{ "Event": { "published": true, "date": "2025-12-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-20", "timestamp": 1766275381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a2d41b29-76b8-4300-b00f-09776ea3fd36", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6884d9ab-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266358, "uuid": "0b798ae3-b099-4c74-818f-6f93fb686dfd", "comment": "Malware payload (Mirai)", "value": "bd7c8b75e72372838ed3259905d78073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266358, "uuid": "17dc5ca8-30b0-4352-bd74-3f9951160b14", "comment": "Malware payload (Mirai)", "value": "002bc08e9e4252f58e402d64fb46bb1d4ed3acf453bbd69d2a1f8888ed16616e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266358, "uuid": "de651e07-f40e-45c8-bc0c-b4e419b1cd73", "comment": "Malware payload (Mirai)", "value": "39b0dfd7fd67f1d9e98a32e207e2f2bbfc038829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266358, "uuid": "f08b7872-a9be-44c7-b648-fbd23433dbc2", "comment": "Malware payload (Mirai)", "value": "b9f27c9f059c23ac15f4746c67857c415dee6dc402132be0efb7fe1f62a489fceba86e409b6e449faddad8d810c657e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266358, "uuid": "aaa59255-1b17-4cef-a0cb-6742b4ebcaad", "value": "T1BEC38E32D5A4A9D4C0624135E462EA304F63E6C902971EBF2FD68A754087D64FF09BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266358, "uuid": "4d81bc23-77c6-4c39-aa33-c19da268a054", "value": "3072:byj5ZKoipZS9HBYHlmq1+rOBQ6BKKlz6B2E1E:bytZskhMl0mQ6B5DE1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266358, "uuid": "23502b64-3384-4f73-8646-9af6d9189237", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266358, "uuid": "efac49ab-3eec-49fc-9069-11bd22316f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266358, "uuid": "43450113-2860-4279-948f-fd1188d7d8f4", "value": "frost.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9bd78d-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249826, "uuid": "1a655234-edb4-4727-8eb1-7575ed944403", "comment": "Malware payload (Mirai)", "value": "1c962be3e604df07e0fc7a40a615de70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249826, "uuid": "f4c7360b-2aeb-4f90-8f9f-c3910734de35", "comment": "Malware payload (Mirai)", "value": "008cf3203c5db1d014cd18b64e55e98533e45127087cc2ed712292cb4acbe34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249826, "uuid": "abf84991-9489-4132-bba7-21c39991590f", "comment": "Malware payload (Mirai)", "value": "8b2b58244284aa97c73ee90f054032e1174a60a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249826, "uuid": "a5772e1d-2e81-4b68-a15d-7247bb57c8dd", "comment": "Malware payload (Mirai)", "value": "a5fa3a1882ce579a96ea00acf7370fc57f047f9be0b2fad5f151740c182ce2ef1d75f53807e631eb21e546138a62ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249826, "uuid": "ed9d208f-3a5f-4c90-9cc0-52eecc76a910", "value": "T19133F170FA8CBC41C9E62DB20C9183C66BA5468A33E3DD79A6D69A5E41F34366784CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249826, "uuid": "d4fb582c-5204-4eae-930f-f68322ef7f12", "value": "1536:dwM+nc3atIUI0ja7hJvUuh/LaG2y4u+qgw09A:CLcgIH0O7hJvRhey4u+qgwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249826, "uuid": "e2f15ff3-dda7-4b24-86d4-7a2c6b392a3e", "value": 50932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249826, "uuid": "78a1c62d-bf48-4d50-928f-75c7327af0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249826, "uuid": "9c207cfd-b36d-4edc-a828-b1eabdbb62c7", "value": "sumrak.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2742d56-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249813, "uuid": "096e4bd8-41ee-4b18-a098-5cb2cdc2e182", "comment": "Malware payload (Mirai)", "value": "ce549c2e992b3c10e1c861f244954a5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249813, "uuid": "975ef5d7-c534-44e8-9967-25fffd05f199", "comment": "Malware payload (Mirai)", "value": "020b5d89315667708d7d91af70bbc3bdbbf9a2abc19282644def144a7c54d538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249813, "uuid": "553deb8e-e776-4955-9b5f-68af6f3af0c9", "comment": "Malware payload (Mirai)", "value": "7c69eb86ddcc7ccf09fc2681056728829057f5f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249813, "uuid": "a241cc5c-eaa1-45d7-851e-c7a77369a61d", "comment": "Malware payload (Mirai)", "value": "eacba1be4fd0c7ba7a6464c6c95b11cf3a207607a0f8270380c75a42bfa95abe5d7ad7e659921d1b860a78448182b58c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249813, "uuid": "e6bf448b-8a1d-4e2d-8398-dfc0113f3426", "value": "T11643F12E1B0501D8C81EA73A6FE757111B530F361907FDEB480CEA4A6F350A56187EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249813, "uuid": "f8c30bac-aab8-4f96-8ad5-40fabbf7d3f1", "value": "768:THkWT7A/GXIGTczsoXr3JbXJgwuvz8nPamUkNMWHDToeAJgGlzDpbuR1J4:TNdXhwbFawcsPanKHDTRAVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249813, "uuid": "1a31307a-c5d0-4c32-98d3-0d89abda7d69", "value": 55684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249813, "uuid": "97b87da1-a70d-4f37-bcc7-556b1ceb3ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249813, "uuid": "082bc96f-a966-447d-be72-c52afa218e05", "value": "sumrak.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742d7587-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254352, "uuid": "0830d5a6-fe86-4b5f-9a77-76f0fb048ee6", "comment": "Malware payload (Mirai)", "value": "a03e6c71409002506e13b897bf5c2cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254352, "uuid": "a2c14a4b-ae71-48f4-baf0-fd18bc16092f", "comment": "Malware payload (Mirai)", "value": "036f188bf76d450486198f33489c84f8d45d5a3b44b0f78e2f87891bab3b8948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254352, "uuid": "0cc7ff47-05a6-4c4f-9323-5683fbcc3b27", "comment": "Malware payload (Mirai)", "value": "6ce4373705727c8173bc43e0fd3eaccb4ac51cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254352, "uuid": "b6539f40-f5c2-4140-9967-dd5085b1b191", "comment": "Malware payload (Mirai)", "value": "9e34b663de7ea2c1dfcdadd4757c0f19cf17d7254fde06a2a59fecc38c982d9a006f4204b298e0d2bd87eda9a27cfab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254352, "uuid": "63c5a843-e136-4795-964c-ee6e86c3020c", "value": "T1BC933B56F9818B21D6D112BAFA1E118E3313177CE2EE7212DD146F6477CB96B0E7B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254352, "uuid": "df9bb87a-eb75-4d1b-99f7-15408080007c", "value": "1536:4nsnAO0Y+Y2KHICj2XrMDWmJZt0au5x8WCBD1iVfhGSgVA7pR5bY1gbN:4fOxtoI2XFyZt0aunfhGSgVAdR97N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254352, "uuid": "0d64cee8-6685-4833-bcfa-57b10dc520b7", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254352, "uuid": "f30f88fa-f3d5-4d60-9d7a-eabbd00b6c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254352, "uuid": "5b9c54d7-3d24-494b-bd92-6de3ebbc58dc", "value": "z5qiy33g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5879cc20-dde8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766265043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265043, "uuid": "2f53517e-939f-4359-bee3-f14f48907847", "comment": "Malware payload", "value": "33b29fdc9d5f422a7fb1d09ed9c705c0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265043, "uuid": "0646a630-8825-429f-ad79-7e49e344bbd0", "comment": "Malware payload", "value": "04f7f9dacc79c3c4e84a9b74487eb402082b04321a11f41ad19a3e5f5ad781a1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265043, "uuid": "8815a68c-b4a8-43ce-8f19-f0a77c0a2f44", "comment": "Malware payload", "value": "109ceb91f25048a93faddad3ed109bcef2ab5052", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265043, "uuid": "52c70012-d1d9-47e9-b93a-a385ddce3935", "comment": "Malware payload", "value": "2b9d97e13aeb7b49a5b9b1c4793c56653b82e37c89cd420331442927f01c46146b605d5475d63b31d4b1dede9cccb47d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265043, "uuid": "9281f339-fc13-4809-a969-d8487a812868", "value": "T10241BD151BF10334F7F2CA79A8B36229AA7BF805FA114F4D418586480866221F87AF7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265043, "uuid": "ecf4ac29-3d77-4e7a-aba7-868eb423a463", "value": "48:8WO35Vr1QMoFMOEBpTGAxRdLXuHdabU3Kq:8935VrqFMZBpTGA9u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766265043, "uuid": "df15f0f4-8f4a-40ae-bd7b-2d5df9600adb", "value": 2381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766265043, "uuid": "0c3d6408-fad6-466d-b67d-327d1e78a19a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265043, "uuid": "15809d17-58d0-446d-8e26-c7ea0025b41d", "value": "Garland_Transport_Rebuild_Plan.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83337ed5-ddc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766251800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251800, "uuid": "44fa084f-6e48-488f-ba59-2727d1541502", "comment": "Malware payload (Mirai)", "value": "9f3288e72e834c75e8943e0f51adcd81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251800, "uuid": "f43bef5a-6ace-4e1a-8662-5e532cbeacef", "comment": "Malware payload (Mirai)", "value": "0521d57d084530fec9359fd3b2a07dd784f04c5367b8d94e20019e535c37dd5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251800, "uuid": "02011663-0d6a-464f-87fe-4f9be67474f1", "comment": "Malware payload (Mirai)", "value": "188185bbed0f69632f136d2c6a38fac4512deecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251800, "uuid": "1f49590d-838a-449c-ad23-53cf13958302", "comment": "Malware payload (Mirai)", "value": "86f9e070739df1a215168c2c3eb30ae17e8994703045c1d239e9c2ede8b77f6ae5ed3e27ffbb6664bc8e3e3880d7a952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251800, "uuid": "fa251009-b1de-4a07-8695-1a987c899e17", "value": "T105C533AF109F4C066920C756DBAC6BE39D53F37C16DAA0422B3DC766647B8D0D9C8C26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251800, "uuid": "8734d2a8-0f29-4ab5-96d6-0cd03c20884c", "value": "49152:tA0yzUi3b+MKSpVYiQetoT5Nmm0mj60wM/HnAhSNwsVzwbFCmQvNt+D:tATNbfKGYiQCojt60wkAhsdyCtvNoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251800, "uuid": "244dd6e7-ecfd-419e-9699-fd26116457ec", "value": 2742264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251800, "uuid": "2694ee03-babb-416d-9eb5-dcfef10c890d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251800, "uuid": "1f85d52a-87ce-4288-a18e-cf5d33daff3f", "value": "batirj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299dc042-ddc1-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1766248214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766248214, "uuid": "e18ebbb7-e4e5-4ecb-b085-33661164c634", "comment": "Malware payload (Stealc)", "value": "09e5f72f55d7e17b7e995be180e203fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766248214, "uuid": "aa254389-eb72-40c9-9272-23bea0ca9ca5", "comment": "Malware payload (Stealc)", "value": "06ddb288650b2e578ee649cae738710dd7238fdae4df75a8d68ee70fcf0807d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766248214, "uuid": "19d9a26d-c1de-48c3-8380-ac57a20cd2c8", "comment": "Malware payload (Stealc)", "value": "757be7d124f0452c16cab69cac6cdb42046dfa4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766248214, "uuid": "ffab0721-9a82-4f86-abce-bf577e1218c5", "comment": "Malware payload (Stealc)", "value": "688cd7e2aabab718eb8ea034a2bc30dea941e22892da6f9b9c24d1cf769ae30382e98cb5b9944c3952a48d7b5fa50a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766248214, "uuid": "244a5c1e-74ce-4a57-8ed8-8557deb7ab72", "value": "T1F8A2E90FA24394E8C51FC2388AEE5777B5B2BD10B5A65B2E17B0C6710F74DA91F38A05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766248214, "uuid": "c125ff4d-a55f-4aa9-b7a8-e6d9fa963171", "value": "507e378b8738173d2b40083e2181b450", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766248214, "uuid": "6ea4d3ae-4435-4615-853a-d9c23e090ff1", "value": "384:hz/8FiDGOsyeL7v0esXkpiyhYDoj8nzTymel:h7ADvZksiyhYDoAnfyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766248214, "uuid": "b76eb584-0ebe-4e7d-a53f-62e57e8e5bc8", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766248214, "uuid": "1f2167f4-320d-4c61-bfd6-86da7c466528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766248214, "uuid": "034c394a-3e03-4995-975a-728db5df6d8c", "value": "09e5f72f55d7e17b7e995be180e203fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7680d23-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249848, "uuid": "2519babb-4e1b-420b-b419-7bce0347cdd9", "comment": "Malware payload (Mirai)", "value": "4eefbbaed750a6ed736a936547c21f91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249848, "uuid": "c7db055d-a2f2-4faf-89eb-a86ee03eb5c3", "comment": "Malware payload (Mirai)", "value": "073079de9b7516ae966b3fe4866e808c7a2f9b579915ff76c9a6cfbfa1666fd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249848, "uuid": "aee10ef8-1bcb-4b01-8444-c4cb613846a8", "comment": "Malware payload (Mirai)", "value": "eeb26ac570dace15a6cd6fc0338a5636f23d18ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249848, "uuid": "ecd28d29-8b79-474b-b526-aa0ab91774ef", "comment": "Malware payload (Mirai)", "value": "45b5ba87e852650d8a6ec07a0504d26107aaf16c3a1815edb77187252dfc0686ec82d74ab9384185e904c209d876f1f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249848, "uuid": "8dd27103-59c5-4a62-9b4d-b76215d94b60", "value": "T143E30846F9819F12D1D211BAFE0E524E77131B7CE3DE72029D246F607B8A87B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249848, "uuid": "45a8d5f7-1271-403a-be1f-cc90eed57263", "value": "3072:zNOCq7IX4/eE97a87kqm8Ve7Z1qSRk7/I:zMC3XYeQa2kBz7ZVRk7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249848, "uuid": "7b46f604-d76c-4a5d-bce3-cfc6c595a00a", "value": 143344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249848, "uuid": "0408527e-a9f3-4ec1-a4e5-e9fb5883983f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249848, "uuid": "a98dc99a-bada-468d-8993-1b64e61a6ca9", "value": "sumrak.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8675db22-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234196, "uuid": "b553b996-142e-4112-8cc7-89c0c56967f4", "comment": "Malware payload (Mirai)", "value": "b88c56d7d03ffdfc610d308bbc43ef36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234196, "uuid": "21a711f7-43b1-4551-9cc1-0f8c9e15f47a", "comment": "Malware payload (Mirai)", "value": "078c256ba5d0e26ab136a35c43f3795f3fe37378a35a2e3395e8420f03591277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234196, "uuid": "eb4e57aa-560e-478b-bf01-4dcb931d4c47", "comment": "Malware payload (Mirai)", "value": "09d4c3595202427aa5f4d538616112a81361b6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234196, "uuid": "ed4b3542-a1d4-4a51-aaa0-13d00f789637", "comment": "Malware payload (Mirai)", "value": "5685710ebc570f970a50e18f3924f1ea1088ed302f10629305278fa15093f37bb1c18a0bc0c82919d5ee8e818ccfeb4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234196, "uuid": "e80c521b-958c-4c0a-bb67-fd69a8951134", "value": "T1B9313202B2181857D9E1BE7077771B8A9B799F024224864869CFE6CBF57883488CD48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234196, "uuid": "dae4ce33-a476-4019-bb2f-95271db19b7d", "value": "24:3LWS9nSWZ6S4/KSwISBd6oTKPfASXe0cPk2e77hrVtfzEWq3vt6f+jOOf+OvnU:igZVbXQASXZIre77hxtfzEp3vln/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234196, "uuid": "ae58342b-d476-434a-a20d-99bdd1fc0350", "value": 1632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234196, "uuid": "27a9c0fc-1ec2-45a8-ac5e-48bd31703c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234196, "uuid": "dc26d489-f244-4606-b7e9-8a2b7ce47c69", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad459b42-ddb1-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupportRAT)", "timestamp": 1766241563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241563, "uuid": "08b9a894-d0be-47fc-8537-23cca15ef195", "comment": "Malware payload (NetSupportRAT)", "value": "915ba9a10baad93aa50bad530836e3cc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241563, "uuid": "0b123c5d-6eeb-471f-a124-210f96f86948", "comment": "Malware payload (NetSupportRAT)", "value": "08af68406a262099a46a5ebd28cba36e8284c29b6d32632c7360e0f7ad489675", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241563, "uuid": "5cf9623c-50d7-4d76-b043-d0c3d41958e2", "comment": "Malware payload (NetSupportRAT)", "value": "5db48c7fcf92fb4148e0d8868f5c3af200073ea8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241563, "uuid": "1308a17a-ce4d-4dce-8896-459a7e6d2010", "comment": "Malware payload (NetSupportRAT)", "value": "3fcccebf434b4b559a285449681548d2737fc19e6ed6e94f3fa2f52dbc4f27e5207f1d14394593392bc006e2053dc1f8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupportRAT", "colour": "#EA9933", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241563, "uuid": "7dd08781-1073-4017-bee9-27e9332888cd", "value": "T17DC58C31769FC126D66D02B2E92DEE4E953DBE730B7040D367E8399A58308C2573AB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241563, "uuid": "f5970188-ae95-4a68-a17a-40e3d9c3b1d2", "value": "49152:HDQZSnkxFozxoX/HZB/uFYBdSwug4h1GQu2SBc6h2Xgg8lW8r5YIqSGV5G:KSnqFozxY/XuFSu89r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766241563, "uuid": "1d7826fd-bd52-4ffb-9cc5-6a49d1a2f8c7", "value": 2555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766241563, "uuid": "2aa63ac7-0e9b-4feb-9ded-82c6c600593b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241563, "uuid": "c0c6993d-d3e0-43c2-a45c-06d8e3150bc1", "value": "payload.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c08d425-dd65-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766208731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208731, "uuid": "7668da43-0202-45c9-9f27-5f9c13bb8a14", "comment": "Malware payload (Mirai)", "value": "299d57ebce7bd7d7ba654177981d817f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208731, "uuid": "901e59df-3e59-4661-ad31-b642cfdd2d0e", "comment": "Malware payload (Mirai)", "value": "093a123021a37f13d2af22b359fcbc683d18e2aa5873d897001b4a6a524c45be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208731, "uuid": "49f59233-b0a5-40fa-9eef-1ba94cda3dcd", "comment": "Malware payload (Mirai)", "value": "168fc995791daf2fc6863e6ff3481b9abf982239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208731, "uuid": "a7aa1ed3-4403-4715-9313-88bd39c4cc33", "comment": "Malware payload (Mirai)", "value": "20a3544861f02cf252733021ca54ffefcd8c1ebbc0659f8cd0c48c2b135cf54c2efb1c58f0cf0f80d75e8b21227329e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208731, "uuid": "16d2d774-43c2-45a0-8013-4e59fabd581d", "value": "T1C7833882F64B80F6D047483000A7F73FCB32D6654161D62EEFA9DF36EE63542A116A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208731, "uuid": "965758b8-b1a2-43ec-91dd-2d536472f3bf", "value": "1536:VzZR6hGiihasIoY2cVwx8KDJAOZIzWwiMJDvnnkgfauVNCb:TR6hGiiha3oY9Vwx86J9bXMJDvnkgTCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766208731, "uuid": "eebf6be8-f068-49b8-8f7a-8cdbc5a1ad23", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766208731, "uuid": "e78c5efe-7d82-4012-b49e-769e14dd6595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208731, "uuid": "fbca53e7-3f41-4c5d-af6c-9adca8ea5e0d", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd64ece-dde2-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766262715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262715, "uuid": "f5e033ba-89e1-4c61-a17f-e9303466e915", "comment": "Malware payload (QuasarRAT)", "value": "59b70194ed8481d22ea8363f793e19b2", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262715, "uuid": "97cdf7d3-b5f5-444b-a98b-0b95422c5dc5", "comment": "Malware payload (QuasarRAT)", "value": "0a8451d4e3fbf6f30e3af50fe7f80e49efc57e815bb599cbeb364c4b1d5cb4d6", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262715, "uuid": "2aedc38c-e62c-4558-93b5-27c9094cf2e2", "comment": "Malware payload (QuasarRAT)", "value": "d6462255b8352b5157ee3801c3015c75c9c0b35f", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262715, "uuid": "39d87884-4459-402a-9738-0b17663f56cc", "comment": "Malware payload (QuasarRAT)", "value": "011cafabcb759254aa1cdbda26e166485cfc1a06f0a3fcc5a98ce840d522e18f1ac3656607bc13b565371e8acce73ea4", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262715, "uuid": "aaff4219-f1ad-4ad0-a3ef-489c4c9978f3", "value": "T19BE54A1437F85E23E1BBE273D5B0041267F1EC2AB363FB5B6181677A1C93B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262715, "uuid": "fb721f49-c972-4bda-a1fa-2c1b583e08b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262715, "uuid": "3999f59e-1998-4ec8-b109-52a0592d7cb4", "value": "49152:4vclW2p9agXI2PrlTnr4BZmFzeMmC41JzLoGdYTHHB72eh2NT:4v8W2p9agXI2PrlTnrmZmFzeMmCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766262715, "uuid": "51220c8c-e556-4c09-8843-cd8d6cf52e48", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766262715, "uuid": "9c2de2de-cf9a-49b4-a390-774177eb0b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262715, "uuid": "e5087829-7b9e-4459-9197-b6e74d05ad2c", "value": "AcrobatReaderSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88f446b-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249823, "uuid": "03ff341f-6048-401a-8cba-feee03f1b170", "comment": "Malware payload (Mirai)", "value": "ab8d8698ed051bd357d8b94cb4833a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249823, "uuid": "b1a086b5-f370-4326-b9ae-b528a0943b97", "comment": "Malware payload (Mirai)", "value": "0b265a89f89abed68d47200ed1f27f4f1d68af668103176085e362fa8979f1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249823, "uuid": "f678e7df-232e-45cd-8738-7940d58a037d", "comment": "Malware payload (Mirai)", "value": "1f3741cd5ef4d21b0eb176d8dca1a982c303c14d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249823, "uuid": "6b2dff15-199a-4d02-9560-2a01bc27e7f8", "comment": "Malware payload (Mirai)", "value": "c620be46fd80553e51c49b689bd3726aa1d40c6da02366b1dc461fddd2f1ce3aab3e122536beaeaa0efd66b7190c7e2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249823, "uuid": "643cb972-079b-4b11-8001-7bb14663115e", "value": "T1FD03F113C3B1A306E1BE163F8A6F76561C91B4D7ACD892EFE4D470E2E851651202CFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249823, "uuid": "77efbbad-8ee5-4700-8bd7-2478972a400c", "value": "768:ifhbRXPX72qwjNdGBPw39ifAvVtscLwaWwietJuOnbcuyD7UHQRj7:ifhtXPKLN4BP6T9tPLbJJuOnouy8Hy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249823, "uuid": "6297cb80-43af-4616-b5e1-f9a371268204", "value": 39200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249823, "uuid": "01aa2672-9da4-4a56-843d-f4b0bf00d428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249823, "uuid": "f8f539b3-adb1-4173-86fc-800e94a94a1b", "value": "sumrak.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d686a5-dd4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766198542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198542, "uuid": "77d3a859-10fc-426e-9788-22a9ba5e848d", "comment": "Malware payload (Mirai)", "value": "fa94031d795cafb79624c6a2f3319bd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198542, "uuid": "247d4d28-1d3c-431e-bbf8-7cedc547b67a", "comment": "Malware payload (Mirai)", "value": "0b9e2b9ee7f3e5e229daa0f8e813b385b71695f661eda4aff2b8f51743846182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198542, "uuid": "295e5e4f-e414-4b02-9d57-fa4e99ce6408", "comment": "Malware payload (Mirai)", "value": "fe396d0e031756d6f079996410d96676d3f817fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198542, "uuid": "465fda88-8931-4b1e-acf7-8c4b8e31c2d5", "comment": "Malware payload (Mirai)", "value": "7791f71bceafd43d4047f4133f6faf13d865da26fe6812742824a52e80803f0ff569fcc4cfa4c08c724a766a6ca7d744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198542, "uuid": "71bc9412-7655-4cbc-8cf5-0a2700e4e42c", "value": "T144C3C81E6E229FBDF759823047F78E25975833C627E1C585E2ACD6102E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198542, "uuid": "3e916c1a-3689-43d6-91aa-b0f2004daf36", "value": "1536:5eVxVNOugg1gILI7hvk3+y0/c2CL4x6zAX0/bGAPQxeOFTxMkZFI:kVNjgDd/c74x6zAGGAIvMkZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766198542, "uuid": "ef072154-e1cb-4135-b540-fa523247b3cb", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766198542, "uuid": "1b723741-7c26-401c-ac8c-2e3917f6c8a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198542, "uuid": "7d24ea79-dac5-469f-b677-188fc9e8895d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a80e86-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223295, "uuid": "1719b79b-7765-4d2b-aac0-8da9a6f0d668", "comment": "Malware payload (Mirai)", "value": "d3d01d4cc63ee900d84aebf9bd1ac847", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223295, "uuid": "62ef4b21-c346-49bb-b088-adeac5a3b69f", "comment": "Malware payload (Mirai)", "value": "0e94fbdf4d50d0719c3db6ac81e847a88b8f24f8b45c1f2962d0dd5f19ce58ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223295, "uuid": "f4a162eb-7ae4-4664-81f4-28b805596349", "comment": "Malware payload (Mirai)", "value": "e4075353fac142dbce9be559f92694dda2ce2972", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223295, "uuid": "342b115f-677f-4b58-919b-8e8b5a697ac6", "comment": "Malware payload (Mirai)", "value": "9b46a1f85534698ab429bc452e114ce45aa667b5cbcee114dcc5a3ea9af05e4d766ae52d870175de72a136aa93e31e1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223295, "uuid": "5c5aa59e-7038-4746-8ec3-af433b4dbf6e", "value": "T1C6A011AB30203000C808FC0828B20FAC20A382E23A080A0CA0FA0230CCA8A2838A0A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223295, "uuid": "bd4c3359-3fcd-4a35-960f-8eb3fdc39df8", "value": "3:L6FT7KDQNUClswWeFGBzSEyLTUWOevn:L6FTODWajNI5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223295, "uuid": "1e0bd594-dd29-4a39-beb9-31412c0f5bed", "value": 84, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223295, "uuid": "4f8187b1-00b6-4dfe-9363-ef60aa8addac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223295, "uuid": "a5bb6fa0-e567-446d-b866-d95764e32f3b", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb41e1fa-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249827, "uuid": "3f25a554-2477-4f46-9a7a-736342f7e6af", "comment": "Malware payload (Mirai)", "value": "2d4f7ccb6c07aecaf0c5a733f467017f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249827, "uuid": "0458883a-61dc-40a7-a830-e77fb9744562", "comment": "Malware payload (Mirai)", "value": "0eaf8243e73a2f2de8164be8c565e3fb343a382ed4e850290d043621b87d6671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249827, "uuid": "6ffa017c-d4de-4c44-84d7-c1f8f62ba4f9", "comment": "Malware payload (Mirai)", "value": "b4f4210f08bb0112ab8d1cdf4fef5e6b04853ff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249827, "uuid": "a011e762-bb4f-4d1b-a51e-f57001ac5e17", "comment": "Malware payload (Mirai)", "value": "a7242459d0e927a5815f3f20e8f37aab966169a829f8fabb1f0d5e59671704d0b4d4a0b4cc3e33afc3807f56161c6f7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249827, "uuid": "2e16eccc-c667-40a1-ada3-828592847f60", "value": "T1EB43027FE7F686B09F024E35DCC9876106925FFC22CA6A33455F962C918AC0339D6893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249827, "uuid": "5d6cbe77-c1c8-4611-89e8-bdd08b79b992", "value": "1536:BRhYgVJvRtp4+NxzznIhdlsDHuBh7Luxzwisu8Odq1:BRhDvnpX/nQD2O5L+6pOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249827, "uuid": "f43ed016-a1e7-448d-aa5e-04dec9aa0ea0", "value": 57348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249827, "uuid": "1f26adfa-bc53-4b60-bd60-33f29c6edfaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249827, "uuid": "8dac534d-1902-482f-b9d4-483c49f7baf0", "value": "sumrak.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5700308d-dd6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766212642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212642, "uuid": "c68565da-988b-4e47-a6ba-77e2ad172f71", "comment": "Malware payload (Mirai)", "value": "271d53e50b024d7bcad3ac01fa68f30c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212642, "uuid": "07884051-e6c2-4fc4-a060-089f88f4a918", "comment": "Malware payload (Mirai)", "value": "100f0e08b7991ba55e71ebc8e3933f340b962a26d6170a645a27da7a9146c45f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212642, "uuid": "f2cb8a4f-4f52-4379-832c-77b6e67a4f18", "comment": "Malware payload (Mirai)", "value": "4b28f0dec52a2caa9006ee7badd17544628d80ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212642, "uuid": "265ef103-ef19-4466-bbfc-ba4762733024", "comment": "Malware payload (Mirai)", "value": "30a79eefe94936d47742697168fe3e7b558cacc0aaf213faab652b9503bea33747cc8b75f076d2ada0fc6ebe0aa59ed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212642, "uuid": "72d8fa7b-62ee-4df6-a7c1-f92c96d9d9e9", "value": "T1F0044C56E7418A13C0D717BABAEF4245332397A5D3D7730699246FB43F8269E0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212642, "uuid": "b4449f67-aa99-4431-beed-05efab38ff49", "value": "3072:GxktOitbO+AAagk4B/YnGswmhsIXaksj1+XUnPM/9CY3tZ:sksitalAagk4B/YGsvsAaRjUXUPM/9C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766212642, "uuid": "a1363d20-d88e-4305-85b4-358bc27f0a4d", "value": 180727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766212642, "uuid": "0ed3af94-ed43-4e11-a945-07baf3c1234b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212642, "uuid": "842e4125-95b5-48f5-8899-4c26ff328409", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc97002c-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249856, "uuid": "4b8b5a79-2282-4433-98fd-8a5410a94d0d", "comment": "Malware payload (Mirai)", "value": "11ac69397518df3d634a404ee0482110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249856, "uuid": "bdbddb3a-6e75-422d-b6b9-c7458d017da1", "comment": "Malware payload (Mirai)", "value": "1055def6d4ca31c42c92d7afa27f3c5aaf337b0c8005448914855afe78b185b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249856, "uuid": "34e98335-751e-4dfc-8b17-def9209343b8", "comment": "Malware payload (Mirai)", "value": "7a1149d45976af2908e5a61401df8c6a4d49c675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249856, "uuid": "ac6b75b1-0943-4241-8a59-e9739512e8aa", "comment": "Malware payload (Mirai)", "value": "d1915a9d667215e31833230b7dae86a3521aea7839757dbec642f3f26fd00a2b8efdb8b6f7c662e0184bd8de05be5aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249856, "uuid": "01af7bb6-eefe-4564-bad8-4dfcc6c563a4", "value": "T111E33956F7408B03C0D21B7ABB9B821573239B64D3E763059928BFF43F867A94E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249856, "uuid": "8d93b421-080a-45c0-95cf-c3e602d22820", "value": "3072:1P+iqEwdaPw437IWDmObt6AB+FehQrM/9jj:12ZDdaPw4LIGbIAIFehOM/9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249856, "uuid": "ba75d2bf-fe62-4b6d-870d-ca6dbb826c8f", "value": 143856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249856, "uuid": "69b38422-b777-4eb8-80b0-d5a32af14ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249856, "uuid": "e0e91380-6046-4872-9857-47da76a7e6eb", "value": "sumrak.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddcac40-dd64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766208600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208600, "uuid": "a93409b4-da0f-40a7-b1da-1ea61062996c", "comment": "Malware payload (Mirai)", "value": "b3d8fb40f715e4e70cdd96e7d0169186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208600, "uuid": "0c9c6f0f-c658-466d-af78-860e00ebbfa3", "comment": "Malware payload (Mirai)", "value": "1078f2fef9abdeda64bb97bd4c1e4ba9a6c8ee74a13eb8f29853b27ea5abd844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208600, "uuid": "85adea7d-d471-4b98-96d6-e78e77bee24a", "comment": "Malware payload (Mirai)", "value": "46ff42188b6ee8414cfb4dcbbac7f4d55f4c863b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208600, "uuid": "461af17c-9dc4-4f31-8f74-f8de548c9036", "comment": "Malware payload (Mirai)", "value": "e9f9e2c8dd197b27225e4fa8e78ae3e5f1daf8a54346ba530bc42b3e0325209eb30768ffdde0a525811bb933d28625da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208600, "uuid": "4c75e770-a862-4c66-b7cd-dd65be00c8f7", "value": "T100D39D8BF78B04A0C86306F007CB0B9E6EA321D15E5BD9E37D29A63B5E754DB0905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208600, "uuid": "1de2d5a3-784e-4828-af20-a792381301da", "value": "1536:cNPl84Yxdno7UIc/dfzGm4GPOhaHwoVc56cNlO1ZFAx6RRgsKx+/LWB:wl8HW73Ifam4IWaQ6c56goZF9gsk+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766208600, "uuid": "e9c6c337-c156-4f23-8bba-9df1ebeb1c60", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766208600, "uuid": "e86ee3ee-33a6-47bc-9716-b0c4b04e3914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208600, "uuid": "ad8dd356-333e-49fd-a4d3-903046d2b021", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c2c7c6-dd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225684, "uuid": "afd49426-5a5c-4ea6-8116-ed2af34c4096", "comment": "Malware payload", "value": "dbae439a80cd9eb811fe4d4939f2e89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225684, "uuid": "ece0acca-112d-4d52-8821-ba41658b6313", "comment": "Malware payload", "value": "11607c1211dd50a49b37882ec1dfc5d187bfff9080892cd5c6fd93c0d80877c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225684, "uuid": "e342a632-4a77-45d3-8bbe-edbc95df0e8f", "comment": "Malware payload", "value": "ce6505c4ff4295ed38ccba649efbfd799f9440b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225684, "uuid": "18c94f9f-e0ba-44b6-a757-4d747a19e64e", "comment": "Malware payload", "value": "d922068e7987ac8495719e591a961c0607ec04e5a9c3fcb2375de94f074e3fc60f7f857ee6056be58f52d8e595786517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225684, "uuid": "99a9c892-9982-4974-957d-a647dc3389f5", "value": "T1B3E2E1413FFE6298F0F26EBA22E49605E17DB55A5C4E83892F09805F18E095BCD37E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225684, "uuid": "f3ddfaac-b699-4705-aff3-2104754bd9d0", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225684, "uuid": "6f344cbe-6d68-4b8c-bd16-0701ea83db83", "value": "768:/A9wAsk5uWLfuT98npCJpkoar+XqAjNVXxJfBQeh5DK:/BARu8uhfpkFSqAjNVhJ5Qe3DK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225684, "uuid": "fb3b3390-7f75-4dbe-885d-9689258fc6ee", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225684, "uuid": "790b14c9-5889-4fc4-873c-e3484eebab9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225684, "uuid": "6852a0b4-9aee-4253-a2c3-93b5216b4877", "value": "cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5c2d1f-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766226635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226635, "uuid": "2747c612-9695-42e6-8f41-b72f2d5ec3c8", "comment": "Malware payload", "value": "866c0158bafb93dd5449cbf5e1a94aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226635, "uuid": "8079d14f-2852-438b-a9f4-8bb42ea06ff8", "comment": "Malware payload", "value": "117b22013f8696a0a980de177f872585253e818becffbf9282493047eca0fd15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226635, "uuid": "6664af2a-e5f1-475d-9abd-3d19ef3f7d4d", "comment": "Malware payload", "value": "293e806f71a2d49319813c19d33f45eda6a79c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226635, "uuid": "e6e2c06a-23c4-49b6-9b20-5e8db3838b73", "comment": "Malware payload", "value": "a28be2f65c5c264c82c423ff7b386e0f192a757fc29d353e673f128d86294fd53dbb8bcbc9a39b99bffe690713c0d733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226635, "uuid": "6e88952b-5b8e-4fc2-bd45-2322c954c8a3", "value": "T15EE2E0813EFE6398E0F1AEBA21D59601E17AB55A5D4E83892F09805F18E095BCD37E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226635, "uuid": "bc1013e4-4551-431b-95d8-837ecfaec975", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226635, "uuid": "dd020cb9-8408-4c40-905c-3f5c88fe8abd", "value": "768:6A9wAsk5uWLfuT98npCJpkoar+XqAjNVXxJfBQe3DK:6BARu8uhfpkFSqAjNVhJ5Qe3DK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226635, "uuid": "b3a5feb4-a656-4bb6-b2ae-fc1bfa168b78", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226635, "uuid": "e9929acb-ac71-474e-b9c3-8d8650fe8d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226635, "uuid": "591dafd7-9da7-4903-8a62-b211961d38c8", "value": "SecuriteInfo.com.FileRepMalware.51461229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931c810e-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (SilentCryptoMiner)", "timestamp": 1766226487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226487, "uuid": "f28e669b-81b0-470f-ae38-bc95e3ed5229", "comment": "Malware payload (SilentCryptoMiner)", "value": "ee49871e53bb83a59c992e6bc1fcdac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226487, "uuid": "947f89a0-9ca8-4442-9bdc-05e8e1e5e8e9", "comment": "Malware payload (SilentCryptoMiner)", "value": "1214268764f9252ca840f1cc7e9b3698ed55f059802fa7ab7442f61144d898d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226487, "uuid": "c125c246-7221-4baf-90db-230c9eafdf95", "comment": "Malware payload (SilentCryptoMiner)", "value": "c135e092191f5ba02da14b5ae517b4f6aace60d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226487, "uuid": "239db81c-fadb-47d5-a7f9-e49811ac3004", "comment": "Malware payload (SilentCryptoMiner)", "value": "6eb3a66e4965fb3a746bc0d9056dd6e0a540d67e25076810616a05a9ad1bf5384ed96b73e6d665991c0c12f621580874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner", "colour": "#F3BFFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226487, "uuid": "fa4aa305-e366-4b2b-b82d-f0808389e8b7", "value": "T124360253D29F61E5D47AD13882466322FD7178600766AADB826057226F32FF07F7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226487, "uuid": "70f859b9-753e-4b40-bea0-f8cc115c7509", "value": "f8861a55b03332de97005193e8e4ddf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226487, "uuid": "8a129dc8-30dd-41ff-9e04-0d8397708cf2", "value": "98304:aqAIYKOKaPuWn0yMxnTq0dKtxaEe+TuVbxinlItUkl5VHfRpIR8sBF:aqvNOKaP30dlTps2BElWU4zR+R8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226487, "uuid": "37718b64-7e9a-42f7-82b6-ef9c997ded64", "value": 4942848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226487, "uuid": "a5dc1af1-dfeb-4a91-bb85-64c3fc645070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226487, "uuid": "a8e9664c-8052-4b47-8509-24c07f2ee10b", "value": "KrN2ZLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979fa847-dd68-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766210173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210173, "uuid": "46a1e468-0ddc-4544-b80e-f4c9e63ba2e2", "comment": "Malware payload (Mirai)", "value": "10d92e5240ea2a68015b91c027abd69e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210173, "uuid": "5805ba98-7a03-4311-b027-76275c522909", "comment": "Malware payload (Mirai)", "value": "134ff58f81d7c5d651ba9b94a0b45723535f21ed17e6570e058186af1cbce7e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210173, "uuid": "eeaf389f-6ae7-42ac-8e1e-70636bf90e4f", "comment": "Malware payload (Mirai)", "value": "d7f51ae0e4a1fe43122b5ee3d401dd62e26c2a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210173, "uuid": "46061665-dab7-4897-b4df-f5420a4f6684", "comment": "Malware payload (Mirai)", "value": "93cba378f2601fe1cc2eab46dc953840017e7d6f718dab38fbd7622bb09f0ab965c7798becf2883686fb197aa93a7282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210173, "uuid": "b7374ce2-1364-43e6-bb79-cac60ffc3fca", "value": "T1B0C3F80ABF110FF7D86FCD3706A90B0625CC555B22A57B3A3634C928F54B65B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210173, "uuid": "aa66f073-6cee-4f68-880a-9a5b53250f7b", "value": "1536:ZPvZHT+DemrUy2+32vfjQJXpi7Oi97ZrnqAwg0tS547+ZSvmPei:ZXZHT+UFMJXy97M75vmPei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766210173, "uuid": "f72f8dfc-a05d-4afb-93b5-fe6a1442e344", "value": 122316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766210173, "uuid": "7fdd6b49-ab31-4f21-a9b3-4750f73c8eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210173, "uuid": "0ff62d67-f890-4965-82db-ac494be30cff", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f22a98-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211811, "uuid": "573b14ff-0a07-4781-b32a-cc88b5560ab0", "comment": "Malware payload (Gafgyt)", "value": "8a85de4429667874602009a1206925a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211811, "uuid": "84cf4eeb-fe1d-45f0-b3ea-da8c39328821", "comment": "Malware payload (Gafgyt)", "value": "13813a126b6094f8d3e5dafa14b4a20a82089cda1e94b083d2d9e540fc24709a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211811, "uuid": "8e21870c-5a7e-4946-b1c4-937ec769928f", "comment": "Malware payload (Gafgyt)", "value": "13b4304477d1c71f59b6c67bddc9d36235862ee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211811, "uuid": "4933cdd1-31ac-4091-9c29-3fee469bb0b1", "comment": "Malware payload (Gafgyt)", "value": "af25ad79f5f82d64b960ccf117dccb2d75fb7fd231f597ed56bf91d0afe0a1c40005fde4218674fb7a355ee54ce9693a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211811, "uuid": "181df995-43ab-4850-affd-1407a8d5c9c4", "value": "T192C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211811, "uuid": "1bdf265b-647c-49fb-a6fc-8f52d1d5c115", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeoEdWfRZrmW+IFj:Ted0W0MZQHqd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211811, "uuid": "2f8cce94-9d62-4089-ae18-8a2a699b7783", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211811, "uuid": "7a0355c0-088c-4253-b4cb-7f51446e215b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211811, "uuid": "a7c45ff1-c450-4541-b3ac-ad46014b1a9a", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7fc451-ddd8-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766258366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258366, "uuid": "f25500d1-4007-4641-8778-a607d973ec72", "comment": "Malware payload (AsyncRAT)", "value": "94da4b7ca1b718d0bdbc19b6f8023020", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258366, "uuid": "12453ac3-1e5a-4e31-b2b7-061657406de4", "comment": "Malware payload (AsyncRAT)", "value": "13b49396083f61d745842922cd79630dd1e56b01dcb026511d054cd91f15e683", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258366, "uuid": "459f7ee2-7bf8-45fb-8211-90b0eaa64503", "comment": "Malware payload (AsyncRAT)", "value": "3a20450fb6dc39b694113dd8a6c8448227f6f1be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258366, "uuid": "fa2bb353-99d3-4d6c-b088-9fc00a4a9e53", "comment": "Malware payload (AsyncRAT)", "value": "fad7c4fbeb56afb88034cec189039940f1da1441de91bf96bd68ceaff72811841ca69c0a0711c9f4c8e3dafa9b0b51f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258366, "uuid": "75e4224f-1209-42bc-961d-62d29802f859", "value": "T11C233C003BE9812BF2BE5F7899F26141467FF1633603D95E2CC4529B4613BC68642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258366, "uuid": "6ff709a0-76d6-4e4b-8904-847b1bd14adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258366, "uuid": "ac130a25-ae03-4c97-880c-d17ad35f2e50", "value": "768:3usc1ThIn5PWUDvOtmo2qzY6y/fTfPIOzjbqgX3iFvVxZpu3mOLPXBDZc4:3usc1Thsq2V6+b4O3b9XS53qVPRdc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766258366, "uuid": "6af1e23c-4118-4ba0-a5a8-43d4d4699b84", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766258366, "uuid": "f35c5494-db1d-4a0a-9d0a-585b478eb226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258366, "uuid": "e100e054-5128-4ce5-8308-2207775d2206", "value": "chrome_dev.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3a4079-dd6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1766212600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212600, "uuid": "c3e8e959-dce9-4f2f-a654-abfb4e250170", "comment": "Malware payload (Joker)", "value": "b5662376efce6779f3d51aa11d95498d", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212600, "uuid": "8aaa38c5-85d0-4bf2-b528-4d608155e370", "comment": "Malware payload (Joker)", "value": "13f58fae725bf085936794d8e7e7389f54ba35500361716b3ac74acd1426606b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212600, "uuid": "01833f9a-e795-4228-8224-096bd1a3e59b", "comment": "Malware payload (Joker)", "value": "6265a89ac639c56f44a54b33b5f9b5b26f53f992", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212600, "uuid": "1a423343-106a-4bb9-af44-46466a461929", "comment": "Malware payload (Joker)", "value": "d4910d10f016618fc2b715405fd4d1dccee385f893ac8822d9ab34737894c366d41ede855a90c2db269fb5240c4f3a70", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212600, "uuid": "19d947ea-6f73-4f2c-b3e5-24ad311f5ee5", "value": "T130672203EE088A53D465C3F4BE130EA93B1B7E1CA88266EF381A7E9B3F352511D4D559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212600, "uuid": "be58db5d-edff-4488-9b2a-f85aeed63b3c", "value": "786432:Q82NXPpis+VuFiWmppNnTW1qfwKhH3cTpDIh:t2Nos+VukvT0fEgp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766212600, "uuid": "56a94c83-a186-4a47-aee4-2c77e3321988", "value": 31263888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766212600, "uuid": "78af25cf-db1a-47db-be4a-5028c5a30338", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212600, "uuid": "ac646485-7631-4c8f-825f-2e3c71eb4f1c", "value": "Galaxy+Wallpaper_1.0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74ed202-dd97-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766230440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230440, "uuid": "79de67c8-2e17-4fa1-8e75-eda875ad11db", "comment": "Malware payload", "value": "cdaf6913615b6c3087618a89cf5daba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230440, "uuid": "51862cf6-a920-444c-8d71-4a79c61460d8", "comment": "Malware payload", "value": "14d374ea0604f70e6f39306efd948e7962fdd21cdb3e187ba461312027ebd3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230440, "uuid": "70c7630f-d623-4ee0-8960-82389a8bdad6", "comment": "Malware payload", "value": "000a25edc1bd2e91d65851c5171edf6facc0ca3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230440, "uuid": "e2bfbbea-377a-4282-8f7f-3bfa62a185b3", "comment": "Malware payload", "value": "8aa02c5f1cfeba7dc102bd7a60516bccbe7044c7d8203e3786270bcf1ce22b66d38346e2a1030bb6fd8ee32d97b52b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230440, "uuid": "2c2cc1ad-48a7-4545-950d-4123bde96840", "value": "T1ECF25B49578C8E37D64F6AFC6CA2635247F6C32BA492E34BACAC45A4DD533C804143EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230440, "uuid": "6383638d-8341-4e50-85a5-fe7cdb46df5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230440, "uuid": "f22ca7e9-1197-4862-b3ef-11063ac0d0bd", "value": "768:U2lTRrJTyMwXrw4QWmaQIzjzuaYR/aG82ADXjAJp0:U2ljlwkoQIzjzua8/aG8tDjkp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766230440, "uuid": "2d733a54-1353-414e-a005-c1eeaaab2aa1", "value": 36848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766230440, "uuid": "2bc4d7dc-1a22-46a9-8b32-b2b1535ed192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230440, "uuid": "e8c44367-0e00-4653-b1f9-0fb4b26d58e7", "value": "Screenshot2025122068698m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c98331-dd64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766208378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208378, "uuid": "78294649-970d-4fc7-ad7f-e94c41c596f5", "comment": "Malware payload (Mirai)", "value": "66fb9644503a3734b088ba1006d53afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208378, "uuid": "5c02a584-218d-48f6-84d1-90a8f0b5723d", "comment": "Malware payload (Mirai)", "value": "16198f68dc0ed4f00b4d390e3a5b6621834b565c16b0f6df3c7ce07bfdcd8ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208378, "uuid": "dee057ef-392e-4a16-8569-79160cb67e6a", "comment": "Malware payload (Mirai)", "value": "58062d73dc9805ea141d8a405316b8dbcd8269c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208378, "uuid": "87d6ba3c-eeea-4f54-a24a-7e28b2aadf65", "comment": "Malware payload (Mirai)", "value": "d9490fa7f40ed7285068fbd4182f7c4e658b9f1095d544f8da6dc3ac5a6e32ac8c03ffcd1f446267141bee363b5490c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208378, "uuid": "ac133ace-5a80-41d1-89a3-94e5f8580b09", "value": "T10D932951FD825613C6D122BBFA6E428D3B2653E8E2EA7203DD205F2177C681F0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208378, "uuid": "6d4cb700-b7fd-483d-a56b-d4002d05a723", "value": "1536:FWKfB7ByQgaFrrjwg3ZxOb7uf2wOUM9ASbqiO2C/mRrEqyXvrg:oKfB7Zr7C7sOUM95oqMrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766208378, "uuid": "70f2dffc-8f85-47c3-b8a7-3a78dcfb4286", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766208378, "uuid": "c4a5e230-e76f-437a-83db-eed5b4d168d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208378, "uuid": "18a2f140-9b35-4374-9406-da5f1116e2a6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba3b5bc-dd6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766212596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212596, "uuid": "81fb4e42-33c2-4ee1-bc8d-ae068f98ee78", "comment": "Malware payload (Mirai)", "value": "d2262b14fd39ffe0c36a89505f37a56e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212596, "uuid": "02f4666a-da2a-46d9-8d1e-7bda8a7502c2", "comment": "Malware payload (Mirai)", "value": "169aa77dbeeb8bfa7ad7749eec142c66c0612b71cf1d4197bbd1b9a11784e094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212596, "uuid": "a43a1026-bff9-4a2c-8dd9-c82f4a20ba7a", "comment": "Malware payload (Mirai)", "value": "3704b382b3e64ed3f75b8e523b2b2bbc065862e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212596, "uuid": "8ea2e530-4172-448d-b8da-23d0d12c6405", "comment": "Malware payload (Mirai)", "value": "bee098950e93c0571b4a7a17fd897e1c4b84c936f85931a4f0b68fcc2aa62ca4aa5fb0643364aa29b3a7e1582f012153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212596, "uuid": "e3098811-e103-4371-911e-c004c922e888", "value": "T15063F1186B66EAD0DD3066388DE80744AF66E7B85AD630A31380CD18F6D66136BF7C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212596, "uuid": "0524e9f3-df1c-4c91-8e61-c77b2915a6cc", "value": "1536:V4YeCK8lpEyEBafotAe1we6EYfLSsVC11BuDI:VzeCK8HlfyAe4vLkUDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766212596, "uuid": "68fd81b9-5771-4267-81f2-7fdfe9ae0538", "value": 68800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766212596, "uuid": "3222de52-e09c-4727-a440-2d08a825d754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212596, "uuid": "0aa0c313-7ccc-4f0b-a74e-aab03ff6d944", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a376b54-dd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766214661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214661, "uuid": "1bf874e6-2504-4fc9-a034-547b59d20d06", "comment": "Malware payload (Mirai)", "value": "193169dbbc77876ab1972161eef1f116", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214661, "uuid": "49350f55-a2dc-4ab6-b98c-15b56252ad35", "comment": "Malware payload (Mirai)", "value": "16fbcffc53a4f39b8b9491e00fc5c7e46c89deff564d5d44b5a8e18535c3a02e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214661, "uuid": "032c7e0d-4ab6-4311-ac4c-205bce92cc66", "comment": "Malware payload (Mirai)", "value": "9d2979c119c94376487b13bbc9e632c0e7a99d62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214661, "uuid": "30be5eb9-b906-47b5-8a49-a11fc023ccbf", "comment": "Malware payload (Mirai)", "value": "16c90a8b21a414bca221ca0380f16ffd41c132c44ee8947733322d8b40cfb3c80be5fb1f17ea09aadb5c4b900e16439e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214661, "uuid": "9911ef73-fd51-4069-90db-681b8a56b4b4", "value": "T15F5118CE30520A316EB2DD6376B9D40C72C990CA51DA7F4B98EC38F4C1EDD087A54EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214661, "uuid": "3cece65d-05f9-4763-9501-021659b839d3", "value": "48:iXyxGyVBGUG9kH+n+LPJyKFBlJ1rl0mp1:iXyxBMUG9Hn+LhyKFBRr51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766214661, "uuid": "1e3ff0e4-9a1f-46fc-bec4-7d4f19cce88f", "value": 2489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766214661, "uuid": "b28de644-0697-4f8b-b35b-06402f51bac4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214661, "uuid": "851c733f-9202-4e92-8b38-4dfff3f209e9", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcec05c3-ddae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766240301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240301, "uuid": "cddd67b0-a9dd-418b-9b1e-1a03342e21d1", "comment": "Malware payload", "value": "241cb466e2d330c9ba7f0972c0efcad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240301, "uuid": "d354fc44-90e3-4e64-a9f5-3c0e815d89bc", "comment": "Malware payload", "value": "1744c798dbfd936590f30c11aaef12dd859998af7d630dce8b203e42f48add8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240301, "uuid": "a68d7cbc-a077-41cf-90ae-3a61eca2df68", "comment": "Malware payload", "value": "bec26e5108c1fcc8a437dc3d7bd538bb99fa5f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240301, "uuid": "a414b2ec-5b26-4a9c-808d-4eace6e71015", "comment": "Malware payload", "value": "7ddb75b4e5064807a0173aa1a62b2810c1a25f534b8027aef3ea42b6166c3b68ba0f2861d0808d0cb571662e8a868fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240301, "uuid": "2b33b68c-9d9f-461c-8008-f74cd368a3d9", "value": "T16884F89B289560F8C1FEE2748665A502BF7130A4073837DB2FA146F10F26BE95E7D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240301, "uuid": "b48eded0-e17c-4ca7-8413-3a2aa3280c66", "value": "dab37a3fb9d931042eaca5d02dfdfda1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240301, "uuid": "955fc3dd-5a28-4273-952c-5244230481c0", "value": "6144:oBTdshMg3rmtFdZ6Zw6RE1v+GtXjOKrZ2RLK0qs9SlKg365O:osCdZ6Zbqv+Gtz1rZSugk30O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766240301, "uuid": "940e1ac8-5a50-4aa6-abd5-c1b3d39b1180", "value": 401133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766240301, "uuid": "f1c59737-0e02-4a73-bf55-388fd9ac5151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240301, "uuid": "a9d47d88-c90f-4b1a-b106-e7015d0a9aa2", "value": "SecuriteInfo.com.Variant.Doina.112752.5454.15313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d2d64f-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249842, "uuid": "6b38fcd0-7ab0-467c-b0c7-ab50d4b112d4", "comment": "Malware payload (Mirai)", "value": "34dd9a1864d9542c5fe208ac4313368f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249842, "uuid": "9d50dba2-a285-4cbe-8dc2-eeecffbebfeb", "comment": "Malware payload (Mirai)", "value": "17d8d80d8d9dfee53996846f5c04815a80e4fad7b58af64dff7ae84205e0a88b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249842, "uuid": "2f184ea7-5fcc-4478-99ce-0f249995c085", "comment": "Malware payload (Mirai)", "value": "5bee54fc2ba7179ae0a51c214c3a0067309a8fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249842, "uuid": "c67fe32b-eedc-43da-a68c-da81458079ab", "comment": "Malware payload (Mirai)", "value": "d514e23e9ede7588545adf55389d2b8861f845c8e652bb6a5cb4b9450c7377b6d25709c34e0f4c14140b4660e47132b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249842, "uuid": "16c4ed0b-c851-4895-aaa1-fb00f11955fe", "value": "T148C22ADBB4995C1BE1C21234772A032D7754A7D8D1CF3703C9AC2F60650E73AAB6EA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249842, "uuid": "812f81e7-d54f-43d0-ae06-5af5f2ed6ef5", "value": "384:98C7iJcssRhOQO5Ey/tvEvWjCSTLc5l4lS6t6GCy12oObp29/BgtLH1NUdpH/5i:98SiJz2gQO5DNg+lQbk9/K1NUr/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249842, "uuid": "f73d8b68-9df9-4acd-8498-203791fc2272", "value": 27444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249842, "uuid": "b4c52798-d350-4b56-a3f2-173de8602c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249842, "uuid": "00103f0a-6db1-4fed-8d5f-26659f56a505", "value": "sumrak.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca02b5e-dded-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267144, "uuid": "568d11b1-c124-4da2-9c34-0e8660feac54", "comment": "Malware payload", "value": "50f18c6a9002d10ea70c7559a451fe0e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267144, "uuid": "48d43e87-9fa6-43e4-8103-78b5c5fc897f", "comment": "Malware payload", "value": "181043062852d05d8a935b0808f109435508b5d3fa5924a47e71ed1760cb75a6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267144, "uuid": "0c9ee708-b523-4094-b244-9b663af9be28", "comment": "Malware payload", "value": "27abad6ca8c68345bd7a6d9a7b246254bcd86497", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267144, "uuid": "bdf42fdd-b0d3-4cab-b072-3999fd1c4536", "comment": "Malware payload", "value": "9d093381531fa694365a765ffc9968238604f9ba737b41a8cc50a85616dfa36f8a9ebbb74d37b15901acf4fe51d1fc89", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267144, "uuid": "99572203-8c80-4c0a-85c5-5b10249a95ce", "value": "T1B3F4235B371EEDEFCA5DE736DE26F84C26D481918A90E61EA009CF510DC03A05A4E79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267144, "uuid": "b6850901-1941-4aeb-b112-7768fb0832a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267144, "uuid": "a862f796-bcfa-46a8-afc9-41706cae3876", "value": "12288:JpOaBrC8D5EBqzJ0tAErNx92N1C382mT8j5mJ9zOdbUAqVEqb5MDZToDwn+h:fOa1tEBkJzEoN1CsJAFmJMbU5Lb5MDZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267144, "uuid": "a33f0b93-1554-4045-862a-0614a92e73ac", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267144, "uuid": "c99806f5-cf7c-4a72-b8ac-754639818164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267144, "uuid": "0c56bf58-8a62-41d9-a828-e8427b9c5ee5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c475f115-dd54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766201659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201659, "uuid": "1d240328-96fa-42b6-a014-f3e024e3db81", "comment": "Malware payload (Mirai)", "value": "27a9f2104d4e05bc8512f6b6f24c0be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201659, "uuid": "8e33b0db-a1ed-490f-8caf-3431d460903d", "comment": "Malware payload (Mirai)", "value": "189328e5c858cf94ccf0c3655b4416ff90c3c404e4ab94912cf11a7984189506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201659, "uuid": "b2a740cf-f9a1-4c55-a7ad-0ea2e8bbeb92", "comment": "Malware payload (Mirai)", "value": "d4db75d5a87e7dbbe808cb4512b63a225bef57d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201659, "uuid": "aeb3cba3-ac4f-4221-becf-754501cb478f", "comment": "Malware payload (Mirai)", "value": "9687da89e459c0e1cc817b89472a8427eb023a2e7d3e68f9fe52bb5fa2bb30106d9d508cb5fa96b1424e0e02b249e8a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201659, "uuid": "57b29a4b-7096-4e3e-8988-64767a0be640", "value": "T1E5934B02B3180A47D1A34DB03A3F1BD1C3BFA5D121E4F689692E9B8596B5D336486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201659, "uuid": "6e5cdcb1-a51f-4c9d-87ff-d88f923d3401", "value": "1536:wrTRtMgxWLtLcDcTD+rdiYRQpPixbbUZrvoxnH7OGdpKTq8kJ+unHxpeECO7HnjA:awoWLt9T1Y2i6wpg2+2xgM/Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766201659, "uuid": "189a056d-809d-4a52-9e69-84de8f377f4f", "value": 92064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766201659, "uuid": "a3104773-3469-404a-9e9f-feb2a1e5e850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201659, "uuid": "3d21f2ba-f7bd-4238-a91b-dcd5a4f94673", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5176602-ddfd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274298, "uuid": "1141dbb0-a011-4c5f-8f2f-9944e6cc791d", "comment": "Malware payload (Mirai)", "value": "77f05be106d3ad954dcf9d4eca607d29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274298, "uuid": "4d0594c3-c141-4ae3-9866-ce55aa13f0dd", "comment": "Malware payload (Mirai)", "value": "196958e8289a31e929e5107e9f4dda1b7bfd11eee1b771de82436840a7ffcff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274298, "uuid": "f4014938-bfad-4244-806c-b0ba667d65dd", "comment": "Malware payload (Mirai)", "value": "b48fae8f0f87f8157922ea8773da5c35c77ee37e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274298, "uuid": "8c8a4227-d4c5-486f-9997-e74846a3f510", "comment": "Malware payload (Mirai)", "value": "329ae33b6768028dae4887e51f3c560d2c94fb2d962083912c3fa8534b042a7d5a3bc311d98e61ba5ae25fac7eb9b0e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274298, "uuid": "b0ca7c54-3c89-43f2-a918-15c623776dd4", "value": "T14DF201A2E4496946E0C04279CF394C58C1A19C4D7933814963CA2F6FFC6F2B6777085D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274298, "uuid": "ab956f72-8007-4cf5-acd7-c862ea9ac419", "value": "768:S/GgCNzMzOJNwLLIeS7cXBcXL4rDGFyhgKiHKh5rLixvGnSj8zX:0xCNumNKEyc8fGFDpHKh5rLsGSoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274298, "uuid": "b8e7fe3e-2101-4501-a9d5-c43c97382439", "value": 34340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274298, "uuid": "4ab7329e-39b7-4a71-a04a-43b5bf5bdbe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274298, "uuid": "bfbe007e-f99e-4bfc-8e60-258885552886", "value": "sdxkzX_UXA229x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e68e1c-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235779, "uuid": "ebe3d3eb-6b99-499c-8046-ec00e82b8c15", "comment": "Malware payload (Mirai)", "value": "b4adba3be0a0017fe48e88fe11e16ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235779, "uuid": "e34ab1d3-dce9-41f4-a726-d8bc2f898277", "comment": "Malware payload (Mirai)", "value": "19c8200b771ea0702045ba77a8f3b1ab87f266663862cbfb6d2e4cce0ba1f1cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235779, "uuid": "ec0e0879-0253-491c-991d-76e6f86e2325", "comment": "Malware payload (Mirai)", "value": "74e460c25df91412d78dbcc997a8c5bb2dd7bf49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235779, "uuid": "af6bcc87-9d9c-4788-9432-089021ebbb19", "comment": "Malware payload (Mirai)", "value": "5b9367555fc12efcfb669e4d0eafd4d022c6e16a48744dfad6e1e28c2d7203552d6bd03a8bfd11d5f8b9195a6d4f2e7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235779, "uuid": "b4242f61-f452-4f36-827e-3a653ccf7f98", "value": "T161C39E87FB8B10A0C8120AF017C71F9D6B57A211CE5FE8E3AC1E763B5A7A4DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235779, "uuid": "0c24a740-17c7-458c-8dfc-7fadab052202", "value": "1536:it+2mPrGbK8XzSi5Kn6iCGrf52T+biLdT6XqlI/uCAYUxP/QgEvE4/LW8:itQryKYzSH6iCGL5c4WR6Xq9CAYVgAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235779, "uuid": "e8924f89-0dac-40db-9160-84c8d5a7fdab", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235779, "uuid": "2d1affe7-02f0-4499-9072-94891dcbaf9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235779, "uuid": "09cf2afa-b5a9-4fa7-9aa1-2a4213e75a2f", "value": "narc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762251f0-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254355, "uuid": "ac40b96e-b69f-4f5f-a19d-7f83984630ae", "comment": "Malware payload (Mirai)", "value": "dc94b62a473bb6cda025afe07efbfe93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254355, "uuid": "135d1556-5bd0-4c24-8d45-5166bca2f777", "comment": "Malware payload (Mirai)", "value": "19eb2e6a1c2fc07a8bed9c45218e5356751a86100c909ff76eaa4bd18dba29c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254355, "uuid": "aab5fa32-55de-4edf-a792-40769517f6ba", "comment": "Malware payload (Mirai)", "value": "b9a182ab4e86c1162622ce71b19cc751bd7b3f57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254355, "uuid": "a17452e4-2689-4d21-9418-23742721021e", "comment": "Malware payload (Mirai)", "value": "f69bb4c7dc19330166c2e38e5c61bc3337c73478c2a3d8d135e92ea9afbc8910298462ce95249430fe4ae2b41dabfd32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254355, "uuid": "1e977672-0af2-45d7-9889-952ad6052a69", "value": "T1DFC3F609EB610EFBE86FDC370AFD070525CC651722A97B7A7574D928F64A24B09F3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254355, "uuid": "2fb939df-d481-4847-bfa7-153af6655415", "value": "1536:QWeUSZ25Dy5uMePxR0hFXNMYuwHW2qDOUu3up+5iQ1vZZO2WNEMvlOKvj8tjlBq0:QWeUSZoDTR0Zik5iQ1Zdgjut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254355, "uuid": "c75fefa7-2e29-473c-b706-64a9bd9e8b1c", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254355, "uuid": "47c335e6-df22-465c-b52f-37c7b2391894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254355, "uuid": "c4fcfca7-176c-46a5-a324-9fa70b4e7562", "value": "2cpe5mpy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f08de7-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249818, "uuid": "c1bde019-3760-4f2e-a4f4-bb83b4e34481", "comment": "Malware payload (Mirai)", "value": "05960b647e345a878f4ad6dd4997813f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249818, "uuid": "96dc69d6-a450-48b0-9135-0b7abd5eb09b", "comment": "Malware payload (Mirai)", "value": "1a07e7e463f59d496df0058303a06ac4b2562a72fc4922dd61e466c81305a157", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249818, "uuid": "8ae5b71a-9c33-4c04-a8cd-9eb66bcc8018", "comment": "Malware payload (Mirai)", "value": "a82073fd7688d0b9637a4bbd5c5464ea951944a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249818, "uuid": "cd107e2b-58e1-471c-81e5-d67010e2e991", "comment": "Malware payload (Mirai)", "value": "0bef5ec484b3189f6fd0043aede0c65b712f9329d480dce8d7b77b6d67defe166179f3c387470abae8ce5bc1dcc02881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249818, "uuid": "ab739a6d-b3e8-4634-8495-d6d1ec6274d2", "value": "T180E309C7F900E9BAF80EE77748530809B130B7A259525A337257356FED3E0992477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249818, "uuid": "66228745-cd6f-45d9-a6ae-5fc226e9ebc0", "value": "3072:JUAUxujDOSfPy2wMoXYNyyY/VxjbiaLQDAtycRYN6O/x5:jbfPbwyYyYpLQ8yc8LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249818, "uuid": "43e9f2d0-360e-4b4d-b6d7-e351bc1b07e0", "value": 151564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249818, "uuid": "13662221-40c4-4307-9a87-4b63f36aa72c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249818, "uuid": "fd35a8b3-3541-4d64-9de3-20873f31a993", "value": "sumrak.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d605c1f2-dd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225740, "uuid": "7b7882a9-fd73-443b-b4b2-242dc77228bc", "comment": "Malware payload", "value": "87ed7e4a0ef6ad0adeb9c4e156b7d3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225740, "uuid": "6321be2c-3c5c-42f3-a08a-dfbce0ff13dd", "comment": "Malware payload", "value": "1c1ea4b5f12a991ba2689d1772ff795df8c7513e296b557821ae3f45de8ea170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225740, "uuid": "6e0482ee-45dd-4760-bc19-f7a60335ee14", "comment": "Malware payload", "value": "7eb2806f38e8f6f4c7345cdf9d5d6674eff96c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225740, "uuid": "cbfb6374-ff76-4307-9b4b-482453b5aff5", "comment": "Malware payload", "value": "a15eaed3fca6582bd33289a0c3f6d2fa4e84cca825f94c0ad413315575d9ba29c2df1f1f234bd8ff3b6a466a31881ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225740, "uuid": "1e186de3-3050-490e-bb8d-49737f6da757", "value": "T1CFE2E1413EFA629CE0E2AE7A22E49601E17EF55A5D4E83892F09804F19D095BCD37E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225740, "uuid": "a34a44fb-d99c-4f13-883c-6f6ef8ac404e", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225740, "uuid": "e96b7c28-b359-4ee0-9696-f9d54a14e730", "value": "768:oA9wAsk5uWLfuT98npCJpkoar+XqAjNVXxJfBQeeDq:oBARu8uhfpkFSqAjNVhJ5QeeDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225740, "uuid": "15ba10cb-06a4-4a15-9dda-d65584dbb617", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225740, "uuid": "29793aa8-a71d-44ac-aa78-676bbdf7a1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225740, "uuid": "ea708313-ba86-4f79-a9ca-4ae0c3b5d454", "value": "raw_cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd8a672-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234481, "uuid": "1390396c-094a-41db-9a56-5fd522ea02f3", "comment": "Malware payload (Mirai)", "value": "91e950bc6532817315f8bc8d6c012f8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234481, "uuid": "e927a51b-b87d-4a4b-9a77-e5b971804d68", "comment": "Malware payload (Mirai)", "value": "1c245443e14f6af15bb9a51699dc68fb4024660465db2781ad7d63f9d6164191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234481, "uuid": "3c08dde4-1f91-4f99-bf79-030fcb912e43", "comment": "Malware payload (Mirai)", "value": "ae20a9970113dfe36de5fe68fdc17bd0138b01f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234481, "uuid": "d675d7ed-7ffa-43f9-8e87-c56cb7464637", "comment": "Malware payload (Mirai)", "value": "af765be4da73d56659a5273db36f2dc69c94b01e18aaf0e1bb0030b5295fd1b9e2e4f643e64490ca4c2d30ff761a8abf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234481, "uuid": "d358724e-7a87-4615-a7f5-8635adedc49a", "value": "T147632A85B8815B16C9C1167FFB2E028D373653BCD2EE72129D156F61378B9270E3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234481, "uuid": "ab501744-6a70-467f-b734-f13eba0cfba5", "value": "1536:FPKP9/hIYzkbxGDHvctcZ4RHF5fLR+8jLKgBCUWIHviO:gP7IN9GDHvIuqHF5fLRjjLKgB/1iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234481, "uuid": "f7c7809d-6e9c-443c-a79e-46776389f6d5", "value": 70800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234481, "uuid": "5c9bd460-608f-4bcf-8d57-01876ab11861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234481, "uuid": "6ecc3a65-4789-4baf-b571-6dd41db98601", "value": "firmware.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b11b24-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766266355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "eb7f838a-aad7-4685-8170-f62d8f121e8c", "comment": "Malware payload", "value": "b33c5407c01bf0f8aab6e6885d7f29c5", "object_relation": "md5", "Tag": [ { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "94536693-5e9a-4079-b041-78169e0df639", "comment": "Malware payload", "value": "1cf61850221c0f2de73185e5f5c31f4179e4dfcc93c7e11dcb7bfe552993e39d", "object_relation": "sha256", "Tag": [ { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "e802822a-8dfb-458a-82cf-d7fca548df19", "comment": "Malware payload", "value": "fc838530ba2a9d22fbb4ada903059d82c3a666ca", "object_relation": "sha1", "Tag": [ { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "10c8f9f2-f39d-4083-9c3e-d694d4419ec9", "comment": "Malware payload", "value": "06317b640312443fb15ed6dae346e6af304f2cc4f3d6aca0dabf424170adf84e20f5c516ec7800aa20719757df758238", "object_relation": "sha3-384", "Tag": [ { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "ec58de25-2576-4352-82db-2dc18c172e75", "value": "T1ECE2721B3644A331C54607328A6FD3E54B35BC599F671523319AB39C2E72AE062B7BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "092ea201-1943-494e-9bec-20708130c209", "value": "384:83A0ebFuoXoyvC85BC7g5Pey3M5BC0Ov:VZk8DCQeWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266355, "uuid": "188737dd-020a-4059-94cb-b838e990292e", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266355, "uuid": "11eeabac-7336-4c56-b955-68284936cadb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "badfd7ed-ac69-496f-bc28-1f8e0447a064", "value": "Producttest-RMM_OK.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8846a9f0-ddb5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766243219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243219, "uuid": "a52ffdad-1167-4cf0-9e30-a285daff090f", "comment": "Malware payload (Mirai)", "value": "50b5fd161e0d15a505f3fd3205bdc3b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243219, "uuid": "3d1f02ee-3a8c-4bf1-9faa-c07738e9c4a9", "comment": "Malware payload (Mirai)", "value": "1d676fd511ac21e7e97cf0a2b72f87aa2639f470a67dda5f09bc51f336ea98e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243219, "uuid": "db7bfb2c-93b5-4da0-bd37-32c0f7aed815", "comment": "Malware payload (Mirai)", "value": "3dfbec674f8dbf13cfb5a453430f38f986df2a67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243219, "uuid": "ab05152c-0390-48b1-b18c-2a2f2a134df9", "comment": "Malware payload (Mirai)", "value": "97eac0f6c2c274aa89d2204781c9fd278707f8da3341de9c8e6921fe8fd1b798730c132323af61457cfefb27cc6f722e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243219, "uuid": "3fafe97a-db91-47e6-a0b6-e1486355eb04", "value": "T14923F271890BDEB124303C76EBD5D39376E12AB1C667301396290A7C2FB9B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243219, "uuid": "87b68e81-ac36-411c-9bde-0299ff9368a9", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3yy9q3UELbUXfi6nVMQHI4vcGpv5:gECFd+A6YHAxOLRQZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766243219, "uuid": "cdc176cd-d2e1-488f-9eec-e2da4287cda3", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766243219, "uuid": "fa63bc28-4963-45f8-83e9-bcd8029757d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243219, "uuid": "659f41c8-7833-49b5-97f7-84d0d511bd8e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22448be1-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226297, "uuid": "23274dc5-b93a-461f-9612-6a0c7b00f9eb", "comment": "Malware payload (Mirai)", "value": "ad0d01a911b41f91ed260442ad59bcf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226297, "uuid": "2704129f-bd55-4fd9-a30d-c291058be544", "comment": "Malware payload (Mirai)", "value": "1edb9f475211a117cf2573f1c8218b74d634a66dd1c7690802913208bbcf0327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226297, "uuid": "53d9e24d-96aa-4200-af7d-cdbcc9b3336d", "comment": "Malware payload (Mirai)", "value": "690ac8d4c0b19ecbc257ca343470f3d1bf12f065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226297, "uuid": "f2d3c40f-408d-4558-b7a5-12223ef98295", "comment": "Malware payload (Mirai)", "value": "9556df6684b6df6594e3ab1e28283bc5520b1a7fcfce0223e16c560624f2ea135f7dfa2da0c9f7a490d4bb942ddac0b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226297, "uuid": "b1c7d66b-1615-4eee-804c-32a7751fd720", "value": "T12C436BC4E643DCB2D8171630147BAF37BA76E2E91228E746D3A8A636EC51702D016EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226297, "uuid": "196b4d49-df7c-4cce-8dcc-2f0db7fb18ff", "value": "1536:BF14yTUx6AhcHIOROPQGc0Z6SblcMUiBVFrVNwbZnm:B/4yTUxdaIOgPQz0ZN5cMlrHNwbZnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226297, "uuid": "cb489094-56f1-409f-ae9e-ff037c4f680c", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226297, "uuid": "d4e8682b-76ad-4c57-b973-77417cba0daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226297, "uuid": "1e1605bf-264c-4273-aced-43ac509b5e87", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fd3ee9-ddec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267000, "uuid": "ed762004-1fa5-4f92-be79-8c15f5635c5d", "comment": "Malware payload", "value": "045354bdeda29efaa7f44c25ca820dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267000, "uuid": "5b2acdc0-3202-44a2-b5df-a4955a88248b", "comment": "Malware payload", "value": "1fb348bf5843367c8933352a54ab0dc565dc0f3ca547fc80d5f100499d04f49f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267000, "uuid": "cc1a190a-d9bb-4eff-9336-c7e42d3ea0a8", "comment": "Malware payload", "value": "6738f57c067264a75e947dc93dd0061cdd9f3360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267000, "uuid": "0b52191a-0c8f-4b7a-a2ae-6360769708bc", "comment": "Malware payload", "value": "cdf664a1749c4ab93805dab6d0007ab1b7818f110fe7d23ad1c7b951cf18f1d0b7732efe747ddcfd31e899141a25aa2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267000, "uuid": "29069221-d1f5-4d81-b86f-ef1ffff7f46c", "value": "T15D264A435DA08AA9D4AAF23CA4A27286776CFC44073176D35A913BB51E3B3C71D3B718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267000, "uuid": "7cba7cbd-73c8-42a4-b3e1-fc7c980daec8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267000, "uuid": "1f80135f-8cbe-4bdd-bc6b-34cacbc949eb", "value": "49152:Ykt8aE+fh7f7P4Qa58aLJXnTdGhlTZVjHfn5f0YNHh2y:YOu8RVr58aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267000, "uuid": "e3c02034-2a99-429d-907d-07d1e2ef38c2", "value": 4460760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267000, "uuid": "158b07ba-3eac-42c5-89f8-8f85baf5a15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267000, "uuid": "ac82d639-0749-4672-acc0-72f9d78484d8", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4e2ed9-ddee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267818, "uuid": "699d8f00-dd76-4601-9e16-780cd4a34236", "comment": "Malware payload", "value": "4743f49b294e8c989603515612c2545f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267818, "uuid": "a375c1a3-d668-4b73-a37b-706fd8f79f91", "comment": "Malware payload", "value": "204e696826c3545bb62910f7a30f7dbd03d8852b4d970275478326b27742d96a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267818, "uuid": "73adc3f5-24ef-4727-8f98-f751d31c257a", "comment": "Malware payload", "value": "0110eaee67b7392937994bae8597ff7d4188a563", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267818, "uuid": "f0733f8e-a151-4edc-a57f-dd2d61ea88e7", "comment": "Malware payload", "value": "3549e1782a8c191297ad76559f7368c086d1a9d69364c96bb96a306ef3a017147af37da13ebb4763940acde20355e4cb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267818, "uuid": "402ea59e-9bb9-4603-bad5-437dd6a1a14c", "value": "T16B510E106FFA0224F1B7AB312FF96661893BB860EA258F2E2010050D21B3811E9B1F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267818, "uuid": "89c6a4da-ec1b-4844-912d-75249e12e066", "value": "48:8iHaKDP9JvbUQOFmdr6GNGdNZTCJCZIyDk1EOK2:8iHTDz2vCADXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267818, "uuid": "aa443162-fc94-419b-8b12-7c05db009660", "value": 2924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267818, "uuid": "7384f913-dbff-44d4-a566-ce36dfd9cddd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267818, "uuid": "019bf167-c6f6-41ab-9875-b6dd0e9e4c66", "value": "\u0422\u0430\u0431\u043b\u0438\u0446\u0430_\u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432_\u0437\u0430_\u043f\u043e\u0434\u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353a9627-dd67-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766209579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209579, "uuid": "04f44f98-9db6-4140-a28f-8b9b7428f488", "comment": "Malware payload (Mirai)", "value": "2bbfd08a4c96654fc8be0965be5536b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209579, "uuid": "58b4f860-c06c-4c3b-800f-bda10641eee6", "comment": "Malware payload (Mirai)", "value": "215a4d4b613576b9d8276dca6a2aea4289b265f697e283a4c40506f0872b9bd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209579, "uuid": "a1eb1c69-ed38-47bb-a19f-70f3a4c24cba", "comment": "Malware payload (Mirai)", "value": "57297c4f3ba893a39810bcccae475d392542fe16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209579, "uuid": "181f4035-a4b8-4260-9bf9-4244b4ea704a", "comment": "Malware payload (Mirai)", "value": "03be692aad7aa2e05e1ed2855614dfac45e36afe5728db5198a46901a35a7c1e3d1d2db4fc037199beaa8c84443ac562", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209579, "uuid": "cbc0c593-8192-4f1d-8e4f-1cf7ad74dc5f", "value": "T18C43E891F9824667C1D023BAB75E5A8D33A163E4D2CF7657C8204B207B8A94F4D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209579, "uuid": "24d43f27-4dd4-4d4f-87a5-5facf9ea6434", "value": "768:rvrFVegVE/XxlQv3Z05MABWjt6hIAUeN0+8dSIheiQxbwdcJ3BdrUAho/rwKQ:Ntq/Xxq3v6htUeN0+85eiHdcJrdBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766209579, "uuid": "df336fe9-9a02-4ac2-8f3c-a61feac8e494", "value": 56096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766209579, "uuid": "b8d79ec9-6d7b-476b-b1b8-cda3b511e3d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209579, "uuid": "442c735c-12f6-4357-bd16-50bc074cf6e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2917af-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234444, "uuid": "a2273989-efdd-4069-b257-46b9284f4c98", "comment": "Malware payload (Mirai)", "value": "be3890bb68cfbf3c5cb1c42a864c3e3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234444, "uuid": "b4a40dd4-fa17-422d-8603-9b45e36d9263", "comment": "Malware payload (Mirai)", "value": "222738bf602bbacf0aa93d19f6b04f386a6c1132fcb13d30d8a30bb8d1261ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234444, "uuid": "151a28ec-5981-4ef1-b5a8-15b311c0e8d6", "comment": "Malware payload (Mirai)", "value": "82c2e98198aa3f83cd42fff075fcac7263f9b09c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234444, "uuid": "c1dfea78-8d80-4388-8266-0bb47879c6e1", "comment": "Malware payload (Mirai)", "value": "90d9e01d81c9e07c9f14651ba3adb5bc9eb80a0dfe0389191f9883431d2778802380c084fb3d4b02d086fb19cee5ce24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234444, "uuid": "a8dae10b-4d8d-4268-8876-c59222d27c7a", "value": "T1CD538D62F4042CD1DC2216B5F4B4CA781313ACF441EA1C769E9FEAA518B3ADCF58E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234444, "uuid": "5b8c7622-27eb-4910-bfae-6e779168bcb7", "value": "768:bebtFriPauImAxgMMYXAesHmglnSxFrLz+/PA8965cGWtqrp0ghNSl28wSIEr:i7iPWiYwesHjSx3GJjqSgCyGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234444, "uuid": "1c8c8c11-86d3-405e-a09e-c30e775deefe", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234444, "uuid": "07cb43a1-0812-4d5c-be8b-d96722466c01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234444, "uuid": "4fff9bdf-aed1-401f-9adc-9a7bd8e12374", "value": "firmware.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ba8a95-dda3-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766235563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235563, "uuid": "5c9e09a5-d162-4899-af92-112238b12a35", "comment": "Malware payload (OffLoader)", "value": "c041912847a30dd5024e51e7cc990339", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235563, "uuid": "6f775c9d-d196-4c70-ab12-e828e01f0e4a", "comment": "Malware payload (OffLoader)", "value": "229aa8d7f88dce937a06c3d10e7ee1a719921c7d56a2d51788bf76520897ae70", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235563, "uuid": "abe95475-383e-45fe-a1d8-854b2001660b", "comment": "Malware payload (OffLoader)", "value": "5a6a885240f6f3723b886b4c7c9c3f3e8eedaea3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235563, "uuid": "e4c26ea4-4419-4b29-b986-44bf4f2f5b0c", "comment": "Malware payload (OffLoader)", "value": "42160cd903dadec249f6f56f93c998d73e7f2fa69bf860e5af906ed7c7b45c6511bea338ded3367a9b3a3bf388ca0dc8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235563, "uuid": "2b707516-0d16-48f8-bddb-881d05ab958c", "value": "T101260233B28A673EE06E5A3B49B292205D3B7621651F8C16D6F40C4CCF6A1B01E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235563, "uuid": "901862d1-c131-4185-8710-e186b664e0d4", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235563, "uuid": "d87074e5-d6eb-4209-ade5-f5f1da1d4fcd", "value": "98304:MN66Sb619+6FDSRa+lUBEyG7S73MLLjAl2TljA:oSbg+e4a+2BEyAysP5FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235563, "uuid": "a22448df-6385-4713-a489-415c047d8add", "value": 4539451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235563, "uuid": "6ea40f9f-132f-4687-aaad-e7c5f33fea22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235563, "uuid": "3c257f78-4574-4857-b5bd-af203813456a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea5550d-ddd6-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766257510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766257510, "uuid": "916d4614-b13a-4625-a9ba-c780d720af1a", "comment": "Malware payload (ValleyRAT)", "value": "7f5d1d55a3dcb9401cc87bcb2c02afca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766257510, "uuid": "856e6ac8-97f9-4b04-99b9-272aaa92719c", "comment": "Malware payload (ValleyRAT)", "value": "23340d57977fa31fd6baec51dc9d42b9f791f3387df32b0095613dcff8501f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766257510, "uuid": "938f88b6-625b-492e-9387-94d433ef30f1", "comment": "Malware payload (ValleyRAT)", "value": "cc47882593bbb021bb24e1e2f5a90deb1fac3b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766257510, "uuid": "c79f66fa-2850-4d51-8a7e-b6e6abf05fd3", "comment": "Malware payload (ValleyRAT)", "value": "3dcffcbbeae996d8cec3a2d4fb0eaadfe53b6c03dee6eb5d54fb0465bf30d4bd8b80f162b4c6833ce9e2432f4d53a1ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766257510, "uuid": "ccf2239d-8be3-4a55-ae82-4a837309f1d4", "value": "T12746232B27A90142E1D88C36D527BED836B657BE9B81A8BC55D6BCC037134F1E613B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766257510, "uuid": "81d16018-3000-46a4-a9e7-21dee81a7631", "value": "df2736ae3a3f2b2417f2dc384c2a6066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766257510, "uuid": "b3ce9111-b67e-4e75-91e6-d013cbad819c", "value": "98304:hSCuiUG1hbkd0VItC9S2cIjod1bVXefnY1ZMIM/oq59z2PHA0VS2Y:hS6h+C9S0jIbBe/Cq59Ggoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766257510, "uuid": "b59a864e-1c0c-4c03-81be-f3ba6f120e95", "value": 5698048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766257510, "uuid": "43132070-4e6e-4267-8a1c-1401164c7c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766257510, "uuid": "8fa241dc-7310-47c5-8e5c-08b1149dea0e", "value": "dc75.msi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283e572c-dd92-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766228025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766228025, "uuid": "a34f2955-77f0-4335-85d8-4ca8cca55df7", "comment": "Malware payload (Amadey)", "value": "48f4d9a0e8deff66c92388a937281218", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766228025, "uuid": "97a5ff28-e89e-4e9d-b1a8-61d9c540c5f4", "comment": "Malware payload (Amadey)", "value": "2411e9aa6eeb0f8f87d6491ec780568c5c853c3702034a3edc5b366c31ba0eb2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766228025, "uuid": "27a5359d-acfc-4208-8c9b-f4c918d2fe44", "comment": "Malware payload (Amadey)", "value": "d7d44004a812635a4a44aec341e95c57125abdd1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766228025, "uuid": "83b9c471-bc55-4263-912c-e7a984681a6d", "comment": "Malware payload (Amadey)", "value": "b391cdff555d56b71e7613fb64632a8a00bb86846aed66c23158ac0e71b41aaff74d2359162663e541133a27c32b33e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766228025, "uuid": "9738ae3c-2129-4673-a374-d74d67aa2753", "value": "T122358E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766228025, "uuid": "2049f152-65a3-4784-ac09-d9d70472475f", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766228025, "uuid": "a3d901b5-c1b1-4c86-a6bb-adda508514cc", "value": "24576:Of5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVIds:Of5xVaU24WGmhkXzFUds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766228025, "uuid": "9571d9c6-77fe-44ca-b417-033492f59406", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766228025, "uuid": "cf0bc733-856a-457c-bb22-87a27f0ab8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766228025, "uuid": "39d526e7-ed9c-4fc2-bc32-89bc52c812f9", "value": "cred.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d0c68-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266351, "uuid": "bed64786-32b4-47ab-8245-81bf24a2c64d", "comment": "Malware payload (Mirai)", "value": "4a2863db880519ad760fad7b2238570a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266351, "uuid": "d180c493-c3ba-4499-b337-9be12a9a753d", "comment": "Malware payload (Mirai)", "value": "263f89416439f5e9d7c35621153981655eec33e46fb7f7eb70ad43357d0cfad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266351, "uuid": "d11a2888-cddc-411d-86b1-6f9731ee67cb", "comment": "Malware payload (Mirai)", "value": "38371415062444cc76b7c119962e54d1cb2e9dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266351, "uuid": "69e6b591-1725-4dab-b9e5-6a4fe9ce5a62", "comment": "Malware payload (Mirai)", "value": "4b36098029896ad8305018502a46a6493587b2ee9f2ffde753aaf30b43de90c7199411348a74792542d5b2d11019c565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266351, "uuid": "c666653d-02f5-4ed7-942b-8917877c3ae3", "value": "T1FC93F885BCC3452AC9D413BFB52E519E332173E5D2CE7212D8A30B653A8762B0E63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266351, "uuid": "ead657ff-4d7f-4623-b559-0e5a1bf7ac25", "value": "1536:zlPOIwP1VibOMQ4Vi/ciz7Ou8Wu1bfPRPRY5VGv9s4PfP9af:wFGOELp1m4PfIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266351, "uuid": "75f6945f-f98e-4d3f-b70c-201dbfb1565f", "value": 95836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266351, "uuid": "de080122-a368-4ca1-8570-b9bb886a96d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266351, "uuid": "0613cb1e-d6f2-4e92-b03f-3ee94a36e948", "value": "frost.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3c0a5a-ddf0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766268646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268646, "uuid": "c505561b-44f6-4605-8a53-54207b2387da", "comment": "Malware payload", "value": "12e645309354f066a533ce1339e9db11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268646, "uuid": "ac47abce-3188-48b6-8bf7-4af02bac1e45", "comment": "Malware payload", "value": "27a88cf47f1a7b456207d4a96affff55e4700bbc089a6baceeb7095139f02020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268646, "uuid": "32cf68e0-fa0b-4223-911a-bac1dc520879", "comment": "Malware payload", "value": "d553616ae893586528ef95ddd6e988c51c588fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268646, "uuid": "ea0901f4-8ae5-4c88-99c3-c4be9dc4cb41", "comment": "Malware payload", "value": "fe2046684fe6bdc6958538092bf469ee8f3c05baad7303ccc79ff9a47123ec2de12453714f8a0a5eb93e9c0d20b3bbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268646, "uuid": "a8900a4b-9264-40ce-bcc3-a7c403c00cdb", "value": "T17EC587F0AE01D4C1F57E5B7BF3ED7908A1342227EADD5A4A00A466591EF6A01FD0ECC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268646, "uuid": "65a1663f-da6f-496a-b11f-6d9940f626ea", "value": "66506cf48bfc3b0d79a8e3790223e69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268646, "uuid": "8b5d9f01-db1f-4786-b99c-924efc08fdd6", "value": "24576:Lf/9stgDa9bOnhtw5bsisEJbFbTMI1yzacttKxyhqatgVd:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766268646, "uuid": "5753da87-6381-4b90-ab52-acd05de2214f", "value": 2592256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766268646, "uuid": "53edff53-2729-4245-9d62-fa34b5a37817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268646, "uuid": "fc3dfa12-f7a6-49ed-bede-fc3994083c50", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665e8004-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "86743082-1490-4b63-abaf-644834d358ce", "comment": "Malware payload (Mirai)", "value": "9903a2b5472336204bbb562a717f6a14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "934902f9-e916-4b05-bdf6-bda7579d00dd", "comment": "Malware payload (Mirai)", "value": "27d0189c10636921860c51dcb5f48dbae0ebcb5871713973b6a1b194e5a9b761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "86f6645f-7d72-4f91-9694-0e21614fea74", "comment": "Malware payload (Mirai)", "value": "813bab8bd52894c07aad495dd4feb17410ffaff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266355, "uuid": "f191f983-9411-4642-bd10-2019350e3826", "comment": "Malware payload (Mirai)", "value": "4c598c3b1cd0d867302ae9874ffb1e78f248baa9799b5ebd8cfba44e9df70478a15c97a6d1abf0291b88e1825e9740ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "69706b07-a439-4fc1-8b63-2cff9b4129f4", "value": "T1ECD34C07722C0F07D5A20AB1263E5BE093FE95D111F4BB89691E6B5A5732E3B1482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "a54ee897-c024-4b86-9b23-661f8096a546", "value": "3072:eiipkAST2h+SJ0I8b/FKJAhUZAs5yPZVfb3:6kDT2UE+/FyAhUZAs5yPzfb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266355, "uuid": "7da7aab8-2cb0-4b9a-a3c9-c58357225078", "value": 141176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266355, "uuid": "ad043371-d13b-446f-8222-406d78a0c2ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266355, "uuid": "d4d2b4ee-8f73-4822-876a-aa5dfe6f8a61", "value": "frost.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d381706-ddd5-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766256864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256864, "uuid": "00f24692-c2de-4c78-9dc8-030e4d55a9af", "comment": "Malware payload (ValleyRAT)", "value": "edae83ca4f25a901cbc08d5805b9025e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256864, "uuid": "3a19c727-4119-4d3e-8b14-e1053cad3c32", "comment": "Malware payload (ValleyRAT)", "value": "28328eaaa8995f20f7160ba23e29a14d7e60f2614e4f27f889123f754d7626ab", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256864, "uuid": "ee1c2abd-e1c9-4d3b-bbf0-c6ca65246a40", "comment": "Malware payload (ValleyRAT)", "value": "a656d020b5123b5870b7ff4db8316df5050f9b6d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256864, "uuid": "21f0f48a-7ea5-4a9f-a13d-17ba8910cc14", "comment": "Malware payload (ValleyRAT)", "value": "1429a2819d84f736d742f29c303ea996435aa453745f15d58186d6d2d520bf64a21e7b0550daf9f03e0459f4b2fde3a6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256864, "uuid": "1301a9b4-da58-49a9-a5e9-da3e92080678", "value": "T1DD761211B3C6C536D26E0177E968EF5E1938BE730B3101DBB3E87D6A49B18C29275B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256864, "uuid": "e2d9bb7c-306f-4936-a3d7-8d20bdb0a569", "value": "98304:8oSTy8wktPqK1SGKg4i0RTf9UQDoVoQaCsXs1oHLZ4I6FzS5BVaIfOnRQo8Xk:CPmSiRf9UDVYCgsWES5DaIvoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766256864, "uuid": "6580cb57-8917-4aa4-981c-975b74a31ee8", "value": 7474688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766256864, "uuid": "4787264b-5ea4-4c21-9556-860446b49a50", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256864, "uuid": "5e78fea4-773f-45cc-98ec-f978c2a99ac5", "value": "dc75.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0da671-dd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766214800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214800, "uuid": "13246e9c-d29e-42b9-8331-714b5e0506ae", "comment": "Malware payload (Mirai)", "value": "8343958627c49bb9e8c7a05e7e8c8949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214800, "uuid": "227a7698-a58b-40e3-906f-535be3b9648b", "comment": "Malware payload (Mirai)", "value": "287d415a178ca5a060851cc61387dc77d0f06dc770932e6fc48148589f0ec29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214800, "uuid": "b31d1cdb-f331-4c8a-935f-4bc7f7714f13", "comment": "Malware payload (Mirai)", "value": "86e56083e6f3df13c573411fa16718d64a47ea1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214800, "uuid": "d2f72ab0-8cd0-4bb3-8fee-180b405179a3", "comment": "Malware payload (Mirai)", "value": "109200bd98f1d178fb3f5b6d542d8ae39955c3e882d1510880369ae98c77bc138dc025f48484e31116f06d5927e9633e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214800, "uuid": "b78eb465-cd0d-417b-bceb-04ac98687057", "value": "T15C044D56EB418B13C0D6277ABADF4245332397A5D3DB330699286FF43F8665E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214800, "uuid": "cde0d3b9-fe6a-48a6-9199-8419a14276ff", "value": "3072:g5nS0MxO6Igla5EdACuvyR7Zjb0DJgWjnLc6CXM/9ahjMArFGP6:qnS0Mo6Hla5EdACu6R5bEJnjnLcvM/9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766214800, "uuid": "516cf142-3737-46e0-be40-4fe81d70e49a", "value": 173794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766214800, "uuid": "46d46ee2-4b08-4229-9654-55bc567caf39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214800, "uuid": "f644684f-0fc2-491d-bcd3-17a6e9024718", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12ff0bb-dde9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766265648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265648, "uuid": "1bd8a830-f779-46cd-abf6-fa1051850e6c", "comment": "Malware payload", "value": "8e5279ab013156ea04b1265e59500197", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265648, "uuid": "131d1c49-e130-4ed5-be03-2e4f4d8d162b", "comment": "Malware payload", "value": "2e057f34f98f4ba78a6a60be4bbaa6c187c13775548fe1c7ce8699cd2e81653f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265648, "uuid": "2ab95d1f-969d-4b33-9c0e-5a3258635050", "comment": "Malware payload", "value": "40ec38a8cb8fe371c23d69a886becb883f06acbc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265648, "uuid": "cc81b10d-6c4e-4a7d-a191-aeec3e67edc9", "comment": "Malware payload", "value": "270063ed4f2c3f47902dc8bbe91ffbd70536a4860c333c1fec55539a9e45012732aaf2787b0106793fecb08ae0913ab7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265648, "uuid": "56654d79-b3d1-4a2d-9475-00cd7386bca1", "value": "T1B22171211B408199EF93C2B3AAC78B558827D8715E5EC7AF3D39D2871E0B3EB01A6516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265648, "uuid": "9b42f9b0-b805-49b5-abff-0d704c65e532", "value": "24:9FCCtfj0Q4XtvCbVv62zK78AYIML0fUTrnbVdB4lMrAbiya4/6wV:9FXtfj0HtvCBS2W77SYUTjbV/VGM4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766265648, "uuid": "51f87a28-d229-49ae-8f84-04bd0a60bea6", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766265648, "uuid": "e83b06f6-d94e-43d0-841f-3bc692af2e5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265648, "uuid": "0f0dc893-596f-4182-95af-4e58cab76ea4", "value": "Enlistment Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78715603-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235891, "uuid": "e9f5d04b-6d9f-4529-b2ab-c3ecf516af8e", "comment": "Malware payload (Mirai)", "value": "0546d53f9bbee4a3441afc418cb7ac95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235891, "uuid": "b2fe47f7-f0cc-4e2f-a1b5-8b30277adbb8", "comment": "Malware payload (Mirai)", "value": "2f355d7e48824c91d5f6163079627ce16c08f08eb8033ed31e5cb9eb3600c76c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235891, "uuid": "4a6d7d15-1b83-4325-a868-a20522b8be5a", "comment": "Malware payload (Mirai)", "value": "893eaf8d86ecfe4ebd9739ad0802eca726303a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235891, "uuid": "e84aa4cd-0f8d-4649-b238-a953373cac78", "comment": "Malware payload (Mirai)", "value": "8bde54d01a414af585d43fbc5c501c8d3901865928fa1b1c4a5e9e8b7f792c5246ec44fdb7fb9fbfab4615552f655c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235891, "uuid": "84ebcfdc-f67e-4c2f-93b5-9627a0c78fb8", "value": "T181839D63C82B1D24D04848F0B0A48F3A9B63E115CA5B2EF7949AC679D087EDCF6467F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235891, "uuid": "64bcee0a-2536-45a3-a86e-c26902be7b2e", "value": "1536:KJ+dxKPT0YDgpfvujKDbCCGrSq6CHi/PzD/29OI:Kkdx8Dgpf2GDqrSq61/PPeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235891, "uuid": "dd41a287-6a02-40e5-b220-822d9535a3a3", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235891, "uuid": "f521eede-2057-495a-b895-5bf2a4ffacb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235891, "uuid": "c761dab1-ee37-48b1-b4fb-20e67fde37e1", "value": "nsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bb7f25-dda6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766236693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236693, "uuid": "995ab1c0-ab1b-4ad8-bf9c-d2b8a298aea7", "comment": "Malware payload", "value": "0c58fd78bb4e3f63b85b8621844dd47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236693, "uuid": "55a70531-813b-487f-b6c2-346bc2f74aa2", "comment": "Malware payload", "value": "3031ae5cc1b964c06cadf7353a7d34da6d0556b6e2b070bcda532f551c7e3e74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236693, "uuid": "8c46627d-58d6-49f9-be4e-4d43d1982eed", "comment": "Malware payload", "value": "ae162b9542786dc1ab3b892ebe47ecf7ed2025fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236693, "uuid": "456a4fa6-19f2-48f5-9d90-14ee37c93e18", "comment": "Malware payload", "value": "b3328b7c82be3201fafa8a53e50552795c3a5f2575a1a9a761d0f3a1750c212d700edda767fcc1ebd8c98211cc7c0ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236693, "uuid": "94c59ca3-9ffd-4617-bb74-78f6b659be45", "value": "T11ED2D04B2B6AA4DEF0836A7240669321AF0D394747E7C33C1A14456DBC91A22DF36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236693, "uuid": "e124d8b3-833b-41ad-a364-b54d8e5ff435", "value": "f09dfdec43a86f0214209d98673dd7a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236693, "uuid": "fc439aae-7c99-4318-b533-9ae868bae634", "value": "768:1X6WduHMyP1ZO5KU1k4NsitVaiXYkUSL8W:1g1ZSzsit9XYkpL8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236693, "uuid": "8f6fa51f-cd8f-474f-a3d5-db48afecb981", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236693, "uuid": "865735d2-706b-4044-a0fd-533a2f9537fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236693, "uuid": "62518e48-ceac-417a-859b-f6e91c7de8e9", "value": "SecuriteInfo.com.Win64.Malware-gen.86217935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67286439-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766235003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235003, "uuid": "643bf674-da93-4525-b25e-b9c6480d78b8", "comment": "Malware payload", "value": "cfaf27176a9e1739354d9497344f7d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235003, "uuid": "40e034bb-dc60-4d34-b2d1-03268d093acc", "comment": "Malware payload", "value": "308257081a160e7850cbb59e4c00fa45acc216ee072c707299322e3be5f477b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235003, "uuid": "466c4853-9305-4aad-b544-4dfc3e312c0a", "comment": "Malware payload", "value": "c82c0928e45dca2a3174784e99deb678576e3c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235003, "uuid": "63127a61-5558-4a91-aea2-c6d0152e51e9", "comment": "Malware payload", "value": "a35869f9a539357a316404b2bcb34265736b7c7400050c0e30999461af09563adeed004fc8eb9ac33d88a237fd9d2b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235003, "uuid": "86c559c7-e8bc-4d17-ad0c-880b06467619", "value": "T168D2E09A2B3F4FA5F0F60B345164436F63727877072B8B6E1AC551AA0C6B886FD3D054", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235003, "uuid": "830d8c16-cd1d-424b-872d-c1e2f362af5f", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235003, "uuid": "e67b73aa-9896-4ecb-8cdb-765e006fc63b", "value": "768:A30hCIA4ebbhxEtexPlWZPPlNE4QgGAQRj4JEV:JhCp3hBSQfHSEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235003, "uuid": "77088bc8-19d8-433e-a579-08d728ca61a3", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235003, "uuid": "de10fccc-ac89-4a9a-a9d7-e3921cef492f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235003, "uuid": "9bba671e-4b2e-46b3-a7f4-166ecf89c8cb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.76814595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e5853b-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211806, "uuid": "f2c47562-f76f-46a5-97be-945c5785be71", "comment": "Malware payload (Gafgyt)", "value": "484d111eb345a49cccaa276eb2711053", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211806, "uuid": "2da8fb41-89af-4d86-9b4f-ab1226d85448", "comment": "Malware payload (Gafgyt)", "value": "311e1310ce80c164bd0c0ed782cb2a9bc87d728599623fbcccce39dbbb2b53dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211806, "uuid": "21ccd0ea-4f5d-4032-bcad-45a025da42bd", "comment": "Malware payload (Gafgyt)", "value": "ef9f2174b7ee4b2287369d777450777d26558761", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211806, "uuid": "2bb5046f-addd-4f1a-a0ba-1881911dd804", "comment": "Malware payload (Gafgyt)", "value": "6a2f5f08db2093f4632faa4a4ecfe0fa78d58ba82cd6b9b36f133aa2be64128f164b7e47465c916f6d79f9f17fec2b63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211806, "uuid": "a5473cfe-daee-44ec-a4ee-f5ac2d18fca5", "value": "T19CB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211806, "uuid": "dbf6222a-73da-4136-9af2-d6cc5be038c5", "value": "3072:MSY+46m1qOzssgFPPKNy+AmkZrQAhPDCXFke:06mgOzJgFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211806, "uuid": "ef2fb45b-b2c0-42c6-b43c-c6543e9a2aea", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211806, "uuid": "237ea17b-886c-49e6-8db1-20d4f920209f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211806, "uuid": "9183cb85-8ac4-4988-b7a7-793b00c1ace3", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa764a0c-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249853, "uuid": "05dd33c3-f8a8-447a-b633-ef0c41aa1146", "comment": "Malware payload (Mirai)", "value": "6536cea908026f9caee87b77c7920f84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249853, "uuid": "0cbe48ee-a8aa-4e81-8f64-6a404804b722", "comment": "Malware payload (Mirai)", "value": "330d8a9ca3bb66ddb22157e33672e392b662436271c1dda54b56e5e5596e94c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249853, "uuid": "31d257fd-c403-40f3-8923-d60091e40981", "comment": "Malware payload (Mirai)", "value": "ce94a11149a54056d828220b2b32e1ee9a490f8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249853, "uuid": "94f2f0a8-8656-435d-bef3-cfd34a60c551", "comment": "Malware payload (Mirai)", "value": "dbb6844270e46aa3dc9e8669e964afe470f7c97053ba3c6cc2b372c2e49fa24cda4be8c74e2a3feb5739a19bc77217d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249853, "uuid": "b17ad6d9-b7e0-4cc8-bacb-8f7179f7209b", "value": "T123D31946F8505B13C5C726BBFB4D428C7B2A1768D3EE720399256F64378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249853, "uuid": "d2766cd6-c44c-4ac1-86c2-e7cbc07bfdde", "value": "1536:2TEC6BWtCx2Rn9634V+GC17nFtHpbf1J9m3DlfldA0wywaA04EWDJZgrPvhrOZOI:2TS6CxSA34J47FtJczFjrE507G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249853, "uuid": "28c86859-4a55-4849-b10e-2d3c702ed9a5", "value": 130988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249853, "uuid": "38e2bb22-8865-44da-9ae4-96bd11c90959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249853, "uuid": "bc50e4f1-3081-474f-b114-e50f1adbaee6", "value": "sumrak.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d166f87-dde4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766263225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263225, "uuid": "f87b56be-7f94-4eeb-ac2c-654b6ad85220", "comment": "Malware payload", "value": "1eff65db828033d7d4bfb1bd8d11884a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263225, "uuid": "0dc783ac-0ba8-4721-8dbb-3165e807303b", "comment": "Malware payload", "value": "331037f720f42e36e2e5c45782fda505c5e736976f006ceca3508e7b1a7ba30e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263225, "uuid": "f3f72c69-12c3-4d9d-b406-de186d0d58af", "comment": "Malware payload", "value": "9685fb90d5c55ae9630ea360c09b500cc39610a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263225, "uuid": "da8dfce8-9450-452a-8a77-6aae7a208550", "comment": "Malware payload", "value": "871ce7467680a9d4cad56f469e87a14466b9987b66ef531b1b5ecf7022db5fb9600106264ef176b716e8bd8a152fc624", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263225, "uuid": "2ad492b6-7f7b-43c5-8de8-adf2d5257a61", "value": "T166A4128997A111EBE83BC5316353771BE0ED6AA107B4B6FF47C0250E5CB22E0173A7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263225, "uuid": "b4a9444b-d90f-4aec-a4b8-ba5c0c8144b1", "value": "6c64757899c8d8b11582865a7239611e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263225, "uuid": "20179a86-11ec-413c-8036-04e5901c6100", "value": "6144:3prRJifQ3t2V27Lu0A9d6Ze7pv/6sohf1jtlzJMMuDW606CU27IM4JGHoo32fyE3:5bIJ0A9dmaqhLlzJMo6nGITcWLsWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766263225, "uuid": "9fa97965-0eb8-4899-aeff-68c594e3960b", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766263225, "uuid": "15581011-4ed6-4181-91ec-80e388a90417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263225, "uuid": "7866ca39-548d-4654-86d4-029b1dbc4cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b844461a-dd3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766190471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190471, "uuid": "4026bd14-2fba-4d06-b77e-f3ec117a7e19", "comment": "Malware payload (Mirai)", "value": "7da4b1396e9ab9e1755d338f5a4cb468", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190471, "uuid": "33007b06-ad0f-4eea-b81c-e4011568cbf4", "comment": "Malware payload (Mirai)", "value": "338c51852bc493d583695b47c694248848f2f212613463b0eebe8fbd660855d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190471, "uuid": "08273fb7-a99c-4c2c-8763-c6668152cc39", "comment": "Malware payload (Mirai)", "value": "6d255980d9746f433f45f1d00a41a744b4699c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190471, "uuid": "99298035-0dad-4b86-9851-d3e6ff073229", "comment": "Malware payload (Mirai)", "value": "bfbdcb83cf0577539887392b547a4ee31c3fcccc0ff7e6af626e0ed80280cdf5052e5e64ab56ce21af8972b9aebc3171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190471, "uuid": "7bd1914c-00aa-4c96-a0b9-6441354637c3", "value": "T155D31A6AEC819F11D8D526BBFA5E8189336357BCD3FF31128E244F25278992B0E7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190471, "uuid": "ab3aa1fc-3f08-44ec-b2ba-fa20e8df982e", "value": "3072:3e3OqeXwZr7OAoxci8j5M1yL7QaMhQKCX41eEQFLGgm+wxiz:4OqeXwZr7XoU5nQaMhQKCQeEfgbwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766190471, "uuid": "8ea4d741-1a99-4e3a-a5f9-8326e918c641", "value": 141500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766190471, "uuid": "bd9803b7-57d8-46da-a92f-87eae0a194c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190471, "uuid": "6f7f400c-dfc6-4f83-b38d-41cced8fc664", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b63218-ddb0-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766240930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240930, "uuid": "c61c4975-a85c-41f1-b515-0332fa92b3da", "comment": "Malware payload (ValleyRAT)", "value": "df46f4c3f25701e29405a5686e485a43", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.H!ml", "colour": "#23592E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240930, "uuid": "a7e89d52-d98a-4327-bccc-48b77576497a", "comment": "Malware payload (ValleyRAT)", "value": "35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.H!ml", "colour": "#23592E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240930, "uuid": "c5ce3b1b-a986-491f-aa94-99b6d7a69a04", "comment": "Malware payload (ValleyRAT)", "value": "4d657a1960c0ec3ec74ebfb6d14fd37c8143b077", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.H!ml", "colour": "#23592E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240930, "uuid": "d7459130-3ad3-4e12-a224-4b1267da9e6f", "comment": "Malware payload (ValleyRAT)", "value": "52220aedeb7aca39392bc39c71352cf7d9b96cc479bf09c29a9c5d1c56553d2db5fca31bcf0328757eb1a5a6df8c4f63", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trojan:Script/Wacatac.H!ml", "colour": "#23592E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240930, "uuid": "881c020c-e5b2-4c82-9e89-adac3b870d48", "value": "T16CA5AD21B287C036D16E0177E968EF5E1938BE730B3145D777E83D6E49B08C2A279B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240930, "uuid": "03baa8b2-b648-4f88-9582-d9065c80ac60", "value": "49152:wkP0ohlj9szAlopTyWD5L6D5jkakEv53rgNa8h6dpuH8:woSTy8wkf880XG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766240930, "uuid": "1404e860-9286-4b6d-ae44-f623b9e63f6a", "value": 2152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766240930, "uuid": "ef2cf439-5252-419c-9a42-be81c3fd1d16", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240930, "uuid": "fb828aee-b9d9-421d-b9d0-0e492b573596", "value": "HUoRONG.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fd5fcb-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235828, "uuid": "5dff5923-cb30-4da9-875a-35432d2c5fbd", "comment": "Malware payload (Mirai)", "value": "3835a7d1d2219bb41234afecb8edb058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235828, "uuid": "01e8bcc2-c63e-4464-a310-f8654b65b3ba", "comment": "Malware payload (Mirai)", "value": "36583f5cb244ffeaab3078927997f6980fec89146df91d5edf1bb9d018ae7ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235828, "uuid": "19f29671-b3c1-4a98-a232-ab8414fa8faf", "comment": "Malware payload (Mirai)", "value": "7eb13353a854ffe1e708ce85502bff06624f59bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235828, "uuid": "1328e6a3-fd30-472a-91c4-78f0227dda01", "comment": "Malware payload (Mirai)", "value": "28cdd9692e691f497bd61e9390ebd6d617b81205a627e3867f345a0a8c01fc70629e006b154ae873fc63f93b89ed9009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235828, "uuid": "3b3df6ec-e428-4c07-a7cf-a6fb80e65381", "value": "T10E8328C1BA8BC4F6D80748304067F33FCB32E53940A6D75DEF6A9E26D9376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235828, "uuid": "eb3ef945-c39a-4e39-a4b4-b17170861bd8", "value": "1536:xp8qEknpXLVUkN7tW4HIWRawsK2oXcK6W2EFI9z:hEkp7VU07tBgXK7XX6Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235828, "uuid": "d723497b-5623-4648-b450-e41c25fa1577", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235828, "uuid": "471fa85e-2c2c-4daa-9e56-e600090cd3a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235828, "uuid": "7c61ba7c-78dd-4562-a007-d7ef0b58c775", "value": "ni686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cef2f0-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223292, "uuid": "aeeacddb-c2db-400b-baaa-8e61f5b342fa", "comment": "Malware payload (Mirai)", "value": "7a7a2e2fe50acf5256f12fc28b913953", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223292, "uuid": "abc42fb4-a370-4c27-b3f5-b3e5b9100e78", "comment": "Malware payload (Mirai)", "value": "371e0cffe2f794224ef69193da697e7d2a8a18b6df44d4f90488797e3630143c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223292, "uuid": "ea4ccb6c-fbac-4885-8174-de79095850b0", "comment": "Malware payload (Mirai)", "value": "362ba49a4ca4e137a95e5422329b6832e0dc19e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223292, "uuid": "5f846579-ca62-489b-bd26-05f4705be38c", "comment": "Malware payload (Mirai)", "value": "0defbfb9a90f31f79651e92fbea7fea75c0bb1fcd8deafb87722a1f7e1e7a3d31e41c972f54b85d5c49a81ff31ea2e0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223292, "uuid": "f2140d14-59c4-4144-b931-b67b3b60ffbb", "value": "T1B1C3E796B8819F22C5D116BEFE1F52DD33231BB8E3DE3207DD146B2076CA91A0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223292, "uuid": "55f388d3-06da-43ee-b4fd-ad66dbee16d5", "value": "3072:DG9otXUiGKazOV8xGho+02slOZ0g2lzWWK5rdfZTXiJY0oJg1in51:DG9otXUihazOVGso+0LlI07KfzZTyJYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223292, "uuid": "d72e4c69-74e0-46aa-9091-f45e1f31965e", "value": 127732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223292, "uuid": "6dca2380-d4dc-4664-b4e2-7da5e41f75c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223292, "uuid": "82cca04a-dbde-48dd-bfc5-c7f7941d44b4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a12aeb-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254349, "uuid": "8ebb1c52-1884-4af3-92fa-516d6ee02800", "comment": "Malware payload (Mirai)", "value": "c8bc6061c49edfdeca72ca29f3613299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254349, "uuid": "db5e15aa-d9db-4081-945c-b3c5192993da", "comment": "Malware payload (Mirai)", "value": "37a7376ae74e97046245c24da750653aa059ec6a27ed64d38ab28529f3d387f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254349, "uuid": "64d5cc4d-d57c-435c-9a0d-6f10aa35a879", "comment": "Malware payload (Mirai)", "value": "3a9470dd137423ce0fd36174c3439bcaf17b4bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254349, "uuid": "39477b4d-a5cc-4c42-8248-7b9b12603a70", "comment": "Malware payload (Mirai)", "value": "961ef069a4243a03617f6478e9552db92eb18606d6463caf7a1374018887752a6028c9dc7a29ebe3e2e5561e64c121d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254349, "uuid": "bc293545-0a23-446e-9e8d-468d4de6633a", "value": "T11BB3C85E7E218F7DF7A8863047B34B21A35923D626E1D685E26CD9041F6138E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254349, "uuid": "900cdc78-98c8-44e2-b973-5a8eda03132e", "value": "1536:jTtgHlCSYhqbLLqDridBiPZVKCNrx39W/RGpYTKGNeRL1HDJ7ABvNL:qH8Ob6DxVKCNrx3qRG6LOt7S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254349, "uuid": "dd0f68f1-5cde-46a0-9c06-23696b1c86c3", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254349, "uuid": "4d596b51-8b7f-4cc8-98d4-032caf9bab6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254349, "uuid": "f2b79ca7-d623-4cac-b988-033dfea680db", "value": "aqh6thrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cdbee4-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234486, "uuid": "28d45f84-2f20-4a7a-8785-ff5a443bc0dd", "comment": "Malware payload (Mirai)", "value": "fca9a3fabd32b5429e6158578709a05a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234486, "uuid": "323d9702-6fe6-4ffb-8b65-12136adc6b04", "comment": "Malware payload (Mirai)", "value": "387ba05c3011436e557c41e96913b90df7c85655f2abe2ed6e95bb4474ccc344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234486, "uuid": "811be39a-838e-49e0-b29b-44da981c69ab", "comment": "Malware payload (Mirai)", "value": "b7ca93e09a52f59d554bb588d28b4cfaa929402d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234486, "uuid": "b1aeb315-836e-48c4-ae26-9681a32dc1ac", "comment": "Malware payload (Mirai)", "value": "3115500f63121272878d6db4af478489999d6a72e72cd0c5b52611f329431d11598dcf706b2bbd90d94887835724fedb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234486, "uuid": "0b51cdaa-aa8c-4966-93ba-be8a83848c63", "value": "T163F330C6BFA13FBFD81ECD330295CA06129D490A5399AF7B5B64D508F64B10A5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234486, "uuid": "d4d83d81-c7db-4d5b-8e19-8e5ab4a60e97", "value": "1536:5u67yNVdyrQQ8Elh8aCbmbDraaR6WKhPkMwxTmMJQuZpHLXUr:5fSl6Qb1a9KlypbZpHb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234486, "uuid": "5fb99e4e-19a4-4dd6-889d-a64efdf59b3e", "value": 161436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234486, "uuid": "079bc5d8-6c37-4dc7-a6ec-235c5b383c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234486, "uuid": "855304d3-3c82-4422-8b61-62314ca57a0c", "value": "firmware.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2457e0-dd7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766217937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766217937, "uuid": "ebcd6e49-737f-4018-a490-a0d04842f0cb", "comment": "Malware payload", "value": "e79b5e5917624f27b2a3e4be4eba85b1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766217937, "uuid": "fdf25099-bd8c-4fbb-80eb-c1b5cfc51097", "comment": "Malware payload", "value": "38c475234dfa88d8d2930651c6021bca3e912d8860e6921faf8f52fc4a170305", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766217937, "uuid": "1df0ad77-5dae-4fbd-9819-362abd84fbd1", "comment": "Malware payload", "value": "2fdfe2518a8e6c1618a57b83be2322614660b703", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766217937, "uuid": "f519b189-95e5-41b5-8cd1-802426dda61a", "comment": "Malware payload", "value": "394b70f015aa1939aae6254fb28cae85a45a94c59468ee5a903e0ee6a0cb141c019d785454bcf95cd43e999b18b24784", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766217937, "uuid": "93d8afeb-3802-49e8-9187-c3f6ce995712", "value": "T1BCC523957BD00EFBE938B63080CAB57D7549FF785A54582B2366AB940EF90132D33329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766217937, "uuid": "d9d8f176-d8ea-4e05-b0d0-3079915a0c2d", "value": "a01d4eeeb2e6d1930ca89466fe0f4145", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766217937, "uuid": "d2febdf5-aeb8-4365-8c18-bebea9da7033", "value": "49152:ApaZDwQzTMrVJWmfxMvK0wG+Liz3G8b/BKrpEfvTkAop7v:lZDbzTMRJPpMvPwIznVO4rtU7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766217937, "uuid": "b45540f9-ef25-42bb-9765-7794f14591d4", "value": 2502144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766217937, "uuid": "3dc5935f-02db-40e6-8fbb-130ba28d9b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766217937, "uuid": "3e14f4c8-3b19-4d57-82fd-e69e81c3b9bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e22b51-dd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766214779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214779, "uuid": "2d1d4f24-e079-40ba-8757-2e4a26e85ed9", "comment": "Malware payload (Mirai)", "value": "fd05b7af774465d16dc5152863c768a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214779, "uuid": "d79d514b-f753-4c8d-b236-921337a090ca", "comment": "Malware payload (Mirai)", "value": "395006c72090f8f0313cef21dc9c104d5176f7d837a3e21cca99016fe705c538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214779, "uuid": "aca75e12-90aa-40b8-a7d5-318bc79fca45", "comment": "Malware payload (Mirai)", "value": "6a36b6988552958180b63ae1c7f59dea4a08cd63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214779, "uuid": "ee6a9eda-caf6-4278-a9ba-90d37ab9aa3a", "comment": "Malware payload (Mirai)", "value": "6f28da75407bad6e25b49a92760bfb94d9d613a514b54110ede22d60ac79270a4288f398dcd0cd9498fa242c67bc63e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214779, "uuid": "403c6b57-a839-4fda-a057-b521d9ced7be", "value": "T1256302229E754393C5E55039FA2C9EE33E6F127C99FE55702D70AA18A3D48C1CB7208C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214779, "uuid": "270f5ea5-efea-4e40-a83a-8a88c17d5b4a", "value": "1536:pwHkfL35YbaMqdZyNTw8hiLyR1BzLuhCUaMN9KmlB:ikfL/5yNTRhiLyR1BzLENwmlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766214779, "uuid": "37d28fe8-c0bd-42bf-9324-d0e0afa29a7c", "value": 66896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766214779, "uuid": "59329959-29c9-4b33-8c25-7ce30be254c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214779, "uuid": "444f3e12-f278-4303-b6ab-5b132beef11b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f52548-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223294, "uuid": "528ca574-5a1e-47d5-a28b-3e01c0f0d6a0", "comment": "Malware payload (Mirai)", "value": "f19f69f44aee38c90a18fc7dfde723f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223294, "uuid": "404c467f-4061-4fdb-981c-8df6245d7100", "comment": "Malware payload (Mirai)", "value": "398a21600bd2219140d85b90c16e0408986024228d221ee2eb7191766cff4b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223294, "uuid": "b2a869d2-2a7d-491e-905c-64faadd9b18e", "comment": "Malware payload (Mirai)", "value": "ccb180b290359723aed148a865eb44d8ec193cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223294, "uuid": "4e59bb12-fb8f-40b5-9e83-b9645fcc419e", "comment": "Malware payload (Mirai)", "value": "f37c6588c2e046e58d421bf4ef22a319f40cbc88de5217c5171e7701555d6634ab090122f48492f83eed19b31dc7c67b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223294, "uuid": "8b5b859c-a10f-4c85-9efa-4299964f2ab5", "value": "T19BC38DA86E4E3DE2D2C7D37DCE044E22712B74F5C62193B0BD0253AED5DBCAA89E0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223294, "uuid": "34689a22-9b1b-4a62-b03b-a0444d8c53c2", "value": "1536:U/6J2G7xguYNiecNH5YUgEg18ztn8M+t1NXrH0PQlceN8zU6:5GumA5YUgEU8+LNj0QWe6I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223294, "uuid": "ed62d08b-a7d3-4389-9530-e106b5cdfa64", "value": 120672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223294, "uuid": "11f759d3-eb60-4f26-85e6-3c6557e3fead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223294, "uuid": "32548b54-1da0-47e8-b9ad-cf490d2dba8a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2610ddad-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223297, "uuid": "6b5041f2-ec62-4c8f-aff1-251fb7f12c7a", "comment": "Malware payload (Mirai)", "value": "d69c0c4c646ff8c3c7e38263daf1f00e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223297, "uuid": "06deb768-b61d-447b-9dc9-a49864a4b544", "comment": "Malware payload (Mirai)", "value": "399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223297, "uuid": "432f632c-fc6a-48e0-9c7b-544cb19d4ec8", "comment": "Malware payload (Mirai)", "value": "05b07ba7519445d5b924c222cab180a2f34203a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223297, "uuid": "754bc2b0-9a25-4053-b87a-62cd54a751bc", "comment": "Malware payload (Mirai)", "value": "9108c394b7f6e5f0ffb822f0cb12b9e2d94443ecb026852de8a78cdf75195a228de5bc1e50e5ab43a6d219201985ffd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223297, "uuid": "a5ee1ad9-044e-4004-a589-6294174a7701", "value": "T14EF0E7DF026104F15681E969FA934C79F00656D939C90B8CE8AE0C35158D92CB421F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223297, "uuid": "e2e2dc7a-bfe0-4f03-8368-6b676f3e29f6", "value": "12:iuZDSHHWEZSqHWE0yzvS0yzMHWEfIjDSfIMHWEKDS7HWp:iuZ2nWEU8WE0yza0yzGWEfZfhWEK2DWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223297, "uuid": "8f27747c-6712-4fa1-99e6-f252b5be72a0", "value": 585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223297, "uuid": "9be9376e-7e32-4fd5-bc19-99b7cc86708d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223297, "uuid": "31cf4abd-3fa8-4bc6-b438-b78c4a834b97", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f969b3be-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249851, "uuid": "affcb31c-961e-4df2-a9b3-27a2c1f914cb", "comment": "Malware payload (Mirai)", "value": "199a246a752bce4261ad0d0fdaebe747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249851, "uuid": "e43d3e50-c777-4890-957b-f620260a867f", "comment": "Malware payload (Mirai)", "value": "39b108c712c0b8b354c3a55c3f609ee629624f6a4b37c3730852549f67be155d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249851, "uuid": "58cff324-4b33-4dc5-a386-0c5c70bdbb3f", "comment": "Malware payload (Mirai)", "value": "fffd1150ab2b8769db39892111b1bd19d28336fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249851, "uuid": "fec85d7d-8a4b-4c87-9939-64eec9ece23f", "comment": "Malware payload (Mirai)", "value": "f5020ab1f6e01a1d7b1712875c7409e9cfe4945d6e5365639ad7dd051319a717dc42bebdf38741b9b1aa560347be3d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249851, "uuid": "9b1e8bc2-6142-48c9-b2f5-dbb005945364", "value": "T196836CC9FAC3E4B6F95201B211369B33C773D62B602ADA47C36E9D269C63501D61AB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249851, "uuid": "a946409d-469d-40b5-b743-e702109f032e", "value": "1536:kQu7P3O2DRZ/j+J4J3iDsJ972efZQpMfozSAvBNbH:Vu7P3OA/6J4J3igJ9CefGreKNbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249851, "uuid": "aa6e81f7-6c4a-423b-8036-dd6b108b2430", "value": 85868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249851, "uuid": "6e536bbb-02c0-4492-bb4a-110f029eb96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249851, "uuid": "c4b275ca-76fe-4b5c-8733-b6551610f9b6", "value": "sumrak.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a033fc-dd63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766208026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208026, "uuid": "92ea2097-e0e0-47e6-b7f4-f668fe07e8bb", "comment": "Malware payload (Mirai)", "value": "8a70c2b3deff62130fee4d682c0eb8ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208026, "uuid": "6684b040-1c65-44cd-a40f-642646d4f622", "comment": "Malware payload (Mirai)", "value": "39ebf1d8f72822e0640ec1ed52169cbac758de5218e10acc02f736837b445cf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208026, "uuid": "30cc1b70-54c2-4c1f-b69e-afbd0421f8fa", "comment": "Malware payload (Mirai)", "value": "6941343bd1ac15e163e9479c63e9773cdb6a74f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208026, "uuid": "a977c105-0138-4984-8cee-5da7eb68943e", "comment": "Malware payload (Mirai)", "value": "ce888662c1ef30c339b2c7150be618217d689e447ef19b8dc5b50d970ad36fc3e716ebb2abd3e7895b7ef187178fc2b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208026, "uuid": "c8a659da-1f45-45a6-92d5-770b9e27612d", "value": "T184A32A56F8828B22C5D512BEFA1E118D331317B8E3DE72129E205F2077C696B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208026, "uuid": "0b621028-63a4-4196-a009-c6128426c02e", "value": "1536:dHnma2wfW/bfiGdLqHjC3PU45GjIZiY+garvVYTfuQr5MsQiAw60pZor7kw58YJe:8FwfKfVdLLh4Y+garvmyw1pZorwwKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766208026, "uuid": "34f0f80d-bffd-4c0b-9690-7861d589c2db", "value": 101092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766208026, "uuid": "f3b85835-ced6-4ea1-97b3-317d04e0ac5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208026, "uuid": "3f4e5a31-852f-4eb2-a94a-faa98603873b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104589d7-dd8d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225838, "uuid": "674cddc3-aa0d-4325-9ad5-10131df8359a", "comment": "Malware payload", "value": "1c4f18a4675c094eb5b9f718be6e57a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225838, "uuid": "98369323-48df-4065-83c9-742f90ed7dcb", "comment": "Malware payload", "value": "3a5744e8729fa4065cbbd54b67503fbcd12ca064fb087bddff4ec9dd934563cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225838, "uuid": "86bf1ce6-3158-4349-9f51-9d436fd03474", "comment": "Malware payload", "value": "d30a2d3f2ca703670fb9d906ac0d8b3521bbf247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225838, "uuid": "f95c87cd-af38-4ce5-8f6e-e0e379366994", "comment": "Malware payload", "value": "ccf0d84210bd5412c0183d54ff5d6e826cf4104e20784eae98fd3656249c3dfeab75cf4bc2b19b6a0b65dc5cb3ebb0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225838, "uuid": "c6ec7aed-94d4-4872-ba85-4ff5cd3b81d3", "value": "T1A9531C1BB35364ECC62AD57486EFAB33B671F8634630AF3F02E4E6702E11E601E5A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225838, "uuid": "bf138a6c-17bd-4fa4-8b92-07af108f0bea", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225838, "uuid": "c2c9e1c6-9d5c-4020-bfee-d99cef6ea676", "value": "768:ycGovCAeG58oao/JVTM5y0VQu0hseQzRxUMUla8vX6puvf1bs9PDV0gOiATWhea:3Goyzo9onqrqcvlP6EvfaZ0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225838, "uuid": "b256f03b-7aba-4bfc-aa86-91a7795b5b87", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225838, "uuid": "71f942ec-b2da-4e14-b059-82189db9c3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225838, "uuid": "499ef3e1-dd69-4a50-b231-4bff6fc353b3", "value": "cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37411e59-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235781, "uuid": "9b0a0994-eafb-4206-be13-80c5693c71ab", "comment": "Malware payload (Mirai)", "value": "33af7b120e5349198c8667346331aec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235781, "uuid": "a9dc318a-f0bb-4a95-8fc2-b7695577c4b1", "comment": "Malware payload (Mirai)", "value": "3b04d7544a98c42cbdbaf3bb38a3ac31398c756b6a29d8ea6f8059454e76b9db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235781, "uuid": "b978ccca-8997-4909-821a-42cf7bb7025c", "comment": "Malware payload (Mirai)", "value": "0e8deed39869407fa9b4fc13af0553ea847a4b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235781, "uuid": "6d32f2a1-6ae4-47af-83ad-679d65d1cd39", "comment": "Malware payload (Mirai)", "value": "c75996282bf15968c2d55899c53d54bbf3e0714fc0e0aa181834767759cc5581f908ab251086499c89e54b12d4b6aa53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235781, "uuid": "70b887c4-ffd8-49bb-9433-c704c17a7a37", "value": "T15003F13105132CE3DE2C59B9BAFC9B003766059DD0FC727ACB10D6689396F2B66D605B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235781, "uuid": "01f03a2b-bad1-47ef-ac75-e8165fbbf5a2", "value": "768:xRHz/+S7TXPzJgF+5aenMUpCIcSUz37mvw6VlBXk3s3UozPO:fHLt7T3ceMUpvcf7Sw2Xzzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235781, "uuid": "4fd8b2f2-4b5b-4375-b8f6-89597ac218b6", "value": 40908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235781, "uuid": "18faada2-e417-4093-9624-ea9dd845c826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235781, "uuid": "75c86d71-aaae-49db-9869-207d97414138", "value": "narm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c482646-ddea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766265935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265935, "uuid": "eea5e2e4-7c57-4385-88a3-216118092b56", "comment": "Malware payload", "value": "ef49be4a2979cc1dc9ac36cf4ca44d55", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265935, "uuid": "40bb5902-cf5f-4f40-a3d4-f9f1f5dfd300", "comment": "Malware payload", "value": "3b4695e313237fce0d6f654838ecb56e14d956216c3c174795c9dc08b1f6ee99", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265935, "uuid": "357821a7-b3fd-4662-a62b-7a73f01763b7", "comment": "Malware payload", "value": "c78d318199797912547cf358943dc83200babd56", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265935, "uuid": "befed7ef-716d-4b9f-b229-03878192981c", "comment": "Malware payload", "value": "21dd02684d4d9fd98280c22777b10629b517e75b4ce30734c0924135601f33fb09f60d341fffec478911815580e5329a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265935, "uuid": "912d540b-623f-4062-93e7-c35b76eb2331", "value": "T17561202227F60319F3FB4B7168F7B3904A33BC55FA51835E5184510C48B1A18D969FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265935, "uuid": "f97159d5-d55b-448b-9900-4aade8f026ef", "value": "48:8xzmyUPyN10eoZ+oXdLXuHHvG76WTAzZ4hbTW6qR:8xzWqmfun+OoAcbTPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766265935, "uuid": "04748885-3f23-4182-b256-39a6c4eab3c1", "value": 3266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766265935, "uuid": "30e8b993-c5b6-4178-bdc0-e387185fb961", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265935, "uuid": "a205920f-a8a7-4f72-a960-5b62dc6ab2f5", "value": "Documents-VOLVO-8173720-DLD0283_Uploads-16.12.2025.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f4bb93-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254347, "uuid": "5ec962ef-7b1a-432f-8a62-7749243dd6bd", "comment": "Malware payload (Mirai)", "value": "a6e8cb501616bb1bd0b14590cd7bd8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254347, "uuid": "854330f4-1b8a-4db5-b84e-3a68b101f5e8", "comment": "Malware payload (Mirai)", "value": "3b846f5aa42d6c8870ea181ab034cc40eb352ea541dea48c3a4cee058722decf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254347, "uuid": "3ac806cb-4288-4ada-8bf5-8e97beb2f377", "comment": "Malware payload (Mirai)", "value": "4a0667dc8b17f2983f806cce088b0ceb0df2ac01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254347, "uuid": "953a18a3-0fbc-492a-9e8e-c131dcaedc93", "comment": "Malware payload (Mirai)", "value": "0efebe01aa5c0016a8bf16c35371f2ae514722ae5f4a8509352ba7e079b89fc0111ca53e42ffed1372cf87dc6c9e10c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254347, "uuid": "e5290816-eecb-4be0-b69d-ab71e13325fd", "value": "T1DD933951FD819612C6C122B7FB9E028D372713A9E2FE32039D256F21738B96B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254347, "uuid": "7504754d-493d-45a2-a330-aa9bd53b58bf", "value": "1536:PxLuSDFzSBLjeYCmBa75lRAM279ACI8abdOsvQ+j:PxaSDFzSJrBatlRAMJnpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254347, "uuid": "b618fe01-a673-4559-b6ed-26cb8d91d388", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254347, "uuid": "a922878c-0d81-45f8-afb3-3b297e66a1da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254347, "uuid": "aec5253d-7ec6-4829-b1ff-93d2d1677449", "value": "4je8xdko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6802146a-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254332, "uuid": "17a2fa64-3dd2-4c74-b771-0b217f4be82f", "comment": "Malware payload (Mirai)", "value": "2097a6da759add6d98781e80f7ecae22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254332, "uuid": "6061cd67-17a4-49a2-b939-825f311aa303", "comment": "Malware payload (Mirai)", "value": "3cf2e42ad3e749e0947d239557a810f14522b39ae3396d4c26bf06266f5974e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254332, "uuid": "66f20304-9e9e-4549-9dee-97e3ece7b7c6", "comment": "Malware payload (Mirai)", "value": "9cb419fe17ea1d67da91960e5e9345ee93adf3ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254332, "uuid": "79ebbe1e-6edd-4d7c-bc71-da9789952f20", "comment": "Malware payload (Mirai)", "value": "a24731c66916aa7f693b9a7cfad497d7c1dac1ed63a8fd5e25642a473298d359696b0ed47682f6ec9a087eaa145f0ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254332, "uuid": "2f83a13d-6ccd-42e7-b02e-f9755d8e154f", "value": "T1BE6302A031017F64C8FB3FAB288C1903179A4979FDC975ED2A6058565B7F9D81EED803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254332, "uuid": "0a8bc9f9-157d-4c12-a50a-070cce669df5", "value": "1536:9G+gYQHTlvhJ2NSm9Q+haLsJkG6L9BKxEZk07/SbNogM:9GVpHTlvzeSmj4sIL9sck07uGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254332, "uuid": "2c15c049-4e90-4e4f-a08b-80325652ba1d", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254332, "uuid": "2a2d442c-5b1c-4250-88b1-15d565ca8b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254332, "uuid": "65a9bf9a-fec2-4dfe-93c4-598754f52dfe", "value": "v0nnog0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc425cf-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766254341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254341, "uuid": "8f1d2e56-d5d4-4b9e-8132-7431b5c12680", "comment": "Malware payload", "value": "3cee99a2e5a3fcd982604cc2abb7da1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254341, "uuid": "bc55292f-51a2-4882-86a6-786932fc3ce3", "comment": "Malware payload", "value": "3d795ebc3710d535d9be8457ffb7b6f63bfe58a501dcf74baca6a251e55d032d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254341, "uuid": "74cb3768-0b49-498e-8437-0d057bc4c222", "comment": "Malware payload", "value": "5c71bea8ae2bf32a7824e41a355750365767df6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254341, "uuid": "b681255a-6d7a-43ee-84de-53cc7d960744", "comment": "Malware payload", "value": "ef519836cf7a97fa872ceb3858d2ebef8e03f439f8c60b6241a90bd3e40c3f81ec06587756b3a0612d8fab8d4b0526b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254341, "uuid": "ae64732c-ec7b-42b3-8457-a91fdc8c8389", "value": "T1DB935B22FA79193BC8C4A97662F30762F1F7438724A89A1F7C710D8DAF6465022677F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254341, "uuid": "7ed40444-6ae9-43ac-bf71-d19d5594773c", "value": "1536:6qKCLw6IMIXR3OCiIp86P1h2bDtoiJq57zAZwralt39CBY:MLrOYsGiJ67s2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254341, "uuid": "cbe034d8-f4b4-4ace-8948-1bb6e9f1df73", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254341, "uuid": "b822a3c7-9b7f-499d-8c06-8b540230fccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254341, "uuid": "e2d9212e-cb41-41ad-85be-cb1852050f65", "value": "l7grs0pe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143cb9a2-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234434, "uuid": "5a026ae6-10dc-4b39-9a45-d9ee850f446e", "comment": "Malware payload (Mirai)", "value": "58f2b2fcb5714b2c5a4c9859f35df333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234434, "uuid": "2f238dc0-75d9-4989-a17c-f52c1c297420", "comment": "Malware payload (Mirai)", "value": "3ea75d84eef340ad8c5a0c2d3be46c54e2372d434c7ff690f6fce3289e8c5acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234434, "uuid": "85406fb1-52ec-4b48-b4f8-1d400a3a1687", "comment": "Malware payload (Mirai)", "value": "324770891d7ad32c2cee9792c216b9416a52c078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234434, "uuid": "0e07f745-cc90-471b-b2a1-7b56c5d233ca", "comment": "Malware payload (Mirai)", "value": "e98eb5f6a8c67cf1e4d7eba49283a6434f16f7682321ef99458241827655eff6073ffc98960a677ad8ec059a91b9e29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234434, "uuid": "5e808eb1-07be-49f2-afc5-9be445759551", "value": "T153832AC7F811EABAF809E7370C9349197271F3A00A530B766767766BE9391D8182BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234434, "uuid": "00af856f-0794-42fc-98ab-01fb116f764d", "value": "1536:MR+dcdo5D+VanK9/8kq8m2QeuacWjcW0JcWcB5Y82jzlDkoYLPuhZkze1GtmO/rY:MRS5cVaKPqV2QeuacWjcW0JcWcBOJjzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234434, "uuid": "a257dbd6-a9cc-4c7d-915f-105917aef3f9", "value": 81576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234434, "uuid": "b79dc102-eb7c-4b1b-8584-4eb858f6cd80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234434, "uuid": "0fb82e54-e638-46ed-a331-1172d9230773", "value": "firmware.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bb134c-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235776, "uuid": "c5233fb7-3105-4ea9-96c5-d8a02ab70aa4", "comment": "Malware payload (Mirai)", "value": "2fcd08cc7a451df011b0308195858bf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235776, "uuid": "6fa0b640-8de4-42a0-886f-d0094133657d", "comment": "Malware payload (Mirai)", "value": "3ef9c49ac068db6603e6cde54f3da6bedea7558c1d97f4732409d77c924b74cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235776, "uuid": "a2457571-9c7d-4d21-b29f-3d83082fe868", "comment": "Malware payload (Mirai)", "value": "1de581fedcd8aedbeb41fd671f5d188e0f1bc804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235776, "uuid": "9a7fad0a-c855-4d03-9cd2-b101db5fc002", "comment": "Malware payload (Mirai)", "value": "bbe5c371f3e478b117b80a37d37fc2c685eb94e210a04f8062fb20c8b7151cec673f041de7f81da5e326f49ff58dc0af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235776, "uuid": "50d05721-2159-4f3e-a8a1-8f758f8995e1", "value": "T15903F1E1C1EA3D00F6DD0177CCFE39562228A1ACACA4A7A3419461FE7252B193F0D7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235776, "uuid": "dcab2c36-bdb0-4787-b548-5a6d808a5364", "value": "768:Kk8SXZQoydUhBC8VsiFCKw3fwmNcDbOR9gA916nXnbcuyD7UHQRjF:6SPy0B9ZFswRb7416Xnouy8HyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235776, "uuid": "4ce7f294-dc05-48ff-9852-3f5956c9cf2b", "value": 40520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235776, "uuid": "0d52e722-b737-4c87-a325-d16cd00e8226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235776, "uuid": "ec629d27-9ead-4393-b61c-8ba29539a2df", "value": "ni686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ab3707-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234918, "uuid": "3fae53eb-2bd7-4a26-8494-1bfd98e5026c", "comment": "Malware payload (Mirai)", "value": "68a1a4f1a52447e4a995585ec616667c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234918, "uuid": "73edab42-c316-410f-a5d6-f84b6dd7887a", "comment": "Malware payload (Mirai)", "value": "3f93796d0e1e97dada8b9e8939018106d8b2edd017ea4717bf5e8e522a0b3b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234918, "uuid": "09c0708a-9a9d-47eb-85a8-19d0995ea9d4", "comment": "Malware payload (Mirai)", "value": "10243469650944058ca3b0ddd8f668cc923171f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234918, "uuid": "e56c7d76-75a5-4743-b577-3c440ffaa196", "comment": "Malware payload (Mirai)", "value": "b6e0a82efa8b4c1f344b445c12f97e313ed11e92cdf8343981b99429694abfe4bb0c3a304b8ae77bcdc362794ea26135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234918, "uuid": "89d9f7a9-df3e-4356-a1c7-57eedb40d3e0", "value": "T198D30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234918, "uuid": "2650e13f-5cf1-4d7c-9b1b-8d5e9d42ed20", "value": "1536:VHQeHIjFlGz/r56Qpl/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5A:VHQeF6QT9FcT4YZMDFYA9gAplNib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234918, "uuid": "cc78dc86-f5f4-4800-9a0f-5a023a80647e", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234918, "uuid": "d0654931-e6ed-48a3-93aa-b4286e873db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234918, "uuid": "99209b4a-ed16-4d79-ab2d-d64f2482b2e4", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740c5a42-dde7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766264660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264660, "uuid": "4b9a9985-b5ea-48e4-906d-475b7e37143b", "comment": "Malware payload", "value": "104487e6537e1ef6f2595e6f507bd07e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264660, "uuid": "ac5893e0-a520-4c9f-9b62-a37ac8619dbd", "comment": "Malware payload", "value": "410c27fcaa3d5c4331a4cfc26794a080eed701bc427edb541e7ab1857947283c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264660, "uuid": "5b22a45a-236b-4c38-83ba-a9fc0d37d4e4", "comment": "Malware payload", "value": "506dd917301be1ffe2db4a8144890071ad0a0eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264660, "uuid": "b97f38b2-a50e-453e-83e1-23325a0b4a57", "comment": "Malware payload", "value": "b0748961b9090edeb442bfdfa9c81dfb5f8e0d202928720c3746d920e385a00479542fc5631b250eab1b64b46bbfa475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264660, "uuid": "c08885c7-ffb8-4d3d-a7a9-92d64128dac2", "value": "T128A64B92AD90466AD5AFF239ECA2A1567330BC04433125D76AD13BA50D7BBC4133BB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264660, "uuid": "d088a5a0-0d46-449e-9650-3a2456a4f729", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264660, "uuid": "42681271-2dd3-4422-a55b-b80c17885de7", "value": "49152:0DB/DQFjdiQx/ZEXf+LeBaLf7SmWywt+gpAHY1bKAHkfC8AGRDi4o55jUf2G8mbr:00j1Yum4Jf34iW2N6D8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766264660, "uuid": "9b2463a6-dc1d-45c6-a8af-00f129d5787c", "value": 9816512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766264660, "uuid": "3b32166c-553d-49fd-a946-ac5d55bded62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264660, "uuid": "ec30dfec-53d8-4273-b47b-9e99e10ea9cd", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64163255-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211805, "uuid": "c1457ac0-4ffc-4093-b34c-a72404ea2444", "comment": "Malware payload (Gafgyt)", "value": "7c8d9939cc40c49414f139733cf53dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211805, "uuid": "b49874a7-01c7-471e-ab3a-89388fad4df7", "comment": "Malware payload (Gafgyt)", "value": "411a273cb82c0583f9508f1b8b88ffe0351650439bea30ec4de979fa57dfe81a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211805, "uuid": "3ee1ddfe-8f1f-482f-bcd0-2a1a0c7c607b", "comment": "Malware payload (Gafgyt)", "value": "090dc8e61d6ed1fc7f2585a153f14f5aeb64edde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211805, "uuid": "1080df99-f015-4fbe-aaf2-b29a2e089393", "comment": "Malware payload (Gafgyt)", "value": "a6f7cf05d053032112d287a936d1d8a3e4e2d5d42043d80259f4b65911d2b2ed6b293f6519a3a0a8f2f9d0497257ac56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211805, "uuid": "027b041e-5b0d-425b-bbc0-39b089155e9f", "value": "T19AC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211805, "uuid": "1b90b99f-8f42-4fbe-8cb8-94a63030a527", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep1+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ef+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211805, "uuid": "d4056e98-2687-4e33-b3e4-345659962ac6", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211805, "uuid": "e7555061-a3e0-49a5-8ac0-cb52f54264c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211805, "uuid": "b3c3318f-7cd2-4e9b-a32a-a7e81730e7a5", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a62e32-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766266372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266372, "uuid": "8324e958-df64-4ee4-9468-2d703b4c60c3", "comment": "Malware payload", "value": "92e5cd9f5e20550917ddede8e73b0f97", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266372, "uuid": "59517b34-b53b-4d9c-a993-6301492c8acc", "comment": "Malware payload", "value": "414db44b4d9fb12d73498677d31432496508b29ddc68288816316e298968e641", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266372, "uuid": "ec52cbcd-c040-4391-b710-1f391d9326d0", "comment": "Malware payload", "value": "418f5b4b51edb234caa19a5f6b42295a58f6c132", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266372, "uuid": "5807cbfe-9c2a-4585-a29e-94123f0628ec", "comment": "Malware payload", "value": "4cc87ca77bc3c5c209e9916f5087e32c09933f59d45cb8ce7a748401952a3f86e1c1031739c611095846c1831cacb6a8", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266372, "uuid": "dfb6acbe-15c4-45d8-9779-0ae1f75c3739", "value": "T190D5575017F50604F1B28B3CB93A73919E727944DB26D38C1314A0196D6CF78D9B5BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266372, "uuid": "c8597b5b-eb22-49d6-9256-b8959c5db5c0", "value": "96:qxlc4lfMhrKPA0iDlc4lfMhvKPX9Nlc4lfMhzKP7idlc4lfMhz8KPaXmiX9K8:SdfvPApdfDPtdfXPOdfePg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266372, "uuid": "5ed125f2-0b47-4fe1-b8c5-fb68362a00f7", "value": 2782808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266372, "uuid": "89dfeedb-efa7-4251-91df-7934dd961ead", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266372, "uuid": "cdecc42c-dd5e-4c64-b999-bcd9296a21a3", "value": "92e5cd9f5e20550917ddede8e73b0f97.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d48f834-dded-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267252, "uuid": "593a1f56-89c9-43fa-ac49-460e67f8216d", "comment": "Malware payload", "value": "b070fe9b35ca079d754f772009978885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267252, "uuid": "df41f9a1-45ad-42e2-993e-380d0f99d1ec", "comment": "Malware payload", "value": "418981b56ea65370fbf7b7473a75929b5ba6b1910efe5562fd362c43676a6767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267252, "uuid": "9ed21a1f-4a5b-4244-83e6-8a7507b9b664", "comment": "Malware payload", "value": "176fd27400cfa21e4410df99085336ccaf22677b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267252, "uuid": "d8d5b6a3-97ae-4717-beab-0df0b0f713e2", "comment": "Malware payload", "value": "4a6f3ba836567a04f0a353ee289d22a0e105dbf3790cc635ef5c94c7e8d799bebf0abad78fb4bdb975fa521fdd126fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267252, "uuid": "55f23453-77c7-48b2-bf2e-26f26c4a1349", "value": "T105863B52B94545A5CAABF23494A1A290BB747C1983303BD76FE8169D0C3ABC4273FF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267252, "uuid": "9240e2a3-ad3d-4ca5-abd4-d7f3e336d989", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267252, "uuid": "24dec0dd-c315-4965-9ff4-b2052bb7bc62", "value": "49152:Z/aW3S5MLxCdcjIaIyYs63oj8LZo/lzfz0bqExkfRnuz4RcBsK16f:cW3EcU7yYt48+jYNzsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267252, "uuid": "397d795c-374e-4352-8b68-d3368f5b4b20", "value": 8579712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267252, "uuid": "6b86ac46-f70a-44be-99a1-71c65958eeca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267252, "uuid": "a46cffd6-7599-4fbd-8dde-a1d04a8c5b1a", "value": "Payload.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9407bae5-dda5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766236367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236367, "uuid": "9214605c-47a5-48f7-9252-224b4f54945c", "comment": "Malware payload (Mirai)", "value": "ee17645a9315b4b635898da8940136f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236367, "uuid": "e12d7a17-8892-4087-a009-0a3bff8628e9", "comment": "Malware payload (Mirai)", "value": "41aa6a6223ab8f210b40e2ea22a2389b7cfce7c3f17836b2b73a8b7577adae6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236367, "uuid": "6749e907-ba53-47e6-a283-2dd04eb12d7d", "comment": "Malware payload (Mirai)", "value": "cb8d769de0aa4dbc262437e86c113e71c7795437", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236367, "uuid": "aab2ce8b-f932-42d7-9f0b-34819b7680fe", "comment": "Malware payload (Mirai)", "value": "d99d6f96df57db8f8c063a8c6c75fb41a23a8f47156c437aa5a23e8a8785b1ef02babe40efabf4d37e0a56e248090db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236367, "uuid": "ada99de4-62df-4e9f-9644-db81298fcba5", "value": "T104E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236367, "uuid": "d7289df6-394a-4bad-845f-30634cea04df", "value": "3072:pUkePntUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUHF4jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236367, "uuid": "c33a4660-e07e-4f56-ac5a-b37fa2dcf791", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236367, "uuid": "0efcad86-53ad-4e2d-bdea-b2260a954809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236367, "uuid": "8e3eb27c-f329-42fc-b55b-9f87b4b624b6", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f5f059-ddb3-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766242512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766242512, "uuid": "9c28c131-0eea-4d46-a2f2-249053a38cff", "comment": "Malware payload (ValleyRAT)", "value": "011683dfdeb5e3c6b7b7aae186b0df62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766242512, "uuid": "dab1c27a-f763-4028-a271-ae3f14beb93e", "comment": "Malware payload (ValleyRAT)", "value": "4271a1fac025b67a6ecd4a4a46a74fbdbf395085aee1bc377194786a2e40a74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766242512, "uuid": "58be3e8a-eae0-40e1-82a7-b962af8aca65", "comment": "Malware payload (ValleyRAT)", "value": "499fe5221399002024b19324de96440aa9db0161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766242512, "uuid": "bc2127da-d2ef-4a93-afe5-40b3a5ca75b0", "comment": "Malware payload (ValleyRAT)", "value": "de90222fc6c8aeddf42d225989d87bcb4f6f8bc7a5353b261070c923f86527ea1daf5785e18182779c65306d55786373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766242512, "uuid": "770a8d9b-cdb2-42a4-ae49-1dce12245793", "value": "T100A6D01777B85164E1B7D13D8AA7810BE6B27C018B2296CF2268A7592F737F01A7F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766242512, "uuid": "5703a4e3-fb99-4ccf-bbce-c836a8d3c40c", "value": "17d9c30b42ac4d160525e49177119686", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766242512, "uuid": "fb1bce0a-c0ea-4827-93b0-328efa6318d5", "value": "196608:mpxJwt7swJp7S5vgYQJpJsv6tWKFdu9Cjup6jpa2/nV3qatJ8lKfOx458vFOt:mpIt7swJp7S5vWvJsv6tWKFdu9Cmma2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766242512, "uuid": "0b802e51-70e3-4777-9473-f7837df7c65f", "value": 9524892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766242512, "uuid": "fc19368b-5291-424a-bcf4-041599f6115c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766242512, "uuid": "7ec6c18d-bc33-49e8-b510-17e573927538", "value": "011683dfdeb5e3c6b7b7aae186b0df62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaac7a7-dd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225778, "uuid": "2ee7dd42-c250-4fce-8e20-4afb23180294", "comment": "Malware payload", "value": "b252fb0520a86dc1eb0b8c31cdbd804f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225778, "uuid": "923d626b-a60b-4072-9050-e702bd97d389", "comment": "Malware payload", "value": "428184b3fa70f4680bb776c214eb07bb4ef7507586a69d2b4ba8d0e23b67d101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225778, "uuid": "b7a0ec32-59d3-4ba7-98fe-14e1388617fd", "comment": "Malware payload", "value": "b4b1148a11740af9ef744f916b1bf345cbc13d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225778, "uuid": "f69ea8ae-fa8c-47f2-92d1-3517b188ffdc", "comment": "Malware payload", "value": "2958110ddde76babe7b62d2aed8d764fbacb3a29131ee7527f176d987d28ce5f569bc9fa323de1b8f931dd18c2b48675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225778, "uuid": "2a8ad320-e120-4cbd-b2e2-185be3dc6851", "value": "T14D531C1BB35364ECC62AD57486EFAB33B671F8634630AF3F02E4E6702E11E601E5A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225778, "uuid": "bc67ee21-195d-493b-b07a-aa381f317589", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225778, "uuid": "9566d12a-e559-409a-a3b8-01f75da50a0b", "value": "768:ZcGovCAeG58oao/JVTM5y0VQu0hseQzRxUMUla8vX6puvf1bs9PDV0gOiATWhea:CGoyzo9onqrqcvlP6EvfaZ0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225778, "uuid": "07229ff9-0493-495c-b627-1258b3acc5ea", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225778, "uuid": "54881d16-e4d9-487b-a541-002211f5569d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225778, "uuid": "1f1176d2-0314-4389-94c5-1abf22da60c9", "value": "raw_cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86df9c3-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766266546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266546, "uuid": "87f5590f-abbd-4a8e-b81a-543fd99c021e", "comment": "Malware payload", "value": "79baab919a15c78b2a21854089dd8d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266546, "uuid": "3a5329d9-9f4b-40ca-a681-64c66d2c894b", "comment": "Malware payload", "value": "4384c114dfd71f7a4c942a712e5db0d2403ffecd1970afe83353c6a28507e4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266546, "uuid": "7feaf0b6-1752-484f-b714-103a9f037da3", "comment": "Malware payload", "value": "bffc4dab7ddcd97b40214c95046233800145c16c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266546, "uuid": "2cc0f084-66c1-4049-ba80-412c59169d49", "comment": "Malware payload", "value": "3ad2083f02cf96faf33602ba6f086cde6f0f2ee82ffc531522eecd21ed2b069945842f6f5a89a262eb056ede65577408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266546, "uuid": "9acb6590-6850-4165-ba79-91473a6595d2", "value": "T15ED623D3DCC816D5C8D34A70668A278D71E1B1169EBA6B2D3BCA1C039E30E97814BD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266546, "uuid": "61cfdd78-703d-4bcb-929b-ca3541f51c8d", "value": "6d17b587a24f5693a2bc089c25ef8794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266546, "uuid": "0a4d6d30-e2ec-47f8-aae7-e84986b9b898", "value": "196608:0fmKrlgndnXCTtvlRCIp3+houZ3mPFopKcf83YGgxdc39FX5/TW5P8HePbeY1fQ:MmmlItCTFCU3+hTBZjnxu39n+SYNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266546, "uuid": "8541ee98-63c3-420d-979f-bad514040119", "value": 13651456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266546, "uuid": "46a4624e-03a2-44e0-9683-ac536ece3846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266546, "uuid": "84276a99-5469-4b5c-9203-1ab3c25e054a", "value": "program.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd61968-dd5b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766204631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204631, "uuid": "6bfb8bb2-5239-48ef-a93d-029923ebaae4", "comment": "Malware payload", "value": "8e4c00427b796545c8d13befea3b1de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204631, "uuid": "54d09326-284c-400f-a138-b3efbe02893b", "comment": "Malware payload", "value": "43bcda72704aee14064f179b07d855d0a866d0d364c13d941980c5700c9d68d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204631, "uuid": "350d89bc-a7d6-4b41-b068-83391b5acd05", "comment": "Malware payload", "value": "2153f289ad4de5ffc98bf7951e07a347f1b10103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204631, "uuid": "43ff5c0c-52dd-4d45-8fd1-679b2336f0e6", "comment": "Malware payload", "value": "db5a2ec51b6711f9019cf8f5003dd4692d42083659dfc5d388cb6219c026759ae797e30e876e5b2b16ff261659a44aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204631, "uuid": "03706063-dc0e-4861-923f-bb0125222a8e", "value": "T135352205ABE46162E07B2774D9F347A3563378722B70526F339486BE0E626D0FA3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204631, "uuid": "6b4123b0-89df-43ed-b0d9-7d228df9fcb3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204631, "uuid": "67d844c1-bd4d-469a-bf01-644892ab109f", "value": "24576:ulyq9etxPRz7HWhVOo/zp1LctFYlOeVuIZPSTSdcje:dq9uhRzzWhMo/zTcbYlO9pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766204631, "uuid": "6c3fc952-db30-41f2-848e-9e7b9c1c6250", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766204631, "uuid": "f4afa79e-39f3-49da-bb41-36b35d257d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204631, "uuid": "e2f3d30c-64bc-4f81-93a7-74bce6109264", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070fa5bb-ddff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274785, "uuid": "b18cb288-6930-4453-b1b6-7a3588dcb791", "comment": "Malware payload (Mirai)", "value": "7921b1cf6c15f5e2e05c59b09a2f422f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274785, "uuid": "a2700e67-7358-4213-bddb-0fa62bb96bfb", "comment": "Malware payload (Mirai)", "value": "4442bdb5ced8991b4a6db203b4e4aa01b5ebd934e5f9efc8756bd20b7c9b219a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274785, "uuid": "58e802cd-99a0-40e4-bc8e-00bb66001c7c", "comment": "Malware payload (Mirai)", "value": "5a4a6d22526c3e0de3d3774bda4cc5a58616fc5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274785, "uuid": "eb493028-7f6a-4660-b9b1-ecfbb607d9b8", "comment": "Malware payload (Mirai)", "value": "e687d3ecaaa79c9e62ce76e93f006c0ea514add0c9514365e6dded76464e758082455e2db1b86f88fe671e14af0e5c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274785, "uuid": "2b69a0ed-651f-4a5d-b893-750aea4e1f92", "value": "T16903E14DF3ED3BCACD5F7CF254690BB17581B090659EEB9893355C80BA86A77A08803C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274785, "uuid": "b72373ac-0aea-4845-87b6-f39480c4646c", "value": "768:KUOr9mFW5v+F7TW7UKSVTuro01hlwUlb2HcnhHICD6O1aWB:nOhYW5v47TW7UV5EXlb2oNn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274785, "uuid": "1ae7d89d-b911-46aa-8361-3226dceeaa9c", "value": 39120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274785, "uuid": "5f8f0cf6-bbac-43fa-9c03-83e2e84afe16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274785, "uuid": "c898e76d-a88d-419c-a0a6-2b5fb5c767c3", "value": "sdxkzX_UXA229x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b53163-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235772, "uuid": "cbea8640-db52-4b29-ac59-f48798347eb0", "comment": "Malware payload (Mirai)", "value": "83924d81d0408ba0a028640fcdd0e168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235772, "uuid": "3a40155a-f2ee-494c-a505-fcc6c8ff9fee", "comment": "Malware payload (Mirai)", "value": "4502ffdbd22df998c89975157d0d859eadccb5e299cf76737e51affe800381e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235772, "uuid": "5c93f0da-0057-4314-abda-1df4b0f3f002", "comment": "Malware payload (Mirai)", "value": "8ceef643e9d9956e3fcf4edfcb60f4fcfb2e024a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235772, "uuid": "c11370fe-d36e-42eb-b92a-41ca266e5532", "comment": "Malware payload (Mirai)", "value": "a41e77ec8c7d47d2ef1ab11c73a0f1da9dc0f03b39a38ac4624adfe4ab4e95ca2b74ccd3e05c04d5158a081b2db1297e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235772, "uuid": "fda933a1-f17c-4d46-99f4-4de60cd1043b", "value": "T14CB2D13960089DA5F6304874F6B4CB8BFB6A55F9C0F8316F1AE16D1E8BCD02E5178250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235772, "uuid": "afd70343-6066-46f0-8712-07e6f74fc96b", "value": "384:z+N4pwj4su1ohLyUM1NDPOPNzhcuXoxN+sZq9nrBPGKwIlc0ylZhymdGUop5hLIx:Xpb1KWUMHDPge8oxMnrtGK9lDylZs3U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235772, "uuid": "618702dc-edb0-4b57-9cc8-d01093105ed9", "value": 23996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235772, "uuid": "c25ff0b4-1e5f-4603-9a0e-49094414e3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235772, "uuid": "5b55a4f0-4bb4-4b06-ab9b-6e94400bc292", "value": "narm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba78a1f2-ddae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766240297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240297, "uuid": "04e9a687-c89c-4f7d-90c1-b0f2b654cf18", "comment": "Malware payload", "value": "e7d92dbdd2b3739aa3587243c26792ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240297, "uuid": "048f5050-3ecd-4fe5-b65a-efd82ea194a3", "comment": "Malware payload", "value": "45153e2ab3b109dddc846c01c4fa8c49afa0c90e5d3e0570813c740c8f0a0283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240297, "uuid": "7553225c-c006-48bd-8b14-f3cb4d3f0312", "comment": "Malware payload", "value": "de4d0a26f18fd2b7146b45c2bf3898f08c863dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240297, "uuid": "ebcd84d1-d4ca-48aa-9e30-c225994ede46", "comment": "Malware payload", "value": "7c74cbc2e5232600150c15131cf34f9330a0ae5c3e0b27cce0cb97cbec216ad1b6ab444b80b5156fa6d302ceecf84fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240297, "uuid": "7131eaa3-fb12-4386-b1bd-622d2264f2b8", "value": "T15BE2F1123B70828CF0F5EB31C2BA59962763F07809674B1A478168FDECB51A2DDDCE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240297, "uuid": "01200cb0-8134-4078-811b-f75d354a9be2", "value": "2530a16bbdceacdf239a430ffb41c4bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240297, "uuid": "9eb86b25-defc-4c9a-b5af-9f11a53f0dfb", "value": "768:lTtlyy3y+8aqIy9bOTEeYL3Rs4pK6q8hywbdmvxN3:lauSIy9STCrg6xEw4xN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766240297, "uuid": "83bc5df6-53de-4f51-96b5-fdeeca1753f7", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766240297, "uuid": "8548f94e-34ec-4a5a-95e5-c10ab3cc41cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240297, "uuid": "0e414192-6efb-46b8-9564-776e18f187c8", "value": "SecuriteInfo.com.Generic.Dacic.6942.B32E6AD2.23984.4897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f242243-dda3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235285, "uuid": "a936e3f9-e0aa-4289-8693-9343f02899c9", "comment": "Malware payload (Mirai)", "value": "421e85aeaab25401d5c62a8e992ed01b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235285, "uuid": "eff3827c-eab2-4809-800c-16474c572d6c", "comment": "Malware payload (Mirai)", "value": "45b9ac7c9f4ff1ba1d5fb8a45728cb86994d4f6fea911d7129fb68e255c21b1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235285, "uuid": "baf7bf61-d052-4da1-8f3a-50e276273e3d", "comment": "Malware payload (Mirai)", "value": "bd248be0d54e111769894593c889ea6fa8cad806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235285, "uuid": "086c4d16-2a5b-4a4e-81a3-fcd00020fa48", "comment": "Malware payload (Mirai)", "value": "9dc8248d08f90ffd054096b202726bcab7eb76cc24043746f80c29346573db838d5878e606b6a3dcf9bca63d14d9ba7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235285, "uuid": "118dc440-3a00-48be-81c6-564e470fb024", "value": "T114042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235285, "uuid": "a5eeeb6c-61bf-4931-9c2f-5fd1efa53dac", "value": "3072:O8/Ws3hjlvbAmfkIaboVSyckpj/HS0BpCi/hJjogM/REC/HV6:O8/tlvlcIaboVS7kVdBMi/XMgM/REC/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235285, "uuid": "21d4b027-3cbe-4d6f-9cc7-0a31a564a0f2", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235285, "uuid": "acc78cdf-d9dd-4026-b831-5c96f425f013", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235285, "uuid": "7f5e8732-4383-4914-b0bb-d0cfcc642247", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3468149e-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235777, "uuid": "470e5ccd-34e2-4efa-9b79-058b7b1a96e1", "comment": "Malware payload (Mirai)", "value": "880ee27f796c65822eec2f77309e29aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235777, "uuid": "c812f2fd-33a5-409a-910c-c542d07ff884", "comment": "Malware payload (Mirai)", "value": "45c6143514d94b293ff80494fedcbb0775288b015bcd676bb6795492ffa87cec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235777, "uuid": "3878df46-dc73-405c-a6dc-0182b1f8ee56", "comment": "Malware payload (Mirai)", "value": "e59fbe8b076c0fbf92ca5fdb7e02cd8fd80589d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235777, "uuid": "5dc5ed37-3d18-4754-8379-b88d023dc79a", "comment": "Malware payload (Mirai)", "value": "aafdd1bbf67fbf95eed9438378a6e3f1dcbe47b6dbb604e8309ab82556ac185967f56f270c3b6896f1718bf603edbfe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235777, "uuid": "7a745aa9-c9d4-4b0c-97ca-be38b0e783d8", "value": "T11A13F1A26E1028DDF470F0BD6FD1CB687C134FB5A820AD8B6B1944EAEB5D0747CA65C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235777, "uuid": "ced5cbc7-653a-4fa3-be37-bc50a0f1469f", "value": "768:BfcQ+l/zCodkjYUcEOseObzXJPNeoBHTY9qEBKYvw583b9leeAv/HikcxJgGlzDF:Bq1OZjYdsxBzOqro68rDLUCkcDVJuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235777, "uuid": "3e58b13e-a36f-408d-82f6-8bf0df52b7d0", "value": 43164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235777, "uuid": "5e67b994-ba1c-4a77-8641-104fab408176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235777, "uuid": "9bd432ff-e9c2-4001-9714-14c69fa9d7dd", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8258f554-ddc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766251799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251799, "uuid": "8cb3e194-78b1-4453-b03c-b732a28fd48e", "comment": "Malware payload", "value": "7f8121b85a8e203d1899691309f22b30", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251799, "uuid": "9980b86e-c41c-4e9d-80be-e898234d3db6", "comment": "Malware payload", "value": "4646218a45f88177a9d221680deaf9cfbb876a092494a8aafc4a61bbcfd0123e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251799, "uuid": "4f2a7909-6a4d-4809-a307-8e0ce05dfe29", "comment": "Malware payload", "value": "efd5e967d9e50221a245bbb9c79d9541b8058fa3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251799, "uuid": "1c6e6b96-b4b4-41aa-8f89-d7e4ea765e08", "comment": "Malware payload", "value": "e71ca0d8394c4e9a88cb9b32ccd85b96314e9e2bd3f593656193aba6a1f8d45f6fd4d27e19d6de0433745cd117af051d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251799, "uuid": "2e5023c8-ce81-4ec1-a3bb-8f47bd9f68ad", "value": "T1C2D095A860076546D4D40730FD20E070240AF7D5FEDFC43C78B604491C14600330EF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251799, "uuid": "f6c45080-fbbe-4867-8f06-b275691ddac5", "value": "6:homRAVuKpRAVm0FaFbFqWDcIaTqCDRiF//oF0DFm38tWpQUmRAVswH:HRAVuKpRAVhobQ3TqAiRoJ38kpHmRAVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251799, "uuid": "b10e439a-4b33-4964-8b79-650ea25ccfe6", "value": 249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251799, "uuid": "ebc9508a-d58b-45f8-869b-a12cd0968cc9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251799, "uuid": "b9589c02-f9d7-4798-a683-ec50de00136d", "value": "heboac.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d088176-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234207, "uuid": "5b55ba6d-5312-45d7-8519-acbeb80cb0f2", "comment": "Malware payload (Mirai)", "value": "df34c5e70f90ff3413035bacb7071b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234207, "uuid": "5344cf12-46f1-4bbd-8f9b-cb9a4127dde5", "comment": "Malware payload (Mirai)", "value": "4692c46c39001df84360efc87f76bbaa1a5e189db36c72f2fb41715b8a724659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234207, "uuid": "e741ed54-be3a-43d3-9378-3b8609fd080a", "comment": "Malware payload (Mirai)", "value": "7661a229c518295d37cbf443a6cdabb7f4cddb08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234207, "uuid": "42e277b5-781e-49bf-bdc7-200d89a76150", "comment": "Malware payload (Mirai)", "value": "ff11eb3b0cfd37aa1e5cb61db7b49f55256d67fe35cfc97171642785e425e1726ff4d9c5cf0f68e57934947709c78963", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234207, "uuid": "dad79c1e-d30c-4816-87fc-dc7b87d2be3f", "value": "T1E92114B7A191E873F61204B659926F4F6B289CE19122FF0A8F511D13FD392E1D231364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234207, "uuid": "6d199ec9-97b9-4004-8a6c-a9d9ca3b32e6", "value": "24:FlBqN8zk0ee7FAul6ZSiSZw0fGywfYrGuWppNlbxPySuluoFvaF6YNzdSJ:fUNhGzsSi0w0FwfYrSp5bxKSu0gigYN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234207, "uuid": "decb0130-9e6f-4562-8d33-3aa201511d20", "value": 1384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234207, "uuid": "c48cdb69-70f9-417b-b19d-bf1476f8234d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234207, "uuid": "f45a3851-8d56-479a-8c71-960eda6a595d", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15aab56b-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234437, "uuid": "f848e44f-dff8-4e05-b13f-810cb1b6f1a5", "comment": "Malware payload (Mirai)", "value": "eb56654f8e9a3ba359a437b0d57b3c15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234437, "uuid": "680efd30-05d8-4ff0-9c27-e1b122947030", "comment": "Malware payload (Mirai)", "value": "4833a373895b8a1fac11587e2c1209eba927a8786e38dbca6922749321629ee9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234437, "uuid": "3fc34a5e-8e54-48a1-964e-e392fe61a690", "comment": "Malware payload (Mirai)", "value": "8b37a431d954558c9040007d6e1ff422f0111e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234437, "uuid": "d0610950-2695-4946-b6bd-9679b3b23601", "comment": "Malware payload (Mirai)", "value": "a7177747952fab82e82433f3dea9bf2851cb42fd5636fb4ac9cb84abc5386ecac7503d7f7de34fe95d211f3481452494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234437, "uuid": "0a15bdd4-2ec2-48fc-b205-aa01f354e945", "value": "T1A003F1B4401528C8FC6FD8FAAEEC07802FF64FA19822C8977C9AD962E8751719B535D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234437, "uuid": "a9bca9f8-dcb1-427a-98c1-77c31bb3f00e", "value": "768:DLaxoPjWS2dgV57DRyi+/u1/eJa8RWYEc2qkO7nkR92hopbI7Rid+BvoqkVYVoJa:DLaxoPjW65Zyho/eQSMOO92hoi7Rid+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234437, "uuid": "884789fa-994e-45bf-8617-8d440399be71", "value": 40788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234437, "uuid": "7d24baf6-86ad-4803-ae7d-eb9353896f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234437, "uuid": "31bc0af1-5318-4e56-9f91-c4d6e6cf96b0", "value": "firmware.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ac680d-ddfd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274326, "uuid": "9b714fdf-cb7f-47b9-b146-4eefe27d72ca", "comment": "Malware payload (Mirai)", "value": "1e3b27427b57884fcdcddfdaf8bb0ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274326, "uuid": "7cc9e609-5449-44df-8482-a35ad6494bd2", "comment": "Malware payload (Mirai)", "value": "4a80f20ffe3764bbbd5147c2a6a2782e5c4201ee5b652d3195ca258c8b0280e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274326, "uuid": "55efe3bb-a8ec-4585-951e-476e8042d751", "comment": "Malware payload (Mirai)", "value": "a993060b0d087b797ae494f3f08f2ee74e840004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274326, "uuid": "8f3cd1fe-ee79-415b-8764-488bb254d574", "comment": "Malware payload (Mirai)", "value": "a8bd8be7a7277a6236072106811cf0f49ada838e21f44134c9b55fa2b8e3d23d32a7ae16af7bf960dc337d1e7d994260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274326, "uuid": "5632989e-f51c-42a6-804f-55af136d7655", "value": "T102737BC0EA43D8F5EB5335711137A7365632F7391129EA43CB68EA33BC52201D5A6BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274326, "uuid": "4ecd667c-7026-49e5-a0bb-bd048c4ffe40", "value": "1536:W3gZy7h5hSebHcw2Ug61h5Or/0SaOUfgctOXHK8VdxnanzFEhOGYLHhByS/ZFA:W3Oy7h5hSebH5Rg61h52/0SqgbXnVdFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274326, "uuid": "889fb370-1250-44a3-9058-bcef74cf7be8", "value": 75568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274326, "uuid": "bf2c3b81-f97a-4a8f-8977-23bc463b3100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274326, "uuid": "4723549d-df8d-4ac7-b650-d8d42f83d873", "value": "sdxkzX_UXA229x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bda151-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235833, "uuid": "049e2e78-1449-4722-bdec-fd5ba043228e", "comment": "Malware payload (Mirai)", "value": "75fcc0be958aa4186f898ea7a351e312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235833, "uuid": "8d08368b-8bf5-4c16-8d2c-08e6e8d0ba8b", "comment": "Malware payload (Mirai)", "value": "4a99375248678d3f9d7391d7756c0bff9a1c24b293a2aff4444b5b1ac8a2063d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235833, "uuid": "e7422f75-81f3-477d-819d-a099e8d4a281", "comment": "Malware payload (Mirai)", "value": "51a5fa580df96d96111c4e0b11accab3c50167a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235833, "uuid": "7414aeb1-f48a-4876-b583-8beab0ac9fd4", "comment": "Malware payload (Mirai)", "value": "6841e7fcc1916429deaf4f286e7fce308fdd9cc12819931b1f047b462888baa847fabc5125a6f966d14611db5192a204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235833, "uuid": "5a04b92a-053b-431e-a1d8-bd46b1e7b0ad", "value": "T169933B56F9818B21D6D112BAFA1E118E3313177CE2EE7212DD146F6477CB96B0E7B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235833, "uuid": "6f4fa9e8-48f6-4d78-a6ea-bc986ba7f368", "value": "1536:4nsnAO0Y+Y2KHICj2XrMDemJZt0au5x8WCBD1iVfhGSgVA7pR5bY1gbN:4fOxtoI2XtyZt0aunfhGSgVAdR97N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235833, "uuid": "39e68142-229c-47db-a9f5-788939995802", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235833, "uuid": "8e6722f3-bbe6-435c-a567-279a73ba6463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235833, "uuid": "c6079382-cf5d-485f-84a8-cd4057f46a4f", "value": "narm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da8f117-dd3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766191715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191715, "uuid": "29fd85be-77b3-46ae-8aba-b2d5f7f7b98a", "comment": "Malware payload (Gafgyt)", "value": "71f3516a46e3e08c5a75c46fd2d9f8aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191715, "uuid": "eec200a2-b121-4d82-b716-a2a503adaf21", "comment": "Malware payload (Gafgyt)", "value": "4b300071c641431d957ff346721775a0790856d5dec8f9310d92d7a732908c9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191715, "uuid": "fe4495fb-0540-4eea-816b-a671f247c93b", "comment": "Malware payload (Gafgyt)", "value": "4429af1d906c17c2c18b4a4c398081fde61f9b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191715, "uuid": "d5c3074d-0255-4740-9361-207126a96b81", "comment": "Malware payload (Gafgyt)", "value": "6469631f02a2d83a4ab27103106c0f8ba4596ee2a5e086a0be85908b3746027eeb8ec909c1860f0f87fed8086f3ce6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191715, "uuid": "86092601-c835-4e85-beec-ad824f88a4e4", "value": "T1A86629D7B8924942C4E43777A8BE81C832631EBA9B9652176D05FE3C3EBE1D90E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191715, "uuid": "2b0331e8-b6cc-40de-a06e-e3d7d49a778c", "value": "49152:XibEnIMQzhoqn6oIAcRLSX0PNW5mwXnR13E5lii5ohpo0b32Z5E2j:XiHiqn6ogReXbi5r0bSE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766191715, "uuid": "f7ccaef2-c742-496c-ae75-5a659e012781", "value": 7078036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766191715, "uuid": "a0dda2a0-a18e-4998-b545-b955a5ce7eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191715, "uuid": "ba9bd5be-e0da-4786-857c-57cbccb8c7a4", "value": "SecuriteInfo.com.ELF.Gafgyt-KS.24259946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f9ef00-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234917, "uuid": "50382471-67d0-4135-9baa-c9c720b17937", "comment": "Malware payload (Mirai)", "value": "91dc4ee98b47e184bbdcdffac0702e4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234917, "uuid": "a2dd554b-ca18-4f4d-b2de-ae5b9aec8729", "comment": "Malware payload (Mirai)", "value": "4b605bd2301c926b48ac9ee428bcb34110fe7b1f4abf26b15ea0afc8ab2caa36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234917, "uuid": "11f08e70-96f6-4dcd-b50f-6ded6fc822b8", "comment": "Malware payload (Mirai)", "value": "8b187aa65d37fa43957cbdb05d5a0b98bb7aaf07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234917, "uuid": "5d10b88c-909b-4401-bc92-c666571b3d37", "comment": "Malware payload (Mirai)", "value": "b4bf5c72992326d356480a7af538fd084a705e598603a40888636182ce47ff4ab2cd17f0426391db1faa4c54e2baec75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234917, "uuid": "7119a398-763e-459a-a252-28c8cdaff9f0", "value": "T1F004885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234917, "uuid": "b659515a-715a-4c52-ba5b-31a319b93b22", "value": "1536:Cl2JvnXPvLYQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/mcwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234917, "uuid": "530d197b-833d-48e4-ac9f-011f02966238", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234917, "uuid": "d066a2c7-a215-47bf-a015-0a3de964ab3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234917, "uuid": "a84aed1b-ee82-4837-b4b9-5a4e1ddd04fc", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc89e4d-dda6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766236757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236757, "uuid": "29d1418b-67d1-4158-935b-94dac4974646", "comment": "Malware payload", "value": "f24f49824694eed3fd192ec2f9c8d5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236757, "uuid": "c011b151-6ea2-4873-b591-9122854f8fa9", "comment": "Malware payload", "value": "4cd9d47746ac5933f995a0195a9e949fb83ac4ca2bd3dcca613c6c50c5716c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236757, "uuid": "7b49675b-c531-4359-aef0-fcb37bbbd7d1", "comment": "Malware payload", "value": "fa73573d21d95d16b705795da99d03177e65340d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236757, "uuid": "2368e06f-bf6b-41ec-9bd3-a9ecec1f70cc", "comment": "Malware payload", "value": "10f6ced1dadb69a2faa2e5b7d0b9b89ff77c288d2a8631bf02d8ec5450ad75d8d5465bfb8408c2a5107348cea6f35de7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236757, "uuid": "0bd3270a-95b0-45c4-a4e7-c15f43cfb85f", "value": "T105C44B90B745FDFADD894BB408D2230963B9F081971AEF2F1524FE3C0D1AA98DD6354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236757, "uuid": "0aa37c73-12ad-4a70-894a-57096e82cc35", "value": "f6c6664bb867c792f57d678384cc96dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236757, "uuid": "44bfd779-a1d2-4ef3-a9c3-09e2ca3a169d", "value": "6144:Q7Noef5vmAvSGS+kKnkw2Rux2dKVuxiEWHysiLRq3vuL6JkSTz+CmogOKCetNDe3:QR5M9gkbIUkruD1qjpiVBhcsiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236757, "uuid": "266fc8ba-a42f-4b78-b5a5-e0927533e5c9", "value": 583379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236757, "uuid": "492e287d-02c3-42b4-ae5b-f81a7557c7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236757, "uuid": "d725991f-76e1-4456-93e3-0281c879f06a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.85996882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e2cee7-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766198041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198041, "uuid": "363d7863-f5c7-48a5-b510-655017ba29f9", "comment": "Malware payload (Gafgyt)", "value": "b32bf56dc072e2e8ab00751ab489679c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198041, "uuid": "5185909f-0bbf-4f45-b0d5-8f218abb222e", "comment": "Malware payload (Gafgyt)", "value": "4d11a8ae8db1635590242d1663ee72af5d9ede563cd8c9f2bf819aabb86393a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198041, "uuid": "7fcd8d9f-ea2d-43f4-933f-790f96336c88", "comment": "Malware payload (Gafgyt)", "value": "12a73692c872a33fe0d651b047933782e3b1b7da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198041, "uuid": "46f2965c-68f9-4e96-8b72-38e78590db9a", "comment": "Malware payload (Gafgyt)", "value": "22ec59d6713d8081237380707ce65d66a400c84767b74890dd43f202e7f80573a018727782f19a47f167e885e2536afd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198041, "uuid": "92f724d1-bda2-4714-8133-afdc9bc1d4e6", "value": "T1A1D3087AF800CFA6F00796B604DB8E216D30ABE30F936157636639679E731D53863E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198041, "uuid": "d7b63b79-3c8c-422a-8879-3b24e632328f", "value": "3072:omRlpqylfbuquNtEzDpzcWrfmZE4/hy99OJ3twqJB7mzj5GDJZ8y2PU:LRXoqf/pzcWrfmRy9YJ3tbH7mzj5GDJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766198041, "uuid": "5d930c9b-a463-4370-90d9-392c2d9ce8dd", "value": 142898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766198041, "uuid": "bf372e60-56dc-44cf-9873-090bf6234b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198041, "uuid": "6c24d6cd-6a18-4154-b933-8c3de5b3d495", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d1607d-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766266200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266200, "uuid": "180be112-8a0b-4b14-bd9f-e958f3f8ad26", "comment": "Malware payload", "value": "c4f898bbd39294241d3f0f2fb80597b9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266200, "uuid": "81003bd3-91fc-41a6-a659-5c8a377f8b8d", "comment": "Malware payload", "value": "4d1a6285532e4d903786e43ebf431bfd87047732e288da84e7ec76941b5392d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266200, "uuid": "53ee4be3-49b6-465c-912b-92f47cd2531c", "comment": "Malware payload", "value": "f9ce899dd639dc945ee0f0d3bf0c63ce8e6e5bc2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266200, "uuid": "40ebfd37-4596-48ca-8ba5-4bacad9a5b3e", "comment": "Malware payload", "value": "dde5a7409e080519edd8ee448fd32fc0c6c54ab1dfc7fab8ad0128fe7e1adce25deedd7c89a8c1e62f642198dd8b3b0a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266200, "uuid": "5d512d19-03ad-4a69-92f7-62466ca36501", "value": "T165B3013B4B2038DEA338FBD58495A5A80F05FD66F5A946B1319BD10402BB5D83DF98F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266200, "uuid": "3da736b0-ba4b-4ee1-b452-4ebbe094725d", "value": "3072:Vr4DDc3yUwSgwGr7gohcra1RlcHpCkV7XTjGuY:VkDDcYXgQX5y7X2uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266200, "uuid": "9fd244b4-51cb-4dd5-8b83-0068766e25c9", "value": 113331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266200, "uuid": "4d789d32-24dc-46f7-a32f-db3e55e299ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266200, "uuid": "9a7c2916-612b-4321-ad41-21502afcec2f", "value": "off.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f76626b-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254344, "uuid": "d6d989b3-333d-4cd1-a363-70068c697aff", "comment": "Malware payload (Mirai)", "value": "e4f95f18b16c3c00ea7d4c87ab8c2f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254344, "uuid": "271b5dc3-1231-486a-8cc8-fbc04d0880ec", "comment": "Malware payload (Mirai)", "value": "4e3ee62bccb45ff02241eaa36e9b5a1c312f55dc561f1b07ebe6bb48e5850cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254344, "uuid": "37c593c6-e611-45df-8d58-ddfad9299345", "comment": "Malware payload (Mirai)", "value": "4482d5c802bfed6d40802bc39f52487152a09409", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254344, "uuid": "ecdb3c74-c71d-49f6-a0c0-1653329ef39b", "comment": "Malware payload (Mirai)", "value": "f328687e90e52b7805be896f5213acadf4bd155f20d3631e926ee0f2ed19c92e9380225faa0e64fc6a6af05b7542d8d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254344, "uuid": "ebde0868-5fdd-4e13-96cf-1953b7f0e1d6", "value": "T1B7042B46EB414A13C4D227B6BA9B424533239B64D3EB730699287FF43F87B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254344, "uuid": "cbd809f4-cb3d-44c4-8c52-c2c66f709529", "value": "3072:npoGm6qQdztpa1g5rvJ1/IR0JLEoQ8pnPkXu7SpbWM/93v0OU:poGHhpaW5rvJ140JLNpPke7SpqM/9cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254344, "uuid": "3113746a-7887-40de-b60e-397286d95f77", "value": 177811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254344, "uuid": "64e2bbfd-aa5e-4a9a-a75c-affc04842e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254344, "uuid": "423d525e-d019-4dae-91e5-59e9bad56f19", "value": "v0nnog0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46247c6-dde8-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766265305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265305, "uuid": "82370d25-ac99-4ddd-bd0a-fc80f278dfcd", "comment": "Malware payload (ConnectWise)", "value": "05bd3c0d66ac1e62016254a5bcf91297", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265305, "uuid": "95d84b72-0c41-40b4-b425-0d9a9e18c4ff", "comment": "Malware payload (ConnectWise)", "value": "4e6c8dc6009f98c0e14ed3f67f08400244452ec3278c563e83e204c08737728f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265305, "uuid": "a78c497d-f1ce-4f36-a57c-b81acbfceafd", "comment": "Malware payload (ConnectWise)", "value": "66b2e8c05a0deee924c0c46c12aad65d92cbee1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766265305, "uuid": "69a4e970-28ed-46cd-ba84-7aad50117def", "comment": "Malware payload (ConnectWise)", "value": "2961ea8be092069c032818de9df840f14132dbcb43ada8ee6f75c04ae34e4f91fc9f97816f5b9917436a387f91121556", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265305, "uuid": "a00f7253-10e5-472f-83cf-8f5648e79fcf", "value": "T16D41A585C6319592E42D78745512D9E4BF2F4396286A86663C63E0274D8FE0C3B8619E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265305, "uuid": "af177a19-e9a0-44b9-8c65-2d0c0aae9bfe", "value": "48:81cWHkOZGyShvx2uCw914VHkOZGyShvx2uCw9hAaUYie:uShvFqShvFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766265305, "uuid": "ff8ae5ea-b631-467a-908f-ef9164adb61c", "value": 2118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766265305, "uuid": "32b8adb8-1015-40ad-a4a3-5b05ec4841c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766265305, "uuid": "5aef1cdc-cd8a-4f6b-b4f4-b1a4ecf5d304", "value": "Product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e92a18-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266352, "uuid": "78ae234a-3365-4182-a186-1fe2d1b7d3d3", "comment": "Malware payload (Mirai)", "value": "4dd1f9203f9e28d7727861e04d8f3ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266352, "uuid": "3066c0a1-e1d8-4045-9099-fb772e21ec85", "comment": "Malware payload (Mirai)", "value": "4e8f0ba152cffbf54a5c44fbd3253a3979326bf455120a6bbb6e749a090f9fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266352, "uuid": "aac3f430-03c0-46f1-95af-71a4d6eea4b0", "comment": "Malware payload (Mirai)", "value": "ce590e0261604d90e306c08af042dfcc7b914cb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266352, "uuid": "32e49a79-8be9-4461-b1e2-eb2106e92cba", "comment": "Malware payload (Mirai)", "value": "5a0629cfa382473ecba1c2d4b95dcd7e8fc1dad4dc2cd9d1e8bf2aba628910847480448577177c0d44e82785b29c4ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266352, "uuid": "34075e3f-5cb5-4c41-bec4-bbcec3b60918", "value": "T11ED33902F48DC0FCC486C1341B6FAA3AA935FDDE123CF2A767D0AB126D8BE61591D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266352, "uuid": "024d5f73-a97d-4359-8e28-9ade7734fce8", "value": "3072:WuFDnONmxGrw5oqs+/Yy4210G46nhpvIzxwprXcGzQH1XViDut9K:tONmxGrw5oqs+/z4210G46hpvAqjzAFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266352, "uuid": "43174279-a816-4006-9b08-501e2324e085", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266352, "uuid": "1f2ac131-8976-4d5b-a05d-bed431423c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266352, "uuid": "ff6db3c6-8e39-45f4-ae7d-1ace844ca42c", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3017bde-ddc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766251102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251102, "uuid": "3f25edfd-069c-4d7c-bc05-5a200c51361a", "comment": "Malware payload", "value": "f1cdd00c8d74326d89a03b671758a8c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251102, "uuid": "5b4f0b07-e82d-4613-85a2-010aa1888547", "comment": "Malware payload", "value": "4f039c90a185cf2b4e09111403b53acc3977877cb0c0da4ff115bf7add684b50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251102, "uuid": "1e0fd95e-b3a7-48a6-a1a8-255e23442333", "comment": "Malware payload", "value": "56f8107b9028aa7c7694ce1549b914b56196a013", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251102, "uuid": "517e1873-2956-4e60-901c-df546da1d66a", "comment": "Malware payload", "value": "09a8864fac94fffbfbe017dbe0ae7e76732fda7f2ed57701f8140751855dde38763fb99f321a2fc44ebf019026bebc3c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251102, "uuid": "9089cd9a-da01-4ddc-ba56-ead4a065b102", "value": "T166A42870CA2401774F83AB98BCA50661C67DD329862705F1F6D98B0D900E9ECF7BD66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251102, "uuid": "8a4a4e61-ce3d-49b3-81e8-ad304af5ff16", "value": "12288:n3qi0Tcx/WcXjohn6jBQwrWV5MqQk3RjU4/x4zv8yu7AXcGUB:n3qi0i/WcXjohYB5WV5MqQWRjUmxAvDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251102, "uuid": "910db59c-2f24-40bc-a7ec-29ac40164228", "value": 456779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251102, "uuid": "ade9dca8-b48b-4fab-bb2e-8f1b28493a27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251102, "uuid": "d8705a4c-cf64-45d1-8fc5-764ddba5ccf8", "value": "Payment_Confirmation 900120251865 Remittance_Copy_2025-12-19_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44364f2-dd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225791, "uuid": "f05da81b-8fc7-4db6-b7e2-44f16e54166b", "comment": "Malware payload", "value": "4d07f872c87152e0c9a2e2699f5371b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225791, "uuid": "33c450e2-f971-43aa-b33c-9bacf8ffc02d", "comment": "Malware payload", "value": "4f6ff3e84e0e766a3741637c53e745fefd72f7186fd617b10a98c27d794dadab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225791, "uuid": "a101db28-71fd-400d-a2bb-c8cbd99e83cb", "comment": "Malware payload", "value": "a58fed9f356eba05a480be4f9bd6bdaf01cc1f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225791, "uuid": "17d26cd5-177b-4d90-8e56-ad1fbe34c2b7", "comment": "Malware payload", "value": "4cd68637a9b9b66e3a3ffee985e734f0605604dafb5e3119a8f38620ae94ce11bbd13d997b770257083a77253a91a283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225791, "uuid": "2c0c9585-1f4b-448b-9944-718eaf85145c", "value": "T119E2E1413BFE629CF0E26EB622E49601E17EB55A5D4E83C92F05805F19E095BCD37E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225791, "uuid": "25d1a27d-8615-4687-b74e-ee1794fb123f", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225791, "uuid": "f628e035-e99d-4a42-ae8d-0bb3eacb478c", "value": "768:GA9wAsk5uWLfuT98npCJpkoar+XqAjNVXxJfBQe0Dq:GBARu8uhfpkFSqAjNVhJ5Qe0Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225791, "uuid": "35b4ecf1-0587-4207-a554-44c876fff5a5", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225791, "uuid": "d0cf5743-85cb-4bde-ac84-0649f5eef319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225791, "uuid": "610c5ecb-bf63-4356-b14d-8e9c381f30fc", "value": "cbot_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a34d26-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234492, "uuid": "f42028d0-9afd-4993-b3c8-033acd83673d", "comment": "Malware payload (Mirai)", "value": "0fad99a1db3f7e1929a56a2f35d1d0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234492, "uuid": "6be865d6-7287-4350-a53f-8d7b3747245f", "comment": "Malware payload (Mirai)", "value": "50241aa393daa2754112c8e36d30c36855eceaae10e3e9a908044dca7d5c9d59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234492, "uuid": "1bee1655-3f80-4057-9887-f81b8ad64702", "comment": "Malware payload (Mirai)", "value": "868bc3c5f4fceb5ea3930ccea305cf399e3d74fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234492, "uuid": "86042413-5463-4624-b17c-b3d44952be26", "comment": "Malware payload (Mirai)", "value": "ef05547ac6f80d0c86a7b50aaa5aee5e0c0c2e2f49970293cd2aa91aa824a8f5de779a630ffe06d626c7e4303086dfaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234492, "uuid": "748a4927-18b3-45a9-a59c-162513a1248e", "value": "T16BC2E79679811A2BC4C0137AB92E478D331167F8E5CFBB17FD0516443F8AA4B8E26B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234492, "uuid": "4950bd14-8391-49e0-84d9-5fe9df2a007f", "value": "384:vLpWJnTWEI6EX/CBLyHrkEdudWml349egchus34HxIUvqhOZjrxhzrsSl65Dw0:z8JnTa6W7HrdodGe9kfOUxhzs5Dw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234492, "uuid": "52cac144-177b-435a-9a85-a8a260a6cc83", "value": 27256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234492, "uuid": "d8e74096-3684-42c7-bb8d-5019ea36bbab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234492, "uuid": "b2aa576f-774a-4e1f-a4e7-a6032e631bd5", "value": "firmware.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa0aaa9-dd8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226078, "uuid": "9598695a-4b13-4fc9-8453-0bede711e779", "comment": "Malware payload (Mirai)", "value": "9564c820d0d12e831c586575502b570a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226078, "uuid": "b838fea2-9c57-48f0-b877-36d9ab2fc3b9", "comment": "Malware payload (Mirai)", "value": "510e8f1bf22911649dc9068d762d5d4ac57f9de2bed5452be462d7613a9102c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226078, "uuid": "1e3d0ce2-fe53-4488-ab18-10ce05c47aa5", "comment": "Malware payload (Mirai)", "value": "468537148ec5a212363e215519e66e7c5f2b19ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226078, "uuid": "8d20b77d-1045-4df2-8ac0-e6b13718c988", "comment": "Malware payload (Mirai)", "value": "e60f4ad7243115068ce4adc5019d9609a4c584aab002b0637943083bdd1be6245dd20b8cfa4756b2dbb78148f579ef55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226078, "uuid": "de6b7837-bafc-4c06-ae4b-bed32f0755cd", "value": "T118534C89F783E4F0E84B0570105BE77E9B30DE162128DE2FD794B973AD32A13A51A61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226078, "uuid": "08c9b076-d04c-4b7b-954c-33bff3cff53d", "value": "1536:PRArLvSiKJS9k+8OsUZ31gJ7Bi0Bqlyxr:ZArLvLK6KLidgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226078, "uuid": "2ca9565d-54d4-4dbf-a232-27715ab06485", "value": 63372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226078, "uuid": "8d80ecd7-f634-4701-9533-73a1bfe7d048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226078, "uuid": "af1ca60d-36e0-4b1c-aad1-6ee00f24a912", "value": "firmware.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ac6f31-dd9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766232314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232314, "uuid": "71a5a5f6-0918-42f6-9bbc-9241cd14f78d", "comment": "Malware payload (Mirai)", "value": "3a72ce32210e3d956487b55bb5c4ae80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232314, "uuid": "2bbb1592-8b96-4d50-81e4-af738722e18f", "comment": "Malware payload (Mirai)", "value": "517886e0b08431ea398f235f2ca898f5dfae212184748ce881a3b92a65b55d9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232314, "uuid": "a49bb211-86d4-499d-9bc1-4e67df038f44", "comment": "Malware payload (Mirai)", "value": "c1aa008e1b568639b4887d3878dac13735eebf49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232314, "uuid": "78facb14-9d0d-4c75-955c-aa4f011831c0", "comment": "Malware payload (Mirai)", "value": "c340685d9382126b369856a8598ba703a61d9f5f479153a57a750a7e48bf468f98533d9affbc3c4f4fa2cba42d27524e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232314, "uuid": "2d39f84b-86d7-4383-aa6d-64aeac1f5d4b", "value": "T10CF2E1E6FC17C60FC0E8A63C9B6C40FE1AEE95C42695D11DB466DE618377CA3693081E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232314, "uuid": "130f10de-b9a4-4ec1-897e-bb2aa1f08d83", "value": "768:wyUFOMfGyQMofYkJ0lVXkYgfJGGVuy15+OmwL+9+LvVL9xryRsEX09/Y:wjOM+yytinXtgf4Gr15h7+92tLryx09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766232314, "uuid": "b842e2e4-b0c5-41b6-851c-eeb5d818681f", "value": 34856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766232314, "uuid": "adc9c5b3-2eb3-46bf-9d4e-e950c11db665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232314, "uuid": "29c24337-0ce7-49c7-b5ca-65ea5c4c70a4", "value": "firmware.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac227c4-dde4-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1766263517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263517, "uuid": "a97619d8-cc8f-4b52-9d8f-bcb84939e35d", "comment": "Malware payload (GoProxy)", "value": "19d06512b780104b672c723f83b487aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263517, "uuid": "8596adc1-2faa-4c01-8191-940aeda31a8c", "comment": "Malware payload (GoProxy)", "value": "52ebbee0e3240dc3de522f80be144b7263056186d8bc7d90cefd7cc4c8375462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263517, "uuid": "6d5be824-09d8-4c3a-9189-80becc0dbd95", "comment": "Malware payload (GoProxy)", "value": "c2ac76fb5a4ea225b227e054a30ffbda9d5518dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263517, "uuid": "fea77553-08a3-4b0e-94e6-ec85b6423e68", "comment": "Malware payload (GoProxy)", "value": "a303113ade9dcc2be444ba3b46274fe6d25929b77538a6032d370954d955afa5d15e46959b2611ffc18748a9c49336b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263517, "uuid": "d0bcaf4b-c83c-4b82-b8cc-a75dc3d0fb24", "value": "T18B664B07ED9055E9C0A9E2348A629252BBB17C485F3123D73B90F7382F76BD06EB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263517, "uuid": "9087e1d8-f2d1-4e2e-9506-6fed08c0501b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263517, "uuid": "4f1d74d7-6519-448a-84c2-cb80bd5ec668", "value": "49152:rXUjfmxeGF0XeIpYZYN32iynOBeoE8GFV/36/daRSjp7aJvT8xojuOG9XUSSfKi6:rk0c1ed8436laNJ4debSmEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766263517, "uuid": "7978a339-9db8-4128-a8e9-6ad274b51d78", "value": 6692208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766263517, "uuid": "0d524d82-dabc-4606-bbad-36c7d01c01c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263517, "uuid": "b8a37c47-cba3-44cb-8fb7-7f78084c29fa", "value": "19d06512b780104b672c723f83b487aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c170fee5-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766254482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254482, "uuid": "dd67b419-921f-45e4-8be1-02c2249cf355", "comment": "Malware payload", "value": "2fd9338041ecc38116d9606cf76155c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254482, "uuid": "ae328ba6-4e17-443c-ad2a-732e275d936c", "comment": "Malware payload", "value": "5379e5da6c6eae2eab376717f13ec203dea2307167bbe32fbd2156deabf1d356", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254482, "uuid": "ac1f6363-d519-40b0-b9ec-4cbd4ee2ec7e", "comment": "Malware payload", "value": "8cf69841237306089b12b37e3d9fa316315288ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254482, "uuid": "c35ea553-8509-4409-92e5-c30ffbcd3376", "comment": "Malware payload", "value": "e79dd6b3b773744de1e85ad6859640c063ee367148f52414ab8a1ff2b0b131c7ec14af0d3303e632569152159954729c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254482, "uuid": "6ca4b2ac-4f7f-48ab-b77c-8134ef78f36e", "value": "T174D12FF2B4851BBCDE9FCD3E9151297D108AB9DB66870D6487AE20657C89FCD2C409C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254482, "uuid": "83efcccd-fa7f-4b77-9cd2-c8e6e5daef92", "value": "192:oJ3mB/oOBqELp83RcC12w2k7saCgnAOBPOZHBPOZHKofImPNwDtgGpismUr8KTxq:oJ3mB/oOBqELp83RcC12w2k7saCgnAON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254482, "uuid": "feacdb1e-bffd-4b98-bbb8-56d5b48984cb", "value": 6359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254482, "uuid": "62c51199-fc25-423e-a79d-1e2ab72a4e27", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254482, "uuid": "9e986503-ae71-4e86-8fc1-f9fdc43894cf", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1577f9-dd50-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766199796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766199796, "uuid": "5f5bb79a-6887-4380-976c-fa1b1384d8de", "comment": "Malware payload", "value": "f628358f6e0d5cf8dc16061d146227ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766199796, "uuid": "75414c75-eb34-45eb-be81-13c10fdfb7c2", "comment": "Malware payload", "value": "5470c2d82bd923626047020a1c8c4a807e98d174a69771cd29018b121c9ba881", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766199796, "uuid": "bfefe2e2-aa0e-4ee7-b273-54e3d3841bf0", "comment": "Malware payload", "value": "5ddb3eb3968630dfd45168d126720618fe127da4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766199796, "uuid": "ba660374-7975-47e7-94a7-8d0a40fa0c26", "comment": "Malware payload", "value": "73d85df683d5086e87b4fc960d92ce060cc8e03f571e4f62e9a2740f99f7cc5adf983294fbdbd757f7bf915583545552", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766199796, "uuid": "7ea3166b-07da-46e6-8bb7-02bad3234427", "value": "T1B8067C53ADA08A98C4AFE33DE8A261D6B7747808433137D35F902A761D773C4653BB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766199796, "uuid": "5bb9ef17-637f-4a58-b317-b62a8081d8a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766199796, "uuid": "cf575463-faf0-4bea-bba4-4f66139dfb3b", "value": "49152:vCNU+5PYDENdfhR1LrB5sdm0xirjba+/:vqWxo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766199796, "uuid": "b5302d3a-a043-4bd3-8926-3a3618d9110a", "value": 3954904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766199796, "uuid": "5b2ca158-aead-453b-8cbb-c809e9e887ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766199796, "uuid": "c93ae914-caba-43c0-8099-5c4538433f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355e678c-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234490, "uuid": "408abfaf-5c68-4d2b-bc4b-619816efc189", "comment": "Malware payload (Mirai)", "value": "1a786de08269c8d41007cf3f1c77f3f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234490, "uuid": "cce6c780-b2ff-41e4-aef4-2c32ec92e9e9", "comment": "Malware payload (Mirai)", "value": "54c4f3e7089343a283ed87b490f2fbe13e13f0345449f5922c9490fe9117a500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234490, "uuid": "c35445d6-6b25-48c8-b282-7a9da3b52f06", "comment": "Malware payload (Mirai)", "value": "617d532c995c33c7837f4813556a141d6f8389a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234490, "uuid": "bca12e23-0e5f-42f6-ad39-0961390dc020", "comment": "Malware payload (Mirai)", "value": "3b35f75f17fbc8bd71a3d40a99baac8c887eb797b52531f48c0f8d7190c7504c559f575c45c98916616485399f824e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234490, "uuid": "9fc31a19-1a8e-40be-b119-e7a0d743ce32", "value": "T10D832A86B8405F26C5D016BAFE2E528D33131FB8E2EE32069D056F7477DB95A0E3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234490, "uuid": "387fa174-6690-48bb-8979-09434b564d78", "value": "1536:7Tn6TSrVLQKWpidXuyoSvibkSXw/fY8KEcsBOARP1zLHKbbjXJu+39JYIGYwCr:pVQ2XjvibbpDbAzzLHKbD9J1O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234490, "uuid": "0eb43653-953f-43ce-b2a9-7f3ee1487598", "value": 82648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234490, "uuid": "7210e354-3c04-4947-ba29-831e517f1ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234490, "uuid": "2d4baa90-a77e-43a8-bbf7-3de94f9d4781", "value": "firmware.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73e72da-dd54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766201636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201636, "uuid": "2c2c0d63-d538-4d18-ab0c-8ab07535f127", "comment": "Malware payload (Mirai)", "value": "744a36be29a9b7980fb6c75677ec7749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201636, "uuid": "5bab4512-c44f-407b-86d5-1b696a9cb244", "comment": "Malware payload (Mirai)", "value": "55bdaa3a8a9608985b07865783259092d37736f52066f94df42f2a4c9820b026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201636, "uuid": "942e3388-e6a4-43b7-9974-58223117a6c4", "comment": "Malware payload (Mirai)", "value": "d969fdd093f364485fbdc0569e84c5b1aa507d71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201636, "uuid": "14fe9fd4-d058-41c9-905f-f8daf5044867", "comment": "Malware payload (Mirai)", "value": "1e0117e206a266dba991f8c60b04cc84780017c0f7d6a9b317e2bc8b364ffc0970e254296533caaeddfe268fadb86768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201636, "uuid": "b9bdbf75-698e-4256-8453-a921463af4be", "value": "T17713F268D2506EA7C9EFD4B0ECA826C1B7F22F55B2A6DF92718AFD009F0210D11C1DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201636, "uuid": "337d51da-179a-4ffc-8859-a3090f80910b", "value": "768:I3R6OSO/wfEg+0LHJtp22AbGI7f2XhS9L1Sdd4Ux9+vLm5AX2BFA4uVcqgw09T:TOoAa0f2k9ojx9+K5QyA4u+qgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766201636, "uuid": "1a278985-0fcc-491f-a51d-5b64d3922577", "value": 42236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766201636, "uuid": "48c958cd-98ae-4a59-890b-f3b3bc4f6d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201636, "uuid": "3a3bf695-a7bf-46fc-8f2d-ad5364940a11", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202426b6-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226294, "uuid": "18181000-61db-4c0a-ae0a-33bc87db4493", "comment": "Malware payload (Mirai)", "value": "33a43da28195d70f7973b007033448bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226294, "uuid": "7a108070-93f5-4764-a720-61d082f55964", "comment": "Malware payload (Mirai)", "value": "56318c2a0f1b329cc9be2c06e99d9902e3ca0bed7451897d313e9377c60a2e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226294, "uuid": "a0ecbc03-3ac5-48a0-8c57-c36f45f9b0dd", "comment": "Malware payload (Mirai)", "value": "d18f5f1621fb6171164927923480c112a4e43af6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226294, "uuid": "94c79e48-fa03-4488-ac76-013f7b73420e", "comment": "Malware payload (Mirai)", "value": "a0064842fd33e9e3c942958182eeddfd1c63b66484e012d5f736a77f261ef3be37fe28ae48195b381c94b9d6f408b9d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226294, "uuid": "93753066-8b54-46b6-995d-4ee58959b28b", "value": "T128635A31BA721E27C0D5903A21F74B25B6F153CE25A8C62E7DB21E8EFF20A4065479F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226294, "uuid": "8d18e638-5041-45f4-9879-95d253568d35", "value": "1536:Gaz5p5zwnq3Yzv1sgQHUZ75ZdotD3gwbZn2H:FGgJ0ZVZw3gwbZn2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226294, "uuid": "25ad5120-ebb3-4fec-b843-f024769bb540", "value": 70488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226294, "uuid": "67eaeb2e-4005-4c3b-b6d5-c7c3e501c01c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226294, "uuid": "758c030a-8ea1-4744-9c9d-fda57df874f5", "value": "skid.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5428f964-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235830, "uuid": "7cd2c251-deb9-4ad3-a32b-660e93092083", "comment": "Malware payload (Mirai)", "value": "2290c3df3ee9762d6dbcbdb933fb5024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235830, "uuid": "87983b4a-2295-4f02-9e48-2487834eeef8", "comment": "Malware payload (Mirai)", "value": "5647222a1229e131b820255fbb675e4056d6d05714cc10471ca1ec32ab290995", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235830, "uuid": "48b1649b-9486-4663-ba79-12f551bab694", "comment": "Malware payload (Mirai)", "value": "15bf76a3108d2ffff75ab53544078dc4dda8498b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235830, "uuid": "16e54ff6-84d6-426b-945c-9db33586ce05", "comment": "Malware payload (Mirai)", "value": "282b2b1475625786987d80c912c0bb16e604661009a1882fb4b82c14c22367b544c19c32bca8f3183e78116c94e64d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235830, "uuid": "447cfd8c-e6b2-4e11-9704-214de0ffd0b5", "value": "T1A5B3C85E7E218F7DF7A8863047B34B21A35923D626E1D685E26CD9041F6138E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235830, "uuid": "1651edad-a114-4d5a-a88d-e4a0faf0596e", "value": "1536:jTtgHlCSYhqbLLqDridBi0QZVKCNrx39W/RGpYTKGNeRL1HDJ7ABvNL:qH8Ob6DJVKCNrx3qRG6LOt7S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235830, "uuid": "9c6abce2-7408-4713-8c76-3723ac746003", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235830, "uuid": "ed50a633-6ece-4b6c-b076-f0208a3ab660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235830, "uuid": "a933cb7f-c0a0-46ea-bf1f-4d6a525c2d9a", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3f32aa-dd56-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766202207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202207, "uuid": "16903997-9c76-40a4-8803-18c716673adf", "comment": "Malware payload (AsyncRAT)", "value": "a59960f7eae0ea5d3ffbe2aa1dd4308c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202207, "uuid": "92e72125-a240-4d56-9555-02227c435320", "comment": "Malware payload (AsyncRAT)", "value": "565a7086f0703105065d5d674226cd0e99b628dc81893f01104126ef743c22aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202207, "uuid": "2d8a63bf-254b-4803-9cde-f105096afe1b", "comment": "Malware payload (AsyncRAT)", "value": "7dc2b6a7f8eb786667670f70c1621b3e6b4838b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202207, "uuid": "bf931010-2754-4e25-86e6-0bbce35ed4b8", "comment": "Malware payload (AsyncRAT)", "value": "080155f6bbad548b0cd804d64011c4fba91cd93742fbed3733d606ff5c81536e868eef04a16da9d85e05ffc0f396fa1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202207, "uuid": "d36e6521-eabc-4606-96c3-a30215dbf0ad", "value": "T172C22B0473F48266D1ED07BE4832A200D375E68B5D53DB9F6EC495AD2A33BCD8621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202207, "uuid": "4a807337-1380-4bf5-a4bc-4516f66aa409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202207, "uuid": "f6c9e8f9-2f8b-4102-aca3-00bdac576304", "value": "384:+4eMn+LbqY3zgetmQkLAMymrJhxUHqqbuUsJQxnCJf+BWfXWw/uyu+:+4nncb/3EtQk8MyCJhxaFbHBFBNyu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766202207, "uuid": "bfe1042c-1933-4cd6-a304-75d4236d4914", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766202207, "uuid": "5a767ce3-9399-4859-a8de-7b34c957ec18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202207, "uuid": "b7efe5a4-7502-4867-bf19-ef16bc45ee31", "value": "AsyncRAT_dean.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7a1c9b-dd67-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766209564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209564, "uuid": "33efeb95-4d94-42cb-9bc9-c3f6ddd727d7", "comment": "Malware payload (Mirai)", "value": "7ca41c81cce9521adabda84cc3a60729", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209564, "uuid": "ded9ff33-b438-4ed4-8d8a-0ff73f7b7195", "comment": "Malware payload (Mirai)", "value": "58979f8f088f4a7ccb290972f63908b9f2aed2745965edec68713c3cd48288dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209564, "uuid": "6eace0b1-4a9c-4b16-a443-83bda764c4a7", "comment": "Malware payload (Mirai)", "value": "e5dfa83363a927ba471dfee0fcf566fdde5ddd89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766209564, "uuid": "b68795c9-7f44-460d-a670-783be53b14cb", "comment": "Malware payload (Mirai)", "value": "133d409c2e04b9c0096da8fed7782f62787f898d91b8a53b46a8322a93fb4c8e7e173bcc7a5c40017e5582165047f7ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209564, "uuid": "48e92cea-d809-40d3-a9b2-5d6549d0fdab", "value": "T11DB2D033CB30AB31C930083BBC3AD611DF965F3195BA745A19694B652BC1ACF53BC689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209564, "uuid": "8d4f20d7-64b8-40f6-b0f2-fb64327638f3", "value": "768:PbOIC33oVXf7LfjsB1oKKwDP4wms3UozH:Pbeop7LbsBjKCPPzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766209564, "uuid": "6d99ff33-97fd-43c7-a446-30fb5f7bdc11", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766209564, "uuid": "c5bfff89-d92b-4799-aacd-3eaf338b1ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766209564, "uuid": "f92aaeb1-ca14-418e-b76f-dd60bc272796", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196f33cb-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234443, "uuid": "3e8a6048-a04a-4f95-ab35-077c42b8ad56", "comment": "Malware payload (Mirai)", "value": "9bdb2583ccdbc3bec8e8fe1b76b150ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234443, "uuid": "3b4757ae-4341-43a1-b3de-07a8af292725", "comment": "Malware payload (Mirai)", "value": "58f45ad0dac9d2e5e87dd43bd94d5d48a8921cb0b87914f25f667b5784697ca0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234443, "uuid": "f3946809-ada6-4553-b5ba-4b195db6b230", "comment": "Malware payload (Mirai)", "value": "1950af35c74754d43c73461fa1316c0c63aa7503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234443, "uuid": "7835770c-e62a-46c0-8d57-f061572eae45", "comment": "Malware payload (Mirai)", "value": "4a261f077c824082f15e71d7c30a7a7ad1543c87d7cb00cda81ebed3b2d70c2f9301b0601b68e9274ff8919fa45c791a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234443, "uuid": "fcd8b082-a063-41ed-b9ef-02712229514f", "value": "T175A34B1327760A27C4E1247941E78737B3B69FD92670920BBA645EDC3F5ABE031833A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234443, "uuid": "4e93e1cb-4613-47a9-aaff-1f24999c47dc", "value": "1536:uotKHi8MUj0sycTOZz6I1YF+Ixl2HhS1NY7E8oWrt9GDC8dNL:/gvM1zcCZ+I1YYSKhnAfDCeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234443, "uuid": "e16730d1-a3db-4d17-ab2d-9afab4acf7ad", "value": 103357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234443, "uuid": "782943c6-3cf5-4f7d-862c-98151df6956e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234443, "uuid": "e7caca65-b482-47f0-b068-2d9b36f16479", "value": "firmware.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6709f305-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211810, "uuid": "7214d508-7d4a-4463-9617-c6da4a648ec1", "comment": "Malware payload (Gafgyt)", "value": "1b8c0a14cc920578bbe4bbe036806d3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211810, "uuid": "f5517ce9-7042-4a45-b680-40cc04f55920", "comment": "Malware payload (Gafgyt)", "value": "5a10d944a493ea6bea05edabe160a628b566cacec387ce098eaf7b194eedd9f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211810, "uuid": "4c62efb1-aed6-4cf1-b8e9-43ca5a267eef", "comment": "Malware payload (Gafgyt)", "value": "960179820b50bfa65d3923c6d3722bfabca14142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211810, "uuid": "2b356900-d913-450f-a147-a554a32c755b", "comment": "Malware payload (Gafgyt)", "value": "8d95a951e6ad0808198be56006b5d2ba69ad136f7db11c2a8d46e5c94f59e638bff8cfff3862c5a1aed788d29d8d079f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211810, "uuid": "3a88164d-a45f-4107-aa4f-d0d0e88a561e", "value": "T109933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211810, "uuid": "75600934-5b06-4fae-858f-6d79aa37bc7d", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Tl4umXxVqDrstKfz9e:Q97vk51RcG7Atl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211810, "uuid": "ff126e4f-4566-476f-9d18-65cceec3c2d9", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211810, "uuid": "6c33ae5b-81c1-4e01-834c-96fa141515aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211810, "uuid": "32c60473-6479-424d-b355-5434705db38e", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29e1ab4-dd73-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766215024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215024, "uuid": "15cac103-90ec-47f2-a42a-a990ead28a7c", "comment": "Malware payload (Mirai)", "value": "62416c990d5d97918aa004efff81d8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215024, "uuid": "182c877f-8b25-45f8-8087-55570d56c160", "comment": "Malware payload (Mirai)", "value": "5b1f2a4aae9074691cb6f36abffe7c155844f670b8fcf1c9106ca60201217bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215024, "uuid": "9ed05f0a-de88-41c7-b687-f7ffa0407978", "comment": "Malware payload (Mirai)", "value": "217cca0b1b621e2e602afc8cdd5e8d9d98a06891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215024, "uuid": "c11a0661-f071-4fb2-b1df-0b9c8e96ac41", "comment": "Malware payload (Mirai)", "value": "1b461968b9cd5a08657b1360f665440a0f0a4b67ae44a79e178924e93b0ed01a81245f9fca47dc2c1923d853010a931f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215024, "uuid": "4790e07b-95d0-4c6f-a080-a5c27a2b4877", "value": "T161737CC6F643D0F4FC570470207BE7375A32E1FA1129EA43D7A89A72EC56602E616B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215024, "uuid": "780dc58d-015e-441c-a812-0a0339f40033", "value": "1536:wp6kfm+q4sX4YFAO+PxV9T8x/ReOSpwPH5oyhg35f9kfzM4NSNTQ1SP2:wAkfm+q4S4YFl+5V18pPyye3h9uIv72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766215024, "uuid": "f5720549-25e0-4456-9c49-0b149e0a0a4c", "value": 79280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766215024, "uuid": "032f19b0-d9e4-4e4f-8321-2e716cc1039b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215024, "uuid": "e3d313d9-f29d-40fc-b894-f89dc3044697", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898592cd-dddb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766259542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766259542, "uuid": "9fcc7dfc-e588-4d0c-ab04-0d7e0b758172", "comment": "Malware payload", "value": "5a6b774bc9dbaf3758dffe16e1e79054", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766259542, "uuid": "3a3e1da2-779f-4f74-a679-a73b65d27fb1", "comment": "Malware payload", "value": "5bb3dfbe2209c5e28aabe73dd4dbccecabb25ca77f47920fb42ee9eba976558a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766259542, "uuid": "5979bcea-ea98-42bb-8b72-b295302bd84a", "comment": "Malware payload", "value": "ee5d687a0ba9f359a1ec3afcdbdf532ef8350c16", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766259542, "uuid": "56704621-8cf4-467d-9d63-62e5d192d1c2", "comment": "Malware payload", "value": "f4db2a0381f4198d3e64c3f79d762f2f67e4c6264eb2552010864b25cc2512d9addfb1586a6e4fc42b37b602816da114", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766259542, "uuid": "19624828-9514-4d4d-b801-2413a8dbb08f", "value": "T1BC954B2AACB105EAD495D33288B3258277B4FC4D2F3123DB2A91B6383F766D49D76704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766259542, "uuid": "94834781-cc43-47b4-b8e6-fef7bc8ffe7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766259542, "uuid": "c9b399dd-ab73-4ee6-8ab0-b607ba8c39af", "value": "24576:9WSePtblyBSIksh+Vb7u7Z6cZhiC+9xWH5GMUjeleN4j42CR/:9WRPNlyUI5hiO7Z6h9wLUvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766259542, "uuid": "6c948bab-c042-4c28-a2c6-b3f8fcf15d25", "value": 2013696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766259542, "uuid": "fcbd71be-3143-4f55-a28a-f839ff41cdbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766259542, "uuid": "52f0e9ae-6fd4-4609-ba10-95ad05ed242b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25873d17-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223296, "uuid": "31de070f-b1c3-482f-9636-4b93b833eafe", "comment": "Malware payload (Mirai)", "value": "397a3d09faa9938c0715d174163f76ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223296, "uuid": "a5e8dfd2-d24f-452f-ab2e-b197f8b25846", "comment": "Malware payload (Mirai)", "value": "5bc39d6724cf4a2fad5ac9c959820a97d832b9af7ff46fdb92d1075933ef6f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223296, "uuid": "2094c18d-818d-40ef-b7aa-653902303646", "comment": "Malware payload (Mirai)", "value": "32d4bc402228c75a44a725e2134e68b7ca8470d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223296, "uuid": "44284a1b-0faf-40d8-8b47-b253573b9b2c", "comment": "Malware payload (Mirai)", "value": "f4b6093a8dc85a8eeb37d4b4b0468382a1a9b184d1d943fd99e842891d4d2d0b75593747c035dfc0c441b51b40e2a8ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223296, "uuid": "f1b1ce5d-a09e-4799-88f4-579b4fc4842e", "value": "T1F2D3AECBB60F9860C86106F407C78B8E3E5362528E57C9E72E1E6A3A3D795CF154A7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223296, "uuid": "c1d2e8ef-3da6-44f3-ab05-1ea4018a3d11", "value": "3072:lrdYNf0DxGB2ckMumQ2F1NaA3patg5+AvbgHSn7q:CKuqMuLAZNcsjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223296, "uuid": "5d6025b9-0307-4603-aaf4-ea489caf2afe", "value": 132464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223296, "uuid": "519def57-f01c-4fbd-afc2-09166681a3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223296, "uuid": "c404fe65-b4f0-4b20-8561-1ec15364e0f3", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e32534d-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766197917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197917, "uuid": "0f8f8fe9-461e-4a1e-b06b-60e700723014", "comment": "Malware payload (Gafgyt)", "value": "31f3dff16351356f8f87639687ccd85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197917, "uuid": "d7300bfd-db1d-48c1-b168-12857a5fa266", "comment": "Malware payload (Gafgyt)", "value": "5c130333a3e4b41bb63eb2c29f510f65df917bf6e297291452ac416489b5cdcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197917, "uuid": "6e9cdb8c-9ac1-43be-82e5-a7e6c90ef134", "comment": "Malware payload (Gafgyt)", "value": "128860f38b3acd4195852872398a31e860211e26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197917, "uuid": "81a788f0-a1bf-47c0-91fa-a52cb7c7224d", "comment": "Malware payload (Gafgyt)", "value": "34244d69bbc8d63a6c9138a6e09892c50b18fd03ceed8d01997ffa8e7b3dbf361f8dcbe97702904b5dca9273a67b38e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197917, "uuid": "ff1908be-90a1-4b2e-ad67-1c68501f4301", "value": "T1F7F3C73BBB130F23C0C600B111E76632ADA5C3D634F952D76AE46D5C5E2A98938A5FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197917, "uuid": "ae11267d-dca6-4b7c-9715-dc001a47c686", "value": "3072:Q6EXpNYFxbNL2iGN8cEHphap1UP3zpUrmzj5G/dZ8ykSU:Q6ErsC+1HphajUPDGrmzj5G/dZ8ykSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766197917, "uuid": "e65181f8-74ce-472a-97e9-d22b54fe8471", "value": 159603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766197917, "uuid": "16f18147-03df-4537-a8c0-dbb4bb923cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197917, "uuid": "d03db119-340b-4ab6-9899-5066d97ad365", "value": "bot.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69cfecc-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249820, "uuid": "0939ab97-d4db-43fa-9b4b-12d2ac24bb83", "comment": "Malware payload (Mirai)", "value": "a091d81a8ed2ea1f27cf8bf1dd7c74df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249820, "uuid": "762c3851-ef5a-4502-90bf-4e33427da78b", "comment": "Malware payload (Mirai)", "value": "5d763d962556094f1524a6e3202365c6d7611c4988772e5f26f136cd19becdc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249820, "uuid": "43e6b2a6-df7e-4e89-9458-4491e0eaac9e", "comment": "Malware payload (Mirai)", "value": "efba039db6ea4b38ca1925140abd0bcb67c46dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249820, "uuid": "3c3fbf27-6721-45cf-8ae1-1179bc1ecb7f", "comment": "Malware payload (Mirai)", "value": "39cabdb0c4140a87bec7ff037748c49a47f4553e4e42da237f81db4edaaf3a55f83e678eea7abb4b6cfab2e03c87c8bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249820, "uuid": "30a9520d-99e9-4b88-9c66-8681b30b5179", "value": "T11D3302333363E2BCC4BE55B71E956A42B18D3D4A9682035B50FE6A5C2EF243501596F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249820, "uuid": "bdc51c29-d503-47a3-b5b2-9c2077e9e7f7", "value": "768:lstQRkXV6a9oEjRPwlQ1De5+LKTPMl9zJfy+05E7RzjMg8ohmPU3P9U3x0XH:lstY064oGalKLKz1+0W7RjR8ohmPJWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249820, "uuid": "0748a5b6-6bd5-4b0a-b19c-05905741d4ad", "value": 53584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249820, "uuid": "7139d436-20ac-4b8f-b1ca-ecc0a2f00cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249820, "uuid": "ce322e36-2141-4cbe-b432-b2093dfbcf98", "value": "sumrak.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6364b6eb-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211804, "uuid": "d6f9c2cc-a78c-4430-a177-cbe6a6579185", "comment": "Malware payload (Gafgyt)", "value": "ad92294b8b2e5cf5ffbfcd1405e03bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211804, "uuid": "33637110-ffff-4dd8-912f-80fd5aa77b18", "comment": "Malware payload (Gafgyt)", "value": "5dcf693e015509dc37ce808631d0ac5fa80c9b9c225400cda17a4f72b0bd6f9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211804, "uuid": "9d761cd8-1596-4161-8390-696200bda103", "comment": "Malware payload (Gafgyt)", "value": "7fc0cf9e7db2258076be612312e69cdb37b11139", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211804, "uuid": "3a3bd12b-db41-437c-8dea-89caf4a94c80", "comment": "Malware payload (Gafgyt)", "value": "7bef80fe7cb75015045eb37dc2181784a28f5789c491e1cb7f46208116cf1f38090977bfcc24667deeefad7e6299beda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211804, "uuid": "2e33e16a-d094-4a13-aa68-a1a379cdd480", "value": "T13D833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211804, "uuid": "56d6f481-e88b-4e95-b7cd-ca4774133d4c", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LmWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Ya2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211804, "uuid": "d5702a9a-458c-45c6-a017-b9cf247c1aa7", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211804, "uuid": "15cdeaea-f88c-45f7-9f3c-acd941f10030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211804, "uuid": "8f500354-eb8d-4eaf-a3be-bbb0d813ddf9", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f201b-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249814, "uuid": "155b81aa-4db5-4a87-b161-1226182d362a", "comment": "Malware payload (Mirai)", "value": "f9c8dc527bf7a46ae9e44097c74b925f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249814, "uuid": "4df75ab5-a526-418a-8ee1-3ab7fd1c3ec5", "comment": "Malware payload (Mirai)", "value": "5de1f5d0c7480b77ede252a5c31db9d10ebaf2e9f87d5b8bb872d772ce32d692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249814, "uuid": "b87ff423-306e-42d9-89ec-adaaaae20126", "comment": "Malware payload (Mirai)", "value": "4c454df9a155cd0f80029aab5709cb9623976026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249814, "uuid": "00745b19-4d9a-4cff-875a-8c57bfba6cfc", "comment": "Malware payload (Mirai)", "value": "6bd408852020fcc0c651af73ce64c45b2be16f8101928016c0d0182d7fb49a354b02f16c74ef2f015875e430d1b95684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249814, "uuid": "3d8eeefa-78e3-4853-95c9-bc70c3c34ba1", "value": "T1DA43F24AD8E52DC0DDBA447EC6D4AE71FDA4A042E99D8A0D330C8F61BB570EB621CD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249814, "uuid": "32a55177-7ea4-423f-988c-ec3d9693675f", "value": "1536:lgISoKaigxLg0+fmd7P+HeB2NbSIiGoKPSn:lgISoKaigxV++7PzB2NbSIW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249814, "uuid": "34792bc6-afd2-4ef1-9d0f-b805cfa7786b", "value": 56388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249814, "uuid": "93642970-952c-44ca-98e2-13706da9faba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249814, "uuid": "09ed6ac9-b8a4-4ad9-9d37-d706a1309f14", "value": "sumrak.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951bb8b0-dd40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766192989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192989, "uuid": "793cd660-d2b0-46e7-aaca-c405cc6d20bf", "comment": "Malware payload", "value": "e933409199f60ce66bb1121086a9c0fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192989, "uuid": "4aa1ee9a-506f-42b0-8a14-0ce1fe9e90ca", "comment": "Malware payload", "value": "5fe6a9409c8c974a1df7568b9ffe2c9c561db6f97026a60a585b08a392a950d0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192989, "uuid": "7d6439bb-28c6-47c8-a5a2-81336e56cde3", "comment": "Malware payload", "value": "0f497ce992e725a820a78206055c26ad2dc37189", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192989, "uuid": "8e14f4ce-23b6-4e2b-8dbe-706fc939a7e0", "comment": "Malware payload", "value": "7e34c0390d8d37e293b29fc882a17bc5cdf8845a543be654f8d6a602895243b6f67bf38c5fec3d873f9d6da852865309", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192989, "uuid": "55e11f3e-e438-4299-a29d-762bda56522f", "value": "T147D02B0CF4030CB3B4344CF9B7DB2494D60FD21D2B0A55C92288121FE4F0C50A020523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192989, "uuid": "d21423ce-42e4-427d-a88a-4ee9b69538fb", "value": "6:/VJ+pUKUF2RVYTeInYf53IUy5p3FsDKVKAOXqIKa03IKq1IEE1IKBKW:/VJ+jRPInY5WgAsONI08W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766192989, "uuid": "39e9c6ef-33df-4b60-b258-c20f39c289d0", "value": 268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766192989, "uuid": "cce843be-0c00-423e-9971-a1e878850f1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192989, "uuid": "e9c0e3c8-afa4-41fd-810b-be7440e923d8", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3590b851-dd5a-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766203996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766203996, "uuid": "d54f3125-5093-40b7-9ad7-550761cd0884", "comment": "Malware payload (AsyncRAT)", "value": "9f0110003530236a303fd15a43b96710", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766203996, "uuid": "5a6b9dd6-ace1-44bd-b13f-ece735a6e7e1", "comment": "Malware payload (AsyncRAT)", "value": "602dc81433b3c2ed46462b906810ad5c1bf5596857651f0e7a809c045c91950d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766203996, "uuid": "581e9f8d-8a73-4663-b097-d0677578134d", "comment": "Malware payload (AsyncRAT)", "value": "57ed80b6a074ad162818b13668ea4992e8f4ce7c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766203996, "uuid": "d7538e1a-c93e-4ddf-abb9-0273e5ee6af2", "comment": "Malware payload (AsyncRAT)", "value": "ed475332f809c86419a2d71bdfae124e4abcbf35d8b436133c04625142b02ba25e79e38de4d8938bd139f7ef26a70b7f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766203996, "uuid": "902dc9e0-67dc-4868-a2f9-9fc7ffa5ef31", "value": "T15CB39F802E45C316F3397AB4C76153810F2BAF76E711BD4E7A8333595A3AEC149027AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766203996, "uuid": "6e295642-1bd5-4dc8-a139-17e404b6120a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766203996, "uuid": "db1dfdfb-425f-457d-b290-7d59349ad4c5", "value": "1536:Xu361TFqG2pry393b82SV+4H0AMx4dsPEKo9S9:Xu3mTFqG2ty393b8HTMC6EKo9S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766203996, "uuid": "70796411-16ce-41c1-9093-11919c6aa129", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766203996, "uuid": "f6bbb2e5-30b6-4eea-adb3-935e6cf79220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766203996, "uuid": "aae7cf6f-50e4-49d0-b683-061146ebfa05", "value": "Google SafeBrowsing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359aa9f0-dd9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766232343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232343, "uuid": "992b2dd7-c54e-4d61-b509-1ec08c447ccc", "comment": "Malware payload (Mirai)", "value": "bca80639a49f6ea312e084aa9537cb1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232343, "uuid": "828f7f5a-a888-47d4-a484-82bceccc844a", "comment": "Malware payload (Mirai)", "value": "60ac136c25ac40f5a91b80c1c400f1193f83619b16d9017363d7114994cfe54f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232343, "uuid": "273ebdf2-2585-4f64-b69a-4b53389c597f", "comment": "Malware payload (Mirai)", "value": "9b9f6d75add79bcb39141305b03273ab94f60ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766232343, "uuid": "19e62d86-007e-402c-817f-ae47c825b073", "comment": "Malware payload (Mirai)", "value": "fcb1936d658940531f805c1e3d8a34d9b23e70c40ba9a66d8e1e9e6801083e2c2c25773740266c4131d108a2ea06d9f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232343, "uuid": "efc29908-ab0e-4194-891b-98e3dc74a166", "value": "T1D3533C89F783E0F1E81A0971105BE77F8B30DE655028DE2FD794BD73AD32A12A11A61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232343, "uuid": "f0e11d6d-da2e-441a-8247-19a74c55d9e4", "value": "768:Zs5g00o9NEo2j2d91/3FJVFdzhOtSlkNTCJnJKx0tfAISVGUQ831gF7BiV5REZqW:cgeO6dTCtokW3uGU531gF7BiVcvJi4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766232343, "uuid": "d57dce76-8072-4f31-ac74-aac6953ee231", "value": 63532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766232343, "uuid": "48e78c76-c9ab-4cb0-9a0a-fb0443f601fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766232343, "uuid": "96467f10-b93c-4646-adc7-258048dcb3db", "value": "firmware.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59960725-dda6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766236698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236698, "uuid": "41cc515c-d2c6-4147-b32c-2b2d03cb1899", "comment": "Malware payload", "value": "087e191d6d8421b3240a718ac9e88b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236698, "uuid": "6276d87d-496e-4477-bf58-0335a0a76e13", "comment": "Malware payload", "value": "60ad592e7c6ae8922ec84c0797fb0c4ac631e962c8ed95e270b2a7ee12ad4a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236698, "uuid": "330ac28b-300d-43d8-aec9-72823aba0176", "comment": "Malware payload", "value": "117cb17e72eed4a8057807078b92e4eef52e6cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236698, "uuid": "671b82c1-a33b-493d-a131-3b3b24790cc5", "comment": "Malware payload", "value": "1664f2754f7f312c3d6fe74423937c50b1ff36fbf2cfeca3f752e699c8f17c58c96f6683065399121b111a6f7a47ea18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236698, "uuid": "48aeee62-c827-4707-acc9-79f0e105f88b", "value": "T1E9148CE077D49D8AFA10167D81C7D222273DFAE187538B07563476322E13ED27EC266A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236698, "uuid": "2ad34196-49ef-43af-a2b7-3547415aaf99", "value": "f09dfdec43a86f0214209d98673dd7a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236698, "uuid": "578e7565-0ac1-417e-8eae-31ab4544ca6e", "value": "6144:41ZSzsiMwzd3xjiUPM9DUkDAJM0eBWsiD:KSzfMwpliUE9QkD5OsiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236698, "uuid": "90b3f70b-8bb2-4004-a9b2-5523cdbd5a44", "value": 206547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236698, "uuid": "103c6d70-9d61-458c-9d8f-d23d32ac693f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236698, "uuid": "cc391811-c499-4b9f-9a2b-8135ac9d1215", "value": "SecuriteInfo.com.Win64.MalwareX-gen.85996882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75249c4-dd81-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1766221018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766221018, "uuid": "75763c26-8bcc-46ca-9249-562b00e355e3", "comment": "Malware payload (Hajime)", "value": "b301d0d423afaf290468e9ef13bb1b39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766221018, "uuid": "f3e892b6-8f9d-4046-8001-3c765865425c", "comment": "Malware payload (Hajime)", "value": "60b5b171e979d2079cff3e47bee2fe990a7650e6c0eeffeaee72208adbb4cb69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766221018, "uuid": "35cdda21-a426-4389-9d29-058e697e00ad", "comment": "Malware payload (Hajime)", "value": "d14261d6f7f85b965f070b1076b38c3d91c89754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766221018, "uuid": "94b19253-c3ef-4a67-8054-67acddb1ec8f", "comment": "Malware payload (Hajime)", "value": "06d175548f45007e6e81f6653e596580ae81c4a4c9baff007eccb8096380b52a0427ec69d3e74d2c655559664e1fe6da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766221018, "uuid": "b939ffdd-82f9-4094-935e-d752a418bd75", "value": "T17533024623A63BB6857188F1A7F8FF49F14A3EA4DFF55C097C217A58A43236C28C491C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766221018, "uuid": "aa812c8e-f254-4ab1-95d0-5a7d84272f7c", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Ef9:yYI0ARqw1qAEv7UIFM8oJorFquy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766221018, "uuid": "e7a044b5-92b5-4abe-8c4e-ac8c3e7ef24a", "value": 54720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766221018, "uuid": "efeb4cad-25f1-4254-89aa-699122720000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766221018, "uuid": "367a7bf7-97e7-479c-a82a-3c6a34017fb0", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90e6249-dd43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766194311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194311, "uuid": "b9b6a1f1-0aed-49ff-886e-b9b084ca638d", "comment": "Malware payload (Mirai)", "value": "68564430134bf1cf20ac36be6949ca22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194311, "uuid": "fa2a6d8b-a9f6-4171-ade9-c29e871dc5ba", "comment": "Malware payload (Mirai)", "value": "61000acaf9c039f2d5f14267efa9f305963dfce44bc2674069f5fb761f1d402e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194311, "uuid": "425836c5-e9bd-4e4d-9332-b78de65172b3", "comment": "Malware payload (Mirai)", "value": "f1dea487b251d71e23fdca27a8123a71d0335ee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194311, "uuid": "c8cf5803-8ed9-493f-b98d-62d8d4e17ca5", "comment": "Malware payload (Mirai)", "value": "f68fc174c8a835b6c4c54900698595da0eb4de7dd36a7486c2b28422855a35bdb8c69dc77719428a3ab964cdcba2faa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194311, "uuid": "2c56d0b5-d49f-4841-80ba-a62ceecd1e1d", "value": "T188933ADBF800ED7EF84DD73B4453480A7230A3B11E831A766247746BED3A1A85967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194311, "uuid": "efd31a8c-5dae-4c04-bb78-4033a2af1c58", "value": "1536:TOMiN0eRPgLvwdGF8xivC2io23yYMJPNhOI9g3vvj7lbjT9mTnqQRgv:6Mfr4dGdCfocyYMJ+Iif95mTnh+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766194311, "uuid": "6d3ef7f6-46af-4253-8435-6b76fb84c302", "value": 90564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766194311, "uuid": "d0a52455-60e7-46d9-bee1-dd35cc951150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194311, "uuid": "c24caa06-e864-40fe-9c6b-71f119c92f1c", "value": "kvariant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113af50d-dd40-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766192768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192768, "uuid": "ba06f11b-890d-4bab-949c-7eb2e9fd80ba", "comment": "Malware payload", "value": "9a9c228d608b3cd771401a0475d2110f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192768, "uuid": "07a067ed-7951-4e92-9253-a07c2097ae54", "comment": "Malware payload", "value": "6190ecc9477cc94fc179466a8ceafd89f9df5f1f9421176001d2666501ed228b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192768, "uuid": "40e91e07-d9cd-4a1e-b45e-1c26f5482864", "comment": "Malware payload", "value": "6330a949c2a70a19e4479ce1584650cbdaf14723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192768, "uuid": "ffbab506-c1c3-4eb5-9885-f93a6d22ff5b", "comment": "Malware payload", "value": "8a4044ac2d9b7fa3322e8602de462fddcbe7dffd684f8212d7343188ef912ba54137ded6b904103103842da1e874dff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192768, "uuid": "b9f2f714-2cab-45b2-887c-5e76208286ff", "value": "T14E94CF12F3207E57E11E9535688143006B84AE7573E2A302FE93B67D642B5B5CF387AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192768, "uuid": "003e31f9-3233-4214-909c-dbfe7d68f269", "value": "6144:SiGJ8odgsLw2/YjUfeD5hqan/XeKqtQXo7gzGnmDcB5DiDROsncOgaJYsSybtlWW:mdgsVFfgdqtp7vnmWiksnWQSybtlWzVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766192768, "uuid": "ef0d1875-d5cd-46d3-a6f2-30573626fb01", "value": 431824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766192768, "uuid": "5ea8fdf7-88cf-46e3-a7d4-d0849499d72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192768, "uuid": "c3d6a05e-dd25-4547-a62e-ee669f207118", "value": "rondo.armebhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e72c01d-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "5a3a8ef0-0597-42b2-9e09-7c839e303c98", "comment": "Malware payload (Mirai)", "value": "c487bff98c1ce46edc54106c566b24dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "2098b710-9800-4396-973d-fa4a5b836aec", "comment": "Malware payload (Mirai)", "value": "6277750bbb663b5bf3b651002c0bae30f37fa844424efcee32cb7d7f349bf7be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "7cc7c13a-2581-4a39-acc2-eee21cfb13cd", "comment": "Malware payload (Mirai)", "value": "82c3f713c4ad2f32ffdbd820ed46504283317e44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "46ca217c-166e-4c22-b176-d97c63c09148", "comment": "Malware payload (Mirai)", "value": "6966c0c1bc1e56d890771d13fb70252148c75a89b22b365a4fa0d11749cbd860cfcce48d52992d1fc78f22849c9c8be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "ce0f81b0-7a50-430d-9ea2-0f10e7498784", "value": "T118C39EC7FB8B10A0C8120AF017C71F9D6B57A211CE5FE8E3AC1E663B5A7A4DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "64075410-afc1-44e4-8278-032b42d2a9ca", "value": "1536:it+2mPrGbK8XzSi5yn6iCGrf52T+biLdT6XqlI/uCAYUxP/QgEvE4/LW8:itQryKYzS/6iCGL5c4WR6Xq9CAYVgAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254342, "uuid": "f7415160-342e-460c-8430-9ac55474237a", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254342, "uuid": "cf8808d2-d970-4beb-97d2-706afc9e7228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "0792cca4-6ebf-461a-a73d-2c22a483ac7a", "value": "x6t0xxmw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc336cd8-ddef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766268270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268270, "uuid": "5439a0ea-bfd8-41d1-9afb-53ae63a34e0b", "comment": "Malware payload", "value": "9e2efe1784907d64b021f8c13f1839c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268270, "uuid": "0e11d699-b331-4493-915e-0fa19a246084", "comment": "Malware payload", "value": "62d914e7943ab86399586ab99ce408e025117d4995f026e4ba40eb3791baaec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268270, "uuid": "2c5b7ba5-0f1e-4350-b170-29c92da08145", "comment": "Malware payload", "value": "25ef032d95f2f598c99cecdde9bc5e4264c2610f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766268270, "uuid": "b9c21784-56d8-480e-bd0e-1d82a72b5726", "comment": "Malware payload", "value": "e52e25ac74261187c240d334959e3ab336ce6bed621371339b371653337cce476a5626140538193745387a673cec6fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268270, "uuid": "9f9dc380-ec56-4b1c-9cc6-ea3769566be8", "value": "T139187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268270, "uuid": "b4024e25-a437-40d9-9f46-aac2c24faf9d", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268270, "uuid": "1246aa68-fbf9-4690-b1c4-8f8934f5df78", "value": "786432:iAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:iAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766268270, "uuid": "64795769-9201-42d9-b27f-de98b8cc3e07", "value": 90418176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766268270, "uuid": "0720b17c-3267-43a2-a830-417b88f38bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766268270, "uuid": "1215db25-818e-4121-be4e-30b63f00da55", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae8f1bd-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234204, "uuid": "d9d68a22-a605-4898-a0e3-14f9de838a82", "comment": "Malware payload (Mirai)", "value": "61b776e3df47f502e3fc69e1e4c01ff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234204, "uuid": "df6be6f8-3470-4626-a4aa-5521cffcb794", "comment": "Malware payload (Mirai)", "value": "6317f2f95bece8eb2907b27c09813ad09fe9199b91ab3df1bcb0b57ec915c5f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234204, "uuid": "27918f28-6a03-4007-8510-fd321f0be915", "comment": "Malware payload (Mirai)", "value": "7163f2aff8176b0bfcdf1b393f07e42bdbce477e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234204, "uuid": "77c1b249-de8d-4b61-a03f-2e563e33cb5c", "comment": "Malware payload (Mirai)", "value": "50f462cb1d71b8e6449d671bab78c394fcfbf44c0123ba2407e688020e0dc528660b50c0b7098ea0648a510bb1dab895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234204, "uuid": "145b5995-d8d2-4d35-9626-d847584c62b0", "value": "T12C31651BEB44BC14FB10ED7484217B792F26596F85DFDE9B4D1B81B0583B00C76A02AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234204, "uuid": "f5a63fbe-80bf-4489-a049-5b429706b2c2", "value": "24:ZP/4zUprvlWpeiBnOt6oWKF6WsP9gAiJ95zZ:ZIzUprvlWpeWOwoB6WsVOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234204, "uuid": "b1bd4f5d-40c5-4934-9a65-e39d93bcdbc4", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234204, "uuid": "1a90db7c-5a31-452c-9f87-dc50a676e0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234204, "uuid": "497dfd1c-ebed-4428-ba82-5e3f980aa260", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6659b741-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211809, "uuid": "df7b4223-0ff3-442f-aba9-559f804b83ba", "comment": "Malware payload (Gafgyt)", "value": "2b405cc51265524303e5b704ff6d69aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211809, "uuid": "eb5a3902-84ad-45cd-b6ef-c5faed9b4f50", "comment": "Malware payload (Gafgyt)", "value": "63d79ebd1ff870825ee4cefb29064fece60b6b0cfd89720b2b169d6badf2b4f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211809, "uuid": "df1a4107-5331-4adf-bcec-4e95182d957b", "comment": "Malware payload (Gafgyt)", "value": "7f08711ae572ad9c21c2fed3e336033adce22b1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211809, "uuid": "bbe1d490-3de2-4ba7-a586-5ca1f2dead86", "comment": "Malware payload (Gafgyt)", "value": "ab16bdef8d9255123a566a43f352835116ece46cc0c2902da4b68cd8f370cf4f21946cd58ed318e46f801d629fbca22a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211809, "uuid": "d9982500-78ab-4037-86e2-666b539bcbb8", "value": "T155935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211809, "uuid": "36993ad2-07c6-4ef9-ac0d-bcc6dc5098ed", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3ByPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKRifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211809, "uuid": "1e01ce62-8c68-4151-960f-5b19a89e4ea6", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211809, "uuid": "e7a02b26-3e7c-41d7-af63-1fd29dee4198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211809, "uuid": "8e1bae19-82bb-4d67-b9b6-1228e9c4d42e", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68e8156-dde7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766264745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264745, "uuid": "09982d9b-55fb-4973-b528-3a46c7484737", "comment": "Malware payload", "value": "993a09fc4bd9df0a7cb24359185216da", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264745, "uuid": "bfedecec-3368-44c8-8ac1-79d29d9070d1", "comment": "Malware payload", "value": "661a7f4fd4a8aa9c3330867ec6d91d2e3319a03ee5be6452cb1b97831ae73467", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264745, "uuid": "01669389-0163-4b59-af44-6f898e35ee97", "comment": "Malware payload", "value": "3b8f11f939893a8819f5601bb4186360642c6712", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264745, "uuid": "a2363394-2ba8-4b1c-9b24-801ac12274d0", "comment": "Malware payload", "value": "01478b1259a3ea2630204707f06171722be52d8e118a4e74c5a6b4c5a7cff4d962aed932fb5adb0101c5e1ec174fd069", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264745, "uuid": "ef4a794c-8686-48a2-9f43-679f5453535e", "value": "T13A61CC0127F50328F2B28E3968B7B3510776BC15ED129BCF2298864D6C71228D471F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264745, "uuid": "34e5e286-a8e6-43ca-bc99-de2200ada45b", "value": "48:8XLxEzNYLEQvoPwdHALCwydhmHsN9XyDPBSg0q4j:8XlEeLcPwdlwcTQDpt0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766264745, "uuid": "519378d5-1353-458d-9790-11cf1d3a35f4", "value": 3304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766264745, "uuid": "a649ca28-2d6e-4d71-9674-2c7e7f7d8b93", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264745, "uuid": "99b537ab-2a1a-4108-962e-e4dfe879c5c6", "value": "\u0414\u043b\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c_\u0431\u0443\u043a\u043b\u0435\u0442_\u041a\u041f \u0421\u0430\u0433\u0431\u0435\u043b.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5ebc54-ddff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274799, "uuid": "dbf5dc27-1655-422b-b48a-152302b43609", "comment": "Malware payload (Mirai)", "value": "e690785204b79fa1da6899090104fa03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274799, "uuid": "8176cde6-07a7-43c4-9491-00e37f8f9d5b", "comment": "Malware payload (Mirai)", "value": "663591c820f500c62226f616957b85f61195f5b9fd9b2f2b0b31d35bd6c7481d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274799, "uuid": "ee86fd6e-3899-4121-96e1-2cf28a4b1253", "comment": "Malware payload (Mirai)", "value": "fe495bb1f619740f430786b43211fe97db1d2dc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274799, "uuid": "72f13781-e807-4be2-95a2-fe6bce732a64", "comment": "Malware payload (Mirai)", "value": "d079a9ae2f5e33ca644159de845317a14e86afab99163eed699eb6ae9d1a12c4d56713f40954e482e5b1d6ff1e00609c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274799, "uuid": "8f802bb4-8f3a-4930-bc6e-61d6fa0da5c2", "value": "T176B3C74E6E26CFBDF7A9C33447B79E21965933C626E1C582D16DD2001E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274799, "uuid": "ee2e6d54-5c05-41fa-887e-47a4594b445d", "value": "1536:8vj7gDh8TNQ0G9aEAwWihKo/E9sGKAC/73e5C1O6t4OKg+c+c+A:sjCK5h7mE9sGKZ/7+6t4OKJttA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274799, "uuid": "d2802eef-0ff4-45b8-a23a-72b2eda3bb72", "value": 113908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274799, "uuid": "d63a9979-6e7a-4f49-9d41-eef1839abe2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274799, "uuid": "91020e7c-a2d0-42f1-97de-02daf3589bb9", "value": "sdxkzX_UXA229x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3536f8ff-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235778, "uuid": "4c6c0792-532a-495b-b46c-80fb01c4f845", "comment": "Malware payload (Mirai)", "value": "9fe8e06e7219831f581e9f2f6f6dce80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235778, "uuid": "be5cedc4-2ee3-45df-be82-4c847f1d5d6d", "comment": "Malware payload (Mirai)", "value": "667de5e07ac22a6290bb25967816c44952820e0c4f8ad3d2627dfbf81ed247f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235778, "uuid": "f8cf090e-a92a-4ede-b3a2-e4048cd0e7ff", "comment": "Malware payload (Mirai)", "value": "cbd13d18b024831ebc8ba7c6a7137d99ac3753ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235778, "uuid": "a2926d33-a66d-4c27-90c1-8eab68cfada4", "comment": "Malware payload (Mirai)", "value": "5f8b553463066acc457c1c48b87274c4f58a0fd8a72d3a1e99c2f090d75b0acb29aa651dea6ba88e35a8f593a1c1f818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235778, "uuid": "8ce991f5-5c83-4308-97c1-7d8ab35d9a1b", "value": "T12C13F110121CDBB7EDF226BF6D5617878A0D44BD88FBF86B061856BA3D828835CED047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235778, "uuid": "5600e637-275f-4bdc-8ccb-8a3327283ee4", "value": "768:j4DTBFzUZxqD7cDFPSkWYu+x3UxoUstyW5TMZFwDgBfzvy7nca9q3UELfD:0DdFza4DgpqkN6xWlEZfbyiL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235778, "uuid": "4bcbd0b1-e724-4d11-b827-414019272fef", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235778, "uuid": "5d103445-7058-4866-9456-994335bec942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235778, "uuid": "6570a37c-b930-4c91-b3f9-8ead2f520d80", "value": "narm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e541860a-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249817, "uuid": "411ae7e7-1d5d-4a62-b7b5-09dd671e096c", "comment": "Malware payload (Mirai)", "value": "67cc1ed923168a551b9a377a88faf251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249817, "uuid": "9f00bbcf-fa48-492a-b496-06d582dbad67", "comment": "Malware payload (Mirai)", "value": "66c60404acaf2b67f97fc3cd57d8436641d88574c388ae6403729eb83ffeaaca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249817, "uuid": "b7c27a7b-d6c1-4f70-a796-2259430cef50", "comment": "Malware payload (Mirai)", "value": "dc27c0780d7f07e9e6b1133471d3c305709cb272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249817, "uuid": "fd2a2079-0a38-4c7c-9ed3-2bd5ef9a3da2", "comment": "Malware payload (Mirai)", "value": "92bb1ddc6c6f9a10c02f973bc219fff05c8cf0b3a0fa9dfd69bc473429b33b6c9372540d6c4a7ad2dd7cba9f32d9bc13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249817, "uuid": "4cc1a28a-b4f4-4ad2-846c-c76ea7b0b125", "value": "T136B34A63CC252F5CD665E5B4B0708F392B63AA6591870FBE1976C2748087DCDF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249817, "uuid": "35ec1e82-ef69-4220-b061-6ecf317cde17", "value": "1536:uat+1sHitS4muCMKfXOz7QGELJ7LIFWSxpEvk/evPy1N/i:u31sHit/DKfkCL5sFWEpEMw2Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249817, "uuid": "a4377c7d-86fb-4061-8888-bd5a3f841a59", "value": 114992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249817, "uuid": "d9d509f1-52b5-46b3-9d84-6e062eaad340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249817, "uuid": "902b1746-9bc4-47c0-8900-66494d3d6f21", "value": "sumrak.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d5ae3d-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211813, "uuid": "b6a3cfbc-7762-4d19-a1ee-afade489f764", "comment": "Malware payload (Gafgyt)", "value": "3d251fbec5a908de5b0b88e5a595a037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211813, "uuid": "c7515610-75f8-4177-883a-f8892c94d27a", "comment": "Malware payload (Gafgyt)", "value": "6724ee9385c2341841f27ff44f9d8a555dee93437ee6439f2820e98ce57637c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211813, "uuid": "7b3e1bf4-6149-48cc-a7c4-3c748c6399b7", "comment": "Malware payload (Gafgyt)", "value": "70ddfd49e30ecddd95d1d8111b688458094c3364", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211813, "uuid": "841bd846-09ba-47fb-af04-f2d890835f46", "comment": "Malware payload (Gafgyt)", "value": "0329f62fc6711185818f66625b6dea84918011aa148772af7adc1f45cf57e85579bf4e6d6ee33ca0eb970d1ae3abd992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211813, "uuid": "d1fc0d1f-0435-40ba-b9b9-df000362780e", "value": "T1CD833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211813, "uuid": "a23a809e-0a8a-4a87-be65-5ae9aaf74264", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCndojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J4BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211813, "uuid": "d22ed780-7517-40eb-8ad6-48a05bd5436b", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211813, "uuid": "cb2dcb10-8fce-491c-b5e4-49c71f1a9b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211813, "uuid": "311593e5-208c-4e5e-9974-f0e9c9281092", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d26c265-dde0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261669, "uuid": "81cf9911-65a7-48a2-b7ce-895984653c4d", "comment": "Malware payload", "value": "159c1244459be2db4d59375bc1b421d7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261669, "uuid": "cc7b1604-ea20-41d7-b1fa-0a7af6c54b8b", "comment": "Malware payload", "value": "673a8b1e119a6c09d80cc865a01e0c0b9e0ecd79d8413ff2aeb26b224dd36eed", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261669, "uuid": "96d627b0-05ab-4790-a385-b012625113ba", "comment": "Malware payload", "value": "4ae61fee472478b01d3982563185805bdce07c43", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261669, "uuid": "2fbd9ed1-6bc2-4ef1-baa8-b0c19676cd58", "comment": "Malware payload", "value": "c293a892a5ee35c411c5c7fca8d4666af662c6fbc4c03006807854149cd007f233aa2023e9c517a13373a73c3731d34a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261669, "uuid": "e7228dd4-ac74-4701-90d5-ab1f97d0a108", "value": "T1E831DF1A4AD51B11C377CE3B44BAE2418772BA66E942CFED44D012DC1C55500F836E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261669, "uuid": "76e9f819-4b44-4639-abcb-60a5bc292113", "value": "24:81U+89W8ArKV+/eJ+o+/t4I0W+WXsWXMXQaR3+hab/j9TLeoCGO+/efm:8/lm1H+6IwWXsWXMXv3KabjPvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261669, "uuid": "36e28869-01c7-4040-81e3-eaac5e77c3b1", "value": 1458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261669, "uuid": "f2bae8ea-2b5b-48e6-8635-0ad1fa4e0466", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261669, "uuid": "ca63dc73-b8e8-449d-a46a-0410248d5d40", "value": "Happy_Birthday.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3311868f-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235774, "uuid": "ba5cabc2-e39f-42cf-bf6a-e41bdc465ea8", "comment": "Malware payload (Mirai)", "value": "60363193897b24e8615c0876d9133b86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235774, "uuid": "e85108c6-56ed-4c19-9b5a-e4f8be214166", "comment": "Malware payload (Mirai)", "value": "677ebcf4adde88082f057303758bec36587568c2ba19a300229d2efe5dfcc2e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235774, "uuid": "eed7c5d3-f96f-482f-8c14-c79f1d2515fa", "comment": "Malware payload (Mirai)", "value": "1d0bc46a016110d580137205b9ee94ba22c5626d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235774, "uuid": "9055174c-cca3-44c2-8249-2af9c576c9a9", "comment": "Malware payload (Mirai)", "value": "493ac8037191ddc670c16a649c955421979ad2d14993ce5bb290e9fa1e3e2bacc703ea7f19b1678012ee1cb1f75ee9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235774, "uuid": "1ae4cfb8-2c5c-44d6-9458-37a0ad677813", "value": "T10C935B22FA79193BC8C4A97662F30722F1F7438724A89A1F7C710D8DAF6465022677F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235774, "uuid": "854e616f-17ec-44db-872f-f25a911490bb", "value": "1536:6qKCLw6IMIXR3OCiIp86P1h2DDtoiJq57zAZwralt39CBY:MLrOY0GiJ67s2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235774, "uuid": "2c13e577-cda1-48ba-811f-d7ecccd20f88", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235774, "uuid": "812dd668-e6fd-43be-81ef-b2cc63d74c20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235774, "uuid": "51b9838e-79e5-446c-a7d9-4fb6e6817169", "value": "nspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ae2a5a-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254333, "uuid": "37863cac-946f-4196-ac09-24c15a5aa37e", "comment": "Malware payload (Mirai)", "value": "15ded70f8343af66903571c1d10b2fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254333, "uuid": "de730589-829a-4fbf-b263-923a951db771", "comment": "Malware payload (Mirai)", "value": "684ea3832261520e77302d3a844d33e18b1c5fb0ec01d7497a52919e41854b4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254333, "uuid": "80b00929-2f91-4538-b940-54d11c582287", "comment": "Malware payload (Mirai)", "value": "2a151cb7f96548fa00b0c000f44d9970b6e51dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254333, "uuid": "37168422-bbd5-4d3c-8884-c7b4aba24787", "comment": "Malware payload (Mirai)", "value": "24568bee8977445897d0ebb908a840f00c669061958318b308564706bdd7c59a5a782bd8b89779dd4d80516b62351dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254333, "uuid": "72c5cf88-7eef-49b1-b0eb-43b2857850b1", "value": "T1E503E131669735D3CA301AB6EAA9C6062BFB097CE8FD723F071119643784A5F14FA01E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254333, "uuid": "18b52bfd-efc3-4136-9099-cb7c399da131", "value": "768:TRHz/+S7TXPzJgdi04d7V8AhWHc3hVEYs3UozPr:tHLt7TJ3VrhHVAzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254333, "uuid": "01d8abd8-8c71-405e-909e-17c17ebf3270", "value": 40860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254333, "uuid": "9f646f11-5919-42d6-b4b4-888e14c77f80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254333, "uuid": "e565fbc4-aa58-4f4b-a7d8-894c7e7b9514", "value": "4je8xdko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1702705e-dd37-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766188912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766188912, "uuid": "f264051f-6c41-49ea-9c7f-2cf552962b5a", "comment": "Malware payload (Mirai)", "value": "460d2c72ed88ce7e3b9f9230757867a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766188912, "uuid": "3e914a89-14a8-467d-be54-e809c9905d6a", "comment": "Malware payload (Mirai)", "value": "6858e69c7b8d2f05f90ae8ff9a821d729419bc7ac87c9f9d58fb2a9d3e4e37cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766188912, "uuid": "a699b039-ec05-46dd-b50f-f67fc24d9dd4", "comment": "Malware payload (Mirai)", "value": "d49315b30d68ad1b3c963201fb978cc5a866dceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766188912, "uuid": "ba79964e-5ea4-43a7-bbe0-493a8e43d133", "comment": "Malware payload (Mirai)", "value": "7b1ef6e7d3900efae2e5a7cbc47eea7489a6f88b828d048e3d2d92e49ce8c215d41a41616ba7b86e608f90ff9e911a6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766188912, "uuid": "ed6ed2ae-2c73-4abf-9a1d-ba8ac42b0cb8", "value": "T1AAF31A56E6818B07C0D2277AFA9F42453333AB54D3EB33069928ABF43F8679D4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766188912, "uuid": "eaf1e585-89ea-4832-b611-8916414a13e9", "value": "3072:x97pfoarchaseNVrBKtTE2A437cjxkp8XqjYoaPobjM/9jbxZDY2mNw4fHxwd4C:BqhasiVrBKtTE/4Zp8XqMoaPgM/9j9Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766188912, "uuid": "6a73f793-ddb2-4334-844e-d7d5b012bb0e", "value": 171175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766188912, "uuid": "b0986316-d64b-4478-a142-f56b32ffcb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766188912, "uuid": "bacbbdc9-9883-4ba0-bf55-c956a07c1c84", "value": "kvariant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354f03df-dd62-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766207431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207431, "uuid": "0f736d34-3d1e-46a1-a2a1-962317149844", "comment": "Malware payload", "value": "a45e73d0b6d88471ab9b15c8748f91b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207431, "uuid": "c10ae090-b65a-474d-84f5-8e03078c7f2a", "comment": "Malware payload", "value": "695dca7508dc49a73424a59e19dd2868fc4ff4ad6e82f96c58ee655cfe8e3a79", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207431, "uuid": "61337bb5-ec99-4805-8aa7-aed32f803f95", "comment": "Malware payload", "value": "30eb67d52910b3820a720dd850272a3638921877", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207431, "uuid": "24c74134-8839-4596-9a71-7eca3fb454f2", "comment": "Malware payload", "value": "9535d65f185f41f72287ae809d1b44940d80a59fb3d58f8affdc17a74b39e05607b543aa9ad8356708aa3be04728ef57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207431, "uuid": "0a0632c2-86ff-4219-a3c1-0e307654a02b", "value": "T11F3733520C23A783A925B5C6D065A0050E1EFC791C34E5BBAFDEFAA9D40E00B77B6537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207431, "uuid": "8bc9e955-579f-4af0-8f42-9543355e4f1c", "value": "393216:zVdaAgW2FUTYqXmZRgxs+Ohiz+iC9+3jLfizBEOB6yYow1sPFlxmLWO+qtZ/s2wv:z3bgUTXmZRqsni2ujLfizFQyYowcnkvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766207431, "uuid": "b0e9086e-ddc1-409e-bd0e-b6c7ecefc1e1", "value": 24532575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766207431, "uuid": "0a721904-8e7e-45ac-9699-6443d806f151", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207431, "uuid": "dbc6aa4e-a0e0-4b01-96b4-ffb8b3f463e7", "value": "D0WN10AD_SETUP_F1LE_(2025)_PAS5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7aafe6-ddc6-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766250339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766250339, "uuid": "83a886c5-dfbc-4ba0-8691-fc61f550ee5a", "comment": "Malware payload (QuasarRAT)", "value": "f12235345a0119516975421b532a05e5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766250339, "uuid": "59925eb0-d424-4c6d-90a7-79be4370c231", "comment": "Malware payload (QuasarRAT)", "value": "6974d872878e7e41038f27e4eaedea801a38cc0f511fd49b379ccc1c3884db22", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766250339, "uuid": "f5105cf8-dc3b-4874-9ac5-6633eb0af19f", "comment": "Malware payload (QuasarRAT)", "value": "8495ce4a2e56ff6ab64421f5fb73263f4eb7f20b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766250339, "uuid": "057809bc-d9a9-4fe6-9779-a41d3430d820", "comment": "Malware payload (QuasarRAT)", "value": "898a4a3733fe4828dd2f6b623f0bc056e91b3586b0d15ef9ee69f3f3e68f3aeb48b6300553f25938f8714a5922b4ff35", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766250339, "uuid": "56d6814e-f1e3-4bb0-95d8-11217d35d0fa", "value": "T1AEE55A543BF85E32E17BE6B3D5B0545263F0F82AB363EB0B6181677D1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766250339, "uuid": "340cc695-547b-4bbb-a704-f37ed1e8184b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766250339, "uuid": "88c8b0cb-4ef5-43fe-bbe4-74c479fa1ea0", "value": "49152:MvOkl2luaWIuuPjl/4dPDEF8SjgFnTFioGdHTHHB72eh2NT:Mv7l2luaWIuuPjl/4d7EF8SjgFnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766250339, "uuid": "4194b87f-0852-468c-909b-094b30f20501", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766250339, "uuid": "9d9697e3-e6dc-44fe-a7d5-20d048e8491f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766250339, "uuid": "330d659e-add5-4524-b1bc-331a8673b7bb", "value": "WinRAR_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1b378a-dd3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766190234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190234, "uuid": "e099583e-d0a8-4124-a66a-b3b0ef2ff90d", "comment": "Malware payload (Mirai)", "value": "3d52a1ce177562fc9b54f462939bf6ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190234, "uuid": "d9d0af9e-2c56-4c5f-9f86-65a41ba3a8e2", "comment": "Malware payload (Mirai)", "value": "6a606126df8031b2c2d16cea3e459a7beed6580eb746f368eaf75cfcaffd3f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190234, "uuid": "a9b393c9-03f1-4147-b5df-f0d575458da7", "comment": "Malware payload (Mirai)", "value": "c9c8771e85e34ff53b6478572e1066133d922261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766190234, "uuid": "c2f1b6f8-e301-4e12-a8fc-9e97484f50b0", "comment": "Malware payload (Mirai)", "value": "a40d4ca5098cfd0dc024f4833dc03f3357e145206f5a72f6dfc533ed817789719940500d509350c0ceb501f979db340a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190234, "uuid": "7ee2d674-967b-434d-82fa-eb9af8ad7696", "value": "T1CAD35CC6B500DF7DFC0BD33786430916B23AA76435A20A77767B686BED311E6182EE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190234, "uuid": "8be35fbf-df4d-45ec-b960-5bece31bbf81", "value": "3072:8wHIbpsjtInaY6YMXy0+K5dZOupJwVEUtVSF:XobpshIruy0Z5doMJMtVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766190234, "uuid": "6d993931-cb89-4dd3-a463-87acd62e4d4d", "value": 130932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766190234, "uuid": "1d6b19da-79dc-4960-a702-e5ca11c8bd22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766190234, "uuid": "afdcddb9-6a20-4d1a-9de5-b938a9085508", "value": "rondo.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e29cf62-dd68-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766210157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210157, "uuid": "543e0751-6f41-4d00-a6cc-ca8cc8ad2f86", "comment": "Malware payload (Mirai)", "value": "2d794af627e2eca2b5c537df5a097a98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210157, "uuid": "e16b46d2-d7fa-4e4f-95c3-62c1e6358e0c", "comment": "Malware payload (Mirai)", "value": "6bcd18e09bdddc9823c1ebc6090640ed723eddb8d214958ee99d607da2e6d86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210157, "uuid": "fb680731-20af-4f18-9e9a-036e3b1dd239", "comment": "Malware payload (Mirai)", "value": "ca97f31ceb987d1c6e0ee8c2fae0c8d9b6ee008f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210157, "uuid": "788429e2-83e2-46b0-9539-749e07440059", "comment": "Malware payload (Mirai)", "value": "bff27c3c4b97d029667f34842e12ea405fdc8fbd1f1869499867b8c798ae75aa87da7f531407b37d44436e6e2a5a8509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210157, "uuid": "c572b96b-7b8f-4a3b-bed6-8847d38fbde0", "value": "T17823F1AFAD18E8C5DD5C2CB153A846D2AD7860803B5E8B8E936D098186732073DEF3D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210157, "uuid": "a0a377f6-fba3-40b3-9f3a-f7fb6208782d", "value": "768:t5iXeMKbg0d5hMDS7V2tEvdZyeQli3KeEciYAhM9xe7Gt+yE832Z0G5BN+0Syxzc:mXeZh6DSJLZyvlOPma46cyNKHV+0SEox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766210157, "uuid": "1e516273-719e-4786-acd8-9829531a6fe6", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766210157, "uuid": "355ecb7a-8ac9-41e3-bc37-fd24bfa8e474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210157, "uuid": "f79d12d2-cc8a-4075-a3ba-1f3c0634f23d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638bf979-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266350, "uuid": "edbabab0-a55e-41b1-b174-31ac53004855", "comment": "Malware payload (Mirai)", "value": "d3784b8a4eecd1c82bae742bb1b653f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266350, "uuid": "4771f432-379f-41a6-b46e-e6393896ac15", "comment": "Malware payload (Mirai)", "value": "6c109c0a95546cb495003464b596291095e5fc0a9502644b99eaa5cb5f1c0c3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266350, "uuid": "f0ddd9c1-b67b-4d09-b577-05a5c62a245b", "comment": "Malware payload (Mirai)", "value": "73308d5c91bfa2f9a46d1e4bc9de28d0f58a98da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266350, "uuid": "ceeee1c1-9fd8-4a55-8ed7-a741a422ff4c", "comment": "Malware payload (Mirai)", "value": "1ab37bd2d2977e2736fc934e5aa19bd2f10e9ddb629b193a6c8f65d8243ab83bf9d4a8bbae5d30b5f68b3fa45daaeb0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266350, "uuid": "33d30a30-fba1-4cb7-b8d6-a1ff72446870", "value": "T10AE33B9DB402AE7EFC0BD57E4CA70E15FA31E3B12153172A629BFD63A8321650D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266350, "uuid": "a17ce050-2c62-4bf5-ba42-18c4a0f08f5f", "value": "3072:SwzwVQJr9BDFuYEPG93wLbw6hkodsdb50MHp5FEAst:EI5uYEPGhV65sZ50MlEAst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266350, "uuid": "88a11477-4fa4-4eac-9ffd-7858723356ff", "value": 152520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266350, "uuid": "d198df58-3f6f-42a6-87d3-32a082322f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266350, "uuid": "4f381933-db75-4258-9941-e855d063f8eb", "value": "frost.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f81cb39-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235822, "uuid": "dbd5347c-283d-4609-9689-f6183e244953", "comment": "Malware payload (Mirai)", "value": "20c2fec28ecff9a3282b946c48537d70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235822, "uuid": "cb6cbba1-455a-45a9-a321-f6ab5a7e01f7", "comment": "Malware payload (Mirai)", "value": "6c663a5117a4506445d9e293927e0bf16ad4735088b4768d704097ee517d0dd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235822, "uuid": "a1d45395-6bf7-44a4-a1f6-4582ef65ab9a", "comment": "Malware payload (Mirai)", "value": "66d2e68112626140c7bd3aa09815f22a96be5cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235822, "uuid": "7146192b-68fd-42b8-819c-b89a6e9b6772", "comment": "Malware payload (Mirai)", "value": "96f60b243feba66c36b0270b9acc448407c91d2013c779b2d4267b966ef8895b2b426cf83b09f0a3232d5120dc19e557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235822, "uuid": "3c24550c-cece-4b4a-9313-00df9478ebbc", "value": "T17D33F752FC82859AC5C067B2A76E568A73A2A3A4D1DF3313DC584F1037C565F8EB7E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235822, "uuid": "43bf8e75-ce82-4e30-b1c3-2bc0d0e5b4f8", "value": "1536:00qySotgV3657lJ6nn5QPTp5BI/BwGp8:dqyftgV36s5C5BI5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235822, "uuid": "024e15ff-38a2-4206-9017-6c480e9834b6", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235822, "uuid": "3ed5d2d2-f844-4f48-9fff-933ba2dcc365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235822, "uuid": "89f6dd61-dd5c-4c93-b4f8-d772b4be8320", "value": "narm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc6faf4-dd54-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766201517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201517, "uuid": "df9ba952-9488-45ec-a038-cb5085e51f20", "comment": "Malware payload (Mirai)", "value": "fcd8080034c407d050cd8ef1e21a7fe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201517, "uuid": "2b08e975-f7ab-4c8b-b3d2-00a728a3f3bc", "comment": "Malware payload (Mirai)", "value": "6d1e8f244ece4575dd4fa0e405b758ba2bf4b265cdf25eda7084d2d7bd3d1a83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201517, "uuid": "580715fc-5d27-4d61-8706-35e6ad939671", "comment": "Malware payload (Mirai)", "value": "131083bc4464571fb31108b539f5759bc4489c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201517, "uuid": "5de08bef-dc0f-4f1e-94ad-9eb8ec593cc3", "comment": "Malware payload (Mirai)", "value": "bde22b5707f8e2bd24582bffbdf8fa920276183ff78905a57dcc7a39f52d798746b6e3339174771f2ee57382a360cd83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201517, "uuid": "389e73b7-7794-4c64-ac92-7a1a468437f5", "value": "T18F839E37E4255E54C19189B034F58E391B13A2C882973EBB5AE5C6B86097D9CF601FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201517, "uuid": "65e78165-38eb-4f5e-9306-9db3c99705fa", "value": "1536:0agENhFLMgqNw6EWOcrKCTp37SK7riCOMImF7MRp:0ebLl56DOcOC5p7riqJARp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766201517, "uuid": "bc1dbbb7-1271-4959-b31a-73b40efc987b", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766201517, "uuid": "491492dd-45c4-4e6b-8547-50b645d9d5f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201517, "uuid": "fe7004c0-c0ea-4190-a380-d205d3064f3a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e312e1d-ddff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274797, "uuid": "65df3e57-ce12-4c57-a9d4-8a31bd2843cd", "comment": "Malware payload (Mirai)", "value": "19ef4cfbc577e5bec682fbd9e87bab0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274797, "uuid": "e9768477-5fd0-4d2b-9a5c-9fbb736ca999", "comment": "Malware payload (Mirai)", "value": "6d4fa792d76b82f4bb28da3f618984dc423df2ba63cc213534f5434f82bcb188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274797, "uuid": "74cbc6cd-5a9e-45a7-8235-69278ed202e5", "comment": "Malware payload (Mirai)", "value": "b6466920182f17d52048d2f2f7540b796af4e543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274797, "uuid": "3a3053d2-c536-4b5b-8543-4e94905dc754", "comment": "Malware payload (Mirai)", "value": "d389974bc4153eb015c7d20b7ce7bc9456edbde45974941fb0bdee7bf90e005ccc7409c18a3c85c228172cb07339f4a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274797, "uuid": "772a3761-5c65-4fb2-b0d0-576d00b65dc9", "value": "T1FBB31906BB540EFBECAFCD3706A9170520CD540B32A96B3A7674DC68F54B64B5AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274797, "uuid": "2eaa2874-a96a-4d50-885d-446ed1521a69", "value": "1536:oacq0sxcYzHMD5G9VzRusZe5xOB3xdGFSZ5/kO3pCeqFTr6KNckAO2FRR1:oa39xcYz454EFSZpoBNHAO2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274797, "uuid": "669e8027-745a-4d7f-b220-7ebdc4a204b3", "value": 114036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274797, "uuid": "c518e96a-f9fe-4d1b-8c22-8253f4ff515a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274797, "uuid": "b071e857-5cf4-4244-8cae-02ec04504088", "value": "sdxkzX_UXA229x.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e08f63c-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "1488c9d7-3b25-445f-b309-77aded3cd675", "comment": "Malware payload (Mirai)", "value": "12fefc20fcf118d5cf67e5355508f184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "1c1eb951-d681-4b45-b147-4a3e65d2b0e7", "comment": "Malware payload (Mirai)", "value": "6e79f84bb5570366adbf387cb4811f17a618051216f1f95c75f465d80d86c303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "7af8ee4a-60b4-4627-81f0-db93f3793d5d", "comment": "Malware payload (Mirai)", "value": "2d4979ebd5a141d1801ce6eea72cb9524041a800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254342, "uuid": "80e02b31-3628-4c14-bc5b-2b350fa576fd", "comment": "Malware payload (Mirai)", "value": "0b54a16125287baacb5708b9e0f99bb5cee1b36e87d306061df3246bd9c1b13c65ef0e0c9e95b52446f430d34122f738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "79694d3f-5db9-455b-a59c-6e209a133fe1", "value": "T12533F752FC82859AC5C067B2A76E568A73A2A3A4D1DF3313DC584F1037C565F8EB7E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "fa9c2f3a-f06f-43b2-8770-a7d97696cf49", "value": "1536:00qySotgV3657lJ6nn5QPTp5BI/RwGp8:dqyftgV36s5C5BIpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254342, "uuid": "cad29be3-7ffb-47c1-af95-5c75fae403c3", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254342, "uuid": "956d32b9-2ad4-4d62-a0c2-30f4a5e13848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254342, "uuid": "317909ab-4f41-4807-97f1-516397fdc2b8", "value": "io8xouhz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386d4df0-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234495, "uuid": "8158a2ab-f1bc-458d-9f96-7c928801a766", "comment": "Malware payload (Mirai)", "value": "5f916173e5b1b1d22fb50aa51b82c431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234495, "uuid": "efd7c3db-6982-4717-b2be-afebed3b6912", "comment": "Malware payload (Mirai)", "value": "6f2e7d8b2963a6d49eb5d90021f9913445579cc6e2fc6684f1bff1a5ef353c70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234495, "uuid": "34800c73-76aa-41bc-85e9-87ff209c43c4", "comment": "Malware payload (Mirai)", "value": "1f1b670612d98c70dc22907cbf36d2b4f0eaf470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234495, "uuid": "d8f19730-18cc-4f71-824f-caa86b75cc58", "comment": "Malware payload (Mirai)", "value": "3fc2d987305807a72aa7eb9500a222ac327b029c98cd2b35450a60059a32d214880fdda072aeef1701fad7b6b2755fec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234495, "uuid": "290ed6af-599b-49e0-bbff-45c75e5a958a", "value": "T1A7F33A46EB404B17C0D62775BAAF43053323DB6497EB73069928BBF43F8379A4E62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234495, "uuid": "e1a5ca71-1e60-447e-8ec4-c016f701db32", "value": "3072:noWUDaC+aMi3DZkajhh8GNUq8nG/S+L/KybqTAh:noJr+aMi3DSajsG2q8nG/LL/KymA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234495, "uuid": "7d441201-d923-46eb-a9e0-dd8d67309f81", "value": 157802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234495, "uuid": "2511f573-6777-443a-accb-fb94bb2eb574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234495, "uuid": "6418eca7-20fb-4571-bce6-3eca2855c30a", "value": "firmware.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd7a1b1-ddd0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766254769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254769, "uuid": "70b51945-a8e2-46c1-9dda-0830f0bff233", "comment": "Malware payload", "value": "6e94a4fbee23f2a47327a48193d6c0ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254769, "uuid": "fff69280-9c64-4800-a6b8-86520c022852", "comment": "Malware payload", "value": "6f50b97cfaf3b9e36e3b970517cbe56cbb8afc267a30c42985dd36f56f341f37", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254769, "uuid": "c104004f-9a8b-48df-9e56-09b7c8085ae0", "comment": "Malware payload", "value": "720ed8e5d768882ea43c3e2e93a7e9bade26a8ee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254769, "uuid": "992cb866-752d-45d3-aaa9-408c1070fca6", "comment": "Malware payload", "value": "176190f4f6959c7e0e000694bd29cc2e52847361d8d8ad86ba195deb9c973f8e0a3b179b2131a40cc447ced6bcdfb271", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254769, "uuid": "8e7e33c3-3c8c-4c6b-9611-e90ac46c555f", "value": "T12F957D5A6C9008EAD49A633288B35692BB75FC050B3113E72B50B2383F77BE4DD76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254769, "uuid": "40939ac8-04fb-4608-8ef3-95c164e710c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254769, "uuid": "c3ac94a1-57ab-4617-aa56-484c3336c78a", "value": "24576:mz6984M5Np5kicFhqWkRengoL5W0YIW+VGMUjeleN4j42CRb:mzy84SNpOiqq/AngodWHtcUv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254769, "uuid": "2ae18a59-3d3b-4afa-b07a-4f07637bc270", "value": 2013696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254769, "uuid": "52f5358a-ddfd-4ba5-bd07-763fdd18c80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254769, "uuid": "fb04ddfe-391d-4256-8141-b5342a0adff2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5dfbda-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254336, "uuid": "b045bc05-f638-4ff5-ac66-af3d3183c8e7", "comment": "Malware payload (Mirai)", "value": "fa00a229dc5e26b9c6579727dd9aa2a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254336, "uuid": "67c84d4c-f42e-4d85-b107-f6344a062e33", "comment": "Malware payload (Mirai)", "value": "71719248d89b6eb4b16ac9b498884b1e8f9bf21490bb6053bc019de39bcec30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254336, "uuid": "79dce43e-917e-46f6-bc83-c6a3f2e36139", "comment": "Malware payload (Mirai)", "value": "c18b95e036e1e8c83e2e3ad4f5799ea83cd87e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254336, "uuid": "335d9f22-5d70-465e-80e5-a5fefd15e159", "comment": "Malware payload (Mirai)", "value": "365e49cbf720a26da556c3c054c32403feaeb8e6e0f88f84e709aeb4fd2e532bbc327c6f4f1a0a10ae42fff4a96ba63a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254336, "uuid": "0e50f652-43b8-4720-a927-6454ab303766", "value": "T18D13F184517C9895DDE19E3F5E6249CB51CAC2B1A0E9B4BA3A2C432618A71AF18E60C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254336, "uuid": "5ea8c21d-459c-482a-b635-668d43b71b4a", "value": "768:j4DTBFzUZxqD7cDFPSk2HakYGiQfrbMsQh+69ji35IOlFTvE9q3UELfV:0DdFza4Dgpqk2akdJfrbLQD9uqwTtLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254336, "uuid": "d55b3976-4fbe-42bd-a071-b3aedcc69937", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254336, "uuid": "31f14560-79de-4efc-a625-c2fa53052943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254336, "uuid": "4097a07d-0056-4600-a15c-b8629d97c2a4", "value": "z5qiy33g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e7af9d-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766235004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235004, "uuid": "7c4ca43b-0c12-4b73-bc05-416f4ff0b39f", "comment": "Malware payload", "value": "6ca253874b756e858c6f0ec56196b4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235004, "uuid": "ef4b5b0f-541a-49a8-91a8-a0b6e9cf8c63", "comment": "Malware payload", "value": "718b1af17cd6d5a73b98fb1ba4f42062765ec70caccb4887fc4fb94a8d823348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235004, "uuid": "4a772761-aa9f-4347-a656-ea4b300addac", "comment": "Malware payload", "value": "8ddcfc5c4f91199339e60de05aa6e2edc0997033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235004, "uuid": "da75c5d4-2607-45d3-ab3c-3db815a4bad9", "comment": "Malware payload", "value": "45daa5d9dbddc3f3b0b3555eaabfe00b20a2b7970aea3f190fb36d36d042432d252918b0a6b909421d6c33a413bee58b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235004, "uuid": "691ba13e-2696-4614-bd6d-e54f1eede1ad", "value": "T16CD2E09A2B3F4FA9F0F50B346164436F63727477076B8B2E0AC551AA0C6B886FD3C094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235004, "uuid": "38be511c-4275-4118-8daa-e0692e2b1482", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235004, "uuid": "f56ca62e-9737-4ff1-b21c-b2a57c50418a", "value": "768:s30hCIA4ebbhxEtexPlWZPPlNE4QgGAQRj4DEV:1hCp3hBSQfH4EV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235004, "uuid": "8b5a42e8-3477-445c-94b9-0aaaa96e6919", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235004, "uuid": "3db851e9-9881-4f12-bdf7-a7d9c06f137e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235004, "uuid": "883be5b6-11cb-4dce-ac7e-ff3bceefe4f2", "value": "SecuriteInfo.com.Win64.MalwareX-gen.46697692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd82f94e-dddf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261454, "uuid": "ca197fac-513e-4988-a136-889e1ec6d3af", "comment": "Malware payload", "value": "bd004d4845685e11b17c1527b9fc3a89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261454, "uuid": "600639f0-603b-411c-bc33-3151cf22ad24", "comment": "Malware payload", "value": "73d42c4d46173dbbaae5874c2cc096ed12bf6e36e00d5414d4d139c0f74fbf8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261454, "uuid": "0d38e228-9e54-495d-bd3a-954bfb2cb10e", "comment": "Malware payload", "value": "0430c75656ff5d8857f9090bcdae16929fc387ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261454, "uuid": "2207d1b8-3d5c-4804-adde-9b6ef1e6d432", "comment": "Malware payload", "value": "40b91f8ada99a7ac1ebd7ce8e6db95e79a1506e113de834b1a762a00925e746e6ded05d9914baa8bcd7c5c7390516630", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261454, "uuid": "fbf6f27f-ead5-4126-ab18-bdea3f894c75", "value": "T10B95ED578B0DABC8C606694277B7F89D032E6679DE9168C343D93FC0391EB0F5874A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261454, "uuid": "d33bf113-2d40-47cf-94c9-9d4be54bb5fb", "value": "12288:KVIWNohZMDw/wzgZNjUCYDaw9Jdb72WSrl/ZcCAVU2J5nuzs/UmE2:JtZ1Hs/UR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261454, "uuid": "2815526c-c90d-44bb-a32c-3b86b96d54f1", "value": 1988659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261454, "uuid": "fa20227e-eced-4870-939a-c93aed80f2b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261454, "uuid": "26b4604e-36d8-4718-af6f-36f23787734b", "value": "crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db958d53-dd6a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766211146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211146, "uuid": "5ddc6aad-6ba4-4056-bde8-fbb704284fde", "comment": "Malware payload (Mirai)", "value": "863f9f5a4ace0915089739bdceec5476", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211146, "uuid": "10ce16fb-096f-4b30-872f-35efb9c33707", "comment": "Malware payload (Mirai)", "value": "75f73b0f495e4f4d6b3cc152a166e3a41790ddacba2655b8284cd66dfc426866", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211146, "uuid": "f890cea0-ecee-4cdc-8d58-39228d6decb2", "comment": "Malware payload (Mirai)", "value": "9f79f8e42855f711b159d77d3e8b1cb783421b3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211146, "uuid": "37aa72bf-61a3-4b25-b18b-cd0151152c9e", "comment": "Malware payload (Mirai)", "value": "6907fccd15fe91771fa671a51f1a72e478d68893d041f04a80c5f863bf4a8b417fa620a2dec5d8399aa06bb690ad6b93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211146, "uuid": "9833f648-1547-46f2-92e0-6c4aa92dbb1f", "value": "T1F741C4EC3EB17B738582CF04B4734ABD705BA9D466904EECA4BE14F9C5BC914B830A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211146, "uuid": "e960909f-bc47-4c92-ab0a-82c5da2a7df0", "value": "24:z5EMy0MBIWiRFcG0a0RKY6pqufKXRC8Y8i3/D/coT0ET0RUgHBGgHB6vE0EufKX7:z56JjH49KxNVHfHsTGmTPQuLeu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211146, "uuid": "e5a9c171-9f0c-4c80-9209-beed7915cfdd", "value": 2223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211146, "uuid": "db229251-f05c-4f1a-abb3-add53e75736e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211146, "uuid": "aa4a15a2-3556-4f4a-bdef-11b15aef56c0", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6e6d98-dd99-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766231277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231277, "uuid": "0e914c2a-e274-4d6f-a90f-f6a507261698", "comment": "Malware payload (Mirai)", "value": "f596dd10a7c4cd0b16997e01ab6906ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231277, "uuid": "0875d684-627b-4173-a15a-42e0be478798", "comment": "Malware payload (Mirai)", "value": "7650d567c04ce00a1fa50841f42593319fa13f99c94daefc0febae5b48ab00d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231277, "uuid": "5ae9e4cf-26e5-4012-bef4-daed5f14662a", "comment": "Malware payload (Mirai)", "value": "e44c9b6562298cf1e6e7471a9d9f41e449db8cb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231277, "uuid": "d5662fbe-5f86-47d1-9ad5-e02afd532180", "comment": "Malware payload (Mirai)", "value": "757f408c8036dd954283a919488959b07d60be22b865eab8c2608b54103d58b72677f5064c434f79619536c316a27ea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231277, "uuid": "4388d578-8163-4bad-a0c5-4113f4eb5367", "value": "T1B0E3A30E2E254F6DF779C73487FB4A24975973D222E1C689D2BCE5011E6034EA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231277, "uuid": "a223042b-a84c-4291-a0a2-9ff60a9b273f", "value": "3072:XzzwSm2bvBi2RC40sQ96pifXNQ3BekszuheRN3MOBlFs0RcylN0okhD9Ot+bVmYM:XzzwSm2jo74BifXNQ3BekszuheRN3MOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766231277, "uuid": "79e8941d-d06f-431b-a52b-7bd622ea4de5", "value": 144036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766231277, "uuid": "062f8faf-f407-4338-9be4-bc442cc288d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231277, "uuid": "243e2a2e-a89d-43de-a21a-48534152032c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0ea56b-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Koceg)", "timestamp": 1766233991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233991, "uuid": "ec4e0dd0-b4e9-4c2c-b99d-d6111ab5b5bd", "comment": "Malware payload (Koceg)", "value": "8109f24fed6d6aec77b5dcdd065e4f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233991, "uuid": "1f736c5a-580d-448e-af1f-3b9f3bc10d06", "comment": "Malware payload (Koceg)", "value": "769a3560c21201f48c136363fe59683fbf0dcfcbbd034a0f6590c353b4aceb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233991, "uuid": "4019780d-e0df-432e-a7c4-d5baf1caec2c", "comment": "Malware payload (Koceg)", "value": "baa06df7561a3a0bb707056737ec3d5ee39826a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233991, "uuid": "0f4fc5ff-9cba-4498-8f0b-84b7453abc29", "comment": "Malware payload (Koceg)", "value": "f2d41d15d69d0b8613e142d05664ca3a7044694e3cd6b1035b34ba488dfe7883d02d0c2dcbf39f135371101e7a0d8540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Koceg", "colour": "#12E86D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233991, "uuid": "83174d10-8a11-41be-ad2e-41cbe1a48db9", "value": "T15894224FD0888786D66F58B457E27271B634656AD20F83F74F1AACAC33E0141CCB9A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233991, "uuid": "7eabd9c0-15ed-4463-8615-39a5641aab18", "value": "08b656407b8d307979dc72c3fcc683a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233991, "uuid": "72a8fdad-d4ce-4b61-8312-7e28f4a04e9d", "value": "3072:3qPPXx0RbMIH7CNZ2sBrfDU9Mv2b7CzMV+k/7tErHZX0cvYcD+lQLMwsRVXk21cx:AZaMUjYOOzpkTQZult9RN9lOJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766233991, "uuid": "63091f65-bb35-405c-9650-6a9818172133", "value": 447417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766233991, "uuid": "388fa9f9-77cc-4da9-bfc0-27f59c4fa38a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233991, "uuid": "58c2d04f-3897-461e-8fb5-c69f813a23c9", "value": "769a3560c21201f48c136363fe59683fbf0dcfcbbd034a0f6590c353b4aceb09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfbf608-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234209, "uuid": "856c9ee0-4f00-40c8-9809-ae4e562ea843", "comment": "Malware payload (Mirai)", "value": "2ef9a5f204bb2f36ac467d6bf4967e4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234209, "uuid": "2c2fcbdd-5516-453e-ac07-87e4c2be3fcc", "comment": "Malware payload (Mirai)", "value": "77fe9e164889596c2ab9e85550d4b2760bd3de2abd0a98809245189fa596046e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234209, "uuid": "048f25f9-791e-4cb5-a758-ec37c9d58112", "comment": "Malware payload (Mirai)", "value": "591732ff59b3632b45031b6a3e9bd82465e0a3d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234209, "uuid": "66c005b5-8ff2-4862-85de-88f7be8d8dd0", "comment": "Malware payload (Mirai)", "value": "43dddd6e4d846080d62c7aa68328561aa75e60ad2cd437f5affd494a98e5c887a08293e8556fb8b7e1157a6c8f892fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234209, "uuid": "5d019894-9991-43bb-8ba4-f12a2e587530", "value": "T14E51F09F5A61DBE4F0F9D93883731E74434912DB12E68686E1ADCA000E5534EAC6F6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234209, "uuid": "bb86d2fd-1e1c-4acb-bfae-702487f64742", "value": "48:Ep7xR+wJijxGrGEOyZJ7EAEqwSDkInzHhm6uPHxxl9dLhmZIKqubpE68WHyVyfrA:EpX+rjwT7EAEdS4Iz4ppxTdILX8WzjEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234209, "uuid": "e95d5982-7346-418b-aa3f-8c25411decee", "value": 2896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234209, "uuid": "718f80b3-1e7b-44a9-9c20-f3974abda438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234209, "uuid": "7fe0b74f-3468-47c7-adff-e42cb5d99acf", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f866e8f9-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249849, "uuid": "3ad8c64a-9133-408d-9972-bc4539bd313e", "comment": "Malware payload (Mirai)", "value": "17517c13bbc9550f250ee00635a0f4a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249849, "uuid": "bf6521b0-80a9-4ecf-b784-b5f5a0975623", "comment": "Malware payload (Mirai)", "value": "78b1a3a54eab3512fbb4c2e46ab69b412c038717ab023b1e7a586a599fe594d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249849, "uuid": "ad2decdc-d053-455c-90d0-411e5e19ddee", "comment": "Malware payload (Mirai)", "value": "f021c2a61bd23b6733a33a508b03d6f301e39c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249849, "uuid": "c5a66b52-e45a-494d-acc6-9ae6374a0a2a", "comment": "Malware payload (Mirai)", "value": "bc94da83d576b5dbe24b3db54b44133f1f8e2d878713c0f0ec5ac5b522b6c54c853ef8538caabb2f90158454ea7b1f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249849, "uuid": "fd568bdb-d9bc-4144-92f9-7dfeec9fd74d", "value": "T18E936BC6FA87C0F2E85B00715132AB3F8732D9540065CA5AE76F8F35DA37942D6273A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249849, "uuid": "9983f740-7ba3-4350-83c2-59df1472045a", "value": "1536:YgrTPYG+NqaKWvClbW+XkIP2dgJ5689GKQBNCEg:PPB+NNalbW+UIdjkNCEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249849, "uuid": "19e05a7e-804b-4dca-afb7-4d926f30156f", "value": 89612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249849, "uuid": "8eb20078-c583-499f-987c-8006bbf7fb6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249849, "uuid": "0ede2291-7aed-4622-a06c-ab93559af6ad", "value": "sumrak.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eb4cbd-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766211910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211910, "uuid": "1af54cdf-23b6-4224-9c28-e05d55876acb", "comment": "Malware payload", "value": "2009be93f5c0e5ab7db9600e7f4c6be8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211910, "uuid": "37980f2b-c307-4801-b8a9-c9f740134b87", "comment": "Malware payload", "value": "78f7589eb8cad766864d5efe0986aa6175ae646a131583ed616154a72728f83f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211910, "uuid": "542d431e-ae26-4772-8438-443416cbde5d", "comment": "Malware payload", "value": "4a6d30161467ebf8b75c8d172786d132e6742001", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211910, "uuid": "85154c4c-7eae-4a3f-9d2c-acf96829e276", "comment": "Malware payload", "value": "a25efe723edff9412b674d3d3bb4aa4ac6a53d00b8cabc456bc34015356f73e56e24c98ec46c92aa0757fee8e362c57a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211910, "uuid": "f26b4741-e7e1-428b-bbde-9fc0fc38f89a", "value": "T190064B53AC904A69D46BE338D8A26292F7B87C18073132E75F803B762E777C4553B729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211910, "uuid": "693ed2ca-d2b3-4c12-a366-811c2995958d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211910, "uuid": "869449c2-8c74-4854-8333-7ce993d71ca2", "value": "24576:mHQHfAwsY72VsWWYXWQisxDE/+Ff02Hsj28FYwBllhk7PddnA4eLGODtbMRdWe9c:mHoAVYSKYXskDE/+FMi2FYIYdmNGWOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211910, "uuid": "ef0dd03e-35d0-4038-9312-bd8a20656aa3", "value": 3855064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211910, "uuid": "1c27c252-8f6c-46cf-8ade-9e74a5b3ae78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211910, "uuid": "3fec72df-d755-423a-a04b-53b0e158c1ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e855d7f-dd98-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766230774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230774, "uuid": "3be8154e-7db4-4cb8-8590-b87c4566bc35", "comment": "Malware payload", "value": "7bac6ffd0c8c9ac841283fa0638ad9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230774, "uuid": "4be64f13-ab3e-404f-af68-8f24f0dda9d0", "comment": "Malware payload", "value": "7ce29158a3c83fa9d4497b9d46c3b646e3c98806bfd115665e4eb2f4d29a28d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230774, "uuid": "20969205-567c-4cba-8f47-d7eb7f2fd5f1", "comment": "Malware payload", "value": "dcf20b794f1e5bbe6e52202e50fecd3a5e2f5eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766230774, "uuid": "951e122a-ec18-47a4-a4cb-218c2ced4f12", "comment": "Malware payload", "value": "8c4f2187bf0177f6589c1560eaefef88a4a69005d07aaf08a2fe4fd7ed0a8b0379ad5372060188f93eb4cb121fdef491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230774, "uuid": "3d74c082-d11c-423c-a2ed-348d20308045", "value": "T1B7D73353A28E7B3EF0698B354973A950553FA6419A4B8DB785E40E5CCE2F0A05C3EF07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230774, "uuid": "7594996d-e0a6-45f5-82be-de7d5b66d8db", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230774, "uuid": "54e79352-9b7c-4b3a-8099-a35ba0b1b961", "value": "1572864:QOAo0uEFaY/UPVGgi41W1oCZOh53SfUv4XzCGdsGS:Qt91/UdHi4ioiOvCMv1Gd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766230774, "uuid": "02c81ff9-9c33-4c68-9baf-8b0b9009693b", "value": 62556456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766230774, "uuid": "cb34e7c6-eb27-4b20-ba81-e4f0f7986079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766230774, "uuid": "cc7f4449-db00-4b4d-9085-31ccaa61360b", "value": "AlliAi_v3.02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cab7951-dde7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766264701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264701, "uuid": "874ae722-06e2-4c36-8a5f-47b66af72f08", "comment": "Malware payload", "value": "0b194210311d6f168cf018967eb82fee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264701, "uuid": "b11908b0-38bb-4acf-8e40-8bb200793b83", "comment": "Malware payload", "value": "7e35497ecf80015dd462bfee2d5008e36b9c3d5a16ff23d0d158130458fd3bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264701, "uuid": "02822de3-2c73-4d27-97ac-9961118e971e", "comment": "Malware payload", "value": "8665c4f5bcd271542c158b27ff3407665ef35cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264701, "uuid": "4bbf1709-661e-496a-b93c-8e67a096696b", "comment": "Malware payload", "value": "7fe2b10bd04c0ab7dc2ce2ee95b6a406cfc124b18ed37658ad0df4f0b3e8373d1157a902de32bbfc19e8cf229c077245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264701, "uuid": "80f002c2-2bb4-42cc-9131-3252e14db46a", "value": "T1B7A55B01E8529E53C6D16B7AF7BFC69433232779C3EB31065E089B742B9675D0A3E281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264701, "uuid": "92bc3abb-5158-4b0b-b27a-06df112459d7", "value": "49152:OWQ5mOZSkY+Chu0KsqBp67ofm5D4PBqKSxhZXW8toU:Y5ykdQu0gBp6L5DkqKSxjXW8aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766264701, "uuid": "f6d57f2a-46da-44af-bff4-502fd1398626", "value": 2235867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766264701, "uuid": "80f17e50-375f-428d-916d-363190e698d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264701, "uuid": "5bec3405-ff72-4fe7-9863-a85047692890", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cef072a-ddcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766252622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766252622, "uuid": "8d353325-161c-4049-a912-d82d3ba11434", "comment": "Malware payload", "value": "af4f19dbfea6222bb33b78ca8e8abf7b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766252622, "uuid": "973e20b7-abc8-4c23-9252-ec36b9a5bfc3", "comment": "Malware payload", "value": "7e370c8d16a920984f55456dad8b8dc94ab441fcc0de9e8534d33842876b8cdc", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766252622, "uuid": "3e025156-2d18-45b2-adcb-2bb8ee179e74", "comment": "Malware payload", "value": "03c40a5e8a0d22b481598ed4b3cb59c8fa834ee6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766252622, "uuid": "49377bb3-28bf-4eb0-aa38-f5b74156b2b5", "comment": "Malware payload", "value": "9aa906cd19a676c8f48ed3cc8bb7fdf3fa0c7e8130b8a394c6bad338c8e61a2756feb9f7f9ed5c494a7cf5263716bb47", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "Pterodo", "colour": "#F6A800", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766252622, "uuid": "ffcf244d-d603-4bd0-b988-3fe828d64aec", "value": "T194C23A0BF50711A443A77983808A2607EEF1D01A3A39B49235548D6621B3DB6FFDF97D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766252622, "uuid": "d2a80f59-22fe-4d1c-9848-896269823e99", "value": "768:k1KHVNbCgrPbZlZjE5ji7imYLBbc8mXd3j:koHfjbZlZj7T7d3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766252622, "uuid": "9e99a1e1-488a-40ca-a035-c09392a62df7", "value": 26684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766252622, "uuid": "9986cfb3-a7d2-4786-8ffd-0c81edf695c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766252622, "uuid": "231df40c-cfc0-4ea0-a88b-f0ac3037a599", "value": "pterodo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ff1c76-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1766266242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266242, "uuid": "0e7d816c-cc1f-4428-b962-8ad3eb4a582e", "comment": "Malware payload (ConnectWise)", "value": "75a9b8ea52ca5b78b61501b65d0563e1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266242, "uuid": "62c2af0d-4cbb-4ce9-9f6b-8c32aa3e0fb3", "comment": "Malware payload (ConnectWise)", "value": "81ad4b055a1de8b54fb14635c88bb084113198932bcac5fea63504afc04552fb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266242, "uuid": "52d4c7cf-e780-46e4-a957-99d5117c6d8f", "comment": "Malware payload (ConnectWise)", "value": "b5e570bca88af5e18cb7358bc3715fb6458dad74", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266242, "uuid": "dac8e164-b0dc-4e0c-9523-8a13a1d67e15", "comment": "Malware payload (ConnectWise)", "value": "4acffbc6927391b56a0412fa5730d60521c5242a2428fcd94c205aefab1afeaf24e91a48878f65b9ee7ca7ccf0ead43f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "github-pawheaven", "colour": "#203A0C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266242, "uuid": "36c9108a-b91e-4fb6-923b-c84136fcf679", "value": "T1BEA6233167E8D618E0F21B35ED3C25B0A4397D64DA52C21F7399391D29B8F818A733B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266242, "uuid": "b2b6f7cb-da3d-456d-883b-8b8dee406060", "value": "98304:Q4WYIGVsl7GUMBJ6QHT64WYIGVsl14WYIGVslz4WYIGVsln4WYIGVsl:YBG+lOJ6VBG+l1BG+lTBG+l3BG+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266242, "uuid": "b8e08bbf-29a4-4b70-9dc1-b0432f0db503", "value": 10018816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266242, "uuid": "b04b27cd-0c01-47fa-adff-80b952e86b23", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266242, "uuid": "6ee81022-9f26-4a5f-b7a3-5c6b01b15ae9", "value": "Product.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f07f44a-ddb1-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1766241432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241432, "uuid": "c0b6a725-fc12-490e-aa9e-dfd466349de4", "comment": "Malware payload (Gh0stRAT)", "value": "badd6ab01d8a920cf132d042b84c2c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241432, "uuid": "eed22677-29ce-4a08-8160-2bb5e763c10a", "comment": "Malware payload (Gh0stRAT)", "value": "81b94ba031487d0ac6485fa6127f3bb1f368b6a087c8d00ecda5a381bded73f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241432, "uuid": "7273af00-7b42-4c7d-8b9b-9400f61d7e08", "comment": "Malware payload (Gh0stRAT)", "value": "2dec4b3b8a9884b630f3f93c1685142fa174e842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241432, "uuid": "529a2191-2213-4c28-a812-4962f8934102", "comment": "Malware payload (Gh0stRAT)", "value": "b1b600f9eb1d04399243fb25b797c25886fe4fcb63d3600f2a01f358ecdcb23657b8721afc7cc16c9daca90fc0b22a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241432, "uuid": "aafbdb60-69e8-4205-b2fe-344951f8e071", "value": "T16E373313F68D233DE06A993689216950447B7F60663DC8A796F0B989CFFA0951D3FF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241432, "uuid": "3bdcd170-8f6d-4678-8af4-144eac33b79e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241432, "uuid": "afab792a-d453-4fc3-a8f8-c92bea02ee36", "value": "393216:knZrEurAje9O5mH5BW4oSXT2uMkzGdVWBJM6yQsCp7xTRrDp5R8Ec:kZAQO5m3/XquMkCSE6sG/p5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766241432, "uuid": "c911b8fd-8eb3-4cea-8432-2d3bdeea6188", "value": 23930151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766241432, "uuid": "e6a1fc15-3195-4fa9-a243-5e13bdfa7b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241432, "uuid": "f602e1e3-e315-4a6d-b04b-25182c95007e", "value": "British SIP communication lines.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79205a16-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235892, "uuid": "7a827d9e-1ce8-48ec-8572-70e904b98259", "comment": "Malware payload (Mirai)", "value": "6ec36f7c0b916d476ca9e976f0974c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235892, "uuid": "c673ccf7-5469-4327-99d6-7f15356eab29", "comment": "Malware payload (Mirai)", "value": "845ab630fd6d8e39b6168386bdd8eef9d404d545f92b6df754144e8263280368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235892, "uuid": "4f2081a2-ca6f-427b-9251-f79dd45d928d", "comment": "Malware payload (Mirai)", "value": "ad1ad1857278234c8775843a7ad6cb8cba29e939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235892, "uuid": "7991dcd9-265d-4870-a5c9-16f882c27f86", "comment": "Malware payload (Mirai)", "value": "ffd6b87001f0801675c2129c9a51956b0f79c3160e6351ef4f46666bc25c15fb119993cfcf35195220e1f056d243398d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235892, "uuid": "d82a587d-e444-4da6-a289-2044efddd5df", "value": "T1C303E13F94CF6F6BFF99BD389C90C7981BD18C09BBE2AA9790453C021626920D74A5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235892, "uuid": "afee406c-ccc0-4251-b2dd-a9e1e65d8781", "value": "768:LtYhJn4jvND7iIId7/GQGGj5pc+G+p75csXQV+/sXiA+wCkm4uVcqgw0Ic:Lt2S+daCj5XG+7g+0yRT4u+qgw0Ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235892, "uuid": "50058359-65ce-460a-9e0b-ff4be301635a", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235892, "uuid": "ea10efbd-b93e-47e9-96d8-ab35d159d715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235892, "uuid": "073fdc45-3f73-413e-ab2d-adbe30dfddc8", "value": "nppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91356644-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254401, "uuid": "f50a8e4c-57f0-4040-ba60-67cc51688d85", "comment": "Malware payload (Mirai)", "value": "299dd36ad0414099e7afc6960b7eb13c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254401, "uuid": "2e9cdb91-f441-4871-9c1c-761165d509e4", "comment": "Malware payload (Mirai)", "value": "858af8cba31f33905f8aa6bd9e63c8de72687a47621371e290fbc28ced58068c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254401, "uuid": "c1132cf0-a4d9-46d7-a3f0-f5960e398aa2", "comment": "Malware payload (Mirai)", "value": "df7a907320c18fe35c664f2ff99ae74e75df474a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254401, "uuid": "d7a94915-9a0c-47b7-9c5c-eadba5b5f6f2", "comment": "Malware payload (Mirai)", "value": "0068fdfe418c1a827a96c80dcb8e0634d8c0334bcdf69873f27308f554264cb06ead49411fbf23909f60eec8fa2313ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254401, "uuid": "6e2f2d8e-f0a0-4317-bbb6-62358202b07e", "value": "T16F8329C1BA8BC4F6D80748304067F33FCB32E53940A6D75DEF6A9E26D9376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254401, "uuid": "9ee0b2a3-9891-4960-8e86-6cc8683e49a8", "value": "1536:xp8qEknpXLVUkN7lW4HIWRawsK2oXcK6W2EFI9z:hEkp7VU07lBgXK7XX6Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254401, "uuid": "c755fe88-de8c-443d-8e91-844047ac382c", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254401, "uuid": "fb3140d9-e8eb-45a1-9f1e-d2394bfb3d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254401, "uuid": "05475da0-5071-4632-b06d-6e4331ad5908", "value": "w5c9u4xf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec8d8a5-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766234210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234210, "uuid": "9ce495b3-b0ff-4704-a5a8-0d456841dd36", "comment": "Malware payload", "value": "41416a85ad8180d4702cf5e960da2396", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234210, "uuid": "fc49b8e1-a65f-4016-afae-fac5c3db940b", "comment": "Malware payload", "value": "85aa062ecca1b3f308aaa36372892019921b9d0b672b3e8b70d8837c2770255e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234210, "uuid": "70449beb-c7a3-42fb-901e-e13880bc0d86", "comment": "Malware payload", "value": "95b52c8a3d3a386262179247f6c35dd088c9934e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234210, "uuid": "0aa8b424-0491-4aeb-8338-60251d1a0b97", "comment": "Malware payload", "value": "c04b2dce4088ae219bcaa68384b9a9639911b7625a2ddc19a1d5a7d103de4c36eb02c187fce458b49bd584f27c2b1d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234210, "uuid": "7c25f8f4-8872-4c43-9ee2-422fdedb6140", "value": "T186216A6627D25D5BCCA406B7DD9B1710A322EEC490CDBB13F21266120C6F2195F1A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234210, "uuid": "d79378fb-b028-482b-9670-43793935798e", "value": "24:JWYRVCO8DTuJc4JxFSw0AOqF2Uz2IpUmxrNb4Ik:JWWCO8DadfFSwf2IxxrN1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234210, "uuid": "f1abb109-7d6e-4845-ad2d-4a17516d7154", "value": 1268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234210, "uuid": "811fe4a7-0abb-4396-97ca-3b9da83162f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234210, "uuid": "1e6e74a9-90f1-419e-af03-4c2272ae2405", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753ce2f0-ddab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766238892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238892, "uuid": "a09f0dfd-1e66-4775-841b-2fd4529316f2", "comment": "Malware payload (Mirai)", "value": "0ae05f39bcfbc9992ee1f2f0877eb55b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238892, "uuid": "b2206a7a-0a51-48a1-b3c8-9a3e850a09ca", "comment": "Malware payload (Mirai)", "value": "86237cd4f5c0e673e8437adb261b960a62273de43fbd1730f64c66e168f4344d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238892, "uuid": "de13f704-dfe4-43ba-9502-2ae460315a2a", "comment": "Malware payload (Mirai)", "value": "c43da3f0a02e1d2adc0d699f8295bc449cbd73d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238892, "uuid": "7d3123dd-44f0-45e7-9ebf-d034efc3b955", "comment": "Malware payload (Mirai)", "value": "a1beb65c3365de3d038b8e25f1b6384d8235e610cd75ccca5cc3d920227c64af62cd5666e3f3cba12952300fa44c442a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238892, "uuid": "1d5103cb-3990-4bd4-aaef-01d7f639cbaf", "value": "T100D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238892, "uuid": "48a7be82-3bf4-4feb-a32c-8c983764cd1e", "value": "1536:cP0nwryWv+n/qZId+ST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zU:ccWv+X+G8z+x57np0gVPM9t9BBben", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766238892, "uuid": "fe85d980-456c-48a7-ad81-22a495508dd1", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766238892, "uuid": "d7849772-8b16-433a-8861-4962e119b549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238892, "uuid": "b1527fac-f6a9-445c-b874-35e14ce39f84", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3801c737-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235783, "uuid": "40985409-f00a-4a93-b18d-fc7c7041f2e6", "comment": "Malware payload (Mirai)", "value": "bc75ddc3c18ac87ab3301a6fcc4bf77d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235783, "uuid": "c1d4f371-2c69-423f-bd08-6ff39380043e", "comment": "Malware payload (Mirai)", "value": "889aa39252634a01da54f4b6985b6e32986ce7fa1ac458f76377caf47b4ef9cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235783, "uuid": "4cc0c6c8-de62-4ec4-beef-e42807a20bea", "comment": "Malware payload (Mirai)", "value": "717f694740ec687b25129e259dd814579fa4a8a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235783, "uuid": "9a011d05-296f-4e42-85d2-e75abb901902", "comment": "Malware payload (Mirai)", "value": "819af92a790a5be87c7155504bc1a3ee9b1bc9a5678bd43a5a160e6f03327ab61f88446cab0fb02b638a4d12e393cb30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235783, "uuid": "2190bbe2-d752-4bfb-aa65-259baf8a4396", "value": "T12063F131A141F934C87357FB689C0203465E583E7AAE21E77DB60D4BABF86817BAC543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235783, "uuid": "ce8bd9f0-fd74-4a6f-8860-ed8c2ad1ad58", "value": "1536:SG+gYQHTlYJAluiG9m8dYJFAt9RHL9BKxEZk07/SbNoXi:SGVpHTlkn3Q8dcC9lL9sck07uGXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235783, "uuid": "dcbce468-d538-4252-b663-12bb4138bdc1", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235783, "uuid": "3fe7b665-c36c-409c-9b72-cd1c31e997c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235783, "uuid": "ecddae2d-ec8d-47ee-b85d-63cb5dc43ef8", "value": "narm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408c3a53-dd56-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1766202296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202296, "uuid": "46bdfced-58a3-44c0-b2c2-c28dde0a73a5", "comment": "Malware payload (Formbook)", "value": "6c455f788f7ca9c2f6dd3ab51c6a281d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202296, "uuid": "b546f3a6-f640-490d-90af-74899543e9cd", "comment": "Malware payload (Formbook)", "value": "89c232f0c040e54ae9568871262eadec3164ef6ccd10529792c7b949f98b25f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202296, "uuid": "6525a4d7-2a89-4488-ba34-92298e5f88f0", "comment": "Malware payload (Formbook)", "value": "d6431bda1155a0c0052957f135bc8440d8dc742e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766202296, "uuid": "fa89a0b7-14a1-4012-96e5-21e5bff63183", "comment": "Malware payload (Formbook)", "value": "c6ac18cddabdf2bcb2039ca2b96002727707ae75daeabbd6c3cb30b7deec58aae4c3f99773952299235e7a19e0a0d731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202296, "uuid": "b8beb0b3-ef4c-4f8c-a28a-5c4f12279f41", "value": "T1D9E412E06E25AB06CD752BB45821CD70A3710E687015FAD7DDEE6F8777E8620DA08F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202296, "uuid": "312f47f1-1e1e-4844-8797-946de39016d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202296, "uuid": "8bb22742-b4f4-4a57-83ee-4128cd4fc2c1", "value": "12288:1N/wsdj51WYH8onN/DW2wg5aJVQGvwRAw+HnPNnRhaoJ12R76+onexgV:/3F1Go1/5aJ+GvwRRePNnRhaoJ12R76j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766202296, "uuid": "b7761a70-3deb-4d35-8608-f5969179a744", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766202296, "uuid": "acff9d45-5a00-453a-bfab-2790bb14f3d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766202296, "uuid": "7b5b0111-319a-419c-986b-33e962ef03e8", "value": "PAYMENT INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dad3b2-dde1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261945, "uuid": "99e1e80a-52af-4c18-aa80-e2559ffd3280", "comment": "Malware payload", "value": "509e42d3728cc458f930800cd72980cb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261945, "uuid": "ceb2d77d-050d-4244-bb77-dda6e9aed5b3", "comment": "Malware payload", "value": "89de1bd5de5668c392635884968157f3cff863534b19bc828bbf88ab0c0f264b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261945, "uuid": "e20a11af-9815-40db-8865-8bcdec5401e0", "comment": "Malware payload", "value": "c484aa10390f88821df3fbdf32ab2cc274d5f2d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261945, "uuid": "7f83f606-1d3a-4e58-a46b-ad4383a100d6", "comment": "Malware payload", "value": "54d915802a8ecc3a9946fc49760abd0de146e0e0d532cc7b0f4562f631a0bb766b3a42f1992c275203d2007d5dc3f2de", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261945, "uuid": "6e3d7d1d-76a6-4284-9a0e-4f249d510e66", "value": "T14B31CC162FDDC2C9503BEA6738ECE14CE79A59082144354B20DDF5D8D5057BB625B4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261945, "uuid": "36e3b8cf-ef36-47fa-b1a4-be20e06bcb1a", "value": "48:fkss/NLbDLbSLb96+D6QbdJc2eCpqKp3lEDUNW:fkrbKUqZpqEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261945, "uuid": "77d4cc26-a056-4657-94c2-4fd1cd82aa34", "value": 1595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261945, "uuid": "1d29530e-fe3c-483f-ae8a-ea7917b60822", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261945, "uuid": "b402e102-ab38-41f3-b447-189b783ded56", "value": "M.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1392aaaa-dd3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766191913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191913, "uuid": "72130f8c-2953-4db8-b505-609ce637749d", "comment": "Malware payload (Mirai)", "value": "e2918caf25e731c49459bc3d0ee9b514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191913, "uuid": "959a1e2c-f61a-4136-a534-96ee31fac433", "comment": "Malware payload (Mirai)", "value": "8a093bb10c81f6ec5695119a576abfd67645a0bbd7711982c827d81fee295868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191913, "uuid": "d7fb530f-fa0d-422a-9e91-22e57b0d5ecd", "comment": "Malware payload (Mirai)", "value": "671e7b39158dc7b7fe529d4ea2fd141161b8ca50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191913, "uuid": "5dfd07eb-210d-4598-8964-3c4ba9a517ff", "comment": "Malware payload (Mirai)", "value": "96991814e323a950f50ffb2a3c67a00a0c2a13fb133782f6b7fd7f625ccd055e8994d9a9a49e2680d4c2bbc1a09eefc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191913, "uuid": "6a80b703-7488-435d-b5e7-d87ad627d034", "value": "T12FA3B71B6E218FBDF26987304BB74E36A79833C627E1D641D19CD5141E6038D682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191913, "uuid": "7ac3587c-fa90-4d3d-9535-ec4d8e3645d8", "value": "1536:VF7FNcKcr9dfmkj6Lx5A6jVHeG+qvHHEADD:2lj6Lb1jV1+iHtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766191913, "uuid": "45ff925d-50ff-4ecb-a0c4-a8eb95f49225", "value": 106420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766191913, "uuid": "34351029-1fe6-4aff-93b8-e5f437d69df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191913, "uuid": "919473e7-3c93-4358-a167-5f1a96cb7dd0", "value": "kvariant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d6a3d6-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266349, "uuid": "b796604f-5330-42a1-a669-8ee525eeb893", "comment": "Malware payload (Mirai)", "value": "9803d9ef3d650f07df77bf74c927ad45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266349, "uuid": "9fc917ff-ff5f-46b9-9a75-8fc9fa486cd5", "comment": "Malware payload (Mirai)", "value": "8a6ddd16ceeec5a114f3e8319a225ce5f75cba9225d79855231de0b113472d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266349, "uuid": "d8f7bd88-0ab2-4ea9-a30b-324d4a6ec2e9", "comment": "Malware payload (Mirai)", "value": "8b552d53e1a7ee57531ea39d7d413fb4cb79fdb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266349, "uuid": "4727950e-8faa-4bb2-a9bf-d8a6a8e887fb", "comment": "Malware payload (Mirai)", "value": "e65f67630fd51e9467fb58319c53faeb0fee48f16458c0bb169512374de450a29fe5b162dc0a0c7a321097a29551b9ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266349, "uuid": "a9a9ca70-9b54-4d9d-849c-1dceb3a020ec", "value": "T1D0E33981B9C25A27C5E523BFFA6E418D3325A3E4D2DE711798635F2037C691B0E73A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266349, "uuid": "fd0423cf-c1b0-4e7f-a8da-7cac829b5be1", "value": "3072:83IUFhqIstIWkxTsk/Y4rFabolkCY4x4nTGdx:83IUF6YTlg4rFabsK4STGdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266349, "uuid": "96b3dc36-74f3-4b71-bcbc-49533d5b7386", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266349, "uuid": "7ec5d24e-a0fe-4c4a-ad7d-e45a2818dbb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266349, "uuid": "088ec2d6-2333-4a31-a26f-65dcf7db0489", "value": "frost.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a32002-dde0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261716, "uuid": "7082a27c-838e-4d2b-83a6-5ef3812dfce5", "comment": "Malware payload", "value": "10ae2685f82eecdcdb6802e02549a6cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261716, "uuid": "62639d7f-d5fd-4112-afeb-08de2c65345c", "comment": "Malware payload", "value": "8af878a537f2591a9b16b45b0b4e420b69a4038522f01967636caefaf6c5cd1c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261716, "uuid": "01bdbdc3-c1f3-487f-978d-ec9e9dc083ae", "comment": "Malware payload", "value": "c7c83b2048a5d75f0a7ddf4cfd34655579d3a99b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261716, "uuid": "83655029-10e9-47a4-8e0b-e15f846395eb", "comment": "Malware payload", "value": "5bd717f7777d3f8c45344797d95cd2a16ab625c01155b0894e8f8e129a3dca26823bc99dce978a71f6ec074d7ca19ae0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261716, "uuid": "008126bf-048b-4f45-a45a-4e2fca2f74a7", "value": "T101113ACD2310921AC90CDF483F9D2B2C9759B798E5B48F249CD5097E9E9C609B06BF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261716, "uuid": "d1819f97-f49b-4092-99d2-19a450de74ef", "value": "24:pObgjIXnxNI5n01rKDlUpid+tfspiBCqituk2cxKyvYlTMuA:pegonA0xylkiMtfMiIqiQk2uK68ouA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261716, "uuid": "9f243462-a13a-4ba0-97e8-d2065839c485", "value": 1022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261716, "uuid": "eed7535f-0bba-4fa1-8e33-61e9c88b050e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261716, "uuid": "cbf024b0-10f3-49f1-b4ee-bb7dfac902af", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87062e55-ddb5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766243217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243217, "uuid": "f03208c8-68f3-4bba-a490-6295d69009ff", "comment": "Malware payload (Mirai)", "value": "ed2e08c5dd1cdad6c01c96a5c74cfaec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243217, "uuid": "b2672d25-ad20-4bba-9cdf-a751e70923b1", "comment": "Malware payload (Mirai)", "value": "8b3c30d0ed0bcdede43b842168792bb18877ac71d840fee814e765b9e1e3853b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243217, "uuid": "d584c36d-3769-43e3-bf86-a0bdb3c202d4", "comment": "Malware payload (Mirai)", "value": "c90c454e7b5aa696ff3afd12e89488bd26077f96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243217, "uuid": "2fbacbc6-2011-4ea4-a440-d8ece5d267e5", "comment": "Malware payload (Mirai)", "value": "5c7aa34db700e691d4a3eb030036f50acace1ea9df0fbf5b375dfd3f2303c62b070d2ba3933ecc65fffb87b189d1861e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243217, "uuid": "b9792c9b-408d-4e46-84f7-5c552b48680f", "value": "T1BBB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243217, "uuid": "5fabf972-b076-4fc6-95f1-1baa6cd147d0", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1Ok/LWy:c9sSyzz36YaWWgg1Okq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766243217, "uuid": "b1e63a12-5d63-4798-8498-2b0a82fea029", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766243217, "uuid": "67bdc3d2-6e1c-4422-bb26-77fda278cb9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243217, "uuid": "b18dfaa0-f55c-4caf-86ce-adc4e13e0267", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6597288f-dd6c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766211807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211807, "uuid": "a07395ac-7f87-46ce-8eaa-7f78d17393fb", "comment": "Malware payload (Gafgyt)", "value": "39ea4bcfaa410130cc5f8caa4c027842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211807, "uuid": "f789a54f-e2d2-4e3b-bfc4-2d17d497559c", "comment": "Malware payload (Gafgyt)", "value": "8b5c59013b40ab2612feef368e51990d9287494fa32cad512ce234b6de2e4379", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211807, "uuid": "6eaded82-8681-4ad9-a22b-31fb452003f5", "comment": "Malware payload (Gafgyt)", "value": "0110603d14df03dbdc8fe19be725395adbea2624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766211807, "uuid": "d2a938b1-3b72-4a82-8426-235a681ff4be", "comment": "Malware payload (Gafgyt)", "value": "ba9620405edd255964b8ca1e999517406a2a5a7bd62c87cb50d037c53d7acde144f228d66af0fbe983979d635b0cd08c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211807, "uuid": "87bcd179-0bbc-452d-b810-177c220a428a", "value": "T18AA30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211807, "uuid": "ebc2140a-3052-4ba1-ac5c-9ee53c42eb55", "value": "3072:nkrWBIvC/IymEdH8ffi6OKmuxVqDr78fz1e:nkrWBIrym+8y6OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766211807, "uuid": "679921b8-87d3-4a90-af37-6303e755c27a", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766211807, "uuid": "4407d295-2bfa-4ffc-842a-860a9c867910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766211807, "uuid": "5ef1f9ce-7181-46fb-b4d6-df0547139b31", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee940eeb-dd43-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766194428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194428, "uuid": "5cb307b1-0d90-4948-9779-d5aebe5d9c43", "comment": "Malware payload (Mirai)", "value": "ed4d31ec0ec9eed4950dd14583d3ab56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194428, "uuid": "568e1cbe-4145-4fd0-a305-5381529d950d", "comment": "Malware payload (Mirai)", "value": "8cabdd0b563dc0ea4cf699df86a4a14a1b69fc2879508e062a0b6f2b3346d698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194428, "uuid": "03c31af4-941a-4201-87e0-85654c71c1f3", "comment": "Malware payload (Mirai)", "value": "4d18bb6f62d22eff22acac1e7cd66c0767137d99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766194428, "uuid": "8e15b1a1-2ee1-4b8e-9527-16c6f377fea8", "comment": "Malware payload (Mirai)", "value": "6782de9c0ce60ba84603d62c4a9cdd74e108f5b48f58108f3a190bbe5fbb6672f5277732374a84593470a1c76410a86c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194428, "uuid": "52c77b5b-b4bc-4d00-96e5-86f381b31c87", "value": "T1B4835B32BA79192BC4C4647A62F70321F2B6478A14FCCA1A7D720D8EBF6461036177F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194428, "uuid": "107ab570-fc5b-4ab4-ab89-2572fe9655c3", "value": "1536:5U0PeyjJDHxYyWXjvDT5WyrutMBrOvt6yJfy:5zxYNX7DNWIBUY26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766194428, "uuid": "6838e02a-2b45-4052-9dcd-73d47645f079", "value": 86132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766194428, "uuid": "c1b0af06-8273-47a9-ada3-9a6a42fe039e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766194428, "uuid": "afdcc8b6-f9c5-4a8e-b7f4-7aa76f9dcde4", "value": "kvariant.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88106465-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234199, "uuid": "10d1bf25-3e55-45e8-b481-e782349d7cfa", "comment": "Malware payload (Mirai)", "value": "43cca0a8a8611b31c7ecfee65fceba8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234199, "uuid": "ff198104-7d13-4d3c-a4ff-ec086b60db3a", "comment": "Malware payload (Mirai)", "value": "8da12e5698389a1034d4e1b69774500ce57438a4e024f3c9af6295f75b73da02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234199, "uuid": "5ac8768b-c00b-453f-bd9e-b818dbe04f5e", "comment": "Malware payload (Mirai)", "value": "29ee5e047b8365a36a5fee198bf2e911e3706b2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234199, "uuid": "42aae7d9-dab9-4cbf-b66c-5b4ee9087a8d", "comment": "Malware payload (Mirai)", "value": "4a34e84e80ea28a8193e727d82bc50560d51696331ec1a0c3e30f708c9e35b1b46efe12a08122810cd2a3d6d6b1bd38c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234199, "uuid": "03dbb161-19fb-4c97-9113-b22c792e5f8b", "value": "T17F313FE277D30DBCC8E441BEAD1B0300B3289F40E0CA3723824CB759AD1ED789E1600A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234199, "uuid": "0ce67180-3752-4d41-84a7-8cbc1d3e77af", "value": "24:ug9dKGpa7Urz/jlIXKcDAHVR7gwH9iZnBBuLl1Mt9gKW:uAdKGpa7UrLIIGBugtVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234199, "uuid": "260b2169-58a9-447a-b800-eab45a75334c", "value": 1532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234199, "uuid": "da7c363d-516c-4969-847e-64ccc5a62213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234199, "uuid": "5062bbe1-eeda-4629-884d-7e5aace59a81", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5579d6ba-dda7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766237121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237121, "uuid": "d2a5d635-ca57-4541-bb45-cec85d0ef809", "comment": "Malware payload", "value": "cb0246f33ad02448a1cd8b4dc77ef538", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237121, "uuid": "4e64dd79-e7cf-409c-b8aa-67991508bc04", "comment": "Malware payload", "value": "8da9fd778e01e2089de2c8874a80489b0c42afbc3f7499f4a5e6b6cd5c1ca658", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237121, "uuid": "7f40e7f0-c7f5-425c-a327-aeb3ee4ebbeb", "comment": "Malware payload", "value": "3356ad42c1010daa38476211acef7016e16dd4a3", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237121, "uuid": "396f20c9-4c96-41dc-9661-650d3b404fd6", "comment": "Malware payload", "value": "eeedc9e47a4ad3a915bcea950c7a4ea958032fd0228c7193ddfb1905a1782e75cf42580406d26a8d6728835b162f48b2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237121, "uuid": "793bbd31-39fb-487e-8dd5-966c1f7c3de5", "value": "T1F8763394B6D215B3C9A74A30997644A0D32ABC383B2467CB3135F52C7E33ED49F7A162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237121, "uuid": "ff5ccdaf-8125-42e6-b471-e54d2eaede6c", "value": "ec919bb84fb4d65d2172036309a67941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237121, "uuid": "f07f22bb-f80a-47e6-a5e3-18381ce78a03", "value": "196608:KJ3XvIPLtk0fG9psK0gQLUEDl/JB13LK/kr9V:KFXQPLtmpsdg3SlBHK09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766237121, "uuid": "a77a956b-d4bb-44ec-85ab-fa1e51472406", "value": 7201280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766237121, "uuid": "fda28f43-975e-48ed-a568-8bde1e431920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237121, "uuid": "c6b9252b-e187-4cce-b5af-ee38f5b553e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eebe0d-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266361, "uuid": "0a28c3b1-b580-4fc9-aa44-aec0eda7e8a7", "comment": "Malware payload (Mirai)", "value": "b4c1b891446feb46e6777332bea910ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266361, "uuid": "eda611be-5b28-4959-8d8e-3184a94bfde1", "comment": "Malware payload (Mirai)", "value": "8de325e94e111abd908aeac2cd223b27f920a54d80b9f5eb2bc19a58849a6d88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266361, "uuid": "bf1aa518-9541-4911-ac3e-c60318d24b9d", "comment": "Malware payload (Mirai)", "value": "d74e1fe9f8ac29149b5893c5a008685996573181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266361, "uuid": "735844e8-b6c8-44ae-bccf-9e92ccecc0c1", "comment": "Malware payload (Mirai)", "value": "f703be023c4e2657ec904564c0e3cc10a475a6dd8c1575eeec6c2d73bddcf07218411360719199707257f4445aaf4e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266361, "uuid": "b4a32baa-246e-4e39-9d99-7cfd55da82d7", "value": "T1C0E3492274791A2BC4D6987E91F70B21F1F1D7D929A8D90E7EB20D4FEF202502713AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266361, "uuid": "b8f7c285-1e49-4dd0-b522-8d5a21d696c7", "value": "3072:MPXI8371j5SWNwhdg5Qk7NQX5qcXHqwAH309CryQl8x4bCfj:P8Jj5SWozk7kq5XYQmx4ufj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266361, "uuid": "1ca808ea-9491-447b-b397-31fb3bf036c0", "value": 146048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266361, "uuid": "e441d16a-fb2c-4570-b488-7db868179fb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266361, "uuid": "897c09be-4f31-4386-9058-fe92dc904181", "value": "frost.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1db14c-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234203, "uuid": "a1452eb4-a9bd-48bb-b526-eaa58834bc8f", "comment": "Malware payload (Mirai)", "value": "a5d92462f85a0429f36fa6ed6f30a496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234203, "uuid": "d59d1752-ba79-4d67-9ffd-04755f60649e", "comment": "Malware payload (Mirai)", "value": "8e31092c2ca124405b69324a3bdb2d89ac546e727b432bddb4d913ef7d77b71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234203, "uuid": "2b137401-694b-47b8-a14e-c4552d591792", "comment": "Malware payload (Mirai)", "value": "5ee0646c855c8f73370aecd288ffb45504b978f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234203, "uuid": "2ca19a85-985c-43f1-ac1b-c8281f681931", "comment": "Malware payload (Mirai)", "value": "d4bd77c3defb69d0ffd2a5db039d1453c67173824bb2558a9b831e6c1d661ab27869317bc84cc3b6c82bf7e7980a228b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234203, "uuid": "5f31cb1c-d413-43e2-b90c-985e092be937", "value": "T1FF51F2AA5F903D3BDE6BDC32056A975A23DC804F63996F865374E800BE0664552C3DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234203, "uuid": "64e8ce63-73b6-497b-9a91-9c6bca7ab5fc", "value": "48:D2EMtlVmbHcFliQDit8i1fimzpw83A52iRJ4l5rrJLXawZ/0XVrrvJFV:D2ffVkcFliQgNzpw55rJ4zrrdXai8XRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234203, "uuid": "41022ee8-5bc5-42d9-adae-183544e41331", "value": 2688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234203, "uuid": "efca6540-52a8-452f-bdea-301c6702d2d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234203, "uuid": "9893fb1a-a282-4e78-8938-95ea2ef252cc", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ead403-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249822, "uuid": "5d521672-b53a-4355-8f71-f161efb52d68", "comment": "Malware payload (Mirai)", "value": "c70020deb918602d6e5f7eac9bccf89f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249822, "uuid": "75a6701b-27a5-4ade-b312-f36321fcde14", "comment": "Malware payload (Mirai)", "value": "8f18c738a20bf65a34ab2c701c018eefe824bb2ff912a2b3907804de87af7f6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249822, "uuid": "5c031dfe-827d-4711-a2d9-6944b9ca70df", "comment": "Malware payload (Mirai)", "value": "2c36c1d11e1ea8811bb91d8d02503af82e6a0738", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249822, "uuid": "b25026b7-fb4d-4a7b-a096-0ca4cc6f83bc", "comment": "Malware payload (Mirai)", "value": "6ddcf13d778897427ffd7a6d4b49f5c6e8008f5ace2911dedfad77af33a46be143dce2a35572825c8519387b52e22ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249822, "uuid": "89c2570c-ab16-43c1-9c51-fc8e8d793b78", "value": "T19303F11B40B8121CCABE907208D79C4F5184C70C994FC1BDDADDA77D9527F1A5948ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249822, "uuid": "3658a89e-8336-4d3b-b3c1-1db159ee812d", "value": "768:M0j10/oBofL/LsmWWEUTccXob2Hx4OQ0fgrXMYLbnbcuyD7UHQRj/J:71sfL/LsxHUJXob2Hx5K8Y3nouy8HyjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249822, "uuid": "f05cd519-e1a6-42e4-92dc-301b5bf28c40", "value": 39968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249822, "uuid": "e89ed65a-cda5-4ee5-aa3c-c0c63ff296aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249822, "uuid": "b19eb2c2-632d-4e49-993c-dff2a33ff197", "value": "sumrak.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1bb41a-dde5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766263792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263792, "uuid": "9b232503-8050-45dd-aad0-58c3d4dc978c", "comment": "Malware payload", "value": "44652be9dc36c33ef0a35d4422523f7c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263792, "uuid": "d5baf5d3-61bb-4ca4-9d00-259d5c7b611f", "comment": "Malware payload", "value": "8f4836cca1850053e87a769a84baed3cdde060ad3fce26f101a20b37375835f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263792, "uuid": "0f66cdaf-47fb-47ca-be17-78a34678cfd4", "comment": "Malware payload", "value": "675ce37d4549fb9e2fabee91befa53c0bac157e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766263792, "uuid": "7b38748a-5ed4-40cd-8215-9367321c548c", "comment": "Malware payload", "value": "378d1f4ce1a1edab22faf3f8d8980060ac5a188547469a60e8f2d3dd784cef032a12130d542a2630dc5a02cb9e7cd6d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263792, "uuid": "0ccba066-7541-4b65-be5e-44e374fb5fdc", "value": "T198D633947931DBED3BC27E412F944AB9BA6185113FD441ABD6222210993F3DFDBCA407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263792, "uuid": "e99f921f-d41a-4761-8cfb-ce7575db8279", "value": "393216:ld6Gn9v3wyfEotZEOHB7RowsY3UPw/pZI:T6I3NrHvo56lZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766263792, "uuid": "da92eaee-ef38-4e61-9511-fe5a11594f4b", "value": 12853676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766263792, "uuid": "42164ee5-ac31-432c-93c6-c3a82624a6ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766263792, "uuid": "fb4bdf75-c6ef-48be-9db4-24be4bbaaf40", "value": "Proekt_prikaza_681_o_pooshchrenii.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d6d033-ddda-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766258883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258883, "uuid": "f2dc3036-1c65-4f85-b11d-7b8eebeac037", "comment": "Malware payload", "value": "a7e91fd8707d3def7c1a16bf5a3c7045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258883, "uuid": "84241f9a-4e01-4caf-9cdf-7827bdab6e21", "comment": "Malware payload", "value": "8f622584f796c260732cd340698cf10568c396ae7994c8e11b186fa367707b2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258883, "uuid": "fb0cf1f6-e6f6-47a2-9fd4-fecc3ca3727e", "comment": "Malware payload", "value": "2a187641691d03e7ccd0d6418712ac8767fbc103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258883, "uuid": "8dec47c7-4d0a-4f72-b848-ffd60ffcaf54", "comment": "Malware payload", "value": "1215b4086360da9b960dd4415265cde1cf0672aeebc3982abd423bf1b22f249d76ccbebeccee508de741aec9c2ac0a86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258883, "uuid": "36baaf29-4c78-413b-9a62-0d10e4d48362", "value": "T1A5A34B13E693C2BFC4E3A6F62BDBC5219923F4391B36620933DCBDB56B15AD85D18201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258883, "uuid": "8c0a8dd4-90fd-4375-9f91-5f2d14a763a0", "value": "3072:GZcEp7Hm3o4QRUUje4jswwgYwrUBGBqkodyk3GmX0VA:hQRrj/wgYVkodyk3GmX0VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766258883, "uuid": "18714a21-87b3-43a8-af01-167360574ec9", "value": 101625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766258883, "uuid": "1f1af8bc-6500-4107-9ba9-c9073882879a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258883, "uuid": "3707b3dd-9e7f-494f-902a-7cc5a9a4d757", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d53d0f-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226649, "uuid": "db71dbcd-55ad-4e50-8531-91e992f2afe4", "comment": "Malware payload (Mirai)", "value": "c3ba6d9aef35dca0b614a463dd00104b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226649, "uuid": "b10ce56d-4919-4c01-a066-2be1b31a03a3", "comment": "Malware payload (Mirai)", "value": "8fc063e2c58eadca3bfcd5c835a4e751e9b0d962f184d094aa5f0c6e3dfa0919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226649, "uuid": "dfc418a6-5a7f-4375-b82b-6584ac8446ee", "comment": "Malware payload (Mirai)", "value": "7b3602af57c31f375f401ce6a2c796e2708591b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226649, "uuid": "23c0a1f2-b8dc-46f3-886d-fceb7e4eb645", "comment": "Malware payload (Mirai)", "value": "d363c74eec49d78f0d3a6a3ebb2f7d269e3606381735c9b3e0ad5f6b7fb386c1208d6997eb577e9e06f9d0da251a9a4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226649, "uuid": "ce30f10a-4f93-4af7-9879-3bdf21b947e6", "value": "T1A73319B8154AF1BCFDF15078F04320EA2962051C369DE3E3B4970472EAB9B4D795AE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226649, "uuid": "d174bc67-4809-428e-b385-4688c4d2514c", "value": "768:BvUhdcbK1X7gIU25H5aKyyusayLzQhGGv8:Bz27d1gj3sayQBv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226649, "uuid": "0344a735-2723-4f2b-bd10-16dad46565dc", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226649, "uuid": "b1f62d8f-781d-4e38-892a-cb69e82fc577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226649, "uuid": "0e397a97-2117-41a1-bf73-12509495e8eb", "value": "kvariant.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f73b91-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766249825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249825, "uuid": "ab6603d1-81fd-494b-975f-7d636c56022a", "comment": "Malware payload", "value": "58e62ae3b5e8563c4abdf7501c0f715f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249825, "uuid": "cb22978e-40a1-4976-95a9-6ec711b1fec9", "comment": "Malware payload", "value": "9069e3de3de3894c0800ea0b0c01b19efc237033b7c6d1df04aa6bd7eadbf2c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249825, "uuid": "6a4c6765-0bed-4296-b85c-aefcd26d437d", "comment": "Malware payload", "value": "9ed2f9c902927b456ee97a505d207a521e25e208", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249825, "uuid": "4e6d6085-7170-4090-a0c3-f82e1f17a001", "comment": "Malware payload", "value": "314640832e26c7349c75b04a65f13ca54c59e68716338e08fe9f583bbb0bfd51be27e62e4d21aa0d99d4816e8ca7d52f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249825, "uuid": "e24b36ee-f342-4d10-9fb9-dc4cf00d49be", "value": "T1A1212CBC07B1A9425E449F48E46BD0CB911EACF9B5AFD912E0771C3D809432B30E5676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249825, "uuid": "249c9a9e-9057-4bd5-b8cf-4c7fe79a565d", "value": "12:3J3bQr3bQ18gdbQtNI2nbQexKdGSbQhbQnDvbQdW/9dsbQdRJR8RzSR7bQSa5aS3:3J3bULiVmNI2lKdh6ejA+32d+4qAjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249825, "uuid": "d8809314-8b21-44da-9ab1-30fa8d260fd8", "value": 1118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249825, "uuid": "39bbf869-724a-4f9e-9480-d53a8bcb3a2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249825, "uuid": "8697b2b8-b4f1-4f1e-a6ad-c583c3fd0d5c", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ac4a1f-ddc9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766251831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251831, "uuid": "a9cb49ea-e738-4845-b745-56c72517805f", "comment": "Malware payload (Mirai)", "value": "0dfc97dd31a339ff0b261d229477d0c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251831, "uuid": "fca1e665-3ca3-42c9-babb-43565b62d217", "comment": "Malware payload (Mirai)", "value": "916746c949b22bf302f611e2309f1bc6296b42f6687826dade74edb37c11e769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251831, "uuid": "f2751403-aebf-4bd7-88fc-c0baa2303fb4", "comment": "Malware payload (Mirai)", "value": "199709fb2f69cc9f26ebcd4f739247974af1f7cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251831, "uuid": "2dd4f08b-1dd1-4598-b029-1ee56e8bb7db", "comment": "Malware payload (Mirai)", "value": "896007534d1fa2815e8064c6431ab672836d0183d00f09f9b02007f9a39d3304e5ce0b95729bf686ae7a6eb35ef7f38f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251831, "uuid": "20030da3-2df8-4849-a8e8-66ea7f11fde7", "value": "T1A3765B13FAA264ECD9BAC834831EA633FA35B84D01217A772BD49B213E55F106F1DB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251831, "uuid": "ce7d260f-0e38-4df3-902b-22c81bc0d4da", "value": "98304:4n5/Nmkn/YVw8TgT/JzmpqLNyu1YvBvqJXDZdt+Fo:4aKQK/Xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251831, "uuid": "f53237a4-d6d6-4c26-83d5-c675cb82ab9f", "value": 7419472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251831, "uuid": "512c6556-e341-4009-aa28-a19ec71fb70f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251831, "uuid": "18087e01-f5c2-4cf9-bf38-ec46df5a9bbe", "value": "batirj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf8f6d-dd8c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766225726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225726, "uuid": "d989fe77-93c8-420c-9ad8-8727cc8f88dd", "comment": "Malware payload", "value": "399d8f4627b46bdc03008be842817676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225726, "uuid": "99bca309-3f3c-4241-aa0a-2e80bd1a3345", "comment": "Malware payload", "value": "91b89db9ca99f750269e13a5ce09ed159c8312faf9587856d6f82c700080ae78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225726, "uuid": "c0d227ae-6061-4c3d-9ad3-291d9e39d31b", "comment": "Malware payload", "value": "8dda215e8ef87faa118ec55d731cc6646d2ce199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766225726, "uuid": "4f673375-b8c8-4b6b-b971-8596e2b1a6f6", "comment": "Malware payload", "value": "bb4a131602b9ca6a71c1734fd6123f020e1a4b74ca2d2f423e08124f8f772b3b40393664837d596f142d4068d1d3bd1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225726, "uuid": "3df05f9d-6dbf-4e3f-b80a-ec387ffd36bc", "value": "T127531B1BB35364ECC62AD57486EFAB33B671F8634630AF3F02E4E6702E11E601E5A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225726, "uuid": "2142b2b7-3c7d-42ae-b339-7e3d3182aa09", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225726, "uuid": "e4282229-43f0-4fc8-8e4c-68e682b5fdf8", "value": "768:7cGovCAeG58oao/JVTM5y0VQu0hseQzRxUMUla8vX6puvf1bs9PDV0gOiATWhea:IGoyzo9onqrqcvlP6EvfaZ0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766225726, "uuid": "f9d84584-4844-4e18-b295-f34dc6ab7629", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766225726, "uuid": "f68a2bce-adb0-41a1-a5fd-c19e6b5e4daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766225726, "uuid": "f07c06bc-6d9a-4da2-b402-953465c70f86", "value": "cbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c7de48-dda3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235652, "uuid": "a69d82eb-c38d-4dd6-90f6-43f5944ebea9", "comment": "Malware payload (Mirai)", "value": "1e62248a3e66bf5717a3a341d920aed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235652, "uuid": "bb098939-45a7-4883-8f73-752c9741d9ef", "comment": "Malware payload (Mirai)", "value": "9283905149996949c5ae7f61d4cc9bcb26dbde1fc13d859dcb0e3db6da8dfc6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235652, "uuid": "e3840a3b-1795-456d-9e37-7bf34d61eec6", "comment": "Malware payload (Mirai)", "value": "6e964eee2b03841c32955651efb5ca3165839ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235652, "uuid": "ec9dd1c1-ced2-4959-87fa-de7b14bfcbeb", "comment": "Malware payload (Mirai)", "value": "5a332e9bad294fe33269df6a926f372abaf919995a95e8e0b2a4e861e6713aec1641c36087627bb7b85eb242e6bfc66d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235652, "uuid": "8b5693ab-c140-4d0c-a8e9-a21107c26aef", "value": "T1F7B34A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235652, "uuid": "1ec68fd2-2820-4176-b90f-0693b12016b4", "value": "1536:1a97/6/q0AmnCl5L9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HCl5Zn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235652, "uuid": "5f79ade0-dfc4-478c-8e5a-b18f11a9eeca", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235652, "uuid": "cacaa278-bbbd-458d-b686-729c4f333430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235652, "uuid": "db8de047-0693-4f4c-a135-e039e4d127f3", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eba7ae7-dd3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766192388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192388, "uuid": "bf6385c2-c350-43c5-92e5-d43f9c03d5b4", "comment": "Malware payload (Mirai)", "value": "44669f227c04ab41375427463a1d909c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192388, "uuid": "cb1bd97e-72a3-4463-ba7f-4c322d99618e", "comment": "Malware payload (Mirai)", "value": "928d101b33e8a77fd10953f11ec339510ab21adb5019c0433120c7fb93a3e811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192388, "uuid": "7e2e1c95-22ae-4971-a83c-b6a4dabbb076", "comment": "Malware payload (Mirai)", "value": "bbdbfaa2afaa651452703fb13a6d65de0b3fab0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192388, "uuid": "1b34bf51-d983-4137-a573-301ba1dd797e", "comment": "Malware payload (Mirai)", "value": "128aa73716a1d5b094ea2306f66118616bc844a69c0bc6bafdca75de83e568f38aef111dc0ab5b4ac1ab05c3532f0ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192388, "uuid": "a77f88ec-be48-49c5-add8-79dca06a090a", "value": "T194E3A30E2E258F7DF769C73487F74A30975973D222E1C689D2ACE6111E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192388, "uuid": "52ac44fd-5e45-4c3e-b52c-cbd563d9e370", "value": "3072:yOAAkt4BJ1rRCq0T0e6NT2EwyIaOQ1dI5pR335jybZwa73NCrbp8+lY5MAoa/MDT:yOAAkt47IqVT2ETfe+Z5yW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766192388, "uuid": "e5716a14-f180-412c-8a92-bd16fc20b4ed", "value": 143764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766192388, "uuid": "0c5d7c9b-b01c-4bd2-afbf-d6c77a103a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192388, "uuid": "e1f4e566-5da3-4262-a743-f598feb6c403", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a185068-ddd5-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766256858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256858, "uuid": "ed1e39b8-1c43-40db-af27-1cf13da7ca29", "comment": "Malware payload (ValleyRAT)", "value": "f1ff38606c229834a91d48f484568782", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256858, "uuid": "067f9ba9-3c06-42a4-8288-84287395105a", "comment": "Malware payload (ValleyRAT)", "value": "930fd881cec8867db13d789dd138441cdf2df2a05df8804baa93c267b5934940", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256858, "uuid": "44a0fc0b-3678-4d28-b486-b01be9734f02", "comment": "Malware payload (ValleyRAT)", "value": "90c27ab4e88271e4828472e5c24b5e35ff09cbcf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256858, "uuid": "fa51690e-b70a-48ec-bbe8-ace6a3e75046", "comment": "Malware payload (ValleyRAT)", "value": "c7f8954bcad064f0bcc9102a3dbd1c30e58026dbdb93f0d4f620976ca3de1bc4442092350aa5aa97878e0dbbdab4c0dc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256858, "uuid": "145fdb92-c9a6-4465-bac7-11b50bb0f74f", "value": "T1A6373311A287C436D55D4577E96DEE4E1978BEB30B3040C7B7A93DBA88F18C29279E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256858, "uuid": "f9223df6-5e32-4c26-9a4d-eed5d4b3f258", "value": "393216:+tDBuR7XQQ2ZH3EQecV5KwbNeNYXcSotiErB+6mJdi7hfEeTi5:K1EA5KwbgGXSt/wf07lb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766256858, "uuid": "6f1d1f72-974a-43e0-86eb-2dfd79172873", "value": 23667200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766256858, "uuid": "be514266-616d-43e6-9f8f-a799d420054d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256858, "uuid": "bec3580c-bda7-4c5a-86a9-b4536f2b8c63", "value": "f963.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71221508-dd8f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226859, "uuid": "455fa27e-413a-4453-a483-61a0000dbebc", "comment": "Malware payload (Mirai)", "value": "9b4298632d3e51e40a3dc89d8bc71d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226859, "uuid": "47104098-d803-4f09-93c5-e049c132c20f", "comment": "Malware payload (Mirai)", "value": "946ab377a4f6f2cd51544054aa1625388ad7a897b3e30670e71c8d14fe04e212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226859, "uuid": "3a1de8cb-32e5-4eea-b4b0-21cb98b6b534", "comment": "Malware payload (Mirai)", "value": "2e860817e4ec9b86bfa0d46400298b1eff6771d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226859, "uuid": "8accec83-ad65-4e5e-9417-7d71d0f401c1", "comment": "Malware payload (Mirai)", "value": "39fd9d05df9389ef45c1b5ea5000b9c6b05a3133f06cbd089ef42f482b8e7d3220744768fe8e007782c55320702e0d0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226859, "uuid": "d863dab7-9a69-473d-842c-4ddef06a0363", "value": "T199831A85BD829B13C6C1127BFF5E4288372A6398E3EE3213D9255F2537CB56B0D2B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226859, "uuid": "7a8ecf66-db8c-4048-b178-1f19f29a6000", "value": "1536:6YWvtNFhJ6hbK5kT2nCu4s34SBZyOb99Kx2l8b5MJTIif:6YW1NFjaFT2CupDBlgol8FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226859, "uuid": "0e920bc9-27c1-4541-9694-c9f1136509e5", "value": 80796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226859, "uuid": "96341c46-eb6f-41bc-998d-9669fa694d43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226859, "uuid": "47cb046f-4652-41d3-9e2f-519c099b54ac", "value": "kvariant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470b776d-dd9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766231513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231513, "uuid": "44dfc9b6-72fc-4880-a3fe-e6fdb3c8f399", "comment": "Malware payload (Mirai)", "value": "d9b152734b0104d7b25508adcc0bf7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231513, "uuid": "dae058be-1425-420f-9df7-1eedef2ca15e", "comment": "Malware payload (Mirai)", "value": "95121b0529c437d15fdf05df549b37d9516f1c31a26001482b0f0a4f32753367", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231513, "uuid": "36282f14-e8f6-4930-bb21-f79310975dd2", "comment": "Malware payload (Mirai)", "value": "c7c922c2bbaf4a1ab1032c596197c691d9f2ad64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231513, "uuid": "e2e133da-0db7-4546-8ba8-9627898bb331", "comment": "Malware payload (Mirai)", "value": "4b3d8af8929d285d92b898c216b0694aaa1d760a91643d1656d9c67eccf3f72315bc655e977498800fa696698bd5b4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231513, "uuid": "d0bd43dc-aaa4-4130-9e19-a82b51a44274", "value": "T15AE329DBF800DDFAF80AE33748530906B630B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231513, "uuid": "2fe791c5-6400-4287-ba79-6ed217fde9ae", "value": "3072:jRsZqdhrvKbbWOftDA4EslibVrjbiJLnN+eAyaih7a:ts1nfhAUliwLnNMyao7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766231513, "uuid": "4726a985-2f30-4c3d-a946-5318bcca24a4", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766231513, "uuid": "a7261855-f28e-4cbc-b7c0-ccdc634523f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231513, "uuid": "38cc1c81-9903-446d-a4d1-4fc6aa44db7e", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e6271a-ddd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766256791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256791, "uuid": "da97b8bd-67a3-46a4-a836-6a48b9c05b95", "comment": "Malware payload", "value": "6bab51bfb33df640cade7842011838c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256791, "uuid": "55d64ccc-7507-4d14-bde1-2038489ab379", "comment": "Malware payload", "value": "955355b4318989a7fd1332f99553879f98e842709609218ce18a6af9b1461233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256791, "uuid": "feaf4980-2b33-489a-8247-284ab4da8f14", "comment": "Malware payload", "value": "cafb390b0ff6261d37900adeb6fe972563d57e28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256791, "uuid": "6737a9d5-c31d-4d3b-84b4-d5d9ec37763d", "comment": "Malware payload", "value": "b7db010c6a03076e191442b40e4526481bd25366edc365e7fb7d6caf6a8aaa00d347ca2d65352cd65cfb6e9d00b6d63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256791, "uuid": "7573beca-002b-4869-a48a-bd321a28979a", "value": "T1FF373396C01F40D6E8680538801B5499E0977E8F2C32E7A7E688FFE3B17B51A56B711F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256791, "uuid": "7d1e293a-c669-420d-9321-06e9f7e535c8", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256791, "uuid": "7135bb4f-d375-4507-adaf-09a49f2d9463", "value": "393216:6kEolc/CHb420NO1BvDog1BVfso0vBCKugdHG/DDzGyEmk0ltd0veDNRtXjjgDKc:6kEolcKHb6NmDn/Vfso0vFu5jGRAumbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766256791, "uuid": "747550af-fb2a-4444-b2d5-de20598aa639", "value": 22616784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766256791, "uuid": "57b5608a-d002-4c79-99cd-6caa74f81af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256791, "uuid": "ebd8fbe1-339b-4e5e-908e-789f2464fd9e", "value": "LetsVPN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b3bb2a-dd87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766223290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223290, "uuid": "fe79e314-9aba-461d-9807-285d6e19a245", "comment": "Malware payload (Mirai)", "value": "f9f929f8999171adcc716455cd1ce2f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223290, "uuid": "24fb6e81-bad1-483b-bbc3-19f258822137", "comment": "Malware payload (Mirai)", "value": "9597a80f69b1dcf45c78cbb72cc519e19c4299eef0d2b3e6c3bdc9aa19210255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223290, "uuid": "08f17be2-e3e2-4f81-aa5b-3fd1da365c83", "comment": "Malware payload (Mirai)", "value": "47f9458aea8ff83113947b48ce9bc9182fa77dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223290, "uuid": "f8fc1bf8-0254-4513-9987-9b4abbc19396", "comment": "Malware payload (Mirai)", "value": "2b71e8af663a295dbaec057b7d9d35b6afc58be325e126c59538cc08491111d7c59647e8162811845f4c1f5c23f7192e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223290, "uuid": "ccc6959f-273c-47ae-a6c5-99ff61d64ff5", "value": "T1DF248486BFA03FFFD81ECC334195DB0A169C890A12947FB66A74D508B68B14E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223290, "uuid": "dcdcedc6-24b1-4d1f-80af-eab6dac47d64", "value": "6144:Q1SR66A66AAB/RtttltKxX/EgHdeWXVh+IJHUmj5BkYTD1BkprMBaXc0:CMnz8MfIA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223290, "uuid": "d877f29a-d949-42ea-b153-ab32cf44de83", "value": 227644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223290, "uuid": "c100d477-2cf1-4c3c-804c-35e8f96f4a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223290, "uuid": "bde279c5-6915-42c7-9e3f-dda88cd5986a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844aae21-dd63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766207993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207993, "uuid": "525397dc-607c-446c-b193-ef807eca726d", "comment": "Malware payload (Mirai)", "value": "b805b3606c4101147dcf9136242ff32e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207993, "uuid": "9762e5e1-5741-43dc-b5c2-eb506f358346", "comment": "Malware payload (Mirai)", "value": "970d48b9edbe3f7877701b695eec9e47f7f64409a951de973b4e40e72e0da785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207993, "uuid": "15d323b4-4a5d-43b5-ba39-d44ac7b11b8f", "comment": "Malware payload (Mirai)", "value": "6b8c7db2dadceeea51de95d29efd6228f36aeb03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207993, "uuid": "f852cf20-a58d-400a-8893-0bc7308170e3", "comment": "Malware payload (Mirai)", "value": "abc1367e5085a0a18e6ba3fa3944c3c2c3040b31061a0f2186c646dd509690ab0727fed5dca3c6b9a286d4fd64b7b5cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207993, "uuid": "124ec92d-d16e-441e-afe1-aa733fba3f93", "value": "T1E4833A07F58580FCC48AC174176FBA3AD923B1BE1238B15777D0EB122E99E216E1DE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207993, "uuid": "96b791e6-c625-4435-bd40-e8124c99f98b", "value": "1536:tLTm7waIzerzviesibxGCKDSdOFjzzsAbvUpe1/7jfnvfkccJ4qW6:VAIzgzadbCKDSU3sw8e1/7jHfkccpW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766207993, "uuid": "fe626629-5b93-4f1a-bbcc-702482916c11", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766207993, "uuid": "f25b58c1-bad5-4bc8-a909-541e393dc3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207993, "uuid": "c85379f8-516a-47c2-b391-fc2b0b26c391", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d6406e-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266357, "uuid": "52f612e8-a53e-4ce2-92ef-55df36e3a89d", "comment": "Malware payload (Mirai)", "value": "4a4539058d9eb68d581e25a6d8c4d158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266357, "uuid": "f0f17937-c707-4fd6-8745-811833712c3f", "comment": "Malware payload (Mirai)", "value": "97f6da2917e358287321571ea5aca6dcd706d8791e52f882c39937b347169b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266357, "uuid": "9862cfcd-bed2-4219-aeed-a886df24984c", "comment": "Malware payload (Mirai)", "value": "069a4f85ff2e7d3c9d0f5ac6cae05b625674d2ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266357, "uuid": "5aa005b8-a78e-431d-8f35-4807f9fbbc90", "comment": "Malware payload (Mirai)", "value": "e67c7689ad08fd371a238e4ac9907eaf01f783a8b1d7c1e126157c2b447325ff9af460a49a1fe9d6a6fc667bfeedc21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266357, "uuid": "ac58e994-4407-4be9-848f-116c158efe2a", "value": "T16704C50EAE618F7DF79983341BB78E219758338326E1C546E1ACD7115F9428E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266357, "uuid": "b190b8f2-5e52-4de7-a0ee-2612b2594c08", "value": "3072:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYRE7X7kZYoMMRlGsvFb41LFJjKHZ/UZcp/:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266357, "uuid": "8c6ab201-6580-4c2f-8d02-0cb18a9d3179", "value": 178108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266357, "uuid": "b7450109-d212-4f7e-ab74-f7688738e4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266357, "uuid": "6cd7eb53-f5b6-419f-a2ab-e4dfc71e002e", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d5e43d-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235824, "uuid": "888dd994-ca46-4c3b-bb17-2b6599eece68", "comment": "Malware payload (Mirai)", "value": "a3242c238e004d0a798a571245ca5fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235824, "uuid": "46bda518-7f1d-407a-be4d-79070897aced", "comment": "Malware payload (Mirai)", "value": "9a9e164179dd3476d495eba17d09cb9c441a6fd96798fbbc7a3859da11832521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235824, "uuid": "559d438c-fc33-4d7d-aa2b-c2a8b7a4514c", "comment": "Malware payload (Mirai)", "value": "4ddad1693bc6845789113d15ae6e9e1f7b20175b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235824, "uuid": "1fb8dbc7-e168-4955-a2e6-42badf664f0b", "comment": "Malware payload (Mirai)", "value": "1e7e09267f478468753a044493dcb104ccbb901e2a485e781c5f9b8351d23294db0cfc09c0f5c0819e3b987f53419ff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235824, "uuid": "8c3ea431-cda9-4da6-b0f6-dcbdc5b3cd33", "value": "T128835B0379C080FCC899C175579FB536C863F07E1239B15A67D8EE16BD8DE502E6AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235824, "uuid": "c3670701-38f8-4d4c-9d46-54be4585afa0", "value": "1536:EuX/V6Uj/Fkc/T4K9WLTtEg1f4M1YV3c47Rz9YxxE3YA3N0:9Xlj/R/T4AP4B1YV3cAz9YxE/3N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235824, "uuid": "434ec60d-a3c9-4dd2-ac77-4532e5bf5590", "value": 85696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235824, "uuid": "e1706dd9-5da2-40c9-9c34-f13c06f48cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235824, "uuid": "972f888e-0226-4d9b-b561-04ce328f2e05", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38be7ed1-dd88-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766223758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223758, "uuid": "5949e888-679a-4f9d-846c-790aac3dd4f1", "comment": "Malware payload (AsyncRAT)", "value": "5236ede8989eeae46c304f78cc9d879b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223758, "uuid": "1f427baf-8c10-4803-a5b5-38ee34c8c31c", "comment": "Malware payload (AsyncRAT)", "value": "9b530d93842bdf10ae796adf6b3157e10677b37b302349922436b7c6469c7b7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223758, "uuid": "1eb92db6-86b3-44cc-b77d-520de57ecd3d", "comment": "Malware payload (AsyncRAT)", "value": "e7a646ff888abffea1d399e86661a69880467b6f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766223758, "uuid": "7282911e-505e-4b2e-9f6b-88bf36e9fc4d", "comment": "Malware payload (AsyncRAT)", "value": "7c5baa2cc257029817860ecb448939369d117a063382ccef05abde36451f2c9d970b2c3b69c461b300fa76a7b48d7edb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223758, "uuid": "42fb4a50-9c4b-4317-b821-2b1686b2b9ab", "value": "T14BC22B0473F58262D1ED4BBE4832A200D375E64B5D13DB9F6EC494AD2A337CD8621BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223758, "uuid": "46aa802c-7e4c-4175-9365-10d5fb4e1416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223758, "uuid": "79639d6d-fd32-46df-829e-c5f666a8f28b", "value": "384:IsA9EhVLq1LrzgepaQkXkMymrJhx8HqqbuUsJQxnCJf+BWfXWO/Su+:BA92VLGLrE9Qk0MyCJhxSFbHBFBzu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766223758, "uuid": "b68e8412-bfeb-4d16-8248-16ffd67160bb", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766223758, "uuid": "caea0823-9e3d-467e-b90c-8ee5541065de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766223758, "uuid": "eb765a3c-62d6-4410-893b-0311a3d0bd18", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e186ac0c-ddc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766251100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251100, "uuid": "cb057915-7fc7-48d6-b100-01ff8e255677", "comment": "Malware payload", "value": "29f0dc34bd9c78d2a32fadb8294efcba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251100, "uuid": "2c9466e3-83f0-453c-a596-4f5de842749b", "comment": "Malware payload", "value": "9bf8c65d3c4ec875ffcc169900f21a5eeb2bacb22c9bd6c5c8f27e02839209e6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251100, "uuid": "3a9db493-4f52-4a05-90ca-6ccbbf42f651", "comment": "Malware payload", "value": "bb5501515b20162fea2a943714e70b6e2f49d975", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251100, "uuid": "31905947-af7e-4da5-8ad7-56e4b0e97b1e", "comment": "Malware payload", "value": "c5ababd9bd3706c29c2e46206c503f527859a2e1fd53910ede5af9e647db9df3298326840d364834538bc3fd5d77c238", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251100, "uuid": "43deabf4-1205-4231-bc0f-c774445d42b7", "value": "T18724220602C40AAD03A4112CD6DE8EAC53B247D9A8D6621405BBDC36CF98BFBDFD52F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251100, "uuid": "02263bd2-77d7-4405-8d29-559ee29fe1b0", "value": "6144:stx9D3aXceQs3H2UPRhXGFPwTXhwchaan4QM3sb8jq4XXlxJL:QWXcCnI4Txwchaa4QM3rjq6XlxJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251100, "uuid": "0faf50f9-8ec3-48e2-8581-85f87bd1b837", "value": 215992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251100, "uuid": "687cc422-f307-4acc-917c-8ab78921b164", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251100, "uuid": "5a380414-7b9d-4a68-8676-040659b60f22", "value": "Payment_Confirmation 900120251865 Remittance_Copy_2025-12-19_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369799a2-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235780, "uuid": "443dd393-ec84-48e0-8070-23f32aa004cb", "comment": "Malware payload (Mirai)", "value": "370ec04db630dc6076bf3e305e3842c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235780, "uuid": "88619f81-c3cd-45f1-baec-3f3b6796f634", "comment": "Malware payload (Mirai)", "value": "9c3e215a57d4d7924fa7777fa799e31de78548d9ac3404070b00bfddcc3e2854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235780, "uuid": "1c98864d-963f-4e56-aa72-1854265131b6", "comment": "Malware payload (Mirai)", "value": "965a1ce080b57509d5d05a463be4372fdf5deea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235780, "uuid": "f0709b1d-cb26-4341-a4bc-44d0952121e9", "comment": "Malware payload (Mirai)", "value": "77062c1c1475d3b958245fd0d6065fa099e13ed85a41f079a085f004a00f22f3e3842ea2605e2e27ea969e8db4b4c1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235780, "uuid": "ab9e8af4-e841-4b0a-b519-4ae7be267d66", "value": "T17113E1CFF17852D1C8FADC3A76A807A0CD07A2921A1F9A981B619DCCE31459F345E074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235780, "uuid": "3c851ef1-bdb1-41a5-9aa3-204172f8c38f", "value": "768:5mTO5i8H7j+D0h6NvNjsL4zkgeDHFwFtJgq12hpIQnxDlWj:55i8b9MFN4L4uiTSKqSQxDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235780, "uuid": "dfb66446-467b-46bb-8304-3a0724d9a0eb", "value": 44068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235780, "uuid": "3940f1d7-706d-4dd0-8f59-e089ea95405d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235780, "uuid": "0ad885a7-52d2-4f53-8651-0127a794243c", "value": "nmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671ca59f-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266356, "uuid": "ed1d6558-e827-4dff-9681-5516c7a09b15", "comment": "Malware payload (Mirai)", "value": "e0c99615e53b551931ee924b2d6ddf8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266356, "uuid": "7773c2fa-460f-4d61-a7fa-0160d19b4199", "comment": "Malware payload (Mirai)", "value": "9c8738bb0a3663b08bbd4a0b78db2d4d1204f120c959717a7471864828956655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266356, "uuid": "ccd04067-dfac-4ec2-ba40-2397788b04e8", "comment": "Malware payload (Mirai)", "value": "5df54c80b8629b78df3c612c4f869f66b9a10e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266356, "uuid": "b9b12efa-e76a-4b5b-89a6-0297e1374625", "comment": "Malware payload (Mirai)", "value": "b555c0fe43bebe8fcf436b7fade8c1a64f2f8e25a15a495c8f19041f745b0c695c718153983d9f5acf83d91443c297e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266356, "uuid": "1d674044-09fc-4af2-8136-f686b2f64f6f", "value": "T1C9E34C85BCC28A22C5D513BFF92E018E331267E8D2DE7212DD621F24778796B0E77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266356, "uuid": "3be2dd3e-b648-478b-825d-77d92e0da1d5", "value": "3072:IsxfP/ROdS5DMbCl/t19iEG5VH0aVxbZlV2q2OeO4o:tGswbCpt1Q5x0alKq2W4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266356, "uuid": "c12fa38d-50ec-414c-aed7-8214903e2194", "value": 153204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266356, "uuid": "7270cff7-a129-4ad8-99ca-2a22f5c73567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266356, "uuid": "c1d30494-7849-4bcd-bc9c-7d2b055a4360", "value": "frost.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f19958-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234435, "uuid": "cbe8f1dc-8a04-4dfb-8127-63a119d914a6", "comment": "Malware payload (Mirai)", "value": "525a3df173a04956d02a58e9f8a6f039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234435, "uuid": "334f951d-8c07-417d-ad1a-5daab14aca62", "comment": "Malware payload (Mirai)", "value": "9d9234eec6af226d1a57a403684d0d1a2c78d75b2043a33682616d8d5c73a571", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234435, "uuid": "7a86f3b8-9e9a-4d80-821a-5e76d93baeb2", "comment": "Malware payload (Mirai)", "value": "1df37b5f1434c12aa28c4dfaf38e6cf0bce2abe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234435, "uuid": "d30f61e6-ccc4-48e9-a619-ae29a6240120", "comment": "Malware payload (Mirai)", "value": "b6896b2d2502d918c71f4e3359472da8e2523d698d74d982604142c4889c2a7aad7dc3f4d85e155dd332e4e52dafa9ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234435, "uuid": "b1122954-a95f-47c1-89da-31d41edaf3be", "value": "T131F2E0B041096C75C2B1E2BAFF97CAC328420E64E1EB7DB5F65906345E8820DBF7465E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234435, "uuid": "765488ca-52e0-45f6-b83b-2f3d1426aa4e", "value": "768:qSoAa4IhJfBL5HS4VANZGXRhVmVGkjY+6lwuitTQ6YSuClGFs3UozM0:qj4IPZL5y4VKQsV/jY+vDqjMlGIzM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234435, "uuid": "19827278-9f52-47f9-ade0-eb4fa8de1f61", "value": 34740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234435, "uuid": "99386f3b-c7f5-4c43-8ef9-e10804f42a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234435, "uuid": "9b289cdf-d0e9-402b-b693-e569135aa058", "value": "firmware.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693336cf-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266360, "uuid": "b21dddd4-7de9-442c-86e9-5f93a59953de", "comment": "Malware payload (Mirai)", "value": "d105db4d96fa99fd74a2c8648a98adcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266360, "uuid": "01f0f100-aa0f-434f-a808-0cc3a7d85dc8", "comment": "Malware payload (Mirai)", "value": "9ebe58ec528e0153eb1113aec8024c58d21a0d513912a496ff4daf1b8c8393f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266360, "uuid": "1d106132-7c3f-4b87-a4e3-c3302f8c555b", "comment": "Malware payload (Mirai)", "value": "3a2c2599a60156210d1095b9a1b5fd51dc7f52a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266360, "uuid": "62e61eee-b735-44d9-8da2-0eead9cc9e1f", "comment": "Malware payload (Mirai)", "value": "3b4aeafa20d65db006dec060148f344601f1b04ea491943526956aa91ead819d0f304a3cd61d15528546c602d2c19ace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266360, "uuid": "8dee55cd-b851-465c-bf53-50236266f2e6", "value": "T19CB33AC1E64FD4F8D91641702267EB379B32FC76013EDA93D7A49B72BC93A41980629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266360, "uuid": "758233ca-a4af-4b77-adb1-4112d5d39307", "value": "3072:KJFrpq7W7PTL9rH5crC3MFZnKOiKYW9iHGNIiP4r:OG7WDTL1H5crIMFZKOiQL4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266360, "uuid": "0f853d6c-8dfa-4f26-a135-7d13d9f65e7c", "value": 116016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266360, "uuid": "10a7948a-8926-406b-b921-38899a224ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266360, "uuid": "96b40b40-0361-4e7a-a16a-768a6c63e94e", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5897e68c-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766198042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198042, "uuid": "3036aac3-1534-49db-aa45-87cb9fb22280", "comment": "Malware payload (Gafgyt)", "value": "42c52d88f15e972d062f3e4b2b82f4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198042, "uuid": "7ea7026e-0979-4798-977f-dd52df06b165", "comment": "Malware payload (Gafgyt)", "value": "a17cc05593dee6556758a10df80f2bd4e3dd652c580bfd6585aa5166d8786abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198042, "uuid": "f68092fc-c950-4194-91a0-fd1537739edc", "comment": "Malware payload (Gafgyt)", "value": "9012ef7ad5cab49156935897e1c9626ce2b69670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198042, "uuid": "7d76f045-2e97-478c-98d6-caedae575cdf", "comment": "Malware payload (Gafgyt)", "value": "ba5862693180d30e48149e8067e674ce6c99aaef3f6358036e82e3995c6cde915616dc14882bb5b14b242c29a60a2d5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198042, "uuid": "89cf551a-9482-4d34-9c6f-8d89a0605988", "value": "T13D146279BB619EB7E80FCE7301DA5912188C968643D93FABB2B0C518E79794F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198042, "uuid": "ae27b13f-d11f-4138-aa99-d0bb2346e30d", "value": "3072:FTF9T/LKBhiwyRT5hI78qWqmv8uNv1BlLMoU:FvyF2T5hIABqmv8uNv1BlLMoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766198042, "uuid": "3df58b0e-c3d4-4df1-9047-9204d7276bc9", "value": 190566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766198042, "uuid": "f55dc7eb-8fc4-49bd-8dfa-67cf7494cda4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198042, "uuid": "144a19d6-6dfe-421d-93fa-3601aed15f7d", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6663db46-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766235002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235002, "uuid": "e4324393-c272-4a61-a58e-f313f12e20a8", "comment": "Malware payload", "value": "4f39fca6637a52d5f45645df98c4fe01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235002, "uuid": "8cde9cdb-62ba-4fec-a620-82386c9aaefd", "comment": "Malware payload", "value": "a18ffa8a15f63d61a7612ed965b71296b5eee8a510a025498ffda9ad97f5410e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235002, "uuid": "70cbbd51-449a-4ccc-92eb-5e7cabf8b1fe", "comment": "Malware payload", "value": "0ccbdd558718a73b0d6ee8d8998bdf40a3e9ee07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235002, "uuid": "7f58ca09-c02b-492b-8ee9-4bca142f253d", "comment": "Malware payload", "value": "d9caf4e6e3dc769781b32232f3025931d1b5f823c5aaab25adf48d46c623ed20ce2f6cdf7f213a2cce5cd7d7eb646ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235002, "uuid": "3d6f80e0-e984-422f-af1f-90bdbd87fa9a", "value": "T1E4D2DF676B741ACCF0738B34D4C80779EAA8B8794EEEC35C574872D42CB62A58C38B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235002, "uuid": "86885186-76eb-495e-8823-c95b1c8f4ec0", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235002, "uuid": "68f98e38-e387-43fd-a953-d22aeec8224f", "value": "768:z+uWeNQNy6kbHpJ22tbkWwTgl3498RZFnZL0b5bs5QIm:zfQNy6Rsh3C8JnZg9bsWIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235002, "uuid": "48420e43-35c6-4d9c-9fb2-31af06f1d66a", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235002, "uuid": "653f0331-17ae-44f9-a636-5ae6ca2ddc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235002, "uuid": "e3ed404f-a79c-4eef-a5c7-bb881e150788", "value": "SecuriteInfo.com.Generic.Dacic.6942.7EACD5EA.27362.5938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aee6e3-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235935, "uuid": "77bd979e-1650-40fb-8fde-a39dd8bd98b2", "comment": "Malware payload (Mirai)", "value": "e52aaf3c471adb8cb3ef888d6a608944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235935, "uuid": "c26d0363-53d3-4e2d-ad19-0583df8200d3", "comment": "Malware payload (Mirai)", "value": "a1cc2b13a656167cf33f7c0e82fc0a54ddb6cc43947ada8fa9df4238e2af11ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235935, "uuid": "75ca6abf-0a29-4559-a0d2-8979badb9e20", "comment": "Malware payload (Mirai)", "value": "1868ecde1990d27c2acd4bc892a06459f63a6ddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235935, "uuid": "799481b8-05be-4790-9981-3ac3ddd5f8a3", "comment": "Malware payload (Mirai)", "value": "09425c28023505a3eb108427e4ca0a80ea2cd6adef28ca0e6459f8442178eff498b9e2109cc0d6b5525bafdef5203522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235935, "uuid": "b1443a26-4d44-4727-8099-60b32d551cd1", "value": "T1FD934C02B31C0A47E4575DF02A3F27D1D3EEAAA020F4F6C4691EBB8591B5E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235935, "uuid": "d379fa9d-b32f-4581-8de9-7fd13769825e", "value": "1536:l8NJzXik7T7urnd2O2SivEfq2sOamN+sdDJZnZKa86FgmYeZrvKmC:qNJGMTyRTNXbZE68F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235935, "uuid": "11fb919a-81ad-4e23-96cb-d42e49b12721", "value": 89440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235935, "uuid": "9fca7fd7-6f61-40ab-978d-c4bd7c5639bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235935, "uuid": "a1da2eef-f8a6-4859-ae6b-e3563d078e9d", "value": "nppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18acd975-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234442, "uuid": "ac9c3355-4d7d-4100-8f9e-b574b39d6c40", "comment": "Malware payload (Mirai)", "value": "fedb0deb9045b0bab80e2eae18cfd707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234442, "uuid": "2b917e9b-fc6e-49ef-be11-240256eaab40", "comment": "Malware payload (Mirai)", "value": "a3e3c773b94f3dc48585962db20ba8d38c7285e25499e50d5b6ab15427d0de26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234442, "uuid": "7bac17ec-ecfc-45a1-8ba0-e33331cc8fec", "comment": "Malware payload (Mirai)", "value": "6a76f9439b59d0175e8cffdfd7ebc19fda098900", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234442, "uuid": "c706eac7-35e3-4ee7-b7c4-cffda59636c5", "comment": "Malware payload (Mirai)", "value": "433a201782d5449c49481e46f0cdfb5ed32e121b227709232d55657c70db2583d1c34137d94d97315238c6235f972ce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234442, "uuid": "1ddd85f2-80fb-4aa0-bcd8-10facbd864cd", "value": "T14062D16097115518F3F24532738B8EC2A355CEA668AE873333092D1A517B8EA7375BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234442, "uuid": "102ee870-ada4-4f42-a713-0be8fa7ced41", "value": "384:LHQHn2o2Mu6pC/1bbjfbE6Jz26RwNE+//TINocdxha7CprpW195oeF:LHQH8/6pC5bP3I6Rwa+XE/xg7CE9jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234442, "uuid": "1a1e4366-f41f-4f1e-a1fb-b173cb974b68", "value": 15728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234442, "uuid": "74beb69b-d7b0-4b45-b4b2-082b913dd12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234442, "uuid": "7a56e204-fe96-4089-b773-37e7b9447b94", "value": "firmware.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93779cb-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249824, "uuid": "f98b70a6-c52e-4320-bdb4-93e4307a9d12", "comment": "Malware payload (Mirai)", "value": "515216c27d2f63f29d8c29fce144a61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249824, "uuid": "d03f9160-e9ba-4104-b52c-7b8439f350ba", "comment": "Malware payload (Mirai)", "value": "a8e657d363b5dc97a9e887e8686306ea0acc346c0b4b1eaf97e23cf2504a028b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249824, "uuid": "df232820-3f75-473b-b52e-6a194839ff4f", "comment": "Malware payload (Mirai)", "value": "953e380b6065aa87b64cb55bb65f6d52cc294c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249824, "uuid": "e519b13f-b8c8-4f0f-ba39-6eb64d78f97e", "comment": "Malware payload (Mirai)", "value": "2c81daf4e14831bf997fae6c918a049533843c64e5064eabf6f8751be7029558f06b1cefc6972c1dc5cb05183994ac9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249824, "uuid": "7659aa3e-7b1b-4913-afba-22a5c6760922", "value": "T16933E124BB007F10D27169B7FA79964615BE4B78C074227F7F2C12E552DE88A87BC781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249824, "uuid": "1edf5ab9-484c-445f-8425-20fead86d4a3", "value": "1536:tMqgfAI/9cx3cnOSRAA9N8K1G+8mDHTwrG5fnppszBt:yzfAI/9cx3A/AAX8SGyTFnk1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249824, "uuid": "888f4143-62bb-45df-b7f0-1334488d7700", "value": 51092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249824, "uuid": "20aa48de-9fce-468a-9e1d-770317ed8a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249824, "uuid": "9eae2630-2abb-4aaa-981b-836625e6c794", "value": "sumrak.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb98e9af-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249855, "uuid": "b3146b7b-ff02-4895-ac82-1158dc5dd72c", "comment": "Malware payload (Mirai)", "value": "c65004042ed64b14c40dde435e2e1fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249855, "uuid": "3058cc4f-f986-4c70-b630-ae609ffd17dd", "comment": "Malware payload (Mirai)", "value": "aac1071192c53ac74fed98a05176cefd6eee2c51f0eb3951ea9b82ad61617587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249855, "uuid": "250c28f1-c946-4002-9140-6afa5af95644", "comment": "Malware payload (Mirai)", "value": "e736e9094d4b0f694e31061b4cf1305c704daa3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249855, "uuid": "1067b729-52e9-4d4a-99ea-8321d55835c1", "comment": "Malware payload (Mirai)", "value": "98ae1edbaef347e65c650bc88f5fa692ab04a69137022b31936b177f988184ea887c565947021211a531df7747d95edf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249855, "uuid": "6084a552-e2e6-4b53-ba8a-9cf7ce55ff71", "value": "T14ED33A45B30C0E47E2632EF43F3B27D1939FDA8221A4E641255FAA8E9172D32458ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249855, "uuid": "977aff51-22f0-4ef8-8834-da1900b0caf5", "value": "1536:cY6XQxLixNRF9HqWXdKVDKmDyFjo+lXAC9hvA9cejY9aKhU6qAwnzy1NVSa:c5gmx/HfMpDy5lPu9SVvSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249855, "uuid": "7ac01f6e-5fff-4cc2-ac69-f12e2ea0d2ef", "value": 131872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249855, "uuid": "1d584e44-fe81-44c6-9dd3-8ecaca562514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249855, "uuid": "4ed21c70-7556-4bf3-a411-bc19b87680a9", "value": "sumrak.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b03900d-dddd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766260323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260323, "uuid": "23a755ee-1322-4c1c-b4ab-988f4409337a", "comment": "Malware payload", "value": "97b8e6bb8d5cb4871dfe8d7440f7313a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260323, "uuid": "6589a5c3-84ac-4ff8-a58f-8a87ec30d667", "comment": "Malware payload", "value": "aafb6782dd22050db04d7e23452639deaf9b8f6b7f00212b76fc2a4f0be265e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260323, "uuid": "a3f9dc79-55ea-44b3-9a56-857b870d3859", "comment": "Malware payload", "value": "f7dfd65bfebc1df1fc31ac08d934113f866f74be", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260323, "uuid": "f35b06a5-39ed-41a4-b8f0-2ce34d491fc1", "comment": "Malware payload", "value": "c079544db5bdc6140cbd664b4781fbced1512de2429f4490393fd48aa91fbdb9238795d0a66fc0653d3de5281496757a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260323, "uuid": "d751b0da-ab2d-4258-8833-a262a621b07c", "value": "T144B31256B005254EF7E233DFBC7A34421E026D4ECBD7675AE54B784D30BA840F099DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260323, "uuid": "8cf27c5b-b7cd-439d-be54-cbdeef0d5470", "value": "3072:CX2tBAJwRZzqeXfPAvuY8KF9lpttshFZyrE:k2LkwPz1fI2S9PtkFwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766260323, "uuid": "c70f8053-7e1d-41c2-951b-744ac54e0587", "value": 113047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766260323, "uuid": "1d903e51-e45f-41d0-ba57-f1678a152faf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260323, "uuid": "f04f7ed4-ddbc-41a2-a914-4fb1d25d412f", "value": "Oferta_Dlugolecka-Sarlej_M_12-12-25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cce7a16-dd6e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766212598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212598, "uuid": "dd46095f-4211-4c72-8e81-536ace116b00", "comment": "Malware payload (Mirai)", "value": "dfa65b77effdced1781b5dd0a21799ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212598, "uuid": "023706c6-288d-4b3d-87a4-5a41ce7914df", "comment": "Malware payload (Mirai)", "value": "ab43916d8e693e404bcb5f0c732139dfae5b3e122a4ad12b6b97d35639cb7749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212598, "uuid": "3ea6daac-1ea9-4ec1-90e2-e7abd96b5490", "comment": "Malware payload (Mirai)", "value": "7264139328a7f085263f043119fe63c23c9cee48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212598, "uuid": "616d53e8-ebec-490d-91bf-67a32fb1d84c", "comment": "Malware payload (Mirai)", "value": "53bbc2eff2dadffce58e9d2a6954090f12ed2aefb119f121f6dda548f1a12e0efbed22cf116dd3ebc9050d61a9a2213a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212598, "uuid": "1215865b-e46d-4017-8874-09b9ed338cc4", "value": "T1D1934A22BA7A1D27C0C1A47A21F74B21F6F247DA25E8891B7DB10D8DBF256402157EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212598, "uuid": "d9b63c98-1b58-4e50-8800-ff89cf5b476c", "value": "1536:ZOXSQ1pxh1OIKtsasJZ7tlHwRhOYCF0VFtqSMGN+b5E8ZnkaZRthF1/:ci+p/g4ZYAaFESMGNOE8RJb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766212598, "uuid": "334296cd-0902-4738-b54b-09f80155b555", "value": 96528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766212598, "uuid": "ed2a07c6-866a-4b00-a984-ed887c260125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212598, "uuid": "d49eef78-7c4f-4bf8-a309-5b87708a1da3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b84e1a-ddff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766274786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274786, "uuid": "7ffb347d-8b06-4025-8ace-64aa54905629", "comment": "Malware payload (Mirai)", "value": "b736ddffbb90901854922f55a96be318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274786, "uuid": "95163eaa-e0d8-4b3a-94e9-081ae8e2e86a", "comment": "Malware payload (Mirai)", "value": "ad231997456ddb2cfede395e0e83bcec403d3e7e0804d8eccd3da115f023550b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274786, "uuid": "28c68939-90f4-42c1-acbb-21f12338a7a2", "comment": "Malware payload (Mirai)", "value": "57e3f9424503b6b83c35ccbc28606638fae06327", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766274786, "uuid": "b525ce04-d704-4ea3-b781-b03ff37a5aa5", "comment": "Malware payload (Mirai)", "value": "9df838754bf93dbd87fbae352adc4de61c147f34855a06ec349e5ce85ea06a80c994115f82b35e8027bc5deec4c76bbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274786, "uuid": "f2c1b855-7a97-45cd-b4d1-1c1134506626", "value": "T19803F10F220681A5DCC300BA13E513522F600B63F982EC5BA65A674EFAC71BDBC95DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274786, "uuid": "c4f22613-a5ee-41c5-9c1e-b9cfff2098e1", "value": "768:1OE9ImAtsh2cFCigB40deQ/0swv+laNaBBICmg6JgGlzDpbuR1Jx:13GIh2cAigB3eU3oEfIVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766274786, "uuid": "69ea7b24-eccd-4c6e-8b01-afd1f4d7d6e1", "value": 38324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766274786, "uuid": "c68f0a09-0450-4cb4-9b26-64a51cea9430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766274786, "uuid": "074e3bdb-115c-4555-8625-ef7167930fef", "value": "sdxkzX_UXA229x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a05e97f-dd53-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766201051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201051, "uuid": "5ce62903-d2b2-4983-9f10-d33a551dde78", "comment": "Malware payload", "value": "ec0389d481984df9c6e3a0ff82f061b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201051, "uuid": "5ae3c877-fe12-4297-b4b6-4d04adf5e62f", "comment": "Malware payload", "value": "adbbb11c3e952d096a9bfc9ec745c63ce88d6c965a17a1cc5fe0dda3793c8e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201051, "uuid": "c80e95fa-a680-44f3-97fb-354dbb245bf1", "comment": "Malware payload", "value": "7a0d391d0982f29b7b90d20ea95df78ff8fad191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766201051, "uuid": "df44b7c8-005f-4cce-87da-0a7f06746838", "comment": "Malware payload", "value": "64acef99d6af8b1b8b4e5c1fba79c0ac45599e5f8a34a70275f6de2c8c1ae261b1173d915b38bf5845a89ad56f58513a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201051, "uuid": "2aba903d-4e0f-427e-962c-e4af66c13e66", "value": "T1F4066B23AD908A69C0EFE33DE8A26296B7B07804473137D35F902A761D777C4653B729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201051, "uuid": "ae004f4f-c390-4e17-979a-6c4959eb8d8f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201051, "uuid": "2f10c595-5ce9-43b7-9a75-327c05bb8198", "value": "49152:eCURXMqapz2TrpK/ryOJ7BSUQx8thwREkboY:eGS/YhwRcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766201051, "uuid": "fb6269b4-ae03-4587-8b8c-5c6060872c52", "value": 3893464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766201051, "uuid": "c8d3ccce-db5e-40d5-92c2-78507722651f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766201051, "uuid": "d13769e2-fa78-44c1-ac04-8cc40fa0a3f6", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12637169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bc51ca-dde1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766262141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262141, "uuid": "1b1b9121-eb03-4f28-92c0-d3fe70e1d81b", "comment": "Malware payload", "value": "cfe9739a37bf3baac5aa66284a0dfdc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262141, "uuid": "b552ee83-e17e-4072-a96b-8272e9ffdba2", "comment": "Malware payload", "value": "aebbd3721d27d47ef81d2e36118ee90f58b9fa17c2b6ba1ba1fcb3a3170c4c81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262141, "uuid": "6ae1f682-2b70-4a00-a853-60ba95698d81", "comment": "Malware payload", "value": "307c4fe3cdf7bd35108f198df4254f7a34f9d4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766262141, "uuid": "a97c3d2c-f89e-4b3f-a659-0eb909a4746e", "comment": "Malware payload", "value": "7118debc61dfaffb9f2a857f63605f75150462aa4c448f7b61242462c425432b7a6b97d692e16fa88546bca839b6c0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262141, "uuid": "62f5e0fa-13b0-4088-9c02-95038e5b8c83", "value": "T15BF57B17ADA285A5C06AD238DC33A195BB707C484B3133D71F827BA52EFB7C1653AB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262141, "uuid": "83267796-3259-4a7b-b333-c5167e94163a", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262141, "uuid": "211a6cac-3adc-49ce-8fe1-1373e7a63b9f", "value": "49152:huHjBppt0AJW89VCmZUk7ECvaqi7Sn+XKp+tmqse8p:ha5i7SKp38p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766262141, "uuid": "e7751a0d-caa9-421e-a32d-a0a163c7a077", "value": 3412696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766262141, "uuid": "45000559-6022-49b3-8bff-d60b1c8dbc29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766262141, "uuid": "ba0aad77-76f8-4ff4-b6b8-4f1043f6fe9d", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76005c6d-ddab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766238893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238893, "uuid": "280650ec-8771-459d-b1c3-12bb5c776276", "comment": "Malware payload (Mirai)", "value": "09e7f30d1637b7796a710ba6848a070d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238893, "uuid": "a92ae7df-01ce-472f-986b-57d9cb1150f3", "comment": "Malware payload (Mirai)", "value": "af7f99e1c3428cbd90e47aabab0a83105c3e0fbb9fa5b5b29bff94dcc4b432b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238893, "uuid": "b53c8c3c-7710-4b76-a76f-bca498034fef", "comment": "Malware payload (Mirai)", "value": "c22c598ebf81d3ca77a604448088dd9d94ae2256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766238893, "uuid": "0c261b5f-57bb-413a-8cc5-7a843a94030d", "comment": "Malware payload (Mirai)", "value": "b0c1a183a5a36ae45caf2d8d7c54281d2d5d26839b5acfd700990660047e44189a92e93a1025c02a49f2d144a1da46bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238893, "uuid": "e395fb8f-88b0-4fa0-b5a4-7b528dbde955", "value": "T19F936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA2511EA16B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238893, "uuid": "3e66e3ad-ba90-41fc-9a1a-eec40440b9c1", "value": "1536:xpmWc2AcighsZ82fJxfcqSHD1mSsM8meUigBQ9TnkISGtAd/0xZ:xpmX2riED2frfkHhmLVUBQ9kVT/0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766238893, "uuid": "f1eaba72-0afa-44d6-9b45-182c4c068a76", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766238893, "uuid": "eca5975c-65cb-4380-b913-d53278e569ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766238893, "uuid": "4ea0502e-482e-4dfd-98cf-68baa08cccdc", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69555b28-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254334, "uuid": "9878b738-2d78-46ee-b5d5-af268da2d43e", "comment": "Malware payload (Mirai)", "value": "cfd0c27fd80d080131d09bfa5e5d3a4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254334, "uuid": "03271fd8-a637-49a4-bbc8-d89b7700f877", "comment": "Malware payload (Mirai)", "value": "b09ac54cad07e93d71fc613da775a956500d7223a6bc7a7b77ccf1664d2e5a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254334, "uuid": "e42bed68-8ab2-4018-af7e-a39032bd40ae", "comment": "Malware payload (Mirai)", "value": "4d789763708c2fffa864c242b262224724111d32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254334, "uuid": "328088bf-fb47-4fcf-9f66-4d3d0cec9068", "comment": "Malware payload (Mirai)", "value": "8264031c693b94cf3988b168a805cf6ba807c2fbf32727b2f68599c076251787aad08d80812462a464a7dcf035904cae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254334, "uuid": "37315138-b91e-4a8c-943c-c15beea6fbe4", "value": "T11913E1DBA31090D6E900E8BC5BB48F60D8664FD7C482EDA5B7A52DC7DE0B1667C43AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254334, "uuid": "18e8bfd5-58e0-40f4-bea4-09b453b5489f", "value": "768:BfcQ+l/zCodkjYUcEOseObzX6gu0NekOmXwNx+CCIiQP4AOSauTl6ZkcRJgGlzD5:Bq1OZjYds1NemO+BIzPSEkkcjVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254334, "uuid": "5c9221c8-4b37-412a-bea2-586440456a3b", "value": 43164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254334, "uuid": "4911824c-7ef9-4304-a8fc-f7f494a4f6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254334, "uuid": "5fdaa36c-0e6a-40a2-9ee4-d2df52e2d57e", "value": "aqh6thrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf220ab-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249829, "uuid": "24f2af7b-6c06-40aa-8dd5-08234a547654", "comment": "Malware payload (Mirai)", "value": "4d942b1bd1e3ddd1ae280c0712561757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249829, "uuid": "9c374a44-7103-47c4-9538-16d215184320", "comment": "Malware payload (Mirai)", "value": "b18c12a77b81e45cefeebf2c3d871372fe3c983fdf47b690351dcda0cf2ba560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249829, "uuid": "dddb7de5-6a84-4913-8b47-726bf17364d1", "comment": "Malware payload (Mirai)", "value": "4e7cfd03c53aa619ef7ce401681629e0fa09eb37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249829, "uuid": "c4f715ab-c553-4952-845a-3e90098c1278", "comment": "Malware payload (Mirai)", "value": "b6a15129ebf15b36a14bb30da0633584704bc0e75714183ae406e20853fc37df241d0d7959a874b364066b10d86b8e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249829, "uuid": "a299d41b-0eea-4ea4-8481-256d54dc5255", "value": "T1D5D2F8B6E7692A13D0B57338A4B2670379597BA10470834FBD480D0B7D967A09A3BBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249829, "uuid": "47da7b6c-e1de-41bd-8ebb-f701b054b729", "value": "768:s0vqosleoqsfcNnzd555dpVZG2fh+TV9U3EGzJ:sQqbg/7dA2JEV9YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249829, "uuid": "789bfd14-7af6-46e4-9d64-f01e3ae34983", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249829, "uuid": "fcc57204-4410-4915-86f8-58a75406e57f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249829, "uuid": "fcd8d826-0ed8-48f1-b21b-1d43ec602eab", "value": "sumrak.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726c1b4b-dd4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766198515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198515, "uuid": "51b65eb0-3c03-4851-9719-f84eb2669ed8", "comment": "Malware payload (Mirai)", "value": "539f613c1300338c831497daf4be2fd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198515, "uuid": "417d316d-a0ce-4e61-bd6a-82b07a05c218", "comment": "Malware payload (Mirai)", "value": "b38cac7dcd0b2f68f15499113658d15987de22ba225cea00a14e95a885adec75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198515, "uuid": "3cb38125-808e-4522-bb14-90d4f8f9d321", "comment": "Malware payload (Mirai)", "value": "5c4fbe5a9d110a05de89b31f9a0210db70d60bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198515, "uuid": "c5df7202-d80c-4015-8706-bba55cbf6c46", "comment": "Malware payload (Mirai)", "value": "46887e02068f376f03b0bf6e01b3de7e492587dd702a27f3c7583f882426b6dc43e0f269658d32cc40792a811150b47f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198515, "uuid": "56f7c934-8aee-4ede-994f-22cbf153196c", "value": "T1B113F165031244DFCE81F4F8DFE04FA22B292F57D90F8D9229A2E957DC4A2B47CE1649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198515, "uuid": "ba1eb716-4a01-4bce-9db0-50e58e7077cc", "value": "768:nH63cEtjr/ciLDEPv3PPMRMdZrIopQOKwpo0AycP1/s/oK6iDAdjKSJgGlzDpbul:nH4004ZrPpQOKwpo0Ar2l6i0hVJuu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766198515, "uuid": "6b167736-1f97-4d69-8e30-56334298f329", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766198515, "uuid": "4947863b-b96d-4d24-a84e-9af1c949a524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198515, "uuid": "34537713-f12e-4a5f-8038-4640d33aa6b9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a464c5b-dda6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766236619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236619, "uuid": "ecb1efe0-b7f3-4919-9e49-25be9778d5a6", "comment": "Malware payload (Mirai)", "value": "76dd3b6813214655d8e4aa3ab293ac71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236619, "uuid": "e0aea53a-cff2-474e-a324-d5e4b31e646e", "comment": "Malware payload (Mirai)", "value": "b3e763e86ce10778af1d18e098c278ff6a040bfd8f2bd7eca0b7f89f4c43e17a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236619, "uuid": "8cfa49de-1df5-4d12-b2c4-48b8cb1381e6", "comment": "Malware payload (Mirai)", "value": "982c16747abc0783fef98858e14f1d0e70d9057d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236619, "uuid": "92eabbbf-cb0a-4919-a9d7-2c455ec06e52", "comment": "Malware payload (Mirai)", "value": "30c6ea17c9ebecd4341ba570ad05292131e075eefa4b04284259e668ef3b6f18dd2986c45afc440f880f70a81b705225", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236619, "uuid": "703cdf91-459e-45a3-86ce-0262d736e44c", "value": "T1F804D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236619, "uuid": "19d3e4b6-c2dc-4653-9eaa-788c93eb6180", "value": "3072:ueEksFM+wX5OEaVR8H3NaMZOTTMJxt9U+7fKbvE:ueEnO+wXIVWdaMATwJHy+uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236619, "uuid": "b2298590-500a-4886-8e81-0af3b35f2367", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236619, "uuid": "96b11407-6460-4186-8ce9-dab447f8e6d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236619, "uuid": "0e010211-2e09-4923-9490-aaa4150cae05", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ec0805-ddde-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766260714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260714, "uuid": "803ff9f0-d16a-4b2e-8110-17b263a10647", "comment": "Malware payload", "value": "6b8d28b35b879ca4f7f25d028f8e3f2e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260714, "uuid": "73b4aff5-39d9-46ef-8ddb-e219b1718526", "comment": "Malware payload", "value": "b452f2d8b63998155a0f0addb4a750490e255825f6e3aafe7dd39ffe49914163", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260714, "uuid": "a9c42ae1-c8e5-4ed9-a656-3613074e259c", "comment": "Malware payload", "value": "eb693201cd39e6d424137bfb9df27877bd58b08d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766260714, "uuid": "c888e69c-e73f-4a14-a278-c2966711ecd2", "comment": "Malware payload", "value": "ec49847be24f47ba2354d9f59fc030498f5213bdb12c4f71e3f6846a7331adee6c802a7fcbfa1b9c03510f60a4f35f57", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260714, "uuid": "498f462d-bfe8-402e-8115-02664115330c", "value": "T11251FE221FD29665E2770F318BFAF3624276F820DC1746AD9088D24818B1640F5BAF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260714, "uuid": "56c707c6-9444-4b4a-8ca6-f37e9ef9e89d", "value": "24:8TE9Jzxrwftd921qAgA4BJUFqrSAOF8mR+IMw2VcpNtkY41EFkaobVbUEcm:8I91o52zLg3rSAOFzRfMvfn13Bblc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766260714, "uuid": "18fb5de0-8742-48f3-a43c-6bfa98577c1f", "value": 3078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766260714, "uuid": "9e55b0d0-99b8-4577-a12a-f68836171316", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766260714, "uuid": "9b0250c1-2a54-4dc2-97a8-a12662b6ca64", "value": "Passport.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b8dbb4-ddee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267594, "uuid": "b505fcbf-0a69-4639-8da8-eab5ffd6d957", "comment": "Malware payload", "value": "7b72967c6bd01a856ab89363eb5d0465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267594, "uuid": "cf26c044-e00b-4a95-8c7f-b4bef8c1c055", "comment": "Malware payload", "value": "b528c4791f65457955cbd30bf649283b73771a2133350453e418c0564a309bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267594, "uuid": "013bac62-e482-4b85-86a4-b7b45e3d4788", "comment": "Malware payload", "value": "74fd52fb3dfe884cfbd6439ea171e67aa01d9c8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267594, "uuid": "8933380d-7306-4873-aa84-d1432bdca31b", "comment": "Malware payload", "value": "742111ec47061651e59ce6b711eceb11ed50b1dc81536600ab43cd13a6cb96103bb6fa73ea0ca323403b9f02aa084b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267594, "uuid": "48b2d39d-6279-458b-9616-16a7e7bfc0c4", "value": "T1DA264B5F98E00BCEEA3EA375F289437FF923659EBF4EE917952305952587000B802779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267594, "uuid": "7978bc53-00c9-4e44-bd45-bca33dfccce2", "value": "abd02735f28f325b5d3eb138ccffd5ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267594, "uuid": "1bb11fca-117b-4257-acd6-95e961a0d79c", "value": "98304:luKS7ii8osKoClDUYQrL/d6QmKbqxNyHG0cnqghWkqhwJt1vkNO/RtxS:luKS7ii8osKoClDUYQrL/d6QmKbqxNyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267594, "uuid": "4c8fcbd7-a97c-40ae-a42e-1786a66ca47b", "value": 4680192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267594, "uuid": "bea7767b-9fb2-4ffa-9738-eaf98f87b65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267594, "uuid": "c96b2929-80a0-40df-9a57-4153a5c40e8e", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65fa8c7-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249846, "uuid": "2a4d4771-b1fe-48f6-a550-20609a5878f1", "comment": "Malware payload (Mirai)", "value": "dd9d29e08d3d1ca0fe8b4ec90d27e86c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249846, "uuid": "b1040716-2c4e-4631-819a-bf5bcd711600", "comment": "Malware payload (Mirai)", "value": "b56a021277bb2c19a1eaa4ed30cedcbae44dedccb396b3879406e980db91274f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249846, "uuid": "5d13f4dd-1c5c-4e80-aeca-39908ea9b72a", "comment": "Malware payload (Mirai)", "value": "46dcbd8b4d9a1219a1469dd60f6f963ff828ba4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249846, "uuid": "5d5a855c-9c72-4167-b0e0-64737ca78aa3", "comment": "Malware payload (Mirai)", "value": "f4578a42e00982b78ab645872930c0b88a3cffd05dff1b5d2932abe7c3502c2652fccfb998afc610f84b3a3e41aaba79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249846, "uuid": "440151d3-6626-4af1-b236-febda280d542", "value": "T1B0D34C07B4C098FDC8E9C1788BFEA12AD972F56E5238721F17C4AE261E4DE605F6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249846, "uuid": "9cf79e69-e9ed-4b85-ad06-a33328b16a8d", "value": "3072:JLFBt2DzVKrHOU01dcUc99VARc6KQYTWNdYHVY:pS8Vq69VBAdYHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249846, "uuid": "ecef7368-e76f-48b8-ad6d-2ba3c0e205cd", "value": 142088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249846, "uuid": "bed6d9ac-a644-4e53-accd-e5c6bb89bc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249846, "uuid": "f1fff780-7463-47ce-ab82-2bd90b0fde93", "value": "sumrak.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69661fca-ddc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766251327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251327, "uuid": "057cd0b1-7cfb-44aa-adbe-6d833a221b68", "comment": "Malware payload", "value": "8e6cabe1e25de2df1959b8eb540263ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251327, "uuid": "ecda1808-97f4-4716-a2f4-8a86924e1369", "comment": "Malware payload", "value": "b5d7ad2514e1a8ddd0dd6f4339dda8a4fa7eed5d923026029b025f750c6dec68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251327, "uuid": "64b881f1-ffb8-4339-92c2-41776f4a21fb", "comment": "Malware payload", "value": "f30b2ea64b8e08b22bd39c8ec3bae2538e3d8e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766251327, "uuid": "15cbf1ed-1274-4990-bc12-761c2aa656ae", "comment": "Malware payload", "value": "39bd332169de2fb2f27a98afb0c17451a703c4a88c4d4e53a67cb1b4fa15f3a9aa3472780f94e4fb9a0239828fa5ee25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251327, "uuid": "1bb4f3c3-dc74-44b6-b7e0-d6ad7871d467", "value": "T1E8758D02F6564FEDD4ABC0F4C9116A2BE5B9B8110728AE7B9ED01BD47F52B20573D30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251327, "uuid": "de00b9ff-f491-4622-a968-7469a3a9966d", "value": "4eb25f1fdb1cc9d0568ab3619651b6ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251327, "uuid": "39766bbb-3776-43c9-b934-e4eed5473324", "value": "49152:dt9cSTWhIai9uTJEnL7qmJFv9P8qdA1bFot:dHVTFnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766251327, "uuid": "d791eed1-18e4-4f6e-bdb8-3e496a4bf36e", "value": 1579520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766251327, "uuid": "be8656a6-b09d-4c32-883e-84cb3ef082d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766251327, "uuid": "d9eee480-9b8b-4035-acba-243b05ef3734", "value": "SecuriteInfo.com.Trojan.PWS.Steam.38766.1717.28879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573817ed-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766198039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198039, "uuid": "dd2e6485-974a-408f-b359-70e80dbce2b1", "comment": "Malware payload (Gafgyt)", "value": "a2cffc79100e72f3170dd7956b0b1984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198039, "uuid": "ee2b3421-11be-404e-bd79-4ebe36d30210", "comment": "Malware payload (Gafgyt)", "value": "b9c56297d1d56050862884a77cfa7ab0a5b89e35bd1946e5c2b148b30fad946a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198039, "uuid": "819d375f-b839-4c14-ab9a-8750b3fe9274", "comment": "Malware payload (Gafgyt)", "value": "d39c323c310a5e5a8e9c3e826de653115b9912e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766198039, "uuid": "aabde8eb-1e23-4983-b895-d3d634c0f1e7", "comment": "Malware payload (Gafgyt)", "value": "b8791b261389ff833bcd2316872ff33853d54523d85eb5f4044ae75d44dfa86791bd76b98d50ef3fb8ee681cda1b6e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198039, "uuid": "a9d269b2-bec4-4db0-94e4-3f1d3da9b182", "value": "T151E34B36A0A15FF3C0467AF7186AAD310F15D5D71BBF269626381BB04B4F5CA300EE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198039, "uuid": "71f03407-6def-4dd3-9383-f5a1767af34e", "value": "3072:xGrkwvqBfvlVHhN0aX2ew9ZjM5hGfqbOlmAK5GWQgy2QQ:IrksqBfvfhN0IADjM5hGCbQmAK5GWQgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766198039, "uuid": "fab59ff7-fc26-4c4c-8157-2a76fae5aa71", "value": 144327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766198039, "uuid": "868f1f28-b14c-4952-9c4e-3a36c9af037d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766198039, "uuid": "6822ad39-08b2-4171-a0a3-01084457e3e3", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86a7eca-ddb1-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1766241608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241608, "uuid": "7c3f5ace-6628-423f-a8f9-8b95b1742f87", "comment": "Malware payload (ValleyRAT)", "value": "63d7aef8e4666267a1ea87f9fbc1026a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241608, "uuid": "6d657aae-608c-475b-a29b-e72b26a1f709", "comment": "Malware payload (ValleyRAT)", "value": "ba17c774a3402a5188b2cdc0c2b0a7c3514294d2162960af9d2a5f6cdf02d89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241608, "uuid": "269b7342-7df3-4810-ae2c-bc4e73d2163d", "comment": "Malware payload (ValleyRAT)", "value": "3f438014177c5a1deb4e2cfa5cba44075cd662a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766241608, "uuid": "3cf8135d-2d5a-4ae9-afb3-10c7e4eb7170", "comment": "Malware payload (ValleyRAT)", "value": "09682b2bc9c754378fe39983837846fed17950102328c7a9df6886014362fc11efe8d478144d5d3c5ebc40693b1e80b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241608, "uuid": "dba653cd-281a-44ff-ab81-d101cc0133b8", "value": "T1A1640253B0C18872E8B31D350879C6616A3FB9201B749FA72718067E5F281D0BF7AF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241608, "uuid": "55f18f50-9278-4b88-baf0-960d3ed38c6b", "value": "49b90f1aacf0f0f7aadf35424298e9c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241608, "uuid": "0bf6e8e4-ca19-414d-a7fa-93e44660a061", "value": "6144:aykHG2FAYjhlfbbNEuSolnSJCfars2Y5FXropQ+URZ0jXq7siHwhpV:a5HfAYjHbhEuSknSJJrY5FX8pQJRS7/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766241608, "uuid": "ed72b8ed-09f2-4e25-b53f-4796500b828c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766241608, "uuid": "26ceaddb-e51f-40e0-92b1-a61bd940e460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766241608, "uuid": "f973d294-5c17-46c5-b86a-bc93759985d2", "value": "HUoRONG.msi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8405defc-dd3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766192531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192531, "uuid": "0eca9b6f-38a9-4c04-a6fa-ce4c183dbdd4", "comment": "Malware payload (Mirai)", "value": "13290e0d38ba02828348a8e57d2e6f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192531, "uuid": "2d5de558-c834-43c2-8800-293a74f5a5c1", "comment": "Malware payload (Mirai)", "value": "bc64a67c420feb303b7f452f7bb05ecabf8e8a098fb3bf6f250f92c780e81418", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192531, "uuid": "825e219e-b3ba-465d-b6e4-0e3c5a9c5eaf", "comment": "Malware payload (Mirai)", "value": "e52d64aae43ce3695b8a88e989041c784a1fb006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766192531, "uuid": "97127a38-0457-47c8-8c46-a0a94e6ee4f7", "comment": "Malware payload (Mirai)", "value": "8a57eea537a3dac892ae909a949a8db3e04c85601232f044e2099b72a6e7fb0b486dbbe0e0f841a4b135ca8187c40339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192531, "uuid": "9766b1c5-f7b6-42fc-b4f9-b1f461ecbb9a", "value": "T1AC831A85BD829A17C6C1527BFF5E42C8372A6398E3EE3213C9165F2537CB56B0D2B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192531, "uuid": "a653a53a-25d6-4c95-baad-5c3835a885e0", "value": "1536:+siLepxlJDh7K5kiKbCiQob4X9ZyObXK0pjkLA7JqmFvdfM:+siipxfZFiKWi5O9/zwU9d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766192531, "uuid": "06a72612-714b-4741-ad58-6f1f12d7356e", "value": 83908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766192531, "uuid": "1ae25c2d-dfd2-46a0-a011-bf261a65659c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766192531, "uuid": "b83587eb-a815-43cc-adbd-c0d9f1fa996c", "value": "kvariant.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81f6201-dda8-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1766237823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237823, "uuid": "b66057ea-a73f-4792-9155-886b5585ae8d", "comment": "Malware payload (QuasarRAT)", "value": "8ff855ac2fa3a693edbefd17cc258fc0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237823, "uuid": "f3a90f05-b85a-4397-8928-233e77e781ce", "comment": "Malware payload (QuasarRAT)", "value": "bd9b8786f6b0e1b3620830522d6082279f58ce30f0870868fbd78d987497f87b", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237823, "uuid": "f1b7237f-6c9c-4103-9404-5baf2e2809c8", "comment": "Malware payload (QuasarRAT)", "value": "4632e0da5721e16c3fc4ab23624e9b01ec8c5b5f", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766237823, "uuid": "9d8e1b87-bab5-46e8-8695-d0dc12d373b7", "comment": "Malware payload (QuasarRAT)", "value": "29b5a88132e56403d1eab06170ad032d0ad2490c62f9bd73a8985cd85d81efb4fa2ab751983a1b548887d5fb47e35ddb", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237823, "uuid": "d9771c31-8169-4b45-9712-980c7ea928e4", "value": "T1EDE56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237823, "uuid": "e591410a-c313-4084-bfdb-23643523e0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237823, "uuid": "ed2a7ae0-74c8-4f41-a8f3-03ce4d5dbac8", "value": "49152:Jvqe821/aQWl8P0lSk3aKA3Z+n9MRJ6ebR3LoGd32THHB72eh2NT:JvB821/aQWl8P0lSk3DA3Z+n9MRJ6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766237823, "uuid": "0ea93d4b-4cdd-4bff-af1a-b35aac999a05", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766237823, "uuid": "9ad5231f-e41a-48e2-9e7c-f170ba806ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766237823, "uuid": "5b0669e9-c443-4708-9e08-63f618b18719", "value": "UserGuardScanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7ca423-dd64-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766208361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208361, "uuid": "4a7e6443-1635-4caf-99d5-6f323414320f", "comment": "Malware payload (Mirai)", "value": "38c8eee8b142966cd99a401989943a21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208361, "uuid": "47bacc88-ef92-47b1-a91d-114bfad883f0", "comment": "Malware payload (Mirai)", "value": "be58a44667b375703a76ad0c6ddca15d16aee9717d125919f20dce30763cc00e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208361, "uuid": "fc6c2375-f099-4b3b-9c90-33615a0af821", "comment": "Malware payload (Mirai)", "value": "a72b05bdef83a44f600bd201b6c6468c6b7fd752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766208361, "uuid": "a9ed6376-20cb-4cc1-afd9-b77f19f995b0", "comment": "Malware payload (Mirai)", "value": "5eedaa6a6a1a7b3f87942a92398576c8e3a530d7d45a992aeba6d775051dd8a3b90a5db6eb00e04d10a2bff796a2feca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208361, "uuid": "9ea935d6-763a-46a9-9ab3-95c8b8d4a755", "value": "T1E813F1BA99052A31C7F60535D22CC586D6E30D3AB0A8F03D7D0D95D923930BB7BE5B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208361, "uuid": "4cd1e3e6-3745-4a19-abe3-693a14d60d04", "value": "768:14pMYWW7zSiQWxyxrpOoG7f5xY8UZz1sQXxe/aLss3UozR:1YJ7mswhpO55pUkKeidzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766208361, "uuid": "3850bab2-bff3-42a3-8d3e-b5589d41b19e", "value": 43144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766208361, "uuid": "5f0cd5b7-43ae-421b-ba0e-a4eaa03ae6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766208361, "uuid": "8f7fd7d0-0b3d-4934-b740-98f8cfca0851", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b06e2fc-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254337, "uuid": "dd965d67-fe2d-4f8b-bd1f-52781f9f9198", "comment": "Malware payload (Mirai)", "value": "c2cb4afad510b936f4b6bcbffe72e7b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254337, "uuid": "757487a8-e222-4168-b42c-b496d11134af", "comment": "Malware payload (Mirai)", "value": "c000352bf234f177c6448a10b8fe13f2a4fe6b2b675bb2ee088f79021b16b78b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254337, "uuid": "1a4627dd-4945-43fd-a19e-dc401b4eac50", "comment": "Malware payload (Mirai)", "value": "7ea0fe0c35febd9031d1d9a48382554b4ba72c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254337, "uuid": "f08070a1-9670-44d4-a202-ef01ed203dbb", "comment": "Malware payload (Mirai)", "value": "0a4b9d79b9aee1c2556a1ea177e21971ea11d5e15bb97e665c722c35880011d25531401194ee56935f9ae0b42c7b5b84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254337, "uuid": "96469580-7997-4aee-8dab-78549ac7773d", "value": "T1C4839D63C82B1D24D04848F0B0A48F3A9B63E115CA5B2EF7959AC679D087EDCF6467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254337, "uuid": "f0b3c16e-796d-458f-ba5b-47dcc5e2d777", "value": "1536:KJ+dxKPT0YDgpf3ujKDbCCGrSq6CHi/PzD/29OI:Kkdx8Dgpf+GDqrSq61/PPeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254337, "uuid": "1199214e-3210-419d-bd30-a1ad85cf00bd", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254337, "uuid": "eff9a44a-09d0-405a-926d-05a5f3497faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254337, "uuid": "e180784e-b6b1-41e5-a68b-f186b18ad606", "value": "40no3b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fd1711-dd9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Berbew)", "timestamp": 1766233489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233489, "uuid": "19e16ad2-aeff-4464-aca2-503e3fb67316", "comment": "Malware payload (Berbew)", "value": "76d2bb81df2a59f886f259995c893917", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233489, "uuid": "6c51ec35-0ac4-434a-adbd-ba32b26be118", "comment": "Malware payload (Berbew)", "value": "c05ec67e75693127e5556eee229b88f93c7cef926cfe905dfd5464be9d305c94", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233489, "uuid": "e6577cde-4dc2-426d-a47e-d02a77aa72fd", "comment": "Malware payload (Berbew)", "value": "4945f681cb909048dfe428005b193ad1a9602ce5", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233489, "uuid": "b4f24cb6-71d8-4e67-af03-6213fa5fd54f", "comment": "Malware payload (Berbew)", "value": "c2e68484dadf15590c0df7cda5ad861937089d2063a055c37baac67b99cff39d02c5fce13ce8272a638e34b60f49c905", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233489, "uuid": "377e8be6-e96a-4bf6-9f3c-6c3a744c89aa", "value": "T18F749D17E15C5F62CA86CA3331210EB3B927C2A64BD865CFB300C4B4B997975BD76A4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233489, "uuid": "36503a7c-01c5-4d31-b69e-e1b52ebc3f0c", "value": "fac73f28669b7c9fd9ec443763cef5ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233489, "uuid": "cf8cd64c-a923-4be0-881b-1e78a90eac37", "value": "6144:YkgiPA6RHv97aOl3BzrUmKyIxLfYeOO9UmKyIxLiajOE:EiPl7aOlxzr3cOK3Taj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766233489, "uuid": "3d184390-dc54-4ac9-a71a-bdc758c45ca2", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766233489, "uuid": "e042b200-5a8d-49db-9925-673c692d7194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233489, "uuid": "9c83cd33-ee12-46a5-ab10-70d06c6c3124", "value": "c05ec67e75693127e5556eee229b88f93c7cef926cfe905dfd5464be9d305c94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f4c066-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234487, "uuid": "574c9eac-217a-4e0d-9309-5ca04221f19d", "comment": "Malware payload (Mirai)", "value": "f0b1764f714e2dcc16d95515c090c359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234487, "uuid": "d02d9b81-e831-46bd-9cd5-e3f7c7151035", "comment": "Malware payload (Mirai)", "value": "c0dde5b4fa97c0f4248e25be497d5a1ee761e0aa40b22084dc0c387cbdfa0377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234487, "uuid": "716ced1f-46cb-42bb-9bc4-feaee358b53b", "comment": "Malware payload (Mirai)", "value": "168650b37cbedc645bf32c9151bca7f8706464d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234487, "uuid": "b1350a1c-c8e8-4a99-a9dc-a2a1bee985c0", "comment": "Malware payload (Mirai)", "value": "99adbd27d77eda6e6469ad6bbbe624c049bf0fe6986d03f13020f94f41add66da9b15caab66ceb380f6428c3c435887a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234487, "uuid": "9f7342a4-e2d1-46a2-9c18-b16e410aa5cb", "value": "T1C2733A01B7290997E6A32DB03B3F3BE597EECE8120B46148795FFB469171E311486ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234487, "uuid": "66d12db3-15a2-43e1-8d41-aef567c1d3c2", "value": "1536:QsnP9f8C2kHlPJ61jo4IyQfUuLCPXhl2/+6rJPpxn43rqo:vnPj2rvhxip47qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234487, "uuid": "cbaad139-ec45-4dd6-9694-1c80c9874f6f", "value": 74468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234487, "uuid": "f972c447-3ac7-4bab-a8c7-1b4f9721dd36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234487, "uuid": "65a154e9-05fd-4d6a-ba0c-bbb45cd459c3", "value": "firmware.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579f80c6-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235836, "uuid": "de92ba22-c405-4eed-b45c-eb8e7b8943c7", "comment": "Malware payload (Mirai)", "value": "4c1e85e35283e7778bd3eb8ffb674a41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235836, "uuid": "7c5b6ad7-4a8c-4b0c-a66b-51c1c558f4a3", "comment": "Malware payload (Mirai)", "value": "c241cbb9e597cf3b98d1adbfbdcebe8b66fc6689691f8d7de1b1c50860579d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235836, "uuid": "14a6f655-3db9-48c3-a5cb-d3e0fff970ff", "comment": "Malware payload (Mirai)", "value": "b4c18768240385ba37e79dbf7cf480b13b8b792e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235836, "uuid": "a594e4ad-065e-4c9e-94da-8a35ea835034", "comment": "Malware payload (Mirai)", "value": "3748bcc3c003918a09efefb1895b93fe21669a5b013df802a2865e95baf6256f1b218f1fff651d06e582ff104122671f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235836, "uuid": "5ec2a22e-0ade-48b4-aa24-b60389aa05fa", "value": "T1E5C3F609EB610EFBE86FDC370AFD070525CC651722A87B7A7574D928F64A24B09F3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235836, "uuid": "863d2b23-9b3d-48a7-bd73-db2b0e7888a6", "value": "1536:QWeUSZ25Dy5uMePxR0hFXd0YuwHW2qDOUu3up+5iQ1vZZO2WNEMvlOKvj8tjlBq0:QWeUSZoDTR0Z6k5iQ1Zdgjut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235836, "uuid": "36b59b73-9ddf-45a2-ae25-274618213b02", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235836, "uuid": "be6afbaa-4fcf-447e-9e4f-c19f7b79e27c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235836, "uuid": "8a1b0a65-acb7-41ec-85d9-8ac452e4c70d", "value": "nmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7460180-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249821, "uuid": "4d50b0e6-d3d8-44c9-a8c6-c9eb41c91b95", "comment": "Malware payload (Mirai)", "value": "8055834936f98517b4b92784f227255f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249821, "uuid": "85318646-1542-4a39-bbba-9cc40dcb4888", "comment": "Malware payload (Mirai)", "value": "c7c544bd12f4e96efe9522e2b1eec9e1aaca2963f1af9d6d825a77e23055ca4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249821, "uuid": "01d100a5-44a4-462d-8d55-ed118a57bb83", "comment": "Malware payload (Mirai)", "value": "e73c30d70bfe6c9d0933177c555a7ab9781e9115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249821, "uuid": "ddd50abe-0b18-4624-a387-d7af90a06406", "comment": "Malware payload (Mirai)", "value": "15b0b88da4486c56cf74a31d60d70ee5f10a2e3c11b73783f272005271e41293c8c76031de313088342aaaea36d25b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249821, "uuid": "77bccad8-138f-47b5-91ad-52a766228127", "value": "T1EF430176305C98FCEF71847F6BAE0AD0205A5B0CD475792171318A51A6E4C293DCAAFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249821, "uuid": "5870e18e-be14-4c3e-b534-2d04fe44e100", "value": "1536:8b23wBYl9ChP+BBRGvgT2fmnbZMwnoOVYiLL:8b23wyChPAmvgiQoKNLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249821, "uuid": "be5c745f-6853-496a-a01a-7f6edaca0bcf", "value": 56184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249821, "uuid": "0de2c182-2e05-4324-97ae-cb33f31a8f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249821, "uuid": "073f4287-a335-4aba-9074-172fbd96d55c", "value": "sumrak.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094b36cb-dd8f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766226685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226685, "uuid": "e45d9a5a-9c67-4439-8d38-663063671691", "comment": "Malware payload", "value": "bf738f894d66fc1b247cc8ecffa5715c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226685, "uuid": "2fdb66a7-03a0-441f-88da-ef5aaaac7740", "comment": "Malware payload", "value": "c87e9a76cced7e4e108d478a927fe2d483fdac3fe18d28bff42f768209552a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226685, "uuid": "bc194394-aa6a-42af-a193-ad15f0cd75e8", "comment": "Malware payload", "value": "1b2d09bfd5ae5e4f77799181cf76195459fe37dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226685, "uuid": "45cd0c3c-5bcf-4f22-a5dd-b66bf5f43955", "comment": "Malware payload", "value": "390ef38bbf6444027d202b8c8f37328e4168e813a2f5bc4b449e311d57d34b3115bf43d96b018c2cb0749fb3bddd527f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226685, "uuid": "efe093d4-77b6-4339-b890-d49a32d928e8", "value": "T149531B1BB35364ECC62AD57486EFAB33B671F8634630AF3F02E4E6702E11E601E5A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226685, "uuid": "e584eb3a-2ed9-4592-8db0-6511c5baee79", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226685, "uuid": "4af17200-d458-482a-9f07-2dc1b648b161", "value": "768:1cGovCAeG58oao/JVTM5y0VQu0hseQzRxUMUla8vX6puvf1bs9PDV0gOiATWhea:GGoyzo9onqrqcvlP6EvfaZ0gkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226685, "uuid": "2c2ff60b-f3bd-4278-9ee7-4863436bd6b7", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226685, "uuid": "a9c30d8b-008b-4a79-8406-c4f75202240b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226685, "uuid": "69653697-b2f6-4cf6-adce-29a1851ed7d2", "value": "SecuriteInfo.com.FileRepMalware.51461229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae99b21-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234445, "uuid": "a64226d6-708f-42cd-802a-28b1b2138400", "comment": "Malware payload (Mirai)", "value": "4084ff8c29fde04e6bac1e4d9ff1b52e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234445, "uuid": "7c91e4f4-6750-4e81-b3eb-6f887b1dac37", "comment": "Malware payload (Mirai)", "value": "cc2ac79f3a34ef1d27057015dc375ea002b4e6c31ddee70813f090a157e34fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234445, "uuid": "cb3dbaa4-8b58-4626-bf04-580002a30094", "comment": "Malware payload (Mirai)", "value": "23d3df44e9d3feaf6ec58b364e4412fa3aad2dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234445, "uuid": "a5be8245-35e6-4649-94f8-48d49eda29e3", "comment": "Malware payload (Mirai)", "value": "bd110e6b54921c86e8261c3edde59e8b32303b487a6ce2d1bf61b4081ff50ac845d33805f010ee7673d2dc58230ee019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234445, "uuid": "7d442d8b-19f6-4972-b96c-71958aa0e8af", "value": "T16753023CA365F5F4CFE0647AD1F519DF8A5A059812BB363614922D9D7C9248002A4FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234445, "uuid": "b3a17d44-ca48-4782-b589-fbab1a6b1a97", "value": "1536:mgSQrSTq2osBsL6OjhJFLDp6wV4hrgUszCCa:wQrSkNLDpjqbs5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234445, "uuid": "5ad7e37a-5b33-4f6f-83b4-84982e710452", "value": 60980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234445, "uuid": "7ba6cf2e-6020-4ec2-ab09-46dd4bd51089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234445, "uuid": "e6b31600-d854-4a7b-be15-5fa078520408", "value": "firmware.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924d6bc4-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254403, "uuid": "8b92d26b-9b12-49a9-b65d-cd704995ae07", "comment": "Malware payload (Mirai)", "value": "931284795e9dbecaff77e76273008a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254403, "uuid": "fb87ed21-b2bb-4d01-a15f-6ef2614f5ab4", "comment": "Malware payload (Mirai)", "value": "cc74ab6dca30b46fdecddab5ae467ebe35d26740ff51531c5ed78d3ea1f2795c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254403, "uuid": "d9898f14-ef11-410b-8f11-e28a15f0e88e", "comment": "Malware payload (Mirai)", "value": "f983ee69c60e5799e55238c625944fa6354539dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254403, "uuid": "904194d8-48f5-4797-b800-17e1821ff410", "comment": "Malware payload (Mirai)", "value": "3c4b19b3f45c2812086fba4a0d17a7fc853a4d6c5ded9f648e21cba8c9a503fad01fab21d2084a0b5dabaa83020e73b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254403, "uuid": "7a2e5d93-1a94-4929-89a1-6c60bb578c85", "value": "T13C736BC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254403, "uuid": "3698d2cf-5a90-4a49-908f-90b790a46d78", "value": "1536:XbwcQ0p+cLBZF6KJdIpmQ3Pk798U755e1j+M:40VZMKJdgmQ387O0Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254403, "uuid": "3977cccc-7b64-4640-bfed-a9b75d87e99d", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254403, "uuid": "6a760ce8-0081-4d5f-bfa9-c9e8d4a36863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254403, "uuid": "fc26dc3a-f724-4dcc-a640-4add8562c7d7", "value": "5a7s2vke", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839bf466-dd63-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766207992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207992, "uuid": "7e35f88d-96af-4738-8d7b-cae8067330c5", "comment": "Malware payload (Mirai)", "value": "3219a660d50efe404ef6555f37c874e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207992, "uuid": "d1e78ca8-4b4e-47aa-a003-5bf29faa153c", "comment": "Malware payload (Mirai)", "value": "cda60790407bccd1f7e11f6b1ec2f299a5348392a1abfdfddaeae28e42bd284f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207992, "uuid": "9fe37926-eec7-4951-8de6-05f1ae218c85", "comment": "Malware payload (Mirai)", "value": "1dbbf6d16adf6eb6050293085ba82d8d999bed92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766207992, "uuid": "1decd3d0-d027-4604-82e7-9a00a506a1b0", "comment": "Malware payload (Mirai)", "value": "24d075fc3e368f6d1471b5e584657524e32aef5402bc0ce91c00a6e589b396c992e913a2223330e9ddf0dee7db3ed02b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207992, "uuid": "11a70de9-146a-4c82-8383-2447b367548c", "value": "T14623F128F5036C42C826993BA17D618E7E01397AE6CB2D401D754C3DB6AB39707BD45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207992, "uuid": "7f4c249e-4612-409b-9866-b93c6539ab9a", "value": "768:1kXsan8kAZvGKG5jiRNo/BkmehwwrGrWvO38ldkRrSxW2GSa19q3UELfd:1kX78kAZuKujRkme5rhvflIsjdLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766207992, "uuid": "03fdc28c-1036-45d5-9b35-d139c59c47c4", "value": 46112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766207992, "uuid": "49a7151f-f8ba-45b4-a4b5-71858eb86816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766207992, "uuid": "859f9098-8ae2-45bb-8d26-291e0d2fc3ac", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a53a40c-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235840, "uuid": "83547452-2c0a-404f-a7a5-8f1859fd1bb9", "comment": "Malware payload (Mirai)", "value": "8dfe2d7679320192b563945248e9da27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235840, "uuid": "3e321a68-209c-40f7-ba99-0d2ca0c10309", "comment": "Malware payload (Mirai)", "value": "cefc34c410543709181408f93b65fef61e4fb5e22b3c9d85a79910e67b193d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235840, "uuid": "7c8e1579-61c5-4016-b2c1-c3eecb78c9f7", "comment": "Malware payload (Mirai)", "value": "f86b75b5e9b2f56d0db6c3e52c0bfe66be00e538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235840, "uuid": "00080908-8929-4870-9e8b-b642126ea741", "comment": "Malware payload (Mirai)", "value": "fcff3d3802f08a61af52e4a950fca85c3ed099b05002ead35b446184d54d5330867b3ec92c586bf158ae4f764b78da49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235840, "uuid": "9fc1c3f0-cabe-43b2-bc6c-e24e7ad35654", "value": "T17B042B46EB414A13C4D227B6BA9B424533239B64D3EB730699287FF43F87B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235840, "uuid": "223416c6-95f0-4b60-a280-99401056b47e", "value": "3072:npoGm6qQVztpa1g5rvJ1/IR0JLEoQ8pnPkXu7SpbWM/93v0OU:poGvhpaW5rvJ140JLNpPke7SpqM/9cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235840, "uuid": "a4a49c5e-edd7-4e9d-a18a-7e7c71602366", "value": 177811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235840, "uuid": "fa6c7a1d-7943-42bf-9803-f743a1d54541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235840, "uuid": "5ae923de-ab42-4202-b9fd-3b150f56ccb0", "value": "narm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c468d97-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234206, "uuid": "923190e7-7a44-4cfe-8d83-68bdf7fc4dda", "comment": "Malware payload (Mirai)", "value": "444e9c6864aafa2a4bcb255875465d39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234206, "uuid": "f95f6a01-91a9-415c-8205-40d8fdceb80c", "comment": "Malware payload (Mirai)", "value": "cf5c2f6121e273f0445794f649a84e1a0ccb7aab64f313aa87e9943e9af1d4aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234206, "uuid": "a4b98446-9957-4a9e-985a-0f5ed4fb580e", "comment": "Malware payload (Mirai)", "value": "e4be55dad384e2dfef55389221ab1cb97f9d5a05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234206, "uuid": "387104b4-3a88-4dae-a1b0-b9e155f1d663", "comment": "Malware payload (Mirai)", "value": "f6bc29a065c9083cae96d3d1c1f4e5499466c4c675b5acffb7be6f890746e6e793cbf0ad868cca5e471494fa8fb08dd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234206, "uuid": "25271abc-f776-499a-91ea-124d041d0d76", "value": "T1713130E5AED04F6DC8E085FF9819035473129F89E1CB7712A21CBB686D1DE1C8C0701B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234206, "uuid": "ef563218-e990-4cab-95d1-b98875acbb07", "value": "24:6S4Gpa7Urz/jlIXKcDAHVR7gwH9iWqQ+o+XLQAmE0BaMBlx+OORSf:8Gpa7UrLIIsQOLVmtBaolz2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234206, "uuid": "e806813a-c308-47a7-bbe7-165713f68b7d", "value": 1692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234206, "uuid": "52e6bfd2-633a-4403-9b17-29ec55b8a2e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234206, "uuid": "09393424-16e8-4046-bbb3-f3d90b3570f2", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e11c0d6-ddd5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766256785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256785, "uuid": "e03e8d1a-489b-42cc-9deb-8c952acf86f4", "comment": "Malware payload", "value": "abd871b96e864eb2dea43bdce66999f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256785, "uuid": "0a82a2c3-86e5-42c9-ab73-52b00b015b8c", "comment": "Malware payload", "value": "d018ddb0901c8f1bd062a0a894902e54346e01ad8401cab49de71bd1e9e2fea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256785, "uuid": "b8d663bd-070f-40ad-8904-41ee12b2e8ed", "comment": "Malware payload", "value": "f5f26554481c5290236b3d430a411b3aebc134b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766256785, "uuid": "8aaac198-1024-49ed-8870-e37683076ee6", "comment": "Malware payload", "value": "43525faf28375838d3726b1f723d9cd7a4aaafebab2f950b05bc890cfc9edd2437f7fac8a5f45195638ef210c58c8f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256785, "uuid": "e602462d-4b77-44f9-bab0-ac32ad46a878", "value": "T1A2373396C01F40D6E8680538801B5499E0977E8F2C32E7A7E688FFE3B17B51A56B711F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256785, "uuid": "cf6cd734-0dcb-4958-aba1-d44090d50f87", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256785, "uuid": "5f9e91ac-9aef-4cea-9a77-37adbc9140c7", "value": "393216:6kEolc/CHb420NO1BvDog1BVfso0vBCKugdHG/DDzGyEmk0ltd0veDNRtXjjgDK4:6kEolcKHb6NmDn/Vfso0vFu5jGRAumbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766256785, "uuid": "c2ace986-9eb9-4faf-93b6-856bd172c43a", "value": 22616784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766256785, "uuid": "ab59d677-f3cc-44ed-82bd-89a8cd097fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766256785, "uuid": "badeb4ba-7dc7-4784-b0c4-045a7c999071", "value": "LetsVPN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8866d156-dd71-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1766214013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214013, "uuid": "b8fd8f76-dc64-48d7-ae8a-d5c87c32d228", "comment": "Malware payload (AgentTesla)", "value": "fcf79fe953caa991b76e243e978a7f61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214013, "uuid": "747927cc-4095-47e0-8545-ce732e2992a9", "comment": "Malware payload (AgentTesla)", "value": "d05cc15b3dea1e20b1ad5fbd76cadb0d50d1eb00465895ac515c49d616b4c12f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214013, "uuid": "43fe2e92-4b6c-4a70-9fd9-dd07558c502c", "comment": "Malware payload (AgentTesla)", "value": "e14b21929155fcd279e7b2885c3ac0602ba0c25f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766214013, "uuid": "dba3bfe1-5aed-4387-9f77-ea9714f61ac9", "comment": "Malware payload (AgentTesla)", "value": "28a63d7caa2d490c105d5c6eb0cae468dfa8d1920ccf9b85bf2a7adcaba7645e3103432584514bb2fc9f88763adf08c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214013, "uuid": "9af994b8-fbec-4d1f-9b82-8da2aa7eda89", "value": "T14935BF0273D1D062FFAB91334B56F6215BBC79260123A62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214013, "uuid": "21bea362-5acc-44d6-8d6f-77600b1a9d04", "value": "24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaV87fKM5PBHZIY9:CPVt/LZeJbInQRaVQCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766214013, "uuid": "4185b47c-d802-4844-b5eb-6f3f00adbe2c", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766214013, "uuid": "739d1093-4f48-4ce4-9e46-021e1131e09b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766214013, "uuid": "10eb5e43-a44f-4468-abfe-7534de870784", "value": "nRFQ_-_PO_INV0498244.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910cf500-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235932, "uuid": "388f996d-980e-4ade-8c6b-4e6e23d8f77a", "comment": "Malware payload (Mirai)", "value": "cb3d6f4b27a0d2d32d8813648cea9c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235932, "uuid": "4823d03b-3726-45e1-ab91-f1e36524f7c7", "comment": "Malware payload (Mirai)", "value": "d089336f39dcef9cb471870c34ed52727ae4b50410f44a5fdda656bd4afaefcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235932, "uuid": "7d719a94-db74-49ff-9352-e6e8e95ade0b", "comment": "Malware payload (Mirai)", "value": "10288d7e4c620c8fdef8f78d6f456f5e6f88e128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235932, "uuid": "d8917cff-1058-4608-93bf-ed844e6be574", "comment": "Malware payload (Mirai)", "value": "5d19156e9606dd114cd87abff3e7dc69a0b4289f26afb7bdbecb6ae62aadd48fac1e27c307c8e879f4c764de9908a4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235932, "uuid": "f87e4bf1-3c98-438d-ae56-d966b27dbfba", "value": "T105736CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235932, "uuid": "16e2f47e-36a2-405f-89fd-ef5428d8c80c", "value": "1536:XbwcQ0p+cLBZF6KJlIpmQ3Pk798U755e1j+M:40VZMKJlgmQ387O0Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235932, "uuid": "87aa1d7e-eaa9-4a66-9717-38343bc29558", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235932, "uuid": "0274ff67-f993-4ac0-906c-eed9e59e738d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235932, "uuid": "382c357e-fc73-4b11-9df9-525f8dcd5304", "value": "nx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48a6068-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766249816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249816, "uuid": "4b528c6a-1658-4b3e-9a3a-d320ba04f5e5", "comment": "Malware payload", "value": "61a03cb9795128199b202d32e706c209", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249816, "uuid": "3814d385-3d2c-462c-8110-1864439da9f5", "comment": "Malware payload", "value": "d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249816, "uuid": "07e3c45d-3b53-498d-934c-1e9248e342d7", "comment": "Malware payload", "value": "c2c47801e47d44551e99aa6b4fb4dc30587ab380", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249816, "uuid": "f1d9d5d8-19b4-4029-9c5f-ae0d2b89807b", "comment": "Malware payload", "value": "dac39f23d625298e083b2b35ce23d19c28379fb1548161a96a3aa9a660c2bd4266f666fdc72bed7875dd8da156783801", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249816, "uuid": "79e5f07c-478a-43cf-9ecf-c8496a6f5c19", "value": "T18D2180FD077169014C848F48A42BC4CB811DADF9B58FDA0AE4BB1C7E8194B2730E6E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249816, "uuid": "6f184784-66b8-478c-b0ee-290240e504c7", "value": "12:4QrKfQ18gvfQtNI2SQexKd4QwQnD6QdW/9dlQdRJR8RzSRRYQSa5aSF6SgQAGnP2:4UKfivfmNIvlKd4De6pOY3vdX4qpjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249816, "uuid": "223e2f9a-4896-4601-af32-4c0f6aaf4700", "value": 1213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249816, "uuid": "fc2952d3-330e-401e-a083-5a45a0642fe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249816, "uuid": "59d47ca7-3a93-4c3f-b48b-06b7909204d9", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65980c79-ddeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766266354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266354, "uuid": "24b3cdea-8947-45f9-8a0b-124aef69ae71", "comment": "Malware payload (Mirai)", "value": "ae7743b23bcb008aa512e3053beb4301", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266354, "uuid": "2a551a3a-a437-437a-87cd-ed261d7bfe71", "comment": "Malware payload (Mirai)", "value": "d2a961569e9ce75e16e24f1ce9614e45a83ce50d90dc0af52347cffb33e30509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266354, "uuid": "03a9690c-4364-4956-b510-bda2755ba587", "comment": "Malware payload (Mirai)", "value": "c0d8146d286a98b270bbcdfd7024494ab32bed0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266354, "uuid": "45c7c1d8-45a0-41f4-944e-636a14de9a35", "comment": "Malware payload (Mirai)", "value": "cb1dc455d5df2815c41b61f93849ac60cbe58d604661fc995efe1168ea39979390335d3dbaf491f5087791daff4adf88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266354, "uuid": "4292e87f-9452-49d3-a3e3-2f86bede2538", "value": "T1D2A3E792BCC2562BC5E523BEA67E568D336073E4D2DA7117D8A34B107B8251F0E63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266354, "uuid": "70c3889c-e28f-43ff-9f7e-feeb1e1055a1", "value": "1536:onACdChqI8Ub0Bp6/CNfJzVPo41Xe/BLG/vXb/9tJJMVI5FUqZrYlq:onACQhqIMBpjVXeSX72I5FPZcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266354, "uuid": "262a4740-6a5d-4be8-8c2d-922fc81dfe03", "value": 100956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266354, "uuid": "093fad57-7a99-4eeb-bfeb-8b11aaa28f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266354, "uuid": "fdec25e8-3475-48fb-a3b3-a56697bb5850", "value": "frost.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487f3abf-dd69-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766210470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210470, "uuid": "e028d318-6fc6-4f7d-ad55-236c1d2405ba", "comment": "Malware payload (AsyncRAT)", "value": "98250b38281b2c652a7f1526263aa5a1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210470, "uuid": "1264dfb1-aa7c-4fbe-ba38-3a91bc826b24", "comment": "Malware payload (AsyncRAT)", "value": "d31b567c5382a5e68eaf2becddf8c125f962c57f7142efe984fe1fe0ae05f13f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210470, "uuid": "993e7ebf-2c8d-43c6-8f3e-6f661a06e3b0", "comment": "Malware payload (AsyncRAT)", "value": "d3ca0d04b8b5c898f3e2dcb5632a0d8623c392f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766210470, "uuid": "3eb28101-373e-4343-a24c-77ef8ce842f1", "comment": "Malware payload (AsyncRAT)", "value": "025a0e537cd5d90935d66cd21c024c9180316bf6f4c14ff6e880e21748cb7cd56cef72c3804662814e1b8ba6bd148279", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210470, "uuid": "b06f6950-b350-40f5-949b-fefe2f51d683", "value": "T1C2C22A0473F48262D1ED4BBE4832A200D375E64B5D13DB9F6EC494AD2A337C98A25BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210470, "uuid": "d1fad38f-6b8b-4161-819c-a17f0e1aceb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210470, "uuid": "d4557220-5391-4109-af57-316a28f68cc0", "value": "384:CsA9EhVLq1LrzgepaQkXkMymrJhx8HqqbuUsJQxnCJf+BWfXWm//u+:rA92VLGLrE9Qk0MyCJhxSFbHBFBCu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766210470, "uuid": "6a998473-5341-4b6c-bfdb-4452f67d967f", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766210470, "uuid": "6a0205eb-c40f-49ba-ab5e-0243e5fdae88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766210470, "uuid": "75a948b1-44b4-4e04-9fa1-1440012b1a69", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ed255c-dd9a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766231598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231598, "uuid": "9aa294ba-95d8-40d4-b8bd-e55614fbc6f0", "comment": "Malware payload", "value": "e3f581c25a43d45c23428cf480e43bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231598, "uuid": "47b1e156-c356-4bd4-af9a-be22ce8767eb", "comment": "Malware payload", "value": "d380c45fe69fa729c8977e43554f78cc8a9143661fa5d608ab52f9a1f5c9e903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231598, "uuid": "513323ff-026a-4927-8444-ce908f87fa87", "comment": "Malware payload", "value": "05394ae34ec33bf8cbe51d984bcd99281e6ac221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766231598, "uuid": "1741535d-a4e7-477e-a21a-cad95572cb80", "comment": "Malware payload", "value": "b361f99693284f0ff368f7a2e2b87f61cdcf308aa60c27287f2ba1b30558efaba013282e9acb2412e7285555658b6585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231598, "uuid": "b0c34c67-8355-4cc6-a133-2179027a652f", "value": "T18E0833C96B51088EEC98533A4392DD18AED5F08EC7ED4447A7F828662D8F3C9CB7D644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231598, "uuid": "d51736b8-bd3a-47d0-9b96-58aa882a90ce", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231598, "uuid": "7d8b5447-0d6e-4bb6-8d43-4f881fee4781", "value": "1572864:hkEWAzWCUb9jETHPQmMpnx9luHY7otnq/2cpiI27oeTZHhmqZAD2Ql:hkEWSKjcvPOn36utLeTLpiDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766231598, "uuid": "4d5afed5-b7a5-4574-a90d-bdc1e348e43c", "value": 77904236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766231598, "uuid": "dea77b65-ac8e-4b75-b0c6-91db25f1b9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766231598, "uuid": "1412e1ac-723b-41bb-8dbc-4989f16d09dd", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a44e15-ddd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766258599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258599, "uuid": "7f3aa427-bb54-48e1-96ad-dd126e148189", "comment": "Malware payload", "value": "1b029a86f873fa775be75ce857027aff", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258599, "uuid": "9583f6e9-4515-41f7-ae47-31b61bbc7fbc", "comment": "Malware payload", "value": "d5ab0d265bbeb15ff2cc57daa3f75c4585c30f06aa4eb49a8b1ed32e01f12d1c", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258599, "uuid": "87c219c7-2c11-4ced-acbb-d6489dc13b8c", "comment": "Malware payload", "value": "5839c1cdde7475c85fd63223c7e6b806996a24ed", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766258599, "uuid": "e6fbd1a1-9766-4097-995b-80c8ba4cb623", "comment": "Malware payload", "value": "e8cd80904ff39a1148d842d4d5d6c784e24ac60150af77c2777937bd0f04185df594df289d0ee71876217840f1aaf3f5", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258599, "uuid": "dac057d6-0593-48e3-863a-5405a8f83211", "value": "T169C512377A19AC84DF950EFF4261C5619DC8EAC391A1C0E1BD500A05BEEDBC0F9697A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258599, "uuid": "6bd026bf-2244-4153-903c-020d6a23afd2", "value": "49152:yPUFQHaBfkEgkNl1NtaESpOiARn8WveFZJyrOeVERd934m1IXw:yPkQ6BvBSpOiMVveFjyrOeVQd93x1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766258599, "uuid": "dd459836-93c0-4d81-a75e-85e2e2480403", "value": 2571182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766258599, "uuid": "427d7921-e54c-4677-be61-7ab5e4f089a1", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766258599, "uuid": "f612063c-8b0e-4c77-915b-cccba0f8d5df", "value": "WormGPT.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebeb6c7-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226291, "uuid": "35d7906b-6a76-4b19-aee0-32323141c1fe", "comment": "Malware payload (Mirai)", "value": "d1f31577626c9ef392e1a543176b1202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226291, "uuid": "1c32cba6-ec52-4ac1-b716-8da1ca33bae4", "comment": "Malware payload (Mirai)", "value": "d5eaa4a3c0ff4d5d296c72c56a8812eebe5c88bb7676b0f5fa5f4b09db8d47a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226291, "uuid": "ccf79847-03d9-45ca-92ab-3187f947d7bf", "comment": "Malware payload (Mirai)", "value": "9349576344ab2620133a27d716864447076b0f32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226291, "uuid": "465df157-5b19-4387-a213-a85683e771e2", "comment": "Malware payload (Mirai)", "value": "12bbccb5419a2ab74c8349e2d06dec98c5929c30e85df190cd7b4842189cbf3c71cff47e57caf02feba38f041974b294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226291, "uuid": "c202a885-9578-4c99-a571-db8f7f0f8ffe", "value": "T10383095AB9814F12C5C602BAFE1E018D371357F8E3EFB2239D106F21B78792B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226291, "uuid": "e1d2e309-8693-4395-b011-766b2a879c3c", "value": "1536:bFnIZUXHKgW6i/2QK1eAGzsriW8ppJapdo0IIRic6WWo5Hy8r85dYoBwbZnJZ:6UXKbC1SAiZ7Ja36Ro5Hy8r8jBBwbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226291, "uuid": "9df59e7a-7a54-422c-93b3-7580d508bc24", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226291, "uuid": "3a1d9635-94b8-4b79-a019-8a34773b2999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226291, "uuid": "d4cab3f9-ffce-4aa9-9447-24c4d4591a68", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454702a8-dd9f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766233658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233658, "uuid": "904c37fa-0034-40f6-b08f-0a8eea2fac2c", "comment": "Malware payload (Mirai)", "value": "a2d0390a7cade91a61d3b2f8efaeffbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233658, "uuid": "9c1894dd-c398-4419-bfe6-7e41f9368962", "comment": "Malware payload (Mirai)", "value": "d8284dd82a55c4fb5cb7fab57466c082f01ca386516d9445fedbd7cd737fa081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233658, "uuid": "2d4bbec4-38ec-473e-a32f-4953ddf5460d", "comment": "Malware payload (Mirai)", "value": "d148a90d94a7d28ffd636074e967c9ad8af3b118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766233658, "uuid": "4ac31c68-5b2b-4913-b754-5e18905d3954", "comment": "Malware payload (Mirai)", "value": "300e6bcd5a9d558a3b7e256fd207f91b049e54a18169a1fc1b6c0f41772e98778174221a8dfd769d6f8fb511d210173b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233658, "uuid": "47fad41b-298e-4620-acd5-32581a56808e", "value": "T167C31945FC415B27C6C612B7FB5E428D3B2A17A8D3EE72039D216F60378B95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233658, "uuid": "b757b021-3b10-4d3a-bbdc-2ce3471c6cd1", "value": "1536:JCDwI4fG50nVg/QDEg9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDj019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766233658, "uuid": "dd56689d-9507-4e39-b27c-6640b51d6a02", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766233658, "uuid": "14c1ce8f-cad1-4035-8399-d1c3735e3051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766233658, "uuid": "56a279be-1fbe-40a5-9477-565e9fea110f", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e079b2d-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226290, "uuid": "7f3d145d-f530-48f7-9c9f-7e5cb1d8f397", "comment": "Malware payload (Mirai)", "value": "a7ffacc161d8a679e7c8b986a067b61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226290, "uuid": "70647562-862e-430c-b461-096a175a82bb", "comment": "Malware payload (Mirai)", "value": "d840f802417e9102df93ae2d09643e92c06c23238cbada3075a50d2f725e2635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226290, "uuid": "71716c29-3d5f-437a-b9b4-4e318975bb39", "comment": "Malware payload (Mirai)", "value": "2646419e5eba64420ca6a1bc2872497ce919f213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226290, "uuid": "53de65d1-0ddd-4d52-9b74-5cb6670ea5c7", "comment": "Malware payload (Mirai)", "value": "7049a151a2ba5349f3cdf02f350f9b88aef01cf7b057b4f19288a89f0a6cec776a8f88dfbd48a0d1146d5984d8b0da52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226290, "uuid": "f6f01859-8af3-4e00-9907-2853b653d51d", "value": "T170438D33DA1A2D14C14A827030688E757B53E1C842E67EBA59E1C2BAD443E9DF94DFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226290, "uuid": "6bf0d0ae-ed30-40c7-a9ff-0a3c85a218be", "value": "1536:EhtaVwiHQQth39YFYBc9KNTk6hzbg78I9sCMGwbZnNdCC:4tuwiwQtoFYekNnzbg3s5GwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226290, "uuid": "75feaf2b-80e1-4c6a-a127-159c1f7654ed", "value": 60332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226290, "uuid": "a6b6e602-d4d8-4117-8682-bee52b1ebeba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226290, "uuid": "bc9ee428-0cf4-4d53-adb4-b377a475e2b3", "value": "skid.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b49f42-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235784, "uuid": "89c3cb8b-0ca6-4e17-a8d0-736c2104bc6d", "comment": "Malware payload (Mirai)", "value": "ff12c32659548adb2a8f63cfeef6b9fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235784, "uuid": "4a1fc079-fed5-4159-80f4-e9fa708dfbd3", "comment": "Malware payload (Mirai)", "value": "d8d732c7a708d1a43e13850b1624394c03ef905c34514e01c5befb0acf1dc22c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235784, "uuid": "294c27a7-ad57-4023-8dc9-e2cec689370c", "comment": "Malware payload (Mirai)", "value": "18f779d3ccd679512a2711ba2151bbd4b8f9e64b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235784, "uuid": "74d25334-b0ff-432d-ab79-e64b0aeefab4", "comment": "Malware payload (Mirai)", "value": "1ac525e52a91069833d7d582e9a12b2a8eae5db7ed4ef70843030dd6abe569abd5254609928031df44ae85f36f66fb2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235784, "uuid": "f03d1fcf-6484-4439-b726-2312af6ca61c", "value": "T137A338D7F801DDBCF80ADBB744530506F171E3A219830F76626B7967ED391A85826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235784, "uuid": "518f9fb5-ada9-48d3-8500-85289232fc79", "value": "1536:0nkppk4+ehabRTcZjpIJY1TiZagB8IxCagm+l5cmhbfDr/Z1ra1AgJ9Iq:zJa1Iw4TiZagKR5NhLXa1ACaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235784, "uuid": "41a920dc-c69e-4261-807f-f8304404d5fd", "value": 98616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235784, "uuid": "6f479c91-a8ac-461b-a66e-512da74ed697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235784, "uuid": "8af1b489-913e-4489-99bc-f8f6ce009f0e", "value": "nm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed18f2a-ddd2-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1766255685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766255685, "uuid": "3ca98e7d-c1e8-4304-a1ca-9be61e261683", "comment": "Malware payload (OffLoader)", "value": "cdbc4dbd69e9d46c2dc631a6cb9203a7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766255685, "uuid": "310ef8ed-5bd5-45aa-80d7-bba0a64bacc8", "comment": "Malware payload (OffLoader)", "value": "d9942a6d35dded924026b36301f00829d2cbf05c57904f167a5d53609219dea5", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766255685, "uuid": "618ea7a8-6e3a-452c-80fe-71048b283c81", "comment": "Malware payload (OffLoader)", "value": "b9a02c0cacf5c23f60e71447853f29b63a4164e0", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766255685, "uuid": "5ce0ab42-f767-4747-8750-80a7d8a23a3f", "comment": "Malware payload (OffLoader)", "value": "e58669d16830e2259430306ab8032a181efa9f1f4497278ccb032440124a91886d41b1a559b4c4b3c49356eca69e781d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766255685, "uuid": "930fb1a0-ae5f-4ccc-846a-8b2423a3ffab", "value": "T1AD260233A289673DE06E4A3749B2D2605D3BF661A41E8C4696E40C4EFF2D060DE7F257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766255685, "uuid": "40ead763-4ad7-4194-9cdf-2eb5167a2d15", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766255685, "uuid": "ca2875e9-8360-4d6e-902c-346fde812ecc", "value": "98304:sN66laq9JlBiGJoF8FX56OWuawcHD/g3OPC/qKZtLfRSmLsP58Kx:IlRlcIoF8Fg6a/D/l87f7RjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766255685, "uuid": "a2d7db6c-dfbb-4703-9315-a2f6bd94b205", "value": 4836129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766255685, "uuid": "355a8817-c551-4505-8434-220425daca1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766255685, "uuid": "42cc972f-7b72-4d78-9e53-c23f80aa494b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1588607a-dd96-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766229712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766229712, "uuid": "9ba8cc28-84cd-45c6-af3e-edf0d24c3718", "comment": "Malware payload (Mirai)", "value": "7057a881e8135e10ddd804fbd49f83b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766229712, "uuid": "e1567a01-e37e-409b-8cd6-264b540fca01", "comment": "Malware payload (Mirai)", "value": "da83bdfce452041df71007b1463e562cc3403c9d01ed9fd97e6bc96ea47d2e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766229712, "uuid": "e4620eeb-2faa-4abb-adb9-c46436d240ee", "comment": "Malware payload (Mirai)", "value": "dd5cef07cad9e24f3ad507c55b9d00ba74a047e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766229712, "uuid": "cc960f33-8099-4e9c-8b55-3c184b61f59b", "comment": "Malware payload (Mirai)", "value": "a576d585218f44808ca878342e1628cd0b8a77c153d1abbf9ef93569057d365d95332f2aba871e450ecd532ca23554f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766229712, "uuid": "e8beb2bf-9fa6-492c-8ccf-184952060f71", "value": "T181D3E659B8819F21D5C626BEFE4F529D332317ACE3EE7202DD145B2436CA91B0E7A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766229712, "uuid": "ea1c1612-6178-4c65-93ef-668ff885ca0a", "value": "3072:A2sMJ0tq8vXflYTiVm1FkyTV7IN4WKasHDC3TiarFSiqO98GOu0SGSRln5OdW:AJMJ0tq8VYTiVEFkyTV0N4vjKTiarFSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766229712, "uuid": "707939e0-02b3-4e07-957e-d85b8ad29590", "value": 130328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766229712, "uuid": "3fa8e825-a0f6-4c9e-945d-99b023248c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766229712, "uuid": "54cc7292-5ce2-4530-834f-cdf1f32f0060", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ed04d9-ddee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267772, "uuid": "c259ed00-ae8c-4ac8-8d06-20c790e994ce", "comment": "Malware payload", "value": "9f929e4d5dd1e54bfac750540f890d49", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267772, "uuid": "913794fa-39f9-4edd-b582-3b433dfa7d88", "comment": "Malware payload", "value": "dbb7037739e18719252cfa1a63a76c12eb9a5ad6f3ae2d1e4d369ca0544a199d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267772, "uuid": "52279d10-12ad-4d1a-90a7-980ad10b32f4", "comment": "Malware payload", "value": "1bc81f21f40f2dcbc198296738e9f3154725d032", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267772, "uuid": "f61dbfd7-1b5b-40cf-b508-220b51d42300", "comment": "Malware payload", "value": "0490d5fbca05defac4c2b5b06d9b30f1775acceb3f66aa27a0b3b3e36f04fbccff1b74aca7f8132f0c99bc995c864322", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267772, "uuid": "82c90db5-e23e-4e94-98ca-50f3d3679e24", "value": "T11EF42313D7F70510D29C4E32C8809D025729FA6ACEE78616EB3D1EEF58453AB97D1287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267772, "uuid": "17137974-b189-4cbc-97d5-9ebcf2e658b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267772, "uuid": "efeee6dd-b125-4653-a188-0ed5b38f670a", "value": "12288:mHWTUy/0uDyto49GrgAAfTpNAXoT528WSHdasAigoKwpypOb8SrjDYr2:gWTU/uDyto5ErPAXU5bWylGovpypObnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267772, "uuid": "e61a7d25-9062-4af6-a827-55d599d7bdae", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267772, "uuid": "40e55590-3925-4aaf-a618-020e763a24ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267772, "uuid": "4460b618-9950-4843-913a-ff8fd15905cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1d795-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249840, "uuid": "f65a3f8b-1f46-41ce-99cb-5738f7b71c63", "comment": "Malware payload (Mirai)", "value": "a1b18b6624cfde6b12576d5870ba52cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249840, "uuid": "4a0edf50-0eec-45d3-934d-a78309271768", "comment": "Malware payload (Mirai)", "value": "dd9a92b29de19af523dcfcbc18e44f8f3028fde4acedb4524249a95e93c0ab18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249840, "uuid": "ab1ea087-c884-417e-9388-b0872165badd", "comment": "Malware payload (Mirai)", "value": "600aa455fcec5287d8f2d380788212866f0d01dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249840, "uuid": "8e219a02-c4cc-457d-84e2-5d84c7d1f417", "comment": "Malware payload (Mirai)", "value": "0f471ae3d30e356b397e568c8ff04596d6a6b030f9736c326bd56b7987606e13921c29603faf81a54195a08a833fd19e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249840, "uuid": "cee9af96-35c0-43de-b60c-0e8c774f6807", "value": "T17AF3D70AAF910FBBDCAFDD3701EA060235CC555722A53B753674C628F54AA4F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249840, "uuid": "8c63ff27-6395-4014-885b-dee307238801", "value": "1536:8Zdfqo8TK2CKalRlRTEmL0BYuSC2op3+OyyBn3V1TtdaQFE+iowMj0EjbGmSamN1:Cfw22Ne/6uOyyhTWFTMj92mSRNli0sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249840, "uuid": "9c699ecb-af8f-4265-bd2a-c17017bc94e2", "value": 172472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249840, "uuid": "f3366d9e-939d-4ad9-af0e-1cfd89d62c5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249840, "uuid": "d6b1bfaf-5e8e-4fe2-b399-f8f8f992f32b", "value": "sumrak.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325ea9e9-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235773, "uuid": "06e1635d-cb4e-4ffc-881b-af762f8c7a61", "comment": "Malware payload (Mirai)", "value": "6384706e377a0668b4a44abf8d45c2a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235773, "uuid": "66c1180c-a600-463b-ac5d-fbfe692ff7aa", "comment": "Malware payload (Mirai)", "value": "de31588241986f5be236903b4299cafd3ed132d031552aedb37410778339ce40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235773, "uuid": "a97b6c50-b299-43f3-9716-2f807c3b867b", "comment": "Malware payload (Mirai)", "value": "953d52ab2baa34acc455643f2395622c7aa83ad8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235773, "uuid": "32f02444-c95a-424b-a16a-0c3d6a51b5dd", "comment": "Malware payload (Mirai)", "value": "b1747675b79a4a49be5f17e1bc90c001f733ee243d336171c5cc4e3dd17d090c442a837654ac1332d510131c971f881a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235773, "uuid": "92628973-c391-41fb-98c4-4bacc9c8a026", "value": "T12613F1631223BA75EC5246FB29FA1D7CFFD25C22D7432B334DC624ED55AAC648102DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235773, "uuid": "5830e941-8461-4201-9d2c-abb0b068eb4e", "value": "768:1Ai7PZ6edbWDShjnN3cfMMJdj4sGAG6lzZteZzTkEtfy7H0x0Kz:z7FRWDWN3HMvj4umzIEnPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235773, "uuid": "bc3c224d-4019-4364-8894-3381869f5d34", "value": 41860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235773, "uuid": "873318f5-c132-470a-b75a-e2573a10a815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235773, "uuid": "2105486e-68a6-4eac-8cc4-0d39ec1f199e", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddd893e-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766235041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235041, "uuid": "92302bdd-da71-4898-b5a0-2cd9d5e64b2d", "comment": "Malware payload", "value": "c9493389ae0b2425128f1e39e6c8727f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235041, "uuid": "e23e5cb6-5ced-4798-a773-7e6d77eb6b93", "comment": "Malware payload", "value": "de3530eb287da742c18647daea76dea7b09fa66cf771d2aab7aa550445545c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235041, "uuid": "4a84fd15-dc7b-4517-9932-143d5b895775", "comment": "Malware payload", "value": "2d72b85247707791ba86d90d26d35098e4cbe2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235041, "uuid": "0e6a1729-074d-4e3d-8544-c4d7fad18004", "comment": "Malware payload", "value": "44e6243494ee36d50b215aa01d449ab3729bda27151f1bb18b9b0fd44b7f2e52a068f514b069fc8a4a455c8762c79d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235041, "uuid": "61282aa6-f898-48d0-bae2-19ceee62eccf", "value": "T1DC531C0B734364EDC62AD57486AFAB33B672F8620630AF3F03A4D7702E11EA05E5E515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235041, "uuid": "1b6e34c3-4a7c-48f6-8c3c-1272fb27a607", "value": "9bdb07b6fd83cfd0e54205b38bedfd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235041, "uuid": "18dc1cf6-9fd5-44a5-8589-53f2d9391dfa", "value": "768:rM6r8IsmmupX4APwkVTM5y0VQu0hseQzRxUMUla8vX6puvf1bXNPDVZtATWheK:IZAmuR4AYhnqrqcvlP6EvfzZ4TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235041, "uuid": "e88c9948-9e16-4f13-8da4-0231b53bb4e2", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235041, "uuid": "2fa07b78-95b3-480b-aa74-91debb3a79fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235041, "uuid": "9644c0e3-b9dc-418d-9ab6-0b883187c7b4", "value": "SecuriteInfo.com.Generic.Dacic.6942.7EACD5EA.27362.5938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1324cf3d-dd92-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1766227990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766227990, "uuid": "27a5453c-df50-4e1d-84f2-e96ec27a84c6", "comment": "Malware payload (Amadey)", "value": "819d0ebe78d214dff118c29e29d431d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766227990, "uuid": "db81e8ca-274e-4781-8415-e01384cf8546", "comment": "Malware payload (Amadey)", "value": "def0aaaa225924555a66d6ea802578461f7117dc1b759c6aa765c457bda7fb8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766227990, "uuid": "ea3eb081-c3b6-45cc-8436-335f08a09dd1", "comment": "Malware payload (Amadey)", "value": "e841696a6a35be62ea41ffdbbdd929efc1eb9785", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766227990, "uuid": "78b9108f-8ecc-41e5-b9d0-25e68da57da2", "comment": "Malware payload (Amadey)", "value": "4b8d4fa7580e1f6cc9b1aff6ba46d84d1f9c0f1db4900adbca856164c9dc2d660dee7280a37157fa826493868faf9f96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766227990, "uuid": "b7eaf406-1563-44d1-bcc2-83ba359dd8c3", "value": "T10F557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766227990, "uuid": "56f5af65-8124-4487-8635-d716fa96d198", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766227990, "uuid": "248ac7b2-8990-4aab-affa-b724afcbef19", "value": "24576:trR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRRmOnW:tkHmiyCkhh2Bamituw+Ubu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766227990, "uuid": "8465105c-f97e-4786-9d4c-a748ad84c185", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766227990, "uuid": "07d7f9dd-890d-48a0-b1e6-077fb6b8e048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766227990, "uuid": "03ecbf68-0cce-45ac-a74d-380e8500d201", "value": "cred64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16579775-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234438, "uuid": "c6b03e2b-a91a-4b29-870e-8634c4f593cb", "comment": "Malware payload (Mirai)", "value": "457937b1f7236096454f01884975c36f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234438, "uuid": "637d7151-3405-4f07-8a5c-c32adb014cc7", "comment": "Malware payload (Mirai)", "value": "dfbfd531535a59846e54e14574d59efbfe95b882e3220c8395a6fde582d1b8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234438, "uuid": "c61c89fe-4b8f-4816-a609-865c1b31bc94", "comment": "Malware payload (Mirai)", "value": "44bf466f0e7cee6e304eb833e5478e939e9f4c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234438, "uuid": "2af85fd8-ae2d-492c-ac6e-7e57c19a9897", "comment": "Malware payload (Mirai)", "value": "02d73cc91a9bcec45ff162dc5cb6a84ffa6103f22852648ab69420f91ac648f3e256b8b863db6f2ce00d3bff99b2d2bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234438, "uuid": "61c80e55-1ebe-4e01-a972-39b836fb23b9", "value": "T11203E07FA54818CACCFA0C75B24E13E1E625E15223F69F6F171065DDA62650BEB8E03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234438, "uuid": "d3b064d8-1e8d-4c2d-9bb1-77504debee3b", "value": "768:mhmRNOGs2KWiGxLp/GXyfsR74dw7RghtCen3v0oHeUqBaqmlMeg6Hgtd2LRE7kZq:mhCns2KW1FGXDb7EtCenco+UqBaLM364", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234438, "uuid": "7f8968c7-0fd0-41e8-8759-a290b0dc04b6", "value": 40828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234438, "uuid": "efbcaa29-898d-4696-a981-8a5b29401e3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234438, "uuid": "45e95ea0-7cb7-4377-8074-e3621870ee57", "value": "firmware.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09761e2-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249836, "uuid": "faf06a4d-4ba2-413c-a155-e51139e885e9", "comment": "Malware payload (Mirai)", "value": "f9046d62cdc8e87b8d8620902efb6d20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249836, "uuid": "9dd0923e-4fb8-4bc5-99ed-c87d525090f4", "comment": "Malware payload (Mirai)", "value": "e18226261b0c9c2b418694029ad5c2d557df38e644dd0db68e45a322d0198338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249836, "uuid": "b9fb4477-9fdf-434a-8e45-bebc9d35a016", "comment": "Malware payload (Mirai)", "value": "7b3fd6e13ce7667c0afbb8e9d59cf253cb2e9527", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249836, "uuid": "258783b5-a8f1-4bf4-8062-a28bfba090cd", "comment": "Malware payload (Mirai)", "value": "1cf10ea1dffe77f4333a17e29c15958543763a06b5e87c63980221bdfc0eff87302c4b0cbd73e5faeb035e4b4ffc30f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249836, "uuid": "c90749c4-fd45-455e-b076-27c2b683e280", "value": "T13BF3975E6F229F7EF5B8873047B78A24975923DA23E1D684D1ECC2141F2025E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249836, "uuid": "07767c76-d35b-4083-a0e0-2fbf5c270278", "value": "3072:71gdvpgm+Y+88avJ2c7Brdr+Q4O9p+7Qz2Xh:72dvpgm+4R9FZrqO9p0a2Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249836, "uuid": "c67bc12e-44a9-47c2-b953-16da9b812887", "value": 171480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249836, "uuid": "b16826a3-dcfe-42c0-a4b0-063feb77172a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249836, "uuid": "3fa18f95-52f0-4e01-8b0b-1d2036a12693", "value": "sumrak.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cedc48-ddb5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766243238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243238, "uuid": "76076a8d-7102-4d93-9315-f4dbea009fc9", "comment": "Malware payload (Mirai)", "value": "04d693a99083b40ba3a9852a68795c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243238, "uuid": "fedf6921-ea5a-4b3b-9a98-a7291fc22139", "comment": "Malware payload (Mirai)", "value": "e187cf4314d300dcfc6092d57df1052f0a11ee0f8fa5aeec49c34cd772a42ffc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243238, "uuid": "8e7b0b9e-3e46-4c01-a181-d5804d92e979", "comment": "Malware payload (Mirai)", "value": "411428036a38a649d42e780cbb58efad507be07c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766243238, "uuid": "38a9c8f3-d931-4863-8828-36006422ad7c", "comment": "Malware payload (Mirai)", "value": "195bba6e90dd17d84c5b68dda6f5d67d1c894efe620e04071f10def4f60969259b61bf73157f7a9472c1bb24556a3dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243238, "uuid": "0d90422d-2fe1-48fe-a6d0-3434197f5e74", "value": "T18BC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243238, "uuid": "b740f2b9-7bf1-4194-a1e1-d63c2cee0baa", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoSXrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuISXrSmM/9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766243238, "uuid": "2fb1487f-007c-4bb7-b3c2-09f6695c71ec", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766243238, "uuid": "1976b439-4a6f-4df6-a6f0-b22a0b70916c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766243238, "uuid": "e8926b06-fc97-4840-a2f0-29daa6d9c14a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29063c1c-dd5b-11f0-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1766204404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204404, "uuid": "3b6c059e-2806-4cf0-9e5a-eb33e2f551b8", "comment": "Malware payload (N-W0rm)", "value": "bc2384b22b960ceac16fddf2bd3f39a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204404, "uuid": "0b3071fe-154d-41fc-9ae1-0bf43720878f", "comment": "Malware payload (N-W0rm)", "value": "e1bae7b12943d03f1077f98b3ace2886cfb7632ed15623f99c2c763b60a1ba98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204404, "uuid": "16e53ddf-6bad-4e84-8226-572d7c68fc12", "comment": "Malware payload (N-W0rm)", "value": "d67f164e763e6773162a2916047bcafdb0ffe100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766204404, "uuid": "187de973-c1b7-45e8-9a22-8471a4334d27", "comment": "Malware payload (N-W0rm)", "value": "948d7fa027d632a9e311338fd6790d9222ff8f40d2ce4802563d99c008b4f2b9c5c47ccfa962a629f78475421b801d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204404, "uuid": "787129d0-69c0-48e8-91d7-b4ce07201fb0", "value": "T1B194234045FDD8E6E59B8636DDD77CA85920C283684AEB7F70098B4D1F43BF84A12D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204404, "uuid": "320eab69-651b-4eac-b385-a24a772890bb", "value": "6144:FQqHvnhoOXgo8cwCdIrgF4TcJ32/3t3WpZ38geyshhGqh1jc05nSBFB:pHvhjv8bCdZFvm/9mp58Dysh8qXc2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766204404, "uuid": "a4f6f5a8-4bd4-4b86-b907-e6ef5b693973", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766204404, "uuid": "c77ceb67-ba0e-4de2-8ef2-bd032f9ca1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766204404, "uuid": "6a7bcf88-6d9f-4b6d-b40c-65589cc71af5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12738368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9004ea8f-dd8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226052, "uuid": "99fd5041-569b-4995-9b0e-05b476405f9c", "comment": "Malware payload (Mirai)", "value": "17bdac9422c75c96c02a441489ae68a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226052, "uuid": "3237ce9f-c6b3-4961-9fd0-0d76545ff763", "comment": "Malware payload (Mirai)", "value": "e22df109717aadfc84acb2ade9ed72ff802f4b85378844e7e8c3e8c62e499efe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226052, "uuid": "6e04da55-5bec-45f1-9574-439524351d5d", "comment": "Malware payload (Mirai)", "value": "f0e96e848f29ed2b72e98d223bde42183d31548e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226052, "uuid": "778afc46-ab1a-411c-84bf-f08983128e14", "comment": "Malware payload (Mirai)", "value": "523cdbe4cb3debb1d27b9a2392f922382a2240acd377f28aff8b4a7221cd1c0771aafc4858ae8da809d90c862c5e98e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226052, "uuid": "d55f5e5a-6c14-4538-9e7a-7d615f335743", "value": "T1CFF2F193BA8DC718C0E04A7B9524DE25FF6A310693EBD1CC7DC4A8D082EB5711E12AA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226052, "uuid": "a2453d22-2d53-4626-a283-f34bde9ea48a", "value": "768:nn+iX7F4gTkVfsxQ54Icz7y051+6ZAS77UUl8M6m0uzf4w7SCp:XXigTkdD4Ic/y0e6ZAMHl8M6Zuzvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226052, "uuid": "d1f13f43-dc80-4079-8a8c-04b2d6a151ac", "value": 34776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226052, "uuid": "8958df3f-c8db-41a1-b2ff-7ab1b18cd0af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226052, "uuid": "d3c0c21f-4509-4f15-aad2-369cf52215ee", "value": "firmware.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5919db51-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235838, "uuid": "048858dc-646f-4ed4-be19-5236465034d3", "comment": "Malware payload (Mirai)", "value": "f529246d859a3f1d612a4f47d6bff56e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235838, "uuid": "09610495-3dda-4442-bb80-bf5c13d371ca", "comment": "Malware payload (Mirai)", "value": "e334aa871b84200e4f6306bb017a393cc0dc1a784606a2232d838533d6146065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235838, "uuid": "3c65be59-ce93-4fe3-be81-7a5ff243100b", "comment": "Malware payload (Mirai)", "value": "70318575c6f3334c6d82a10fb72d6231a379a82c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235838, "uuid": "13aa29e8-676c-4c8d-bd8f-c1e4903cce41", "comment": "Malware payload (Mirai)", "value": "fa867204cdef7b83127fd7306d90c880a7bcaf3d836881b6d26037371094aeb0928f191eb85b9d5033bcbb55d7c9f688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235838, "uuid": "8068857d-7b09-4b20-b607-9f9c73d9dc84", "value": "T131933951FD819612C6C122B7FB9E028D372713A9E2FE32039D256F21738B96B0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235838, "uuid": "a80ca75b-fef1-4703-baf2-64aa3942bfd2", "value": "1536:PxLuSDFzSBLjeYCmBa75lRAM279ACI8abdOsvQ+j:PxaSDFzSJrBadlRAMJnpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235838, "uuid": "e2b5955e-e39d-4f34-9f1f-216827060d72", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235838, "uuid": "33e10036-e658-434f-972d-eccbdd7893ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235838, "uuid": "500c4acb-85be-4dee-88ac-6b1dc55a447b", "value": "narm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e30c87a-dda6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766236706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236706, "uuid": "39084629-32f9-4ea3-b5bb-55d07b853b19", "comment": "Malware payload", "value": "6bfd76e50e5b8c529e67d7648e9ffa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236706, "uuid": "9924de4b-ceaa-47ff-933e-567d133c5064", "comment": "Malware payload", "value": "e499c7de5655e13a51929c0aed2f7b2d1e745ee815798cafb1e3aa57b07161b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236706, "uuid": "72445dfb-e9f8-446f-974d-71899c42e021", "comment": "Malware payload", "value": "536ca570dbe1123a3cc725d2b01ca830cdc3e9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766236706, "uuid": "010821f7-9717-4d0c-93da-cb247be9e153", "comment": "Malware payload", "value": "7f3f0074387e4b62e648ab07db3b9cb49af638a4d09dd15b376469344655bce619ecaa7bf0cdf8e77731281f5633b7b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236706, "uuid": "14101b03-386e-4589-a462-600ad1c41a82", "value": "T1E6633A6BB3A3A8ACC217C2789B975632A8B8BC5A0571F77F4388D5713F21E911F39111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236706, "uuid": "807713af-8047-458d-a6b0-14223aa6152f", "value": "f6c6664bb867c792f57d678384cc96dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236706, "uuid": "0e6c6f82-b035-4f0c-b9e7-c86d3a5e2bd6", "value": "768:/HC52RelCToeXn4sw88d3H4JsCn8xzpFCCBwSAJXF34O0hsmvrRxcrUNz+XggZu+:qsOClNJsC87A3fiLHU4Nogg0vbthL5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766236706, "uuid": "5e11d49f-b011-4601-83f0-c2ac567bcc86", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766236706, "uuid": "dbecf9cb-fe1b-4c7b-bf36-6c0d3eb997c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766236706, "uuid": "a364d8c1-68af-43c1-ab76-643baf3b2336", "value": "SecuriteInfo.com.Win64.Malware-gen.86217935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217f8d78-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226296, "uuid": "903c8216-c16d-4128-ac20-d6c1b61a42b3", "comment": "Malware payload (Mirai)", "value": "d044d21a19b8b350f7d102ee41411b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226296, "uuid": "439163ba-ef07-4e87-b1b0-9945c0fb2c37", "comment": "Malware payload (Mirai)", "value": "e4d08a0cade9a968887ba039a0a51feef89d847fe74b6745e50a62864a26d490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226296, "uuid": "d22beb23-5f51-474d-a490-2e1ccb42187b", "comment": "Malware payload (Mirai)", "value": "dc9aa729b058143705c9c8eb5c2379930ba7c5c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226296, "uuid": "dab19aaa-4dbe-4609-81b0-c2a47f96706f", "comment": "Malware payload (Mirai)", "value": "d36716c56384257d1a63df24102918532f92ffd20e6ee4c4a74fc576647fb1df110c085bf32e17e6fe82921268855377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226296, "uuid": "9ee62558-5cb6-4708-9731-035a25a311fb", "value": "T159532A03BA4184FDC09AC1B41B6AB93AF87631FD1338B5AA77D0FE366C49E211D4E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226296, "uuid": "72100915-2abf-4b80-b6b0-7fb8cb91a52c", "value": "1536:8t7HjUwUhxVwlizBEwUkygBypRBKPyLkXGugZdufgkGaMTwbZnFf:A7HAwWjwlvKyMy/BK4kXGugyfgZaMTwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226296, "uuid": "94c10ef3-f346-4f5e-95b9-837e9e63fd01", "value": 66496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226296, "uuid": "a9e24788-0f23-4531-bf81-aa091b740806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226296, "uuid": "e15f13b1-2cfb-4ff2-837d-a19a20fc2e14", "value": "skid.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446c323c-ddec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766266727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266727, "uuid": "248ae150-cfe6-49b1-9697-36a0beeda8ff", "comment": "Malware payload", "value": "772bb22159e1f104aab0f9941a976b89", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266727, "uuid": "218275da-e464-40a6-9c20-d40eb085c7f5", "comment": "Malware payload", "value": "e5d3ac93c4cd9a15b2c754d573ab9fc66980067b23516f744b5c5e826f5f29d6", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266727, "uuid": "0e240064-ad41-4b17-ba3b-e1c51f8feac8", "comment": "Malware payload", "value": "34369edbdda70cb8a97906dc98316aae99762e4c", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766266727, "uuid": "34c86536-a793-4a18-98dc-31ceac9d44f5", "comment": "Malware payload", "value": "30a961fc56c350b8055d84e93d8d4ee0f6ff81bf74158c1eee99af8b269c416dcae0dd82cc2ee27ed73caba3c2cf76e5", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266727, "uuid": "d1e6c5cb-2252-4e24-b073-054345e6eb66", "value": "T190B27D9063FD8744F0BB5B3DAA7773C45CB23956D622C7CC1364E419482071ACBA9B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266727, "uuid": "18c0f69d-333d-4fbc-ad02-23ecdff9fb8a", "value": "48:qzP3JfkMNBPEPKSvEgJfkxfkNBPEPKtO/QKo/kvt:qzfJfdKPKeJfy8KPKtKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766266727, "uuid": "29b8e088-77b0-41e0-8d78-a2586c350a8b", "value": 23661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766266727, "uuid": "f9421ca8-6e14-42c8-9839-a256bf90f308", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766266727, "uuid": "7148b910-419c-45f5-b043-57ff68208513", "value": "772bb22159e1f104aab0f9941a976b89.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d022e84-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254340, "uuid": "4e11781d-9b2d-4cbc-9472-e7dbacaa217b", "comment": "Malware payload (Mirai)", "value": "2ef93bb77ee1e9b99159c2a20de674a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254340, "uuid": "d0305e81-634f-41cd-9f54-9c1b27315130", "comment": "Malware payload (Mirai)", "value": "e66547b2903a6339cc88dffa283b3363d07fba7a22b6dae4303c1b4c079e9b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254340, "uuid": "7368bbde-7425-47cb-82e1-bbd05d378ffb", "comment": "Malware payload (Mirai)", "value": "4395f28a3342f59b755c4f3897735edff10798fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254340, "uuid": "1b2af116-57c7-4189-a4d6-0c59fa6387a3", "comment": "Malware payload (Mirai)", "value": "0a7802d251d1b949438b83bb4a81fd71a74a6bbbd0f6217cde7ad897ee1f07738ef99d797b699879b55e3d41585fda79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254340, "uuid": "b48aef79-af42-47b7-8693-42d0ee083b84", "value": "T13903F1AA53EE5632F178D1792DFA7E5C580C7308409900EE66C4121FAEEBE24B5746FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254340, "uuid": "c6e852b8-ee1b-41ef-875d-8a257587354d", "value": "768:LZuGsWVtzmZqIhIXCbyuUtYLeW+nMMBenCnbcuyD7UtQRjs:L81mt/I1yuUtYLeW+nMseCnouy8tyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254340, "uuid": "747fc0ce-ffe8-4bba-be81-bc72570b6477", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254340, "uuid": "4dfe44d3-704c-4f4b-a251-6352e6cf6c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254340, "uuid": "bc9396ea-ac4f-4dac-a7db-938ca4cb8eec", "value": "5a7s2vke", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5ae4e7-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254339, "uuid": "6073da38-e2a8-49e0-9ae1-df39c3ab262c", "comment": "Malware payload (Mirai)", "value": "2fa7afd9feb0d958b870733b9f9a3a63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254339, "uuid": "2cdbf6a9-a218-420e-b595-a904de9a3518", "comment": "Malware payload (Mirai)", "value": "e89451bf15b4bf89fe666b83e2a3318162569344c6f238c14f37a2515ed82607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254339, "uuid": "d5415b0a-2c0f-4778-af54-56f54b9e15da", "comment": "Malware payload (Mirai)", "value": "4d5f503b85a1feaad59e062fb78be5bc962151b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254339, "uuid": "84d97f94-cc67-404d-92e3-085153a3867d", "comment": "Malware payload (Mirai)", "value": "c158a85f1e901172873e68df087c9b7d801cea077de6d941db6f6f33b99e5f9e7d46d85a68a22bc595d67db60372d6ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254339, "uuid": "a5c3f089-99d7-4953-b3c6-29c33051b40a", "value": "T1EE03E195C8AB7444C9EF22B7DEEF214A1120943C9CD95B60D2D032B6F992F763A847D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254339, "uuid": "0fc8498e-765d-4750-8afd-8f3ae5937542", "value": "768:Kk8SXZQoydUhBC8YUEQ4drmE8EfTDKnTgnybczRnbcuyD7UHQRjt:6SPy0B9pUR8EfSnYconouy8HyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254339, "uuid": "e59b9019-2860-44e0-9ffd-5b843f735172", "value": 40520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254339, "uuid": "24284f39-78d7-45e3-9ba5-afa8803290e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254339, "uuid": "9d84b8b6-2855-4e6a-bd1a-ae2c1f89c52f", "value": "w5c9u4xf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d39e20-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234440, "uuid": "a9ee1e2d-3fec-49af-8fca-c5106a0339ce", "comment": "Malware payload (Mirai)", "value": "e37a8e475c8563f8efce33f078664acd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234440, "uuid": "addf1c28-1b10-492b-849c-45f47204272a", "comment": "Malware payload (Mirai)", "value": "e9aebf9ffb3cd67e5a01cb453fdeb197db37305cd3517d3ea1e32f41a76b7164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234440, "uuid": "2b693188-b1ed-491e-83b0-fe6c9f8cce2b", "comment": "Malware payload (Mirai)", "value": "85b85ee6ec43d6c761f7e40ce1e474b2b8197bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234440, "uuid": "a731a4f5-741f-46ad-8176-58c25db8aa6a", "comment": "Malware payload (Mirai)", "value": "96dc02ab9c6fefb5d9202f62a46620da5c336f2c5dc743d8255c65655c1b83d1c23a73e77c9fef63e82043473c2280f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234440, "uuid": "674b7300-62c0-4040-9745-7adf09c199c5", "value": "T1C203F160B41ED872CEA2453EE757088957890CFE95AE3293670C886C7D9B5B73E7C244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234440, "uuid": "05d4c337-ea44-44f9-95b3-67767f2a9171", "value": "768:unTSuQD75R5XgeSq1ZVGGuKye18KFkz4tAPVYZR5ZoHypRuztc9q3UELO:uTSTVXX8GSMVFYOZ8tlLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234440, "uuid": "b7a20b3e-7d35-468d-8320-d15accf95ad7", "value": 40680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234440, "uuid": "32f1c9b5-40da-49f0-8504-71ab2551ea00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234440, "uuid": "e3fd166c-1868-4198-ae86-126e9874d97e", "value": "firmware.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9755408-dddf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261448, "uuid": "889a4e0f-2c79-4b43-a5b3-2c81317c4b2e", "comment": "Malware payload", "value": "fccf5ef4cc0cf6c0f4b7a317243e13a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261448, "uuid": "77833de9-63c6-4d1c-bac6-485bc41c8363", "comment": "Malware payload", "value": "e9d68ab00276007216aa3691416854075958a78aa76a5dfeec17ef7456adb7cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261448, "uuid": "0642bc1a-7842-4ade-936a-9264afcf12b3", "comment": "Malware payload", "value": "fd3ad86cf17c4987d44550938970b886393a8f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261448, "uuid": "7bce3e6b-01d7-4b18-8aae-bd44f3c0ca0e", "comment": "Malware payload", "value": "1dfc19b02764faf89ac8a9c81cecaec2fc58d6b3fc788446854ea0e3bfc004f6004b1efc928d170ef8896480802b4126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261448, "uuid": "d5ac38fc-8add-4770-98b5-c7c59523ebdb", "value": "T1261833C15312C6F9C522053EC2719CB68FD11D66BFE184DE2D9AF2E31AD7966482F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261448, "uuid": "03bfb34d-5c3d-4cf1-a8e0-314faf0572e2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261448, "uuid": "df96df8e-2c3d-46b6-acab-ad0d630319b8", "value": "1572864:KPWYxcnyfXHBBhuFKT4fptVXfSBB8fKlTCUuE03+vrf0yZRSAw0xaKSbw/A:KPpUyfRjGKkptVXfSBJVCUI+vRFxPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261448, "uuid": "aa2a8b12-6dd8-4841-837a-d57505be7f73", "value": 91140495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261448, "uuid": "4d586670-0419-4d24-898b-196f5fc6cbe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261448, "uuid": "497661b9-e267-4665-b6d3-c855f4088ecc", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312a114b-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234483, "uuid": "814be0b8-96c2-4eab-8dcf-4e4f3a059e6c", "comment": "Malware payload (Mirai)", "value": "6937b3960320e3605f519139f268ab9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234483, "uuid": "ed6bdcf7-a423-48b1-8026-a1e5f199c683", "comment": "Malware payload (Mirai)", "value": "eb337d468638bc97463f010cf26888d84a0756d80afab07ab64edb044f32db24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234483, "uuid": "d8666c88-fd6e-47d6-94c4-76080d7e1d42", "comment": "Malware payload (Mirai)", "value": "411cf90d99d2dc64de541c803ef1943958971025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234483, "uuid": "a3d62525-f773-4363-8b5e-8b10fd80cf7d", "comment": "Malware payload (Mirai)", "value": "de9140a834265f2422a8232fb3dd5628673657f11ea94392879d333d45bbc4778a3443923605356716f381cc5f262bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234483, "uuid": "27b556ab-466a-4014-8c33-9328767a7b77", "value": "T101F3736B6E50DB19F65897310AF7BD38835A13A726E5EA4AC18FC2006E7131D1C0FEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234483, "uuid": "ea7d3be6-484a-4aa4-b594-d46cf631ed8c", "value": "3072:8rfgjVgmuKIvGI7T+M9ggrUZMdNuVaaHiyLqCrpvkFb1l8WQKfu:8Dgx0KIRggrUOdNKaLyLqCdcFb1l8WQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234483, "uuid": "7088d162-19fa-4714-b64d-bfeb1e4c64d9", "value": 169632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234483, "uuid": "545c090b-de3c-4997-9956-72395e7ca728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234483, "uuid": "01bdaf40-0af7-4e4a-a82b-1c432d19de10", "value": "firmware.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa2b36f-dd6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1766212272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212272, "uuid": "e189550d-2788-40ae-b815-c68b522f36d9", "comment": "Malware payload (Joker)", "value": "3b92e40117c349e9481e84542fdba552", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212272, "uuid": "21cd364b-380f-4a85-95c2-10f9be33b531", "comment": "Malware payload (Joker)", "value": "ed5dff2023acbcab14444cfe91f558c06b72f633813fb49fabd16a9dba5c2a86", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212272, "uuid": "cb8acc4d-7bf5-4dad-82a5-4a1ff7c7ceac", "comment": "Malware payload (Joker)", "value": "62a9f7769c3c4d896f01a376ed0e8c0d5202c82c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766212272, "uuid": "f12b53cd-9950-478a-8cc9-b80935b687bd", "comment": "Malware payload (Joker)", "value": "1c508d01d927dd922e9d450d633ac64c702261420dfd7d8467e14dc4b4f670df04da1ffb3cdb5433d90317d4a568eb44", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212272, "uuid": "40dfeeff-31f0-4fa8-b5b8-93765cd20160", "value": "T18207228AFF0CE83AC8BB5077CE6A4163326B9D5546529373391CB21C25B31989F4AFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212272, "uuid": "468bbe3c-c05c-4d9b-ad22-a43012f4f464", "value": "393216:6m/ud4xFaRBmxp/jfjx7w0ym9o44SNgEg52SJ9HK:1/QkF+ExNjfjBXym9jNgE62SJ9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766212272, "uuid": "e61efbd3-5f2f-41fa-9be2-c9a30bd9c7e1", "value": 16964437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766212272, "uuid": "b8ef3452-bfab-4f0d-aee8-c5ca444767f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766212272, "uuid": "3817f7ae-a1bc-4ff6-be7b-32486b32b3d3", "value": "Ultimate+Phone+Clean_10.17.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e81fb0b-dd3d-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1766191555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191555, "uuid": "c01dce37-888c-47ef-91b4-d2b79c774ff2", "comment": "Malware payload (RondoDox)", "value": "36894f7a190f3e2eb0f6061671e7299b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191555, "uuid": "31fcc4a0-722e-4515-a7bf-83383799968f", "comment": "Malware payload (RondoDox)", "value": "ee3b6aaa1edecd0ed27bcd9ab835ca41735c85263fc8219cc2a9c62f66cad920", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191555, "uuid": "e1a1292a-ea7e-4a8c-b92a-f21b1dc97459", "comment": "Malware payload (RondoDox)", "value": "bf4b1587491f9bc00a5cfc5dfaa627c490e87155", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766191555, "uuid": "63369f1d-e9c6-41b1-8b60-d9c071404818", "comment": "Malware payload (RondoDox)", "value": "a3f613c137811915a41a56d39af6826403b505619c0746e5abbacf7738ba2658dbcfc7995448c90b1a0c99d7b9aff0a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191555, "uuid": "405135fc-fb68-4a51-bdcb-d6bbf9d5495f", "value": "T1D812F1A931C512F6BCA945225193BABCCB07E1E564638EBEFC5848FF6972C08F05C745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191555, "uuid": "fa152129-328f-47f0-888f-6d32b34caf77", "value": "192:mPEcac/goLngQoiOoOoFoMoroSoRoiozoZokojovobCmoCop3oroA:mPhj/xoiOoOoFoMoroSoRoiozoZokojv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766191555, "uuid": "84dd939f-6e33-466b-85e4-06ad98fa6cff", "value": 9731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766191555, "uuid": "082a6477-a168-4340-869b-c8afdcfdddb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766191555, "uuid": "417ab9e8-e750-43d9-b794-e13a511138d7", "value": "rondo.aqu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2471f0a4-dd74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766215134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215134, "uuid": "d5c3afa3-f20d-451c-88eb-46961e4da613", "comment": "Malware payload (Mirai)", "value": "6925308e1a29657e9d6027b71f3088ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215134, "uuid": "9b73993b-6286-4597-9a1d-61e309822edd", "comment": "Malware payload (Mirai)", "value": "ee69d2f047fb8bd98d96d1ff4fb41f5dbea8aa91d81b60819542c8de7eb80a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215134, "uuid": "1b938551-07f0-40a3-998e-a740d2ea7fc6", "comment": "Malware payload (Mirai)", "value": "0a854557665f37d12244af7db119c001ccdb8148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766215134, "uuid": "7360f198-f1af-4506-96bf-0e17197064c2", "comment": "Malware payload (Mirai)", "value": "ffb9d0c4002bb17790887f858cd72530b99d237aa84a6c5b021fb2ac00c5654858ad155251b18789628d8d0cd7efce45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215134, "uuid": "e0d4a178-9bf2-468c-b5a2-7e88b4ee36a3", "value": "T1BEA34BD7F401CEBEF80ADB7B44570A0AB635E3E106831B276757B963ED321951862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215134, "uuid": "8917b34d-0db1-45e7-b9b4-35953ccf9f10", "value": "3072:WtQIMfjbhxIbhhTykLVGSyYYZmdCu3IKDMqPz:FezykRGSyYYZm4u9MqPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766215134, "uuid": "e6f38de9-e4fd-4345-a35f-8d8cf34dafe4", "value": 100888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766215134, "uuid": "4ea25e62-971e-47a8-be58-d59e60ac8cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766215134, "uuid": "b0a716c3-674d-469f-8bbf-8cf57f90c767", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17005338-dda1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234439, "uuid": "3baa7f9d-c1a9-412f-a3da-5768e0efc602", "comment": "Malware payload (Mirai)", "value": "de4c07968b8523dc82b2c45d3f2d675c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234439, "uuid": "cd365052-0b21-4181-8019-2e2fe6bf7d3d", "comment": "Malware payload (Mirai)", "value": "ef6497bc0ac64f97ec95c9310fde801ee595dec9a468aeb6190a034a9319cc8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234439, "uuid": "30085680-957e-47ca-a1dc-9a0b32f49f4a", "comment": "Malware payload (Mirai)", "value": "ae40252b9019e41f00501e54daca80244e723c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234439, "uuid": "e3930dae-e9ca-4b15-86b9-001b227051de", "comment": "Malware payload (Mirai)", "value": "0e010488aef161fc708606f4f2b7d853171df27e97ac67f4a6ccc11c5f8ead9399aeab90a769cc809c5e0fe68ac0b1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234439, "uuid": "8577f58b-a48c-4cd6-a536-a08d762f9156", "value": "T16BF2F138D68A1DA3DBFDB5B0A855E6E02ABD5FDE36D1CC86F0C90F01990B0256BA14D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234439, "uuid": "ea12720d-3a1c-449d-aba2-9ef7674bd831", "value": "768:Pd8TQolnUo9x+kIJ1tz4zCzQjlYguRi130tXB4uVcqgw09z:CsQUXJeCUxYZeEtx4u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234439, "uuid": "585e7b56-775e-49cd-bfdf-d83b817588b3", "value": 36972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234439, "uuid": "3963dac2-8e01-433a-b89d-3d6032cb51ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234439, "uuid": "1f1de73e-fe63-43f3-9e9e-33431b51865f", "value": "firmware.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e4591-dde6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766264109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264109, "uuid": "46772d85-c41b-4f01-b5f2-db4be405a225", "comment": "Malware payload", "value": "27b6bef8905b38fbea4f534fb6f42490", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264109, "uuid": "877e36e9-17be-41dc-9089-9d7ab5f89184", "comment": "Malware payload", "value": "f07c7d12459cb63d6661dd6a0b61946484aa5ca53bf5f77454fbb9f9ea2010eb", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264109, "uuid": "d12d3d09-f979-4506-b49f-eabdaa7c667f", "comment": "Malware payload", "value": "677de53a0417208faf6ad37925690b8846ee7ae6", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264109, "uuid": "c58dad9f-b117-4063-b515-9e66785c488d", "comment": "Malware payload", "value": "db56eeed071b6ef3b1a1446b1f6b3f2f952af3e0e214aafb7381808cf9effce96ffa063522169e17f39e282b53d83a72", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264109, "uuid": "23231be9-929d-4a1f-bdb8-6b2515c08e77", "value": "T188E63372925AA44EC441CF70BEB97658101DF0E39EC9B1A220F88746A45DEF93BD3376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264109, "uuid": "20871ef0-4be8-4d37-adef-4f9468caa1bd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264109, "uuid": "533dc2ae-92f9-47ca-8643-459de8bc0efd", "value": "393216:l1deSa4ooC1U5Ml1OxAwKxZH5Dn0D/Jcx8iHYp:Tggoo5al2AXZz0TunY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766264109, "uuid": "73760879-a4fc-493f-ae7b-baa1d8736d7e", "value": 14519296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766264109, "uuid": "4aa9e0a8-34e4-42e4-a3ca-6257929dab8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264109, "uuid": "f2c837cc-12e5-4bdf-9ff3-2d1fe364f1c8", "value": "SnapshotPubmle.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8910a75c-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234201, "uuid": "66601ee8-b33d-474c-b67f-699a5989ea38", "comment": "Malware payload (Mirai)", "value": "4208cc9dd449bbd03065170990167cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234201, "uuid": "b138e38e-d99c-4302-8106-61a0f7cc7bc3", "comment": "Malware payload (Mirai)", "value": "f0c99d93117a6eace2c72d165e42b791b3e23a14760265fad1b4016bbaf9b35c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234201, "uuid": "4bdf2ff8-ef1f-4f33-9dd7-eb8366678ff4", "comment": "Malware payload (Mirai)", "value": "b7c5629d99d1e808e070cf3c66bf5d72ed944c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234201, "uuid": "615ebb71-a1d4-4c69-b08f-a2221267145a", "comment": "Malware payload (Mirai)", "value": "5a1a7dd4beee106c44ecf638951b167a0fd8122b5747c1f14ca8accca52ac1f86a261ddbd274f6c69969777c37bad306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234201, "uuid": "11faf377-9cb1-467b-97f1-f347cda939af", "value": "T11C3130E5AED04F6DC8E085FF9819035473129F89E1CB7712A21CBB686D1DE1C8C4701B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234201, "uuid": "8fa850dd-4df2-4c09-b8c8-c23b1864e022", "value": "24:6S4Gpa7Urz/jlIXKcDAHVR7gwH9iWqQ+o+XLQAmE0BarVqlx+OORSf:8Gpa7UrLIIsQOLVmtBarQlz2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234201, "uuid": "8c09d9d4-c6a9-4e85-b3a9-0c98892e9b54", "value": 1692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234201, "uuid": "94d7c88f-dffb-4360-bf2b-37456260fae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234201, "uuid": "c261b771-77a8-49f2-b3b8-6e7731a3ab00", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb7ed93-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254338, "uuid": "49ff741a-d9e0-43c2-bd1a-26048927d9c0", "comment": "Malware payload (Mirai)", "value": "6fe5b810c01132c9be16ded50eac67aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254338, "uuid": "158f88f1-3450-4f1f-b44b-a3c2ad2d19e7", "comment": "Malware payload (Mirai)", "value": "f1017e1553dde211b487f1200f72868202fa74cad8cbe9ecbb35497421d7a5c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254338, "uuid": "2504faff-3d0a-4c7c-8cec-2b4678dea64c", "comment": "Malware payload (Mirai)", "value": "18cf4428f7d6f265100b01c34026f85ece18467d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254338, "uuid": "962c7a53-9911-43a4-985e-ac88ade5dab9", "comment": "Malware payload (Mirai)", "value": "e3ede2bbe3e5ca5017243a86277191efd6bebf8778b14454fca1dab23c6de607abd7b56d4c012002a5040b7e2a79c357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254338, "uuid": "b3864d3b-17db-435f-84d6-f54be9062a5f", "value": "T11C13F2DEBA152941CAEC64FFF1DB1FB289D335B2270A9D54270B8AC8CB1598B214D53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254338, "uuid": "cffa56c3-af8d-49c3-8b70-8a4b50a44fae", "value": "768:smTO5i8H7j+D0h6NvLywqAIqU/zfbOPnTuGk6fpASAmNaMBDNWYF:s5i8b9MFWwqbYTuR6AvMa+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254338, "uuid": "1c0c900c-17b9-4daa-8c7b-cec9a331fa35", "value": 44060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254338, "uuid": "e5408619-d0f4-45a1-8741-546fbdf65aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254338, "uuid": "57b360fc-d31c-4310-9dc0-dc69258e3c80", "value": "2cpe5mpy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ff5797-dde6-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1766264420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264420, "uuid": "440ece2c-b2c9-4390-b346-28733385bbfe", "comment": "Malware payload (AsyncRAT)", "value": "0139516247855041cc016f5a8bcb8388", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264420, "uuid": "04fc8a02-24be-4d14-9187-6c4bc76338b2", "comment": "Malware payload (AsyncRAT)", "value": "f3786b3ad427daec3440d3e72cb7a8c67f07b9dac2cf948629ab7a573f5e3c3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264420, "uuid": "aa56eae4-9603-4568-8e09-67deaea9d18e", "comment": "Malware payload (AsyncRAT)", "value": "f6e37f7713a49ff06682044a75cee1e5126f1754", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766264420, "uuid": "edba423d-be7b-4c46-ac59-ea8a7900a30f", "comment": "Malware payload (AsyncRAT)", "value": "8085ae86668dfd40c1ff595e25d508b070b61509c23a26ef8e808d19a339f7f3c7f5030fc6dea68d3cd022960c3986c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264420, "uuid": "31d17947-ae80-456e-a660-dd52980165db", "value": "T1F6232B003BE9812BF2BE4F78ADF26185867AF6633603D54E1CC411DB5613FC686526FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264420, "uuid": "a300ee49-c01b-49d5-bc96-512732f7d976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264420, "uuid": "5773af57-3513-4b93-82e3-4552ba256071", "value": "768:zuMhi+TDlxOZvWUjwF8ONmo2qztHSLVawe+3PIKzjbogX3iYS8L71sElRf2PIPhJ:zuMh1TDlssF72uyk4wK3b/XSYHdRfMID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766264420, "uuid": "f98a9d44-a85d-47c0-ad0f-0aa629d41678", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766264420, "uuid": "944c75f4-f1f4-4a48-88a6-e95209ea9005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766264420, "uuid": "22167e31-37b1-4e06-8ed2-8b6cdf0760b6", "value": "ZoomUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674c45b9-ddcf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766254330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254330, "uuid": "59b7eee5-84f9-490f-8a28-d76007e43b07", "comment": "Malware payload (Mirai)", "value": "61c2ca7b8616ad10ad7c67f9b3f41ab0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254330, "uuid": "f6d36515-5fed-4c76-908e-b3be2659c9d8", "comment": "Malware payload (Mirai)", "value": "f5953e80e5f409c2edf86b10d26b9e5da356cf319dc0ca8cb0e8482ba92c5683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254330, "uuid": "d0d11c4b-d02f-4c46-83fc-e7973c724449", "comment": "Malware payload (Mirai)", "value": "d678f7634dbb5c141943cc1d70f0335aac1d5dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766254330, "uuid": "f47ba059-e60c-4599-921f-8673ccc42b9d", "comment": "Malware payload (Mirai)", "value": "23f9a9de2b2e9246d657f9463fa82d5d8e23ba7efbca99e2f93de17b750de324169236dc55be169047916c7147fe1390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254330, "uuid": "de34783f-9112-43db-9a18-86a16aa33d4d", "value": "T11FB2E139A0545850EA314CB8F570C787B7A555F1C1F8313A2AF1FD1D8ECD06F51B8299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254330, "uuid": "8e4b8956-39e6-462f-b19b-97b52d332066", "value": "384:z+N4pwj4su1ohLyUM1NDPOPNzhcuXoxN+sZq9nrBPGKXqrrgxjSZhymdGUop5hLX:Xpb1KWUMHDPge8oxMnrtGKarrgx+Zs3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766254330, "uuid": "50b3c273-6431-448e-b3f7-cb151477d0b2", "value": 23996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766254330, "uuid": "10c6137d-823f-4c80-9099-408fa9417d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766254330, "uuid": "84e8c7a4-9d31-4ce5-bed5-844080e00448", "value": "io8xouhz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6b2599-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226293, "uuid": "192763f4-6634-439c-956d-17fe009cfff8", "comment": "Malware payload (Mirai)", "value": "cf860d26704e9d0d362b173757bcce0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226293, "uuid": "dda62483-7f8d-487d-af7c-80d71afc33cd", "comment": "Malware payload (Mirai)", "value": "f662b954c7fd0bde228d693d8602a68c7e363dccafa0fabbc93653f4309b7fc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226293, "uuid": "0547049f-4110-43ca-8465-dc481f0355ba", "comment": "Malware payload (Mirai)", "value": "577b5c95b6d746d900850bb98600921de5ab5374", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226293, "uuid": "43569ce2-4599-4606-b4ed-35e0f2b0c9cb", "comment": "Malware payload (Mirai)", "value": "4c411eeec80f45bc86b6c7335c2a820850133834f79e715dc9588a371936d9b2959df1723b2d70ebcab8539cd59f0fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226293, "uuid": "2f1a80fe-4455-4cc4-8eaa-875f021c9b9e", "value": "T1C0633AA6F801ED7EFC0BE37A40470909B570E3D456A20B3777A7BD93EC721A56816E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226293, "uuid": "6edccae3-cd8f-4ed6-85e5-ce90d54101c0", "value": "1536:UJj7AkwGXJajREFFFRR8TGEXWecL5oBTTrw9VG4MeTBnHf:UJj7AkwGZaV8FFRLecL+xL4MeTBnHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226293, "uuid": "c0b62765-56a2-40e2-935c-29f9d6fd2366", "value": 71792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226293, "uuid": "17bb6479-f047-46ad-a149-25ef51a5515e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226293, "uuid": "c5c43229-50a5-4306-94b8-64584ea1e6d5", "value": "skid.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a30d6f-dddf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766261304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261304, "uuid": "3255698a-e9c5-4ccc-8779-0594cea7418a", "comment": "Malware payload", "value": "b0798dce76c382acce6b16693dd3089f", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261304, "uuid": "fb0b5d66-0165-4883-b936-f08a773489b5", "comment": "Malware payload", "value": "f692ba8fbe76ee5488fd81ad3ae6689744b7b8f9e35712cb6848bb7151f7bf1d", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261304, "uuid": "cb614059-b89c-4403-ae44-b11a3b3ddc0a", "comment": "Malware payload", "value": "80f1d0a02c6385775d39e9bc8d9ccee58cf40517", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766261304, "uuid": "40326865-e6f3-4228-85d2-716a21d717e2", "comment": "Malware payload", "value": "c4cfd2012fbe43a8fd764ff46d26d384dd991703a98e5b486e04568cffea1c23e7e4bcaaedeb0fed818a026e8cc4497b", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261304, "uuid": "9ac2df04-329d-497d-bfb1-b7b955957671", "value": "T1E9222C1236245754D4F98639FFD62D6736C87D02B8704B557026771954E9E0C3760CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261304, "uuid": "a4d4aec2-f38b-4be4-aa93-6ecad10d25e8", "value": "48:9r1g804QRlEFlErlEl15s6pMNAoYoT29T3IORNdT4g8NrQ+s:95tRyxYoT+Tfdeds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766261304, "uuid": "ec705450-a30c-4faf-b07e-a739db1abea9", "value": 10739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766261304, "uuid": "fa319954-beb4-4af4-b0e6-90f619d33b36", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766261304, "uuid": "ad6f6a38-1833-4617-9a1c-31cad8d2d2e3", "value": "Invitation Tanzania Independence Day Celebrations 2025 (09 December 2025).pdf.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689d3dca-dda2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766235005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235005, "uuid": "8ed0274e-ac5b-4e01-abe6-d87f36629acf", "comment": "Malware payload", "value": "48c406b02e2192108548b1d20dd79ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235005, "uuid": "6c42e011-31e8-4bc7-884b-9006fe002832", "comment": "Malware payload", "value": "fa1f88dee45ae92a45ef25ed46146adfb8d2cfe8758c3b8efe02aa8e38463386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235005, "uuid": "845adf4a-809e-4d0f-a40c-ea9900c0fac8", "comment": "Malware payload", "value": "17f3eb32134f3984895a9c7e2ff3499aacf3999c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235005, "uuid": "e4a2af4a-fab8-431a-9d54-26164809a3c3", "comment": "Malware payload", "value": "8c87304a524fe1f20b0f58434bd0bbba2fdc90e1f350855bf1931a64dfcd858853cdb5d21cc904fb64a913eb84a2ea5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235005, "uuid": "3e055623-c1f5-4188-a6a4-bfeca505f1c9", "value": "T10ED2E0DA3B3F4FA9F0F60B345164436F63727477066B8B2A1AC451AA0C6F886FD39054", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235005, "uuid": "1beaf863-2ae8-46b1-bfc1-32d420880965", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235005, "uuid": "1bd64210-985a-4720-9c8d-8fe5ab845cf8", "value": "768:c30hCIA4ebbhxEtexPlWZPPlNE4QgGAQRj4XE1:FhCp3hBSQfHoE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235005, "uuid": "9128f5f7-a701-453f-ba40-7bbb2be80dad", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235005, "uuid": "87c32833-3a92-459d-80b6-75e58982b26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235005, "uuid": "dbf7eda2-b785-4c3a-b397-f9a6028840e8", "value": "SecuriteInfo.com.Win64.MalwareX-gen.56332561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b96a130-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234205, "uuid": "127dceba-85ee-4ee0-a94d-8696b2c20756", "comment": "Malware payload (Mirai)", "value": "deaba8dce98e2db9922483eabea6dffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234205, "uuid": "42f71045-2b1f-40e8-933f-c3992741f93f", "comment": "Malware payload (Mirai)", "value": "fa2c3f100bb85df83b061c33f569fa8eba239b330dd8dc8b3e84edb0af3cf5ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234205, "uuid": "79584cf7-11b6-4882-9eb5-067caca64a23", "comment": "Malware payload (Mirai)", "value": "5d0ca6e1f4a82a62bdba7e0a7b621090545f06ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234205, "uuid": "9b284f36-3908-4a2a-9958-e3bc3bc714ee", "comment": "Malware payload (Mirai)", "value": "c20e7306f46de1d76ec88861ef8fb918a63104c00a525e2713f08bf2fe9c75cf030cd775da230a65c867dc637d7dd54f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234205, "uuid": "95274b58-ff0d-420c-8124-4b1a240a29b6", "value": "T186210377F7FF6A46C4A485350E53575D7E10ECDC0018921AB6E1AC1E9C45211BD576F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234205, "uuid": "bccd1ad1-de1e-43de-8010-2f0eba8caf30", "value": "24:3GJNLIEoRzqy2W1XVFxEMG9glf2xzoSMdCFVnjDS:WJUz/FnF+MGujMjDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234205, "uuid": "8075b707-2d4f-4fea-8adc-47364d48bf36", "value": 1424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234205, "uuid": "89cb5ec3-b46b-401e-b1c2-d4fb3ed23c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234205, "uuid": "d7d42899-ae43-43bc-92c1-718f7bf29394", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee01be8-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766197918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197918, "uuid": "1c9be65c-895a-4a87-b784-07df1dd6ac5f", "comment": "Malware payload (Gafgyt)", "value": "57054bac12f39422a30dc8431659848b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197918, "uuid": "c8992641-fcd3-48a8-ba3b-ddada267fbd5", "comment": "Malware payload (Gafgyt)", "value": "fbe4b1d90f6b9ca88ebef7a7183026d27023e82b91ded55209d1709bb1ae1d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197918, "uuid": "6067331b-276b-4832-be87-94d717eaa4f3", "comment": "Malware payload (Gafgyt)", "value": "ce6768b601cc60c2b446522ef90b4ede7441d8ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197918, "uuid": "ba68b94d-9595-46e2-93d5-5bc3fe7ad389", "comment": "Malware payload (Gafgyt)", "value": "935a8a6600a7ba5fde527beb622a0540734354afe6b611cbd109cc1ff39e240b5f1d90b51a15ec986ac2149266546ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197918, "uuid": "b57e8d1f-616b-4ec7-b576-bc55683d12a8", "value": "T1F814A53E7A22AF7EE268823007F66FB1CB5511D333919392E17CD6145EB224D189FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197918, "uuid": "9a46332b-471f-45f6-9cb0-432cb03c3162", "value": "3072:IG1hBBd/RB3DW5MvYu35hEzmASqmv8uNv1BlLMoU:l1/zCigu35hE2qmv8uNv1BlLMoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766197918, "uuid": "91d19abe-5656-42d1-b69a-85b9e598f0c5", "value": 190550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766197918, "uuid": "4cd0c597-845c-43ab-a6e4-0b8c75a62f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197918, "uuid": "7386fcd4-cba6-40e9-a5cd-dc1be1d3c09a", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872d34a5-dda0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766234198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234198, "uuid": "851be784-27e4-4374-a131-c4de1044bc28", "comment": "Malware payload (Mirai)", "value": "252d36703f361575f08a32b8209dd7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234198, "uuid": "f318ab6b-01ed-455a-93d6-9c60ee4f82ce", "comment": "Malware payload (Mirai)", "value": "fd0753d6cc8a039a7c5ebfb920d4a84e9a3f9f0bb3b00275b15ee9e184a359a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234198, "uuid": "aff51ddc-b4ab-4736-9a4b-39300620dd6a", "comment": "Malware payload (Mirai)", "value": "2943abc3d9e0d787d0b4efcd06bf7586eeddc7e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766234198, "uuid": "433c5145-4f63-433d-adec-9a43cac2a537", "comment": "Malware payload (Mirai)", "value": "5999ae594cf4ae54ac275bf47ca077c583809901d347e43ec985dc3f04f5e98d854f2c049e7e7b974dd5273413ba08af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234198, "uuid": "898d4dad-5536-4b12-8fe7-bf095fbaf8dc", "value": "T14121E15DE75A6D9FE9B391396413031240707676E5031A12E3259E3F2F3B285520A0CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234198, "uuid": "b103ad43-f8ec-43a1-84b5-99fc20defb34", "value": "24:3AaZmqKPYw+U7M0ebcJnHXZJYzD+zlnLfnKi+v9PlOMQ3YNvsZ:WbX0bcJnpJoKI9PlOj3YNEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766234198, "uuid": "1c91cbe9-4d0d-4bcd-8eba-3b54705f0964", "value": 1348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766234198, "uuid": "47e8a097-c5fb-4b4b-b244-3f3327ba0671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766234198, "uuid": "c3faf413-982a-4c30-8c62-8129a048eaf4", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6d59e-ddae-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766240356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240356, "uuid": "db658a1d-c53b-45f9-a474-abe68815d56c", "comment": "Malware payload", "value": "7337b1d9fb55350eea6bde0641f36ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240356, "uuid": "706ee267-c7d1-4b9c-8ab4-fdfa1ca2b8e6", "comment": "Malware payload", "value": "fd9145bc43e7fb92d17da36a5940210057d2dd8f7ddf1cc4d2448dce97177522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240356, "uuid": "dea191ba-59ac-4781-9804-842b226efa77", "comment": "Malware payload", "value": "13295f4fce768b333687ba55a6afc757c4213cfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766240356, "uuid": "d19e564a-9f8c-41ff-8ab7-ca7ea93df9a9", "comment": "Malware payload", "value": "0e010dd39cf6ff6b394d2babd83c29ae4cc0e94be1b5ba71d5806ce2cf185712e7b35a0fd4cb050678fc614ab0fe4040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240356, "uuid": "bf315caf-4d55-4eae-a7ec-9ca467cb44c1", "value": "T141633C17B34364ECC516C5B486EFA733FA72B85746309F7F1654E6302E20EA06E2EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240356, "uuid": "ced0b102-2eeb-4c82-8752-e5bb0568b243", "value": "a12b7d1cf4b53c25ee30bb9ff1ebfece", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240356, "uuid": "9504214f-d312-4813-a88f-54750eef4935", "value": "768:q8s85D7AVhckaqLSyb4GIbOYYY20hsGNhRx8lUlPXeXUhuvF1bJpElqnE3cJcBWk:9S7w81HwVTf0alPsUcvFlcqndjFWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766240356, "uuid": "d6bf4b1b-4f41-4fdd-8021-e69d2c415e2a", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766240356, "uuid": "65b6e645-1121-403a-abbb-776ffad04043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766240356, "uuid": "3f0b4b12-3390-49c9-bffc-4a4697a383f9", "value": "SecuriteInfo.com.Generic.Dacic.6942.B32E6AD2.23984.4897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d8bfc1-ddc4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766249815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249815, "uuid": "2876501d-801e-4b28-a1b3-873ff7dd625d", "comment": "Malware payload (Mirai)", "value": "26dd7892105210e50e3561578febff0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249815, "uuid": "74b2973e-42e0-42d3-a439-b2810be26fe1", "comment": "Malware payload (Mirai)", "value": "fe42c0e128ed02574179e239ec54ac6b3979c77912af2c287c79cf7cdad837d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249815, "uuid": "af64fdfa-eabc-484b-b6f0-aef7b369b3d7", "comment": "Malware payload (Mirai)", "value": "ce9cfd129310648a06eea8a4d9011abeaad9f38c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766249815, "uuid": "8c625f6a-81b9-4c59-b1ad-26bbf24476a4", "comment": "Malware payload (Mirai)", "value": "2e0ceb430ac6f1ec6400671880f487a7f59fbec647857c638b5b3561d58e6fc400b23203962eff1e44d347451446e86e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249815, "uuid": "7c856f88-bc46-4f33-a439-412385c37983", "value": "T1EA72B0E5525BD052F37802F6001AAD871913ECB4948386B75D97FD4344AFE4BF96A0D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249815, "uuid": "c46d4a24-a9a5-447d-b3ac-aeed34497e76", "value": "384:S8ZdTq39pTppGAt8SzCTCMAICZREZ+IUyXPiMEYUFLq+hTp/ftBdx:S4dTq3XTp+SmTqhHEZ+In/iMLaLq+dRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766249815, "uuid": "fabe39d1-3643-42f8-b2bd-18d0598bb703", "value": 16900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766249815, "uuid": "eb54fa0f-cf8d-411a-9179-f9397e0145c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766249815, "uuid": "97bffafc-c004-4b8c-bf15-35f65884bf39", "value": "sumrak.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2a740f-dded-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1766267222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267222, "uuid": "d34a7d6f-1468-4459-81e7-6e6f99723370", "comment": "Malware payload", "value": "32205bbb766ef35c0545c4f3ab4edeb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267222, "uuid": "ccd17fe8-18a2-44cf-ad67-10fcefaad786", "comment": "Malware payload", "value": "fee934dd9ef6d651cac02060cbbb0c7c38cc6dc508bfa22aed5042aba30ce9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267222, "uuid": "f6791734-e2e8-4824-a6bb-95923e5cf9be", "comment": "Malware payload", "value": "40190aa5ed68b1bbf4c08c15c249ee85fc4a8b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766267222, "uuid": "4cab5b9a-aad1-4821-a18e-9a17cb50ed5c", "comment": "Malware payload", "value": "5c89babda6dac6ee6d75053318469939f52b5bd47f037379929047fe856ef380b5e8deb987c03d00c2fac4f569759b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267222, "uuid": "c1bd8448-4cf9-4e1c-b581-bcaa011b4158", "value": "T116A66CD2AD600B69D6ABF239E9B252957330B844033124D7BA9127A54D77FC4133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267222, "uuid": "aeb8c083-985d-4c92-9389-016206e7bc6f", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267222, "uuid": "3bd9ae05-7b08-4116-a75d-7fcf0fcde941", "value": "49152:qlZdoMoafyrmAOnlKAVKTkNx3tNPO8+pWjvWXnTjHE6nQeIVb7AKJp+dOmcVUWKd:qKa09fIVQ1dj3u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766267222, "uuid": "d3c789d7-671e-41d0-9cb3-f7e76910d0a5", "value": 10307256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766267222, "uuid": "fa582bf6-c7ad-4ef7-a4a1-754b747ac5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766267222, "uuid": "34ca5139-c619-4796-8b44-83e183565b0b", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c232c0-dda4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766235890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235890, "uuid": "d495e186-81ef-46fc-b121-16f7bfd84701", "comment": "Malware payload (Mirai)", "value": "4bb8c59275cfeef9482e8f71d5e6677e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235890, "uuid": "ee5d661d-bbcf-44a8-ac96-5628f7507e7f", "comment": "Malware payload (Mirai)", "value": "ff1ebd10f36cf8b2e7f4ac99c701683c3dc07f650ebdbd88354633f3b58626ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235890, "uuid": "18e04418-fe96-454e-a2ff-b6addc7d2c75", "comment": "Malware payload (Mirai)", "value": "e541b9aed18ad7d024e01ea58ad18fb23a89e22b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766235890, "uuid": "a14de7bd-50aa-4a2c-b7e4-176a2b049726", "comment": "Malware payload (Mirai)", "value": "b11f5c2325f4c6ff11214bb8941e0ee61389d2a4a61671cdb53b078383f3ec45ccd0f0a00a0661e1d2f3630c7a65eaeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235890, "uuid": "17343b0a-a119-4246-88e2-54e36cde3127", "value": "T1FF03F153619BE61AD1BC537854FF3CCC8D5CA00804EDC0AE8EC470A3699E67996343E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235890, "uuid": "c5f40176-4d72-44b6-8a7f-34a20c6bcda9", "value": "768:LZuGsWVtzmQiKuytEauWc08sp+GQb1643G6CnbcuyD7UtQRjh3:L81mtnwy1uqhO+nouy8tyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766235890, "uuid": "36250f0c-b39c-4761-a897-0df4d3e6f916", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766235890, "uuid": "c54238c6-f3c6-403f-ac23-6055014110b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766235890, "uuid": "3a8ecf54-906a-4cfc-a671-0dcc3ae9d9b9", "value": "nx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d240e2-dd8e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1766226295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226295, "uuid": "24a90e49-45f6-4f58-9362-636cc5e1403d", "comment": "Malware payload (Mirai)", "value": "d9d5ae3b4b2b5007d4eb7ab24add9853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226295, "uuid": "cf01081e-3ba5-4373-946c-ec367adf76db", "comment": "Malware payload (Mirai)", "value": "ff810afcf0dd77eb6b64b54a70eddd6b6f1de3afcaf9494b65bf6cb6a8bddbbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226295, "uuid": "cd23e2da-13e9-458a-88c0-69db98ddcf4b", "comment": "Malware payload (Mirai)", "value": "f240bd84e4f511990e66582d198d3b7963425dc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766226295, "uuid": "3f9702b2-26e4-403e-91b5-19dcd094f04c", "comment": "Malware payload (Mirai)", "value": "05dba33b04304f0ceed7b7659531606a7f23b264fb47c1fb3e94c6ccb1ef37ca5038d15a5c293d39ed3cedb9ee038961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226295, "uuid": "e455950e-76f1-484d-9121-32a6da5f3a08", "value": "T194632902B3080D03D1A71EB0263F1BD1B7AAD9C123E4F685795FAB96C675E334585EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226295, "uuid": "fe566678-577d-4e0d-a237-cd221c5f3b84", "value": "1536:/TY+qinlwesDhpauDC9gNbgWLjjcwbZnlht:HqiHslhC9gNbgMjcwbZnlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766226295, "uuid": "666ad82c-52dc-4c69-9046-6f9d0a0f86a0", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766226295, "uuid": "6f6bd431-ef41-467a-a8c0-80c749e1f315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766226295, "uuid": "72773e19-9702-4ffa-8315-7eedaab61a51", "value": "skid.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7b0c88-dd4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1766197916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197916, "uuid": "a8ea3c3d-30e2-408a-b233-4d60ef96de21", "comment": "Malware payload (Gafgyt)", "value": "e5ea6449ac5abc39b0b63994d472a7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197916, "uuid": "8c0f3fcc-731a-4f94-aaa1-eebd4a0924e3", "comment": "Malware payload (Gafgyt)", "value": "ffc60604aab2e03164bb7f82acbe8d04e7405c5b954e986692faff8dee7fa625", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197916, "uuid": "c8bc302e-9da9-4578-b211-e9c0ff39ef7f", "comment": "Malware payload (Gafgyt)", "value": "aaddf12299de5efbf01f3be536f54465c1eaf415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1766197916, "uuid": "bd608c91-74a2-42b3-a150-b9f234b448c6", "comment": "Malware payload (Gafgyt)", "value": "f2a5d364a36d6b870b05be9e2e55a73db0579b9a2ad9403359d7e46a17a866420b65bacb99c63ef42f770c85eb142a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197916, "uuid": "455a0604-7f55-4ce3-a13d-11eb81f2c031", "value": "T1ACE30837B2D18DF6C04342B026EF9AF29D22F1FE167A311B23A02D705F2E9C65E55A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197916, "uuid": "d7d24676-6e2b-4fea-8720-4070c59569b4", "value": "3072:o+27+b2L2KBUdtgNHIPnVSWDicnpphahp50H50llkcDDm+QyyXFZGOjPU:wUd2BIPVSiphaboMpDm+QyyXFZGOjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1766197916, "uuid": "ec894865-5389-445f-af5f-e48b0a763455", "value": 146968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1766197916, "uuid": "9f45d67d-7abc-486f-8388-9e4f3f0014d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1766197916, "uuid": "2484afde-91d9-4ad4-abd2-ebf1ac0d2bc2", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }