "f3bb2144f028302d030f9457ec102e1cd871b932", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038608, "uuid": "c55604e9-e19c-4525-a47e-710d6c1841d6", "comment": "Malware payload (Mirai)", "value": "dd8430b0b08eb2851c55c4e199e8bc4e280b59242c6743a0155a5449496d4c5b2a443a4ec45d4e7bb8c457f5eede1dc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038608, "uuid": "5d50f93a-a6e3-495b-b5ba-5397642d2952", "value": "T125F2E1703645BCA1CA704572E9A2CF47F75AA379D0FF316915090A18FCE162258F63CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038608, "uuid": "7b91f08d-537d-4dec-8d66-3ed58bbe4608", "value": "768:hJTKmOVP3WWkPgb7lPBIqxwQEECBah3zGKxglcS+s3UozH:hAmO4POPN5Evo3FrSjzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038608, "uuid": "c91563a3-33e9-45f0-9681-d62b22d7d543", "value": 36832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038608, "uuid": "17d92ff0-f1c0-4893-a01c-09e4ef62a48f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038608, "uuid": "f02c5c60-8e96-4197-9313-8311ef72f2fd", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b01a71-5b57-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1780056688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056688, "uuid": "9c820709-245b-4cc2-93db-42858183bdce", "comment": "Malware payload (BlackMatter)", "value": "4e6ba23ef44cf029840880a48dbc4768", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056688, "uuid": "5613e7c0-1277-4164-aba6-602331ef0450", "comment": "Malware payload (BlackMatter)", "value": "f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056688, "uuid": "a6003ab1-a4d7-4d07-b177-fcc9c2a19d36", "comment": "Malware payload (BlackMatter)", "value": "bafc3865d3cfe1c48709ed21dcc371896b67349f", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780056688, "uuid": "1191297e-f4f5-41ad-a3ea-308d9cba73f5", "comment": "Malware payload (BlackMatter)", "value": "28be50180efdbe1654394fcaeba7e6340e91e578b20fc0d4bc47df69b54419a8112e6afdeffd103d4ae710253e3e2bc3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056688, "uuid": "7ec8d9f0-cc0f-4de1-aa49-260556789700", "value": "T10AE37D21F212D0B3C83718F53736B5B2B39E8D2C15A96817EAD80F5DBCA58232F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056688, "uuid": "f402ebe1-32a9-4e40-a2e7-b9111357fcef", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056688, "uuid": "f4bf1c58-b09d-40c4-8573-b21566e419f6", "value": "3072:n6glyuxE4GsUPnliByocWepKrIc20QvsG:n6gDBGpvEByocWeEXQv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780056688, "uuid": "b494c5c6-0774-40e1-9a38-90abca601a89", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780056688, "uuid": "ca7693e2-4267-418f-88c9-a6d89bb6373e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780056688, "uuid": "5c34835c-2784-4bfd-84dd-d19e22452ff0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad37227-5b3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780046335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046335, "uuid": "8140a6c3-9d95-4a20-b285-3816a04e81ea", "comment": "Malware payload (Prometei)", "value": "8800bf579ba3143ba9f78bcde4cd0322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046335, "uuid": "f72a3cac-a536-4ab5-9caa-5eefd0fc4ea2", "comment": "Malware payload (Prometei)", "value": "f0a097a7660e5ad0c197e6438ac28aa4d46bc95bfc45fafea7401540a141509f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046335, "uuid": "4877a1c4-1188-41eb-a4b3-0b1325f7f8ea", "comment": "Malware payload (Prometei)", "value": "c9cb54a8bde59e3f67e4df3c5025c2b7fdc2c9fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780046335, "uuid": "47bb63d3-bef1-41a8-a295-cac16e129c07", "comment": "Malware payload (Prometei)", "value": "0d4f7ce0cce45a1923f23d40a13b850073e28e4b2904110cff847f6240b467084b278f1ea3caaedfdddf385b3c044133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046335, "uuid": "68c5e467-09a9-4d99-adf2-f754bae93e65", "value": "T1D7A423B4F9219E8F6DD769B91B24831DE082D172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046335, "uuid": "827dea80-4b87-4f96-bcec-137412d7b0d1", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdX:Fs6pyCC/Ya2hpi6T6N41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780046335, "uuid": "10d01194-0d63-474d-925c-7d5a85647502", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780046335, "uuid": "9fd73e69-d94c-48bd-b7bd-7698a2b4f424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780046335, "uuid": "fe22c04f-660f-4450-93a8-5bb7dff3a1d7", "value": "f0a097a7660e5ad0c197e6438ac28aa4d46bc95bfc45fafea7401540a141509f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c702807-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018313, "uuid": "7f844c23-2b16-4704-8a3e-d5c0155f9854", "comment": "Malware payload (Mirai)", "value": "92f5d03fcdef20b4a2b8dc55d75da69f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018313, "uuid": "67fe576a-e9a3-444f-a4de-bb89ed1b45b9", "comment": "Malware payload (Mirai)", "value": "f2a21f38f3a6702d2438525f392fb51e77fc6de9472641fd8210872ca32622c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018313, "uuid": "91cf4fcc-c98c-4720-80f0-2ed387f69423", "comment": "Malware payload (Mirai)", "value": "8da0f91a74c7c41bbc85952ef1cae369ec74f424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018313, "uuid": "625b1457-7d60-4e48-9df8-272f9adcb4b0", "comment": "Malware payload (Mirai)", "value": "1fe372efdd04c51d52fbaa54f0a8c9cd9b6ab207ccca2e2aca103b1af837bea26420ea26dd2294045368a5b634556630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018313, "uuid": "0462347d-5f13-44b7-a30d-b44bf14f8d1a", "value": "T1F7D3ADDBF6474551C86202F007CB4FDDAE2362C19E1B89F36D2A663A48790CF5509FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018313, "uuid": "52250787-4fa0-494a-87c9-539c2d08026e", "value": "3072:JCdvbIzU+UMTDLwjrolla0QiREhUgYSqo:QqU3klI9MSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018313, "uuid": "b80cda22-70fc-4b71-ac56-04402ccd8c9a", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018313, "uuid": "2308f137-2140-4652-9e6c-efa68eddea9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018313, "uuid": "4519412f-1cfd-46a0-b568-b7e6c19c33fc", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11726b7-5bab-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780092866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092866, "uuid": "4098427f-66f6-4452-8de1-4d84f8f99f87", "comment": "Malware payload (Gafgyt)", "value": "52da28c7ccd40bdaac64d11c66e3dcce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092866, "uuid": "39392425-9cd8-40ee-b27a-ed81b9fabe8d", "comment": "Malware payload (Gafgyt)", "value": "f452bae3769df419ee8fbb995cd505b888d442634f91660aec2497b4bf18d4e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092866, "uuid": "5143cd86-f1c1-49bb-b0c2-bc69fbfd49e9", "comment": "Malware payload (Gafgyt)", "value": "787ac788c560400cbc25d083dbac1989f653ebc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780092866, "uuid": "a3bfb2c1-7d8b-4697-b019-cbdab75b67bb", "comment": "Malware payload (Gafgyt)", "value": "8319272e7a9aae21106844deb7a2a529d4cd87c4e5bb9baa12ff53ec23b642cbd5b1cfb13ff9b10484ab7dde019f17ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092866, "uuid": "ddf6c500-0bd7-4ea6-84c4-1a9613813796", "value": "T11D922A86FD45D905CAC4567AFA8E828C37266358E1CE33426B1B7F92574AC3F0E3B914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092866, "uuid": "4200fa57-ed03-438b-8d3a-c082f4809495", "value": "384:NUz+DQ7ucLDDFZVRvk97eCSw1KgQ2ncl01EQTvWDFx4e:NUzWcuGFZjvL3WjQ2nE9YvWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780092866, "uuid": "0a85c903-4aa2-45fd-b60f-8d7e3625b03a", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780092866, "uuid": "b2f3cf42-6b4e-45e8-8c4b-3436a6350d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780092866, "uuid": "0e1977ab-3ff2-4a89-a132-12db0f0a5188", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e389bb5a-5afc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780017762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017762, "uuid": "7deb2679-4713-4bff-ab3e-294ddfb7fc01", "comment": "Malware payload (Mirai)", "value": "06903ea5c8d24baaae9686c50a58abe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017762, "uuid": "23de8b38-1902-43e2-a1ac-69cafe02a7f4", "comment": "Malware payload (Mirai)", "value": "f766293f93db87e55fa4e6fd1365b93d0787ce88cbd79691d3ed552de148064e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017762, "uuid": "ba919135-cbae-41b7-bb22-d806af88a5bd", "comment": "Malware payload (Mirai)", "value": "b7ceaef4d7758989487f3d226cb2f41ff373d74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780017762, "uuid": "96597e34-c46b-4f8e-8ef2-76ba3c8ae29a", "comment": "Malware payload (Mirai)", "value": "e943520a5149c4a9741ecb2ba97e9f459d5696165c4e0c10397734536e5dd4529b2a0fb1dce4c4fd74b988f54370acc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017762, "uuid": "c2f42d6c-86da-4116-a51d-1f3f7e459a4d", "value": "T13FB3A4497FB01FF7E8ABCC3705E92B45288D591B21B97F36B930D844B54A24B1AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017762, "uuid": "80e3bc27-ba6f-4fe5-b2d4-0895e2e57d07", "value": "1536:sfC28vQaaeNVANctJRGtilZzPneHqGkZtbrkH2uI9DZIr1EBm3yw+:sfC28vQa3SctJRVrD9Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780017762, "uuid": "1ddaa607-6d5a-41ac-bb7d-4bc9fd212d5f", "value": 117544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780017762, "uuid": "9af7292a-232b-4ae8-8c23-69e5d693f97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780017762, "uuid": "c48c1532-6808-4a47-ad43-3f08afd35a52", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ad7ee4-5b98-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780084448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "fa04fe27-adfa-4246-b7df-3babd1e17fc1", "comment": "Malware payload (ConnectWise)", "value": "e03fe210c959e4fea3afddcce8c99d18", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "928d74f9-08d8-47b9-8a79-c7af1ef18609", "comment": "Malware payload (ConnectWise)", "value": "f7a8990967451895c005989eb9d865b1527b280fee281277e6febdd360e66297", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "8c07b160-6656-4700-b65a-79f0c35a59a5", "comment": "Malware payload (ConnectWise)", "value": "dc2883cf532deeaf15cd0e6a266c110daf62ba32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780084448, "uuid": "6d55d568-212b-4b38-abd5-439da6f6dfe9", "comment": "Malware payload (ConnectWise)", "value": "eb90d6da355cfe3efe1709406b2513a784327cd49496fa4e97263828c569519f19ac65c4ad6618a50b0b70189c43caee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "2e66a934-f312-4d84-b946-ef8329c1075b", "value": "T1AC646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "7d38e7d7-1b44-48ee-8e78-71edd46be254", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "be9ddc6f-5bd0-4425-a7ad-cc52cf86363f", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780084448, "uuid": "584a622b-add5-4152-9986-1c189d226a99", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780084448, "uuid": "a9e20279-b603-4ec6-94f0-b2957320ca54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780084448, "uuid": "ec1ff8f3-a20b-456c-aa1c-3441e207f7c9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7665b62-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038706, "uuid": "5628fc94-f300-4c1f-b257-f92908a8721d", "comment": "Malware payload (Mirai)", "value": "3ca8f438f02e9e1a5722b9f260173038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038706, "uuid": "a5b7e578-fefb-4b0b-9afa-ee5fd67f68ce", "comment": "Malware payload (Mirai)", "value": "f7ba5b3632424eefc134618c345b76ce74613215c64184132cbfc0024d3a62b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038706, "uuid": "870006f1-6d81-4b33-8e2d-1c76a9f49ec4", "comment": "Malware payload (Mirai)", "value": "dfef603b3857e29de52a11e6a9808b6682e5a10d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038706, "uuid": "533034f6-4a0f-4989-bd6f-63a7bbfe1d32", "comment": "Malware payload (Mirai)", "value": "274aedb76c77958e948fb448779910f61927b2a031c3b2011e4374b74c37e63a2c1e78a746a3f84caca23b9fc3bef465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038706, "uuid": "3511598b-8334-482b-a317-5ddce054f098", "value": "T17B735B41B38C0D43D1971DB03A3F2BD6D7AFE9D122E4FA852A5F9B8691B1933054ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038706, "uuid": "4ecd06bd-0f05-4a5a-a0d0-863493350e8d", "value": "1536:k3fm9vWGC9nCFwUzQz4ln7IHl+94tCy/fVf6t:IfmhxCMRkg7IF+7SfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038706, "uuid": "dc4cd132-0793-4775-81db-b4bbe74623d7", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038706, "uuid": "7369a610-1546-48fc-96d0-2fb59de43b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038706, "uuid": "07b20493-0ab5-44bf-8e40-2c83e632a7f9", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458109e9-5b69-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780064312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064312, "uuid": "ef90cca0-6e67-434c-9229-f07c7e7008e4", "comment": "Malware payload (SalatStealer)", "value": "2bc27f71884a7b80baf748ab1ac6f02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064312, "uuid": "aeb9dc5a-9963-4106-9b1d-0cc715829982", "comment": "Malware payload (SalatStealer)", "value": "f859e01fbf57168925f33a9ef2302d1cd9b33812a1ea62a20de1ea024b640da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064312, "uuid": "c9203e5d-58b7-48bc-8899-1a6c00b6635b", "comment": "Malware payload (SalatStealer)", "value": "446fd669a36c77ee166e9fa8418a651287ed875b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780064312, "uuid": "4dd2cbc1-19c7-4fe1-bddc-7b159012fd8a", "comment": "Malware payload (SalatStealer)", "value": "bd6c77c45139e49b5efa475c387da3e2140a4b04f1e157aeb8f2b49940d053873b9f7b2a0a86423c8bb40bfd40b8be2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064312, "uuid": "62b27ae2-7ec1-4ee9-9175-1337694bbd62", "value": "T147D73307942AD621FD83E7FC57F17A1D29E3A3A8948E2BEC8E567D6E131260C71E1311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064312, "uuid": "a66bd8ff-4fee-4d64-8b3c-960cb4861b70", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064312, "uuid": "ab5a101c-9bd2-43a4-93e3-793afe15af4f", "value": "1572864:0dBUqI4AtqE1uaH/rYG9vloduIImQyMNdPd7+ypJ:0fUqlEhHsGr6htfMfnpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780064312, "uuid": "d37f0ef3-4775-4642-aef8-1714eeb91dd4", "value": 58138624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780064312, "uuid": "857f0ed4-73c3-45f7-88b9-31153aff2767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780064312, "uuid": "d5b3ddbc-4ad1-4b84-8f95-dab988a3a67d", "value": "neverlosecrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6e629a-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "67f90b09-4edd-4e9b-b504-429c3a2fcd7b", "comment": "Malware payload (Mirai)", "value": "f44a4e0bac5f9dce49db1b292d6dfe8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "cde0fbb5-12c4-43c9-a4be-875e21815a3a", "comment": "Malware payload (Mirai)", "value": "f884e31a8847ba08ca7ca56207685738019410f76ad3bdcaa6e3f15fcd077e40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "e6e619e1-94bc-49b1-98ad-56f846e5b932", "comment": "Malware payload (Mirai)", "value": "802bc19c072f54e47d002c0f9450352606542aa8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048593, "uuid": "440d5745-e2bb-4956-9b85-8d623cd611fc", "comment": "Malware payload (Mirai)", "value": "8af0b14b90971c1d0dff68eb10ec23addafec147f6a66984c1e6c602889a90aef4b91fab17678b9e7408969345699dd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "f6740eeb-98c8-4855-b1d7-54924f11ed92", "value": "T17E230271850E9EF225703C36EAD5939375E129B1C6673023D6280A3C6F797131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "79b82097-8a7c-48c3-a67a-1a545c57b648", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b379q3UELbUXfi6nVMQHI4vcGpvL:DECFd+A6YHAxaLRQZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048593, "uuid": "85a417e2-9c63-4ed4-be8e-123a088b2304", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048593, "uuid": "db0b9493-8a78-41e8-9061-f2525598dbc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048593, "uuid": "12c2b70e-7ea5-41e9-835a-85c8be6d99ed", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b58a6c5-5b7f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780073797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073797, "uuid": "a9bef6a3-9661-4915-b1fd-bc8a605f76ca", "comment": "Malware payload (NanoCore)", "value": "a81138846a494a0656ed0c81a7ca2456", "object_relation": "md5", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073797, "uuid": "a536eb98-cb45-43a8-98aa-3065d9e72964", "comment": "Malware payload (NanoCore)", "value": "f8df00989950ec6386adb27c1a5d5fd1d5a0340e9ed52c6df3984621136d2076", "object_relation": "sha256", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073797, "uuid": "959c572b-86fe-45a5-9760-c0cedf070a9d", "comment": "Malware payload (NanoCore)", "value": "3d8648752d7dd31cd4b797b8deab2eee0c03d01c", "object_relation": "sha1", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780073797, "uuid": "dfcae73b-0a1e-434d-9292-4e7931ad8b10", "comment": "Malware payload (NanoCore)", "value": "76a169c23ee09a29c1f2f2166a17e77d261ccb38492124ae0c58495dfe2c16d19de52222bf8a1453ab67f0600a580de3", "object_relation": "sha3-384", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073797, "uuid": "74aa6789-e079-4d96-abb4-77349a417953", "value": "T18264E02677E95A2FE68E967A61220143873C82E3D8C3F7DE28D450A74F667F40A070D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073797, "uuid": "912e56ac-5c21-4e22-94da-5f8a1cb84513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073797, "uuid": "fefb8300-76c2-4729-bdcd-2598c5927140", "value": "6144:CLV6Bta6dtJmakIM5skoOj+bi6NMDQXbP/0itjdO007JwbYoFIlF8bB:CLV6BtpmkaoOj+b1NjXb3rtjd1+aXylE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780073797, "uuid": "37a4ee30-8b13-415f-bf39-210f680e7303", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780073797, "uuid": "9743d2db-e7d1-43de-9b0f-ba7d3c081db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780073797, "uuid": "1abc41ba-119e-460f-bc36-69452d9c490b", "value": "Eas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074a8e79-5b02-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780019969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019969, "uuid": "8e96dc18-0f17-4d34-9798-454c8ffb4c66", "comment": "Malware payload (Mirai)", "value": "210db3dcd53572d2974ee028e3a0c4cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019969, "uuid": "22be0fcb-327a-4b9d-8a02-48ec3e3cf2f0", "comment": "Malware payload (Mirai)", "value": "f9baa861e81587bc806523bbcb948ed35e68bcd4c9fa99d55b203c6dacac7cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019969, "uuid": "c66096ba-2709-42f6-b169-91e88dea6409", "comment": "Malware payload (Mirai)", "value": "1734b6c03748c84149ca3db7de24730aebb35b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780019969, "uuid": "22d920d1-d863-4739-b7a1-179a81e9d635", "comment": "Malware payload (Mirai)", "value": "c45e9bb956400147692deb2cdf9ce1103d93df0b4eeb089f0a289459f65a90a5bdcf8630a68dbc2e1194c3d0fc9e8da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019969, "uuid": "58f88430-d1a5-4835-9f31-611243928c15", "value": "T11F735A02721C0E43C1A705F51D2F9BD58BFBE9D11AE4E489655EC32282B5E3F2289F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019969, "uuid": "021fdf98-b00d-4d35-be7d-21fc12dafed8", "value": "1536:e/s2dApZ8U4mxPSCvPzAUaU1Nm+Tym3yw+B:eeeZmljzAUaU1M+TxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780019969, "uuid": "58869684-2103-47bc-9066-25b611a30197", "value": 80380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780019969, "uuid": "37f782b6-6550-479b-807c-c5ffc48c9180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780019969, "uuid": "6a3fa2be-25a4-4e0e-98d1-f17279ee9a60", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb4edf3-5b2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780038660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038660, "uuid": "9d7dee7f-42e7-4347-b907-d9509e8fbb22", "comment": "Malware payload (Mirai)", "value": "7add0d05f796b59a687f373054e2298c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038660, "uuid": "dc3aa41b-92d7-4f14-ae95-9b01f6a93c6d", "comment": "Malware payload (Mirai)", "value": "fa1848aa8576598ed5050ee3ec4bc501425dd41f89e86506fa27a46902831437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038660, "uuid": "2bf8bae9-f69b-4755-b845-e48af029cdf5", "comment": "Malware payload (Mirai)", "value": "f4fd56e57412aa0d9b8acbc9fe18fa662da5a664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780038660, "uuid": "fa161c30-19ec-4f89-9b90-f02abfa2536b", "comment": "Malware payload (Mirai)", "value": "44b4a6b2a5ab42fee9a46ab5e9e9d223192958f26699c793d3983f1a863bc625dde80a8e65689eb6e2657e99b026a1ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038660, "uuid": "4e7fb986-0d59-4dc6-8624-f2eaf0101090", "value": "T1F483185AF8814B21D5C512BAFA1E164E331307FCE3DE72239E24AF7137CA51B0E6A855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038660, "uuid": "d1a5a891-662a-47d5-9c66-6a1033ffe74f", "value": "1536:GpnQQmY6CpD2sAKv7isPtBBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtM:4m0D2ym4EZCSHYMactW4Bi9gnS4V0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780038660, "uuid": "d90e5869-e8d8-41f1-a8a7-38fb0d5389d9", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780038660, "uuid": "e9cf38e1-98ac-4219-8331-83306723ea62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780038660, "uuid": "81a69a17-b128-4b39-83e9-2dcbd8aea72c", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac185bb3-5afa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780016810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016810, "uuid": "362da6db-68f4-45c0-99f3-c121ec4cbea8", "comment": "Malware payload (Mirai)", "value": "65eeb2fe759cbd97f3051bb713187631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016810, "uuid": "b4827b06-939b-456c-8a4b-cb312528458d", "comment": "Malware payload (Mirai)", "value": "fb31799d02ca3f5763b8279bf9db98bfa0c4b36d297cd0700bc54fd0fca64080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016810, "uuid": "538ee664-cf3c-49b3-b1f8-ea39c9e339ab", "comment": "Malware payload (Mirai)", "value": "7c754c2b768d48944c0a68a5286344f1badb8da7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780016810, "uuid": "4f2b633c-03b4-4009-8e6c-6488bc5b5bea", "comment": "Malware payload (Mirai)", "value": "2502ff656f41664b909fb9e662d625a3999704244adf47c6f4f582b1d5349ea06da66821f9494f0564e08f20ed596730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016810, "uuid": "74d9d0d2-2a76-458d-9f27-c4b9e0445bbe", "value": "T1F5C3BE52C45068E4C25841B2B2B0FE3DD363D62E61972EF7A999CD26944BFD8B40D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016810, "uuid": "36e2f4ff-226d-4fd1-9548-1c018f40dc4e", "value": "3072:g3cMpI+F4Fbv5esToBU80eWA+7QoARjz1ojv:g3c6Az5TUOD8Luv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780016810, "uuid": "ca709615-b743-4d61-87ba-863ff0fbebe2", "value": 124440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780016810, "uuid": "c1d54aa4-5595-46d8-bb3c-b051c792ed0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780016810, "uuid": "7191549d-12a6-4e0f-8c72-de46f4929e90", "value": "023782pler.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69eae46-5b37-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780043107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043107, "uuid": "83c12342-5c96-430e-83a9-6f8ece5f0f65", "comment": "Malware payload (ACRStealer)", "value": "33472b4f1cf611a7cf9901a4db4d811a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043107, "uuid": "44382fb1-f491-47e2-846c-722613199ac6", "comment": "Malware payload (ACRStealer)", "value": "fc78025df01642eff63990f86b0bfe0ce67568ab9bb530df9cb6db86552785e3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043107, "uuid": "70dac87e-46b4-4832-8d5c-dcafb9de6cc2", "comment": "Malware payload (ACRStealer)", "value": "e4b96bec5a3b97a1a00eb0ca4a0600574806d509", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780043107, "uuid": "5d336367-f69a-4424-a1dd-a07d49bceeb8", "comment": "Malware payload (ACRStealer)", "value": "a8707b1ef12e4f83e3ff7eddf02b31972d2e829640f92746c26aca1e6b10d78118066a729bd93b2ee810d1ac34e96654", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043107, "uuid": "915aa951-54a6-4e04-9600-d324d6ebbc8d", "value": "T129F58D4A7CE048FAC0AA533289B322967B74BC150F3263D72E51B6782FB36E45C75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043107, "uuid": "1b9e1b57-349e-4aba-92cf-6e554cd06e18", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043107, "uuid": "9f6c46fc-bb5c-4581-96b0-6c3885bc0ae0", "value": "24576:rqW+wX5MXfl8SGOz+vJypbEvYdMQqlSygsU9s+0/nBele7tK2tbsmconj:rq9wJMuSGOSIpmHNfdX4Foj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780043107, "uuid": "d651cd59-8d7a-431b-889d-be2de306dea0", "value": 3349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780043107, "uuid": "489e2ed0-a1e1-4dbb-8869-6eb6dc263eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780043107, "uuid": "ca8d93e9-0801-4685-9887-9a5477d3a056", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11988568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eef9ed-5b68-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1780063879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "1424ee34-5bd9-4624-9b99-1c08a2d3111e", "comment": "Malware payload (Gh0stRAT)", "value": "e1cbcff021b1a275a48dbf87d4d3483c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "a9381e2f-150e-41e9-ba1e-bd612602b70e", "comment": "Malware payload (Gh0stRAT)", "value": "fdaabbf7b7585cc473502c21a1471f95de45d5492216e8e6c035e1856d6af9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "af56d950-00ec-44a5-9990-260a5e25f3bd", "comment": "Malware payload (Gh0stRAT)", "value": "81abdedd475d122d2d996a3ce9fbc646f7412530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780063879, "uuid": "2b20a894-d13b-402c-8df3-5ac249ba6d91", "comment": "Malware payload (Gh0stRAT)", "value": "492412b455b2c73dc51a1a669ee867c357de727b3743736efd37f2f67db8ef0ae0cfa0a2c039aa01df7a08b011f73bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "f4d31afb-ba69-4bc3-9094-2f73c912d65e", "value": "T16C461223B2CB663FF0BA4A3A4AB6D212553B7A6169024C678BF8085CCF254D11D3F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "44e552e3-d0a1-4f0c-be6a-abc7960da48e", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "e66cc09a-94d0-4213-b01f-679c4f9adb52", "value": "98304:S5fgQnytIw/s0lgg5VS2WPvzyyfUyv/fsg+Q+IHaQo5iku0BS:mbnyOw/BggVavXfU+VxG53BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780063879, "uuid": "4dc2b5da-bfb5-4bae-a1fe-293813db0237", "value": 5426135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780063879, "uuid": "5fc725f5-2189-4944-8cb5-e8df9552d957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780063879, "uuid": "160bef71-ce9f-43d7-9e89-7bb163dc67ac", "value": "\u8c46\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acef30ab-5b28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780036568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "46fc4bc4-863f-404c-9e4c-e66f0288e0b5", "comment": "Malware payload (Mirai)", "value": "b7eba8cf2dca6a4ffe579f9226011f6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "aa358b8d-2766-4745-9e61-d68f05347341", "comment": "Malware payload (Mirai)", "value": "fdf43583241472562429d0c890169ab02c9a2ca009b1d3746c6548ad70cae22f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "159befd8-f129-40c6-81eb-8b719700066d", "comment": "Malware payload (Mirai)", "value": "a626629f6afbf9186fd8725153f7a56cac18e85e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780036568, "uuid": "cd3c867f-ad3f-42fe-9a73-51e3452003c1", "comment": "Malware payload (Mirai)", "value": "a4ab072f4a9b45a1bc6c8495c03221872068f1a82d814ae0afc5ee435ac1e57c3a46f94556aef5521f7389f768b1637e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "d50f28e4-e75e-4981-8896-c147b9b69596", "value": "T11CA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "3fcaadd1-0ad8-4db9-8d07-dadf9a277e3a", "value": "1536:7nufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAO:CbU2RC4kPCtSzWu3/3L1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780036568, "uuid": "fee87a70-cabe-43ea-afbe-c432bfe83122", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780036568, "uuid": "ab6a5533-7f73-4e87-b155-f1d448c7c50d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780036568, "uuid": "fe0417cd-cb55-404a-a244-8aee113aa44b", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb2a54c-5afe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780018480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018480, "uuid": "913fb831-53a8-49cd-9e98-decc4725774e", "comment": "Malware payload (Mirai)", "value": "0718e146d4089254decc5b8ca6debef2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018480, "uuid": "587a68f2-649c-4e0a-88f4-bdaa4bedb24d", "comment": "Malware payload (Mirai)", "value": "ff14573ba39717c4b8f4e1b1fc69961befa62eb7687e9374886e7f8d58f98827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018480, "uuid": "7992600e-dbc6-4663-91aa-563e4a101c55", "comment": "Malware payload (Mirai)", "value": "58e6dd33809678044256e8334caad5efeac0d7d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780018480, "uuid": "76a794e8-b851-4339-9e6d-c76e561b1767", "comment": "Malware payload (Mirai)", "value": "4f7bc8498aa1fadd851a51ad452fb2f23c48f03dc2e75eff7e42fa09c7c188308d438055470d3cd4bb0d603babf25104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018480, "uuid": "c279bedc-d2a1-437e-bd47-90492b4beff7", "value": "T144E33A86BC818A11C6D512BAFA1D218D331357B8E3EF3213DE145F2167CA9AF0E7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018480, "uuid": "4787c4da-2c73-4a11-a641-ee98328e244f", "value": "3072:6K8rU825HQvbybVDrzaEGM+aKJ082G3/IGAr1uM:j8rW0EGXaVY3/SRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780018480, "uuid": "005393a2-fcfa-49dc-a518-c51768e071b2", "value": 144852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780018480, "uuid": "c9e602a4-3fb9-4686-a150-4356dd6afbaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780018480, "uuid": "a876dd84-0df0-4b00-8a2a-dd27b2cfb334", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf58294-5b44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780048592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048592, "uuid": "a56a4b41-a724-400b-9f20-52dc1be803f7", "comment": "Malware payload (Mirai)", "value": "cacca7948ae1237818dd6144588741e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048592, "uuid": "f210a357-991d-4669-8686-dd9462367378", "comment": "Malware payload (Mirai)", "value": "ff151ed18defe4a5b59480a4c730968f711f4cc4477cf802e100b56dad695efd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048592, "uuid": "b95145d1-c005-42cc-b422-3518f19a3c56", "comment": "Malware payload (Mirai)", "value": "92af8b1743e18ca45ce1f4e0101ab76804cbd8b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780048592, "uuid": "59cb094d-a01d-4c25-a932-227e55b351b3", "comment": "Malware payload (Mirai)", "value": "cdbc983c6ba0f210d65b6bb990dedf069f12cc977d16a65e172f430fa1993c0358096d3051493077bf4e412911db052a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048592, "uuid": "c3a020f8-d2da-4bfb-8ed9-c9ce7295d36f", "value": "T11F330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048592, "uuid": "ea49a6e8-6a00-477d-af8d-53229683b889", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG+:r/hqaJMDg9eqK806MHdkfQX6HuC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780048592, "uuid": "b9095149-c6dc-43bd-9a23-47a96ad05823", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780048592, "uuid": "4962ae8f-21a1-4ec1-b1aa-7c42e267b6a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780048592, "uuid": "6e5a03ea-c50f-4adf-9fa1-66ce4d5df651", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b7599-5b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780037546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037546, "uuid": "74329743-bc90-409d-9147-f71b65ac0da8", "comment": "Malware payload", "value": "72b2ae28a5d8a98225574227e1a724c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037546, "uuid": "7133da09-bbcd-4148-975a-73983975affc", "comment": "Malware payload", "value": "ff3ae2e72f50037153c943205f4d6fa90a756763e15b2cb8a5d09f8afeb06253", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037546, "uuid": "7cdfe2e6-7f56-44e1-8ca3-8f4d0c5cc092", "comment": "Malware payload", "value": "8f961d13054a8a80f1814441211bf998f9f4f010", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780037546, "uuid": "96f31d4c-770f-4cd8-8565-2af8ab9dabf9", "comment": "Malware payload", "value": "841ecd1f7ea89a60cb30962b749ad96b0ad9f006c0ce807892bc144b791fac40dd96241f75de87ed3ecac3ad130d0655", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037546, "uuid": "c81af4a9-34b8-4f00-96b7-db296321a454", "value": "T16896DFAB6DDC361D3000B1C2F48521F5EA621336DBDE12D9B8F924337AFA49AC46D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037546, "uuid": "a4cacac0-afd6-4579-b4ad-721473a5a3fb", "value": "6144:NubnYpscE3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfEhwpNaVwS0msFJvXiESUWjl:mPelS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780037546, "uuid": "a53074b9-7528-4c35-9f91-ab64f52f435c", "value": 9075792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780037546, "uuid": "8849e4b9-9a52-4b94-bcc6-f9f966ddab60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780037546, "uuid": "3d35d220-39bf-4f17-9e53-bbb7a76578bf", "value": "Update_22.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }