{ "Event": { "published": true, "date": "2026-06-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-11", "timestamp": 1781222582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a59eb206-1607-47b8-b7cf-8f65d3659fd0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d4fdf8-655a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157432, "uuid": "1fff8375-8dee-4925-9898-215ce2e8e266", "comment": "Malware payload", "value": "ef9853e7248e17faca5e58787e9767dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157432, "uuid": "30b9007e-5f87-4b12-a6e5-003c945fa572", "comment": "Malware payload", "value": "00085239fec97b87fcf5ff6bdfcb86c2022243cf975e7afa61c01bb952b816fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157432, "uuid": "ddcb38fa-ee67-4d08-bb36-9b1b2e78f4be", "comment": "Malware payload", "value": "13084491332368db89ded2c52d2271e8c279b200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157432, "uuid": "472750e3-a360-4f42-b89a-551206d99e4d", "comment": "Malware payload", "value": "f82d593d2b32081c587aba28a8dcc4a912f3aafc1fc14582ac5782a07324555984a0eb960f9b5d3d016c1a11719e281f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157432, "uuid": "3c388d42-4bf5-4513-8090-8b184de0bedb", "value": "T188968D03EC9549E9C1E9A23189BB9252BB717C480B3223D72B50F7386F76BD4AE75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157432, "uuid": "9fdaf8f6-ce64-4ad8-9e8b-600a7ad9378f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157432, "uuid": "7fe01101-73a4-4bcd-bd78-12b1cc14152c", "value": "196608:ytDpaZyzfhzHHrNtpIvYMcplpgx7q4xKIb15A:yzaZyzRpIvYgxO4xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157432, "uuid": "386322ec-4cfc-4de3-a5d4-5142631b0591", "value": 9145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157432, "uuid": "74591809-1400-4b8b-972c-99d33e49029e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157432, "uuid": "38bcf7ee-0289-47c5-bc6f-0f3a09723858", "value": "client2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14db259-654a-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1781150770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150770, "uuid": "3f79b29a-2134-4fc0-91c4-c161072620ba", "comment": "Malware payload (BlankGrabber)", "value": "f68c0fee1b17583507a050d97d96c671", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150770, "uuid": "7705ebdf-6e79-488d-a75a-f6dd037823d2", "comment": "Malware payload (BlankGrabber)", "value": "003a9dc4eced7813bbfa6db61e0dfe36bd496ddbe6fa61328e33bf4bc319e72a", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150770, "uuid": "17b6ecd9-6530-4b2d-914e-c5826f940398", "comment": "Malware payload (BlankGrabber)", "value": "cdaffabf10a51cef3f1e8928685e497e4eaa8d96", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150770, "uuid": "70238aba-5691-4717-ad8c-d5334757f731", "comment": "Malware payload (BlankGrabber)", "value": "d5db444f008f25e7b916c9ce55948767dd72d864c17cf695aaace4cb01b0c036b32df5e9e4cb04c69076dfe7e17d5763", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150770, "uuid": "fc372843-9307-415c-88a6-167883bee0b7", "value": "T14E7733B520EAAFF5F677F97594175501A37BBC022360D18A31EA04A2FE761E15B3E023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150770, "uuid": "834f652b-fbcf-451c-aa55-61f6ff5fec5d", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150770, "uuid": "86ace1c4-ac99-47d6-88dd-1b6ec4a65252", "value": "786432:JLKdWupTFGIAevvmcp+FKah+lqaXp+4x+Cz:JLKgUjxCKaYAQJx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781150770, "uuid": "a62eae3b-462c-46cc-bb8c-b0b56cc4823f", "value": 34305256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781150770, "uuid": "0d98c9e2-2e3e-4443-b400-ec12acc3e0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150770, "uuid": "2d7435b9-97e6-4270-8df5-8d661e06e6d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96df9857-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184146, "uuid": "2e13388e-64fd-4681-85b1-844ee65771a4", "comment": "Malware payload (Mirai)", "value": "88b5e5fcc51ffa39231b7e4910eebe2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184146, "uuid": "4947796d-9490-4540-b16f-7f4d36d1e37d", "comment": "Malware payload (Mirai)", "value": "0091957b1e40966450f9fb47ba619f5a3e2ec2934354f23947b058133df4d1b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184146, "uuid": "809960b5-e483-4e3e-a86a-65f406092e91", "comment": "Malware payload (Mirai)", "value": "043e17f043e4e5fc70a7117d47a77e10535f7110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184146, "uuid": "4bc7822e-a591-4125-93c8-5065bab1b743", "comment": "Malware payload (Mirai)", "value": "039ccbb9c04129fccc438ed4c82309fda6f2f283014469756ca81eb209a1b9f2fe3e059b56895c46856f5c0431f4497b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184146, "uuid": "a15f650f-edfd-483c-be25-c56bbfce56d4", "value": "T1AD430221566CB8BAC87414F2E6198F977E1D1DFED1EE333B932A9005426B9E6C0DC502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184146, "uuid": "b1f7a550-b830-4c60-96fc-41fc9977e733", "value": "768:Tc7fWZ0t+kgKqWJQm0VJn3vfesPJxX7JXPbOD8kXJFAwIZlSNI9xnyi9QhY3UfP:DZ0YGJTy2EjVfGXHALUNaxyiUtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184146, "uuid": "3f549350-c014-44da-8b0c-dda4569255b1", "value": 59192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184146, "uuid": "68257807-a320-45c6-a6b8-502bccf4f18b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184146, "uuid": "ed078635-5de2-4974-9f26-12992bd26f34", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29bf600-65dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781213855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213855, "uuid": "68344c1f-b6b6-4a20-b3f9-677b63237627", "comment": "Malware payload", "value": "be7a78dd13753b0e696ba71aeb0f086d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213855, "uuid": "e4bdf83f-dbcc-436a-83d2-5c75adb59a06", "comment": "Malware payload", "value": "018620179a96f33eb119a33c7f9c7041dfa36f1fa943c9cb6f01323c71904c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213855, "uuid": "f0222a4f-76bb-4520-8266-a959932f2f65", "comment": "Malware payload", "value": "deb7f2571c0def51f1a50dfa6936dd5130ee505b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213855, "uuid": "4d9905bb-d58b-413c-bf40-46758be464cb", "comment": "Malware payload", "value": "73993f3c80e13a05de2f1f6436e811eda01c4b1ee7324d1f9c310dc08e5ca4ded5d954bf5124fc79c8d45e25ba372349", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213855, "uuid": "5eb3c82b-a5a0-48d7-83f1-62bedf8a6f90", "value": "T16724874A6E328F6DF678C73047F74A25D76D23D626E1D680D1ACC1052E2439E681FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213855, "uuid": "ed351514-3a50-4dce-a4ab-91d877a9c1f6", "value": "3072:HslJM+xXqo+PAaPsGUpYgqgIWcbVE2N1kB7jc1wO1YX79L2KK4q8KZrlb:HH+xXqrAgsCUgXQ7oKVq8k5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781213855, "uuid": "e638aea6-6b85-4541-9557-0a89450ca740", "value": 218616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781213855, "uuid": "b23ce1de-7d4c-4f37-9fab-03873c428440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213855, "uuid": "c394b7ad-5fa7-438c-ba98-7d9b0f044c4d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac1f326-6559-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157014, "uuid": "92185cee-ba72-4555-a2b2-b9bb24c22b25", "comment": "Malware payload", "value": "2cd4e1d28f455756ffd8d3d05728cf3b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157014, "uuid": "92ac2263-7e0a-4cc4-ba70-08756c18c480", "comment": "Malware payload", "value": "01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157014, "uuid": "d5fe1e87-6515-4bd6-abd6-9200a1683eb0", "comment": "Malware payload", "value": "9b766cca40f5dd48da8e0552f3edd6003367c0fc", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157014, "uuid": "20166e6f-3e85-4483-961f-4ac2ad135dd2", "comment": "Malware payload", "value": "6f33fd1810ae4e5f1a3ffb82fb5c124a92b26973c375074bea70742a2d5f970b4d9ffb53f7de1e8df6cbed2211fb7e90", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157014, "uuid": "62b5b143-dad8-409e-a9fb-15d25eb39a33", "value": "T10444F603D35744F9D86AC675CAA6D233A521B8599534BA3E2B84DF223F21F10F72DB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157014, "uuid": "69ada1a9-5255-409d-83c6-95882bf7cee7", "value": "8762b7d30a5eea5cd266f2a6fcc62f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157014, "uuid": "77a238a3-01a1-44f8-beae-2a4dc9935ac5", "value": "3072:hUrwe1T/9hWkwxsA1OqJLeA/SsgBmXvrVx77JQMR2/wFYcRhTI9ERy+5xSzd8waZ:hgJGtdLe4vBoMR2/yuERyfSzyhfwQzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157014, "uuid": "217f1e62-913b-4e53-94b5-7ce2c01fea44", "value": 274768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157014, "uuid": "74be665f-214b-4c3c-b401-0a76775bd102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157014, "uuid": "0426ad28-328f-4e70-a745-01dd2255598f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bb0351-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146154, "uuid": "6dc3229d-1bd9-4d3f-be32-f26e30568f3c", "comment": "Malware payload (Gafgyt)", "value": "055eba1b5628a7c2bdb578926830aa29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146154, "uuid": "6b05ab88-7ce5-4284-a254-5433ff2739c4", "comment": "Malware payload (Gafgyt)", "value": "02b4a57b68781020a57ff60e673617ee23f1a0b85b46bfc390e9608db27a3501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146154, "uuid": "bde0e9f7-3dbd-4ba0-9d35-cd70ce068160", "comment": "Malware payload (Gafgyt)", "value": "c16ed6248bf7b898e58eb2392796be9809cae7ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146154, "uuid": "9424cf14-dd03-4338-8a1f-2ecf90fd901d", "comment": "Malware payload (Gafgyt)", "value": "271bc01734e6616d849b0b9b957b34935e5baebc139690601c43f2a30333010c69add9229b0e1c1072dbe672c1ceb548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146154, "uuid": "fcf9ba69-3652-44aa-ae95-203c2e5ae209", "value": "T172C33917F9419F41C1D325BAFB8EA64933136FF8E3EB7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146154, "uuid": "3dc91422-a68c-47b9-b118-d8a992f07a17", "value": "3072:ryo9yVznJoEsaMD56iNwaQFgei/oCkRXY5hTpZ3n:ryEyVzneEsaM96iNwa8ggCkRI5hv3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146154, "uuid": "9f4d496e-1eeb-4e61-bcb8-4cedad4890e4", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146154, "uuid": "36be8295-d324-42af-bd8e-bb9ec37f6c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146154, "uuid": "d2c3328f-9c3e-44db-b90b-e502d001ad52", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441a073c-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210636, "uuid": "e893f9ee-0b6d-4adc-bc29-571642856b11", "comment": "Malware payload (Mirai)", "value": "274b5bea49096d9ec65654e346c217bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210636, "uuid": "449363ea-f1ee-4752-97a4-0556af0a21b1", "comment": "Malware payload (Mirai)", "value": "0331d7d75ddba0a3462a7274d95f574cf59abceb601192784cc1f2d454676bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210636, "uuid": "7dc38333-f82e-4dd8-8a4a-cab9a370678e", "comment": "Malware payload (Mirai)", "value": "9cdb76d0a0ac6645408fa31209f580d0387cc049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210636, "uuid": "54850f88-a5bf-416b-9db0-031a48a57f15", "comment": "Malware payload (Mirai)", "value": "75ed34b143cddf4b61bc9d85a4bd0656d2dfdf740dd5096ae87167bb3aa624ea1e562dc4823343750dd06da363a78529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210636, "uuid": "ffda982b-e472-4a53-89b2-7d43e4d2b158", "value": "T1607302A29BBA9C6BF1DA63350F53E2054124D2801D377C94E385DBE141B2BE8ED28FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210636, "uuid": "96744530-eeb8-4306-891a-4ffd6de573b3", "value": "1536:jLrsTHDvquGPNPJLAqrQPEHGhhgnoEplq5rACRql1EfwpAMsLVydJfpmRnouy8Hh:jLrIHrquGPNPV8wqgoGobRqlmwpAMsY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210636, "uuid": "2c6312d5-e093-4457-916e-faca5f37a907", "value": 77240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210636, "uuid": "d76f39a4-b9d1-4ea7-b6ec-ecf2f9be516c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210636, "uuid": "b93fe441-f670-48ee-b091-de9101755e25", "value": "0331d7d75ddba0a3462a7274d95f574cf59abceb601192784cc1f2d454676bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f9a73f-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146158, "uuid": "259c235d-286a-417c-8d71-e66879332177", "comment": "Malware payload (Gafgyt)", "value": "3d9d95d08cf7582247aad0c0cf289596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146158, "uuid": "0126f264-d07e-4a80-825c-983cc783940d", "comment": "Malware payload (Gafgyt)", "value": "05c778187ff079456fead10405ab911f31fa40a6a501178f34245c13ae737f09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146158, "uuid": "06cbb0a2-2e91-429f-8db7-199b6cdc31f8", "comment": "Malware payload (Gafgyt)", "value": "83e4a1817210484def92b06048a1efb9115dec3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146158, "uuid": "6af51455-094d-4cb4-9a76-263b816e22f8", "comment": "Malware payload (Gafgyt)", "value": "fd678cdff4de3bd50add4ca4da0dfaa2c94ad1934011663363ccf71d4e738a89b09dcf810af020f15015c6ee72b55019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146158, "uuid": "c888e56c-8bbc-4cf0-ac03-5a967245b9bd", "value": "T15EB319037B0E0F83D1573DF02A7F2BF1979ABEE215A4A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146158, "uuid": "9fe2398b-a3c6-47ba-893d-7a7e7db0395b", "value": "3072:itIuYiaM5Gj8iOvrEZfODakSFG2wlu5h7pLg:iCuYmhrEZOdYG2B5h9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146158, "uuid": "5ed06765-8a3a-43a8-85f7-9662e3f02328", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146158, "uuid": "0344cf34-c78a-4349-8fef-e905a12f4a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146158, "uuid": "7d8e7b27-f6e4-47f2-bede-52a67eb73b58", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ccc64a-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781189377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189377, "uuid": "6eb9ca85-a9d3-4ace-bc34-bf41f9db4498", "comment": "Malware payload", "value": "d520de2c947d5498919aebb848a4712e", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189377, "uuid": "f9878e1a-ced2-49e9-849c-fb8281968ee5", "comment": "Malware payload", "value": "05f1d32dc674523b19b5d1b2dedbc57218a35f0ce51c6c98637f1188022af982", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189377, "uuid": "22a78c6c-1785-4806-9147-c7ce7d9e586e", "comment": "Malware payload", "value": "60e55b602c520e70be659676e34c6cc6e991d8c8", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189377, "uuid": "dd4b5504-aac5-45ff-99e2-8fda3362f14c", "comment": "Malware payload", "value": "9be35e849120fe6d53259026e662a779fa9367b9a80013f1dc41820d0dcf39c1df32bf1c925298b45c207bfc8f099f38", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189377, "uuid": "b65f44d4-71f3-4087-873e-781ff2771b39", "value": "T1B9341265894B4571D20A417B6F1D01A58ADE67D80D3170288AFE7ECDEF1363BFA32C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189377, "uuid": "c3bc9f33-e044-4955-b769-d0f01482a374", "value": "6144:4T2+HYrvhj8MrCvGiwdbHoA020pAdiAGMroys8Zqt6:s2UYrvhLCvGJHo35udiA/UBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189377, "uuid": "d082af92-9c00-4cd8-a960-200ba4a708ed", "value": 239048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189377, "uuid": "01db7055-6710-40a5-943b-7d70c0ef90d4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189377, "uuid": "29411c05-ec8c-4f70-b782-fea6d233642c", "value": "Draft contract.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aec1088-656d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781165470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165470, "uuid": "b3f76f0f-ea4d-48a4-bdbd-38b5341c88bb", "comment": "Malware payload (RemcosRAT)", "value": "ff26d99b8963fcfed196e5a9c78cc0be", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165470, "uuid": "30a37800-e78e-4ed1-a7ae-c3c5f11d287d", "comment": "Malware payload (RemcosRAT)", "value": "0645ad6e3c8752a0a38d46c623ed84eeaac4117cd4c7e6d0055137de16ef5b4e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165470, "uuid": "14978570-5954-4a7e-8685-a03d151c8d66", "comment": "Malware payload (RemcosRAT)", "value": "2203cf2dce8bfa9fc16d3a13ecfef359f1dbe05e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165470, "uuid": "c272e793-a786-4dd4-a27b-e5d2474fde98", "comment": "Malware payload (RemcosRAT)", "value": "4288e6e5a127999c917579c858fcdbb43f81da30cad2ee609f053bca658da7e8d10c2980fadd6a99172522fc48b665d5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165470, "uuid": "3d715080-edd1-4d8b-8017-d1448d43224b", "value": "T199E6D5D26560E38C7033648376DAAF1CA3977B10743DCA466AD0EE3ED850EA45CDE94B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165470, "uuid": "344b00d1-25de-4e63-8491-d609bae7b0ea", "value": "384:zmwOAl5cO84iMVpSWlODjgGA4JFm2/sWh0y26jMwPtYNslyw8vIDI10F9lV/vUk9:ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165470, "uuid": "6d9c136a-6b58-450c-9435-afe6c78399ef", "value": 14879446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165470, "uuid": "3fa4c79c-8fe7-4278-8856-beda4c7154e9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165470, "uuid": "63ee9cab-d2ee-434b-8ac4-24854c136d4d", "value": "PO26001-RICHLINE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bd4e4f-6570-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781166721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166721, "uuid": "a98f8fd4-7f8a-460d-950e-cd20ef68a47b", "comment": "Malware payload", "value": "3324c916686cb3e0edf65c202c8cc28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166721, "uuid": "8862b800-2b44-495c-bced-19670e5b0038", "comment": "Malware payload", "value": "071dc6630c4dfcda06113444db326d6175d9260ac45d5b7186b790237342174b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166721, "uuid": "6e34e97b-c645-49c5-aaef-f634bf89997c", "comment": "Malware payload", "value": "757a1b9798fe832f59f5e35666cc92e32fb714de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166721, "uuid": "cf53e4a6-9f84-4542-983b-976748454a3a", "comment": "Malware payload", "value": "ce85db6e84c137de4074e24cd2e408e8b60648ef84a46f6b0e52890fd3a0cb32051801277da93370647e5ea334312bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166721, "uuid": "fd170bc8-eec6-476c-ab0a-5d34364f9211", "value": "T1F4143A0BB6A510F6D9BBC238C543170AF97274A253705BCB07804BB69F6A7F4AA3D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166721, "uuid": "9c272414-a040-43eb-b198-146c09e225f1", "value": "ca25ec2fb4091ae45253c2189263d950", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166721, "uuid": "22ed5b34-40c9-4c63-813a-1abab59d822f", "value": "3072:T/YRHgXDoyiXngBwtbee9ij8hP3K+Z900Uvj/U/SWlplUqkdUyG:TLmj9i+3KQarsSWeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166721, "uuid": "62b9a9b0-eb36-433c-b25a-9ead3bf4926b", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166721, "uuid": "9bbe4863-2ecb-4e06-be7a-0f48fdbc009f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166721, "uuid": "41d5c2fd-21d5-4758-bfb5-555d5114c452", "value": "SecuriteInfo.com.Variant.Tedy.985738.95794887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a724c2dc-656c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781165276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165276, "uuid": "28deff9e-8391-4322-87a6-397b1acf4843", "comment": "Malware payload (Mirai)", "value": "eaf552e3adc128d03a44c81083ca988e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165276, "uuid": "1c66501f-046d-4f75-857a-b1b7c304a967", "comment": "Malware payload (Mirai)", "value": "081de3346fdb7fd48348888720f3c459f1f472c2ed8ff5e5ff3ef24a71f45dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165276, "uuid": "220566b9-93f0-447f-8efa-6af22f017220", "comment": "Malware payload (Mirai)", "value": "acedd0c16c93ca67d8039f6c847abedb984743d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165276, "uuid": "1133a5cb-b122-4eb9-a3eb-d74eaafadff7", "comment": "Malware payload (Mirai)", "value": "cacb28aee53925ddd0c531dfa148b6058730628a19a4fd65fd70956ad10fa6509e5c3ab5d77b7b7006e30ef44573862b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165276, "uuid": "f3e0da77-f1fa-4010-8957-1bf9aa6fa5bc", "value": "T134F3860A6F228F7EF269877047F38E34A75977D616E1C690E1ACE5401F602CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165276, "uuid": "922c8344-8656-4299-b7df-9545b950d425", "value": "3072:tiic+oX0fa7uy69Zagf86svDd3htwlofeBTlXgWrfc:++oi2uyeZXffsvDdjz2BdfrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165276, "uuid": "db789187-93ab-4969-b462-0e8062a9ad03", "value": 160528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165276, "uuid": "1a9893e1-a925-45e6-a654-328730169264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165276, "uuid": "6c5eb0bc-fdc5-4c85-8139-e1131d3a2c9c", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bab9c0-6559-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157143, "uuid": "840b348b-e504-4d64-8eeb-272e9bda2109", "comment": "Malware payload", "value": "37866854ea6f4ed56d04488ce1400264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157143, "uuid": "ec20f9d3-2008-4491-8abb-1f39dba1d1c7", "comment": "Malware payload", "value": "0837b5acd5783956cfecabe4b1714b9f8a2d68adf70d7839fe2d7d0c7b96e37a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157143, "uuid": "a7db6ad3-468a-4610-a93d-b8685d5712be", "comment": "Malware payload", "value": "708e3d7685453255bc154ab0a903edb585599fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157143, "uuid": "2d7a0ef3-9221-4843-91cd-b14a944381c2", "comment": "Malware payload", "value": "149936b4dd3802159cf401bee0aaf1649b2a2eab1824b6feeaf8fcff0a7a953582bc38cc06c5e823a7d4439528bfde1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157143, "uuid": "59da177b-b6f0-44eb-a6e4-2e8ff2351512", "value": "T19795D312AA84849CF05A837487CD8523A5617C41072DB5FB02D07ADFEEB6ED31AFB61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157143, "uuid": "b6e02cf8-6a77-4744-9c3e-8f5e0fab49a7", "value": "80ba9ac5400ffe36764b2193d0e8e215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157143, "uuid": "5889e276-6975-49e7-a2cd-953ba18d5b23", "value": "24576:AUigaLhzJiQ9230OcnQWQfH9r/98ev7+c6C9IA0Q75elBr2z94hwQ2fOZaE2pV:j2hzEQ93OOQW8vqA0Q7UIz6RQDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157143, "uuid": "fe7afd8d-d5f1-488c-a646-1c863d135164", "value": 1987624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157143, "uuid": "fcc16346-d01c-4d4d-8490-de9c821d748c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157143, "uuid": "768acbb9-e6e3-400f-8a8f-6c8161e445ec", "value": "37866854ea6f4ed56d04488ce1400264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67b13aa-6558-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781156684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156684, "uuid": "f0705e64-03c1-45a2-bdc6-a3c56827777e", "comment": "Malware payload", "value": "5548d76d145e096025e2fa8b59cd8c33", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156684, "uuid": "797ba7d1-e543-4cf4-89dd-50aedc22d113", "comment": "Malware payload", "value": "09e57d2500dec545a35f98b083afb9d9b9956ce3107c34fe2ff14b082cb9aaea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156684, "uuid": "d853502e-71b8-41cc-a07e-ba909599d677", "comment": "Malware payload", "value": "01cb669fd4689fc6c563ef99ac68d1d155dbff0b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156684, "uuid": "8729ac79-c011-485e-b9df-1f8caa1000e3", "comment": "Malware payload", "value": "a333a63aae4e0c36ce004e93fa8bb098cac0d1b8459bf9c26d70c4dbe8eadcde2bd7eab8127997635d365b0952ef6656", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156684, "uuid": "b6dd7ca1-d574-4b71-8bbf-2421aa314840", "value": "T1C401EFCEC002EBB04195E85E66A751807812C3CB15414FA83FDC843D9BE96587059F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156684, "uuid": "0fa10598-671f-4944-b36b-d661dfaeabf1", "value": "24:kXCKysE2hi0ziQvZohayFTz8BjpOeXTN7:e9Qp+MsyFv8BjpOeXTN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781156684, "uuid": "7389c4d0-ac28-4d02-9f54-42c273b0e73e", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781156684, "uuid": "54b7e175-29f5-4dde-95a5-f4524f65cfaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156684, "uuid": "a6cd9287-1377-42b6-a2e6-f72223c2f244", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35cbd7b-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179577, "uuid": "43d8edab-bf80-40ee-8879-2309a4e003e6", "comment": "Malware payload", "value": "c4575e60c59addd690ac3862b4352003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179577, "uuid": "acda8db5-5c09-4e36-92df-3d73529c945c", "comment": "Malware payload", "value": "0a6574c69f68c45d478237607ce776023f0758da8194c5378bc604f0bb4b9c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179577, "uuid": "936ceb21-b85e-4a35-a47f-b553fe376a40", "comment": "Malware payload", "value": "a62c61c55c013935b385d2466f3df02cb8c9e979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179577, "uuid": "a4e7b97e-5eba-41f7-94b9-5236cf6b025c", "comment": "Malware payload", "value": "382ea7fd4c7fbf756a5ffeda81f34d85efdb3e473acc4403e233759aa2243fec9bb8a733b459cbe2f8fdc16abacce17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179577, "uuid": "86b1822f-a0a9-473c-8eb1-af5dad05bb45", "value": "T16522F508BBDC4325E4BF8B384DB393551772FA018522DFDDACD8229E6C636818D52BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179577, "uuid": "9da51efc-b9b6-4309-9ce2-f3d3bf33abaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179577, "uuid": "60f61b16-8d48-45a1-aa31-a1907c3a7e9b", "value": "192:qGF726fhQX/j+9cmz3LYZw6lDaOaC9SXt8ay2xFr:t3Qna3sZw0DaOaC9SOayE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179577, "uuid": "ea9758e1-a45b-47f9-b351-fac1b1f5ce51", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179577, "uuid": "d3b09087-8d91-45e3-ad02-ab8ae915b17b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179577, "uuid": "6219e029-4bae-48dc-8a37-362b2ee9fa39", "value": "rL__ciaSandraPinto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390ddab3-656d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781165520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165520, "uuid": "55e20593-c080-4b93-be6e-5ed5e1031069", "comment": "Malware payload (ValleyRAT)", "value": "b8a321a209f04ee24a4bdfc95b0305ed", "object_relation": "md5", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165520, "uuid": "4cb6ec06-4135-439e-ac86-4b1902e23735", "comment": "Malware payload (ValleyRAT)", "value": "0acf526f1706c632342bffa48643b6ed029bd5a0f3ad7741e243a5f31d6fa931", "object_relation": "sha256", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165520, "uuid": "bcdceb41-5a09-4294-ae13-288ad8fad1b4", "comment": "Malware payload (ValleyRAT)", "value": "d25619d424e1b0c27c2698ad75a209d0b115cac8", "object_relation": "sha1", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165520, "uuid": "bc16db24-b579-40a3-9a22-d14949afaa6b", "comment": "Malware payload (ValleyRAT)", "value": "f51b17026003a8b7e24581073689d7351babbb85e812641b6e80c0d4df210f0f482d40956beaa47183a21f9e712923d4", "object_relation": "sha3-384", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165520, "uuid": "62848538-d86b-4834-a36c-6a6e7a936a20", "value": "T122055C03F64684DEFA7AC07D86364132E522B48D473065E73A9C6E382F56ED21E7E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165520, "uuid": "d64d704c-22a4-40f7-aa8e-a9d83e71608d", "value": "f8458a68231ff5850171c4c2f9793fee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165520, "uuid": "1ed6b9a3-9406-4465-92d6-87206908b750", "value": "12288:VlJOcNRTrWhuYnj9KFksDkMwkc7fFOLG8eepJfsK5ZS0:VucNRT6huPVIM27tOJVfZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165520, "uuid": "2a137884-66e0-40f6-9e8d-b9b7d6264e4c", "value": 835944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165520, "uuid": "087d2d5f-a0a3-401e-a460-7f25f4fa004b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165520, "uuid": "1a274085-7dec-4393-83d3-5149b14a1ac1", "value": "#\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7614add-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180791, "uuid": "a4945215-ed72-4a72-b86b-161f601ef118", "comment": "Malware payload (Mirai)", "value": "11fdebc95c10c3f73fa3b4ceeed02418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180791, "uuid": "0de5197f-3265-4123-a87e-00ad84fd7948", "comment": "Malware payload (Mirai)", "value": "0beb9992ceebd96f8d79682248e08d81ba2fc0302f82bcd73d26b26d6ad83b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180791, "uuid": "e2717bc9-4ffd-446f-9d4d-ccf84060e30f", "comment": "Malware payload (Mirai)", "value": "5e3cc2d25446e925d6d5a4dafb961261ce44f427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180791, "uuid": "f1012e85-43a6-4695-8acb-98f5dd625a4b", "comment": "Malware payload (Mirai)", "value": "ebb90bd235c8c8d76f7448307b2b95adefc801be67fb659387b4de15e7007ee3752f9f7ecdf1733bfeef39d1790921f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180791, "uuid": "d70a799a-91d5-4d0b-b663-b134db80baa1", "value": "T1E3A34A9ABD518927CAC516B3FB5E4289372717A8E2EF32039D155F21338B82F0D7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180791, "uuid": "69bc6cb6-196d-4689-b5e2-37761152087f", "value": "1536:m+wWFprWoS5UfWXCk1uIQezR8BrZkhstDyZKOFKbhnYHZHvJtL:Vnpro5aWXjuIV8Bryut+6SNJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180791, "uuid": "190f4688-36c2-4250-bc6e-6b96abd55671", "value": 98660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180791, "uuid": "286b3ff5-fbb7-421e-9b14-062e929e1c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180791, "uuid": "eab7eb48-b28b-49f3-87ee-b6a5b7ddf9ee", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac6ace9-6560-11f1-a769-42010a9c0008", "comment": "Malware payload (RustDesk)", "timestamp": 1781160047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160047, "uuid": "793fed1a-8f1a-4647-b83a-5d477a5ec8e0", "comment": "Malware payload (RustDesk)", "value": "f2d2c5ce23257f43cca9a5d49b9dd08c", "object_relation": "md5", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160047, "uuid": "9dd97a7b-683a-415b-badf-c2285df53659", "comment": "Malware payload (RustDesk)", "value": "0dff181b29d64aa245f8da5cebc1788e7f13e2600e03574c236508659b15c16c", "object_relation": "sha256", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160047, "uuid": "ec32542b-71f0-4cfa-ac5f-51f4739641d5", "comment": "Malware payload (RustDesk)", "value": "2ff61bc044343d186333ffd3630e2d86f0417629", "object_relation": "sha1", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160047, "uuid": "a4958a49-4f80-496b-b34b-f08839e4818d", "comment": "Malware payload (RustDesk)", "value": "e013890882f7b802618cbc86cf5268a326e31caefd277ade4a529cf1eb2b111b0615362ccc998a1743d91dddf44db16b", "object_relation": "sha3-384", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160047, "uuid": "088f59f2-b848-4040-a2e4-c9c43b37f3d0", "value": "T13BC33B449D6A1A4BFE680ABAF2C7988CFEC635684D1E7741F824DF216C91158F12E48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160047, "uuid": "e1bd1cd7-ab95-4e2a-986d-7de82f0ec363", "value": "192:Rddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddk:BAzYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781160047, "uuid": "6d640f24-0d27-4765-87e3-267d7cb45d3f", "value": 126178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781160047, "uuid": "161679b4-4b8d-4e11-b875-7522429e1378", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160047, "uuid": "c26d5be2-0ee7-4e97-beee-b89768b16d71", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17e8d19-65dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781213397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213397, "uuid": "f64b95cb-d189-4174-89d3-2c320f3357cc", "comment": "Malware payload", "value": "e9251fd000b3b77e159e6b79fe04b17b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213397, "uuid": "fc71925f-5831-453f-b797-d4dc827fe30d", "comment": "Malware payload", "value": "0e1c5ecc2246ce476e30e7de4074930eee112d2c63038a89cfe1e3641b63e959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213397, "uuid": "1cfe1dcb-32a5-4452-b78f-b4d06897ab7a", "comment": "Malware payload", "value": "4581cc92f43f07dc2a5f08f4a93b3820371c5449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213397, "uuid": "d7d742a4-c8e9-48aa-9cf5-753a05516676", "comment": "Malware payload", "value": "78a611676f3a9493e4c8cc2da295755e38c5d2035f13e8cd7697b0de9b9e73ab79f7dd4fedc7bcb6619ef3105ac97995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213397, "uuid": "c0124e0b-a6d1-4cde-bed6-461b22a0c399", "value": "T105F32A05B31D0943E2673EF03B3B27E1D3EFDA8121A4F644291FAA8991B2D325589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213397, "uuid": "52ce54da-abfe-45cb-b8a3-fb50a60e1379", "value": "1536:QgbZDhC+wzGS7M0rCR0S2BwWNakv6o2zZ/dQxBZLUN9WYuZX9CJyr7wqdbcFg2vI:aNvY20kv6o4dQxY47wpyxxQCGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781213397, "uuid": "eeab0204-5c27-4e7b-b45c-044822086c6f", "value": 160048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781213397, "uuid": "4ba6cd41-d5f6-4ac3-93ab-79c00fb69b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213397, "uuid": "38018502-fdb8-4ff6-bb6c-8568261cc8c8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cd5b79-6537-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781142609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142609, "uuid": "0130e8e1-a3c5-42cc-b59c-c24f7d741ecb", "comment": "Malware payload", "value": "ddf3fdec68daefa7d46525fb8d40c6b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142609, "uuid": "15556b90-57ab-47a9-8492-fc59d5e4d491", "comment": "Malware payload", "value": "0fb17b217a525f8fee47531706a530d5e041d3aa8ccdc71a99795cf070571e26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142609, "uuid": "7a5d4b49-d207-46bf-b6c6-f8c32ca38e21", "comment": "Malware payload", "value": "f07e105c96cc47a8548d069436b77f34ad60ce2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142609, "uuid": "e96577c1-4ea4-40f3-832f-871d73d065f0", "comment": "Malware payload", "value": "2e2cc4a716f4eb64fbe23f7c451603938aaa37944e1bf0b1e224a0ebdc8d8980ce019c48afeb9ce746d699f11e57e74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142609, "uuid": "128ae055-446e-4817-be3a-d15fbd4241fa", "value": "T17EF3F716B9819F16D5C152BAFF0E538A33131B7CE2DE72039D246B647B8B86F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142609, "uuid": "becc1163-8909-42fd-a68c-1d20db7513ca", "value": "3072:sRzwt8/urMIUCyKIEEcjeXXAo8HoQC4IaXETSMgSKa7Qfkw:sRMe/uFUCyKIEEHXwo8IQCJaUTqSK9cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142609, "uuid": "379cc3a7-8991-49ce-8a03-9a58cba60bbb", "value": 170632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142609, "uuid": "385ab2d8-3fe8-4248-b739-1ffe9750c6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142609, "uuid": "b753520d-2cd5-4e87-8181-9fba34678c88", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8848ec38-656f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166512, "uuid": "c095c983-6668-48c7-8061-926e995c45ca", "comment": "Malware payload (Mirai)", "value": "2e8b19a8b182676f29d0b402c786024d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166512, "uuid": "67dea74f-ceae-4808-a726-1ac2465b2cf3", "comment": "Malware payload (Mirai)", "value": "111f915aa0f5d0248b7d7ef13154b76e22f3c7e67625641d48fa4909552e2e41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166512, "uuid": "93ab71dd-f591-4655-b089-872c94a1cf49", "comment": "Malware payload (Mirai)", "value": "647f777b111bb80ccfa394cf788f6f62029551ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166512, "uuid": "18172d4f-9004-45ae-a525-186166291242", "comment": "Malware payload (Mirai)", "value": "0e6f5dbd27431c86225a99a72f7a2874ce4746de54ace4a01a15a2add7ca039ce339d63151cf4050fd88b9a6d3dc8c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166512, "uuid": "b224ba9b-3427-4df3-a7e7-b7cc57cee88b", "value": "T192E47E9DFE4E3C42E2D7E3789E4987E1A21B71E0D32391A37582030DD5D69D9CBE1A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166512, "uuid": "02028a68-c469-45f2-8148-818d6b99e17c", "value": "12288:iGE/YDM92FVDBtGMBSr7rERXy5yzjaqaE96EK+ZM86WaELoCw5X4t6Pj:ix/0M9CDBtAcXy5yzjanZYuehoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166512, "uuid": "2dfab9d6-15ab-492b-9197-203a1c06a209", "value": 705232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166512, "uuid": "a4f50dde-28de-4503-8c3a-792a010a0428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166512, "uuid": "4711e6e2-e099-41aa-959f-fbf2e6c893f7", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cd4bb0-653f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781145790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145790, "uuid": "41522f22-1e84-46ee-b781-42a4d7ecc4ec", "comment": "Malware payload (Mirai)", "value": "5509a5c2304c85f4f50d919c4696ae80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145790, "uuid": "ed10716f-c196-4342-bd39-52cf15c0ffb1", "comment": "Malware payload (Mirai)", "value": "12a756c8fe01ff0ca04bbdab21a5c1e307aa9de63b93d7ccd60d954b772ce49f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145790, "uuid": "1dc7524f-bd69-4c6b-847d-906ecde86e42", "comment": "Malware payload (Mirai)", "value": "f3defbf5aa0149336c26fdfcdcd78bd6bae4f3a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145790, "uuid": "ed519fe8-113b-44fb-b4fe-176c3fa062f8", "comment": "Malware payload (Mirai)", "value": "9a68cc69cfa02b80a3162d79ac46978b3c37cde9910c8335cad921b9bab581e1e70ca32c4f24be9fdcba7dd1d9d906c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145790, "uuid": "39b5e3f6-169c-4342-b09c-fef5542aec19", "value": "T130C3AFDBB24B4550C46107F01BC39F9E3B5362258D6FE8EB2D1DA73B247A5CB090A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145790, "uuid": "8b5e8889-02d4-4818-9db5-19e8a7c1439d", "value": "1536:cwOgueEMl+5+g5mZZJOJnQ1xZkCw0C/D/V9gDnLgrpqxH5Igsvf/LW2:c9rl5fUjkQHZkCQ9YnL4WH5IgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781145790, "uuid": "18e820d7-40ae-41e6-a446-7df7632b2801", "value": 124080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781145790, "uuid": "b336fd31-5dd8-4e6d-9a67-c9aa79cb9ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145790, "uuid": "4667bcae-8e53-4bed-9782-cb6b0b01c8e5", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a6de96-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184147, "uuid": "dbd8eea5-5536-49af-b590-1ff4484e4329", "comment": "Malware payload (Mirai)", "value": "b9b733d7c9f65de415a8ce6edf9c2b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184147, "uuid": "fc6ac944-168f-4be6-8445-422065c66a03", "comment": "Malware payload (Mirai)", "value": "12b149f16545da3fd11a7effc6ab05823920688b879c8dd43e965790b47cd0ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184147, "uuid": "b2b934f8-cbe5-4999-a7b0-ab419d5e1d4c", "comment": "Malware payload (Mirai)", "value": "7badc035c467f5ee9c5d4e9486f0bd1f7c200468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184147, "uuid": "5292f6c9-b75e-4b24-bbeb-d0a3d88190db", "comment": "Malware payload (Mirai)", "value": "0ee1ad97ce3470a8b48b9b151593eb2dc0a473177ab959368f3d9c52cfb5f2296b1fb264b91f27f68f476fb61aafd64e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184147, "uuid": "d125f7e9-178a-4c16-9dcc-6733758ac07b", "value": "T1B243029C2FAFC1BCDA7055FBE268C45C651A68ECE09C32B22751850DE5C70AB17FDA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184147, "uuid": "66d12aad-4b2c-4230-8b16-3935719332b4", "value": "768:8sCbw6H7Dy9Z3I+knLP4qa046WDNJzrGwhm6toZQHUcurkRKXQM5Jr1Jctut3Uf4:bCM6bu7Zk8D049miobrSq5NG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184147, "uuid": "bac56d2a-6942-4161-8ae7-4c0e1dcaf9db", "value": 57132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184147, "uuid": "5e061bc1-69c7-40cc-9144-b4d5e74482c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184147, "uuid": "3a704670-1b25-4ee3-897a-80352841353c", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c75925-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781189437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189437, "uuid": "5f009036-9f49-4390-a3f1-13a5649a0950", "comment": "Malware payload (Mirai)", "value": "f2a27a1b7bfc9a476a9b83cfd9d6542a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189437, "uuid": "daca3b99-915a-4086-888a-bdfaa6efa541", "comment": "Malware payload (Mirai)", "value": "137e204407e22c1fadf0c8132f72e9244712af1de5dc115ff25e1393ab950b32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189437, "uuid": "f5d4d558-eafc-435d-a920-539e1e9b5b4a", "comment": "Malware payload (Mirai)", "value": "7e59c0feede2a453e63ecaffbbd750a6891ab58a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189437, "uuid": "a3d525a4-1619-4b31-9abd-15c3ce35ca1d", "comment": "Malware payload (Mirai)", "value": "b4519e0775816e245315b193eb78ad216c4ade87b0d3316d7470e2dba514b03087bf2e8c4b09a6639a689bea673f122a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189437, "uuid": "165f934c-3aee-49bd-a246-84fe19c432d3", "value": "T1E7B32A03771D0F87D1273DF0267F27F1979AFDA115A4A284A91EBEC062718B32196ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189437, "uuid": "3cf42ad0-43f7-446f-a214-a00b3bfe9c0b", "value": "3072:JaFpnseBMRqcj3ns0lCGk7TG44v35hjUpJU:oFpbDQns0lCtHG4O5hjOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189437, "uuid": "2535ffbd-fe55-4f50-9691-ba0d9a17d77d", "value": 107884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189437, "uuid": "d3a53802-c139-4468-975e-9f2a3adb0442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189437, "uuid": "dade717b-b222-4fa6-8563-f70cbe4742ed", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092ba499-6585-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781175748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175748, "uuid": "6f6e9dd8-43e0-4c37-828b-38e9ffd14414", "comment": "Malware payload", "value": "ed0a0b3f0e7a5c14d038a2c3703df2e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175748, "uuid": "bf023101-d285-4aee-afa8-9c56c819aa4a", "comment": "Malware payload", "value": "13d8f15d2f25cf2d1d71e640ec7ef45869b088639daacb9c2a1cf7b98530a310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175748, "uuid": "181558f4-db2e-45ba-b453-f5c6b536b829", "comment": "Malware payload", "value": "22640dc4ed564120616185327201ed9c6dfb432d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175748, "uuid": "b6b0281f-e5d0-4846-8ba1-c99a72fe4e1b", "comment": "Malware payload", "value": "1ea882724adeb9fe80130d7f778a4643998f733967aeed1fcb0f6cb5382c42bc3a1b55c901e95488dc7d0b5d37806ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175748, "uuid": "69ae8dcc-676d-4509-915e-7703dd9818f6", "value": "T1F022FA09ABD98332E4BE8B784C73934016B3FA169923CF9DACC8119E5C636459D41BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175748, "uuid": "bf62a3f3-51ca-45c2-989f-1edf9373dad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175748, "uuid": "19cc932a-9c47-41f1-befb-613770af22e5", "value": "192:h/v1jrEKRTxithgQ0eptLYZw6ClaOaC9XOlQy2uiS:Z+K2th90ezsZwBaOaC9XkQy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175748, "uuid": "2450c938-c436-4871-96ca-4c6c2111398b", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175748, "uuid": "1b021e2c-9003-476c-a0d4-8a014dc21537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175748, "uuid": "d664968c-8b47-4e00-88cb-d769946b8d2d", "value": "rCau__eJosefaFerragensLtda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1baf183-65ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1781193264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781193264, "uuid": "8efe4fef-eea9-44a8-894e-7da12ac70ed1", "comment": "Malware payload (Vjw0rm)", "value": "a2cefbde644417eae349cfbc6d40fcf7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781193264, "uuid": "86b8119d-9ed7-4197-afa2-f39b6b62642a", "comment": "Malware payload (Vjw0rm)", "value": "141c743c4d3f667a22bec9429efec6bd50966695c2df7046b625dd525a754558", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781193264, "uuid": "cbc44cc9-521d-47cd-9cbc-f5bbffb891b2", "comment": "Malware payload (Vjw0rm)", "value": "88c6221f7374e02b8362448ef394f451be61d7e3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781193264, "uuid": "b5214ae2-db65-4b22-8267-cce0d1e3e292", "comment": "Malware payload (Vjw0rm)", "value": "e3ca8098f874994ba8ef3148ec80270003081b3560f409c6ebf41d9da3bbf73f421eed0dc918e352cfead020e623015a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781193264, "uuid": "aaa9542c-a3c7-4dc0-b1e8-e77b31fdce47", "value": "T19F45067F1A881843F4592D8D863B006A96AD7D25021FB4937E5D4E2D361B93EC982FF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781193264, "uuid": "54a5db43-43b4-420a-a117-da7763142407", "value": "3072:tTbJDH0B6JfbnZ6abLec9sUeZT131OPwbV1Ap5Vomedlc6bH1ZWy0z64q8pM6e/C:tT9yLsLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781193264, "uuid": "3718b990-61f6-4880-8a77-190ec2a68d5b", "value": 1170834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781193264, "uuid": "c94c82ea-46d8-4e25-be3f-6966d0a9dd94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781193264, "uuid": "b83035ee-1b0f-4a6d-b6da-d6f08c58ec7c", "value": "notificacion judicial_F2CF0E_161A85.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4139af1-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180786, "uuid": "83a3b0dc-df26-4c0c-a679-7175e9aecc30", "comment": "Malware payload (Mirai)", "value": "14b76c478b351db13fb00d16a0cc2027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180786, "uuid": "4fa75156-e973-40ee-903a-1e3aa0ede8d1", "comment": "Malware payload (Mirai)", "value": "158065c86254c7391f04f6d1949dd2c32e78b3e7199a5f2ecc4ab09c7c977f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180786, "uuid": "369bd5af-c26c-4627-ae20-e8a5141d33fe", "comment": "Malware payload (Mirai)", "value": "7d389e5328be683fc834f705dd1070328368f4c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180786, "uuid": "2152621c-54e0-4809-8695-4481e608136b", "comment": "Malware payload (Mirai)", "value": "923f3901c56dc7198cb14075dee9d6847bd0f4dcb6edeed528e99ff6d6f572abc1b2908bd038658cb3fa56c501b5b805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180786, "uuid": "6bdc2b70-ba0c-432c-9bac-4627669cfd17", "value": "T15D631995B9A288ABC6C4177ABB1E9789335363F5C2EF3713C9140B51A2CE91F0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180786, "uuid": "972cac54-ac26-4d7a-b8f1-22b666c93392", "value": "768:Kn4Q0PLZY54EcUWrIUo/UGSJO0PnZ1v17ffAaabEeuoThmlYimb24bDlbQLWtfFX:K4QEZ8rWVoGJ9h1vBgRjuoVIP7ubKWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180786, "uuid": "df154fbe-8b96-4f25-b2ca-038c03b7f220", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180786, "uuid": "f9e967ac-83b5-41d8-9362-03da6d4e4253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180786, "uuid": "b30bbcbe-6b95-49ec-8d3f-468fc67327ae", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e09a07d-65b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781197848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197848, "uuid": "42f03686-d7ab-4420-aa5e-4e54d903a1bf", "comment": "Malware payload (Phorpiex)", "value": "537013864063eb458e47b3fcbbffbc8f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197848, "uuid": "b6dbe768-c217-461c-b83f-77dee762d8f3", "comment": "Malware payload (Phorpiex)", "value": "162a1c2e10796e24e94283907b9af34f7cbb9a38002e374afa715f7d101248fc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197848, "uuid": "625bf785-9b9b-4a05-a6e3-ec1add24a18f", "comment": "Malware payload (Phorpiex)", "value": "164493c98f5172618a090b336b9ddf41d90f5751", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197848, "uuid": "7d3bec4a-2588-4ee6-af07-1ee1160e376d", "comment": "Malware payload (Phorpiex)", "value": "a621b31b0865c77c2d86b84d686b75cb7a4c302ea559892e153732ad37539c11552ad28a6201842c5a91b67ad5bc26ca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197848, "uuid": "308fd193-5a69-4317-b7a4-7bf5554f14de", "value": "T1B1824A0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197848, "uuid": "887af522-b1df-4d3e-9d5e-ace97cc8152f", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197848, "uuid": "72cf7753-ce25-4db3-a8aa-3a58b0a10498", "value": "192:EKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSiu9zw+ghSpOgbO5qmEd/FN2GJxx:+0W/ytwEN/0bu9JgwHcoav8U9cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781197848, "uuid": "67d2dfbb-7932-4b7a-aea6-6e6d1256f8a3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781197848, "uuid": "35e531f1-0b7f-4c67-8f40-f1572f48f725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197848, "uuid": "32b9b0e5-d171-46bc-9608-5ec1bbcdccd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c6714-6582-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781174693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781174693, "uuid": "1a7135fd-5469-4a1a-88d9-88e11ef35b66", "comment": "Malware payload (Mirai)", "value": "7420a24c3c8aabd0dacb608aabc3f056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781174693, "uuid": "c7a74c8e-a5ff-4c5a-b45f-a10c525b6e17", "comment": "Malware payload (Mirai)", "value": "17cfb44d387b7e3c5fa621c6828501a93efb7052e443f6474c9fba961aed6061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781174693, "uuid": "4311738a-c554-421d-ab8b-95070c97f47b", "comment": "Malware payload (Mirai)", "value": "d032ad51de45ba48325971053d5401f1011160cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781174693, "uuid": "a506768b-aea5-4d40-838f-31a93ffb2bbb", "comment": "Malware payload (Mirai)", "value": "ee9780b5f835ffe550aef80c2acf8c4b8fe26fd61ce04cf87e01a8238a61ce3d0e56f6dc18140b2e25be9382d4ec584c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781174693, "uuid": "7b708c72-14f0-4767-a083-aa4c99c0f58d", "value": "T171157D47A2B374BDC057C43443ABDAB2A935B43502226EBB65C8D7303E27E701B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781174693, "uuid": "cc650d7f-a9ea-401f-9ffa-c41bc739b211", "value": "12288:uE/++JACr6e4s8tD/6kP6/tjZPLvsLvlb7K1c+zu+I5SoI0trXCdzuFacpJyJJZA:X24AU4shkP6lFL0LNb7K1c+C9I0tmhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781174693, "uuid": "1cb4a9f3-4da6-41f3-b26c-c24143eccc09", "value": 902344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781174693, "uuid": "c560e0b5-d8aa-4a22-8cbe-b37453669a7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781174693, "uuid": "bd428f71-36bb-41cc-9a99-7844d37e4c39", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23388e95-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146156, "uuid": "ede0c33d-c792-4d5b-aeb7-63c2b5899c52", "comment": "Malware payload (Gafgyt)", "value": "1d5a6774922fcbf11bfd099da0be2927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146156, "uuid": "0741da6d-9ccb-4fc7-af16-8f9a53556bf1", "comment": "Malware payload (Gafgyt)", "value": "18be43df55ff6bd73ba34df1fcb08132a40a98de1cc4365be335f4a1cdfed0d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146156, "uuid": "bcd36fc1-a9ae-4707-94cd-781b4a526c00", "comment": "Malware payload (Gafgyt)", "value": "17fbd5915f0be7d7f074a42c50153dd0d4bcee82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146156, "uuid": "27916e2d-c46c-478c-bf99-a0d43d0e072c", "comment": "Malware payload (Gafgyt)", "value": "755e614eefcd62345c71adb0aedce9b0bd117aca5b0109b8cf2fffada377855d4043e6c8340b33067c1b42ec7a2efaca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146156, "uuid": "af25c239-3553-4e65-b761-b960f76c5a5f", "value": "T1FCA35B03B6D18DFAC08BD1F047DF6A259D32F4FE166371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146156, "uuid": "b19774e7-399e-460b-934b-c843454dbafb", "value": "3072:9DOBvsEyGiQw2g2BkhP9HJkVX/9jJ3vQteQZCV:9DOzXfW2BkTpmBJ3vQtefV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146156, "uuid": "a3257439-f0e4-4d8f-9128-b60a1851a559", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146156, "uuid": "5b7aaa51-7a55-4144-9bb3-4f106081f0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146156, "uuid": "84fafbda-991d-4dcf-be3c-01a69785608d", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca0b2c9-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210677, "uuid": "75b2c399-708f-4d0e-adc4-1ec48a694f2e", "comment": "Malware payload (Mirai)", "value": "1e5d54782a0db7847b0d2f2481c59603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210677, "uuid": "6ffd6ef2-f3b2-4560-9b42-4ee3341ddce6", "comment": "Malware payload (Mirai)", "value": "1aff6e31c43bb8cf8b457d1b2444eaa8dbd6df82869663b5ba7b108996e935c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210677, "uuid": "83bea93e-62dd-4e05-8d69-26a7c358650d", "comment": "Malware payload (Mirai)", "value": "50255a1082beddb36871708295399732d98b743f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210677, "uuid": "b3ff4ddd-e967-4937-afa8-8cf509da7ace", "comment": "Malware payload (Mirai)", "value": "aa47e4393e134a08be2d513d845ce42b102518ed410a6f8316ed2f3bdfeb64b9c8b558b63d69b255d5baa1d87b1d0ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210677, "uuid": "1cebe33b-39b6-4bab-b73c-a6452706712c", "value": "T14264A51E7E21DF7FF668877447B7CA20969833D626E1D548E1ACD7081E2024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210677, "uuid": "ef05271b-80ff-4b2a-a582-954dca4d95e0", "value": "6144:Q7OizPwy1KRxss8UkP3v0Sjz3IsyuixpF1wUF:QCM1KRxLYb3R6UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210677, "uuid": "955d044c-17b3-4b53-bb12-c8990b59d5e8", "value": 319484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210677, "uuid": "2b3625b8-23b5-4b3b-af90-4fa84c77380c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210677, "uuid": "2646b8d5-0c06-4452-80b8-1da06faa9568", "value": "7d33f4e642e2687158f9476dbe6a4c5fcf757ad38301bdd99e3fa259addf8d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5884edd-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781221161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221161, "uuid": "16b04f0d-eec6-4bd1-ad34-82bc69c90fc5", "comment": "Malware payload", "value": "b784b910b92ca97fc848824a720c6da9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221161, "uuid": "c6ba41d8-6a51-4cf8-bb1a-5112664923f2", "comment": "Malware payload", "value": "1b608372bc5e07b9723c63f34c79a8709eb7adb73c5042bb412bdab94ede406c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221161, "uuid": "ce0a015c-cf6b-4c00-ab6b-4f3626564aab", "comment": "Malware payload", "value": "4c32fd69f2841568d4d062a0bd0b66221d1b0461", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221161, "uuid": "3410037a-fd39-4186-afce-07e4309a87b6", "comment": "Malware payload", "value": "5062a27c7ce782b27b931d1cc338b2695dd444b456d69010585158991a4349effc9efaf50a6f16279c59486dcdb37148", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221161, "uuid": "3d8c213d-6cd9-4e28-bed4-a25876593b79", "value": "T19111A8CB51D06332856DAE1DB45C86A4704B4BF2E4EA3A3DAFD42A1BC4C9715B054B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221161, "uuid": "715c7d8e-dff5-4341-8574-e0aa43c15adc", "value": "24:qyeivy5ytNISyPKEy1yJzfyrVyECy8yyACyT:qyeivy5y9yPxy1yJzfyrVyLy8yyACyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221161, "uuid": "d9a9ff07-7610-4ca9-9f01-c35c2f76dd59", "value": 913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221161, "uuid": "83c6fd80-0f3d-46f6-8e77-d9363b05106c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221161, "uuid": "b64f1c8f-a1d2-4f6c-adf1-8464021d9782", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9784e8d-65a2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781188606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188606, "uuid": "7d80e335-75f8-48b2-b626-d3a748592438", "comment": "Malware payload (PhantomStealer)", "value": "17fc597a566ef75dd7cd79cdc8f85159", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188606, "uuid": "bc2f2c42-6868-427f-816f-2af1ece232ba", "comment": "Malware payload (PhantomStealer)", "value": "1cc3b1bd2ad30186c900f4f5dd74cc67b958cf95e3132eda23efdaa12c67e50e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188606, "uuid": "20449b33-3922-433f-b023-49200e1b26d0", "comment": "Malware payload (PhantomStealer)", "value": "cc6f678f1458cea2e3929541be17523e401f26b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188606, "uuid": "ac849488-95af-4dcf-bb9a-78248835e590", "comment": "Malware payload (PhantomStealer)", "value": "0f67ade82a6347334d9425294cd71de178c27e91859b307ed8a6ba4f057bad0735a768a25ecd5f3ffcf51274e2688249", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188606, "uuid": "e0a338ec-e4b8-473d-a531-cd49e4e9c819", "value": "T1B3733DF8A3D8C48C46CD4D1E97A66F61583D19851C937A9F32760FEA801F7DB860BC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188606, "uuid": "70018917-d917-4564-941a-f08b3b93bb75", "value": "1536:cr5yqp2Atnge/JycCIYnP1O8wY1S5c8FUxWvKb0r6/n2wCs8SR+vW5KDDGmqcYEa:cr5yqp2Atnge/JycCIYnP1O8wY1S5c8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188606, "uuid": "d1527685-72f8-4f4c-bf17-9f743ca84ab3", "value": 74095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188606, "uuid": "cd75387d-21e6-4922-997a-ccee0f140ed2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188606, "uuid": "e8611a2c-f805-4bb0-ba19-6bd6ac654188", "value": "Customer Scanned TT Copy 927353663_11_06_2026_$53,800_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c329c777-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180784, "uuid": "51c6ff6e-4dee-427d-bfb6-0977f32687b5", "comment": "Malware payload (Mirai)", "value": "f90c41b17dbd091fca9977e9d6f30852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180784, "uuid": "60798531-8726-48dc-b311-2fe2f3ed9d10", "comment": "Malware payload (Mirai)", "value": "1d3032fd86fde8e97abf73b99b300adaab2d25338ce95968cc511063c4975784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180784, "uuid": "53bdc2bd-fd8b-4961-b57e-69b6194b2407", "comment": "Malware payload (Mirai)", "value": "3a29548b0c9421f6359008a1591f8b6d8963272f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180784, "uuid": "2b578d54-4b19-4ffd-8bd6-2682a8483a25", "comment": "Malware payload (Mirai)", "value": "8f7720f19af9bd2501d7fbe1ac763d6797c9672cfb8074ee047e9fdcfdb784229fa3297df4bacf1d290f7a0b02e327ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180784, "uuid": "e5ce5034-c8a0-498a-a916-e7063de0d6d5", "value": "T1C6C3B70E6E318F6DF769873447B38F21A79823D626E1D681D2ACD5111F6034E246FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180784, "uuid": "fb58d0f4-adb0-4252-9957-1959b92b9da7", "value": "1536:hp9fbzXshB8rKtOVvlK25zleV/7YNy1sj4q/SuGBK+eNxzlC7Fi:TaH8GclBmZ1sj4q/HGwlluFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180784, "uuid": "341fbe13-a958-4b8a-a20b-e7682fef2417", "value": 126764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180784, "uuid": "27a18aec-1fab-470d-bfc1-4a98381327c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180784, "uuid": "c6d4ac4c-cfbe-44f9-9e9c-e2c05fc8bbf5", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94572b5-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221248, "uuid": "df6766f5-578e-455c-b3e7-7e9ba5b71064", "comment": "Malware payload (Mirai)", "value": "d837fe2e63f5b9ac3ccfa7f4d6241e37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221248, "uuid": "405c5fcd-4f55-42b8-9fdf-19ffd53acf02", "comment": "Malware payload (Mirai)", "value": "1f172faa9eefd9daeb6d7c2b97f3d04c7187cd4dc7354de6d5e7b19c50078c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221248, "uuid": "baa5ac60-46e2-4533-bf7c-b3d02adce3cb", "comment": "Malware payload (Mirai)", "value": "4e336f94faa650f03b526fac61229897eefc4d95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221248, "uuid": "f380ec33-35af-43b2-8cf1-d36be5b5405a", "comment": "Malware payload (Mirai)", "value": "5cfa90e2a910dc4bddb2df2ea25b8e035f23c098d0c2842cf93f19747f38c723f41e5a7721a26e977c00a0fd361e270c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221248, "uuid": "9fd14829-50fe-4283-8c8e-f6d23181ff0b", "value": "T1DD235B31A93D1E17C0D0B47A22F74B45B2F1565E2AE88A6E3C330E8FFF2194499571B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221248, "uuid": "3e2e60c7-6cf5-489c-ba4d-2d7a49948d2a", "value": "768:mI6oxkM7B1ReOyTZBTRWfU1xoAH0cHNDpbm0O+IkiY:mI6EbAOyTZBTRWfU1xoAH0cjrwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221248, "uuid": "884ddc89-31c4-4a58-af78-6cf9aa56f9fe", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221248, "uuid": "f8846305-4885-4586-9496-32d4809f794b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221248, "uuid": "591555d0-773f-4dbd-ba23-b789a126c6ba", "value": "zoryn.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ee16a1-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207359, "uuid": "49f7d6c5-bb51-4e3b-9e85-b0ae8b8d0356", "comment": "Malware payload", "value": "85595ed6019bd775e6525254c9716e58", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207359, "uuid": "9821d20b-404f-43f5-b46d-f34d28179417", "comment": "Malware payload", "value": "1ffab3963314fc1219e5df9144160fdeabaeb0c29c57c9b1946877747deff5c1", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207359, "uuid": "70fae587-247c-449b-94a9-5f311ab8b40d", "comment": "Malware payload", "value": "0fe98ea24d1e2e7e3e693162c3e8e12d7dc44340", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207359, "uuid": "c0535dc0-a065-42c4-b734-ed2ddc05a28d", "comment": "Malware payload", "value": "915494194613433b0023921cf64735b157f499b6c854e03906883c02545de1103fd5ccbfcf17b9531db816d9062f62d0", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207359, "uuid": "e34c2c1e-cf73-40ef-81ea-e5995dfb4aa1", "value": "T1E5E1EEA7B2175977FA2943BFC287DAEA22FD7B306253071E065804082551D497D74B82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207359, "uuid": "01415271-4870-4ae6-aaad-53216cab90e7", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207359, "uuid": "d2abe72c-4047-4038-b238-16c63ac5a0e2", "value": "24:ev1GSkiiljE7h1oypFqknehtht6dp5raKq9KWZACILUujp:qkfjCay/nehthEdTE9JZAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207359, "uuid": "60a2a04f-8fc6-4e5f-9016-afd7c6e906d3", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207359, "uuid": "2a6a3018-3501-4ab5-b598-f1ff9424c233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207359, "uuid": "2d675065-527c-43b0-b27c-aae3aa8734d2", "value": "msf_adduser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1962fb9-6537-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781142610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142610, "uuid": "12722023-ccb2-43b8-8e0f-df0f8ade2e16", "comment": "Malware payload (Mirai)", "value": "fb73c9bfa76ff9c384885fb8f7ded904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142610, "uuid": "50c33835-b845-438f-8138-e0b0b4e582ce", "comment": "Malware payload (Mirai)", "value": "201ee7a369051b8d24affddffbd83830b36dcae033001d3ddb1738f134c4c0cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142610, "uuid": "e2c63e4e-e071-4ac5-b98d-d553f09bf4b0", "comment": "Malware payload (Mirai)", "value": "b20b3328e1fec502463873e2d09ed15d86e34030", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142610, "uuid": "cdc8199c-d290-441b-8251-74d6745bd0e0", "comment": "Malware payload (Mirai)", "value": "a3146c4d88a621578231e5959179d3af53e66ee65b8f8df689d582275a3c9b5a1cfe31271e04e538c2dc666ca85bfd8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142610, "uuid": "3cd17016-b76e-4d69-a7de-231a67f38a93", "value": "T14C0418C7F900DEBAF84AE33748134805B230B7A254915A376267357EED3F1981977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142610, "uuid": "f18d154b-5a71-4c77-8967-4ad8d4cca37a", "value": "3072:K7YeTvOAUIWT+ftyEDg23mpUmAJaaHzVLjbioLh5N9qsIDKB:KHCAcWyEk23mpMoaHhLHbkDKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142610, "uuid": "4e96a222-d732-4407-b86f-6b27588c91ea", "value": 173060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142610, "uuid": "b5fe74ad-7794-4d9f-b329-7e57fbcee4b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142610, "uuid": "d5f663a7-9c29-4023-805c-276d223ef9d5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda32fbf-6538-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781142979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142979, "uuid": "04fb3fa8-95a9-499d-a27a-f7c2e3610d1d", "comment": "Malware payload", "value": "bd47ff37740a4402365d83ebc5ac6862", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142979, "uuid": "33b9c598-ec6f-4125-b6db-00183aeb676c", "comment": "Malware payload", "value": "205a4ea62f3c91c22761c9ad92b6ce2810f27ebc6a44c60774b70e3886cee35d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142979, "uuid": "9ac95ed2-bc0f-42d2-929e-d9c14e11ee8d", "comment": "Malware payload", "value": "effc07a47a27af65c9ac875595f1e1484554d07e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142979, "uuid": "b3e5209c-84b6-4314-934b-f5dcf096b3fd", "comment": "Malware payload", "value": "311a485fded7d9557452879ab2501729ba6bcbc19998a0a63cb6b968d9f570cd9d9213dec9933f843d45d002ac81817b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142979, "uuid": "4692b7b5-6315-44b9-b1e4-6a63b0583e09", "value": "T1FE01ABCEC006D65080D6D46D32A75084B821C3CB2A469BE9BEAC583ECFB5B58B059FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142979, "uuid": "72205ffc-f909-401f-898e-eaff0eca5ea5", "value": "24:kXCKysE2hi0ziQvZohaG8OIXnSNlB3hjiX:e9Qp+MsG85XSrB3EX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142979, "uuid": "ae3b9183-53e5-4b07-a2cf-2e0b9bd822a8", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142979, "uuid": "c78dfb5a-ac93-4187-9882-64af11809a19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142979, "uuid": "dcc0dfa5-2ba3-4523-be3e-c8bf145ca748", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bdc1b2-65e2-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781215794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781215794, "uuid": "4b8b6d77-1ca2-470c-9226-0911cf258417", "comment": "Malware payload (CoinMiner)", "value": "b82f0b9989f316d6679e1ea067e31cdd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781215794, "uuid": "214e9899-20aa-4671-b076-09b9ce93c254", "comment": "Malware payload (CoinMiner)", "value": "20a1484577dc0b66613cc70619a74dfcaa7da6c19d0a4949cbc83a8e80317fd9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781215794, "uuid": "a1f9e3cf-87ba-4c34-a115-2ddcb3c86606", "comment": "Malware payload (CoinMiner)", "value": "213cd9fcf2377c5b72e02e4490863dc535bbe871", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781215794, "uuid": "685947bb-407b-456d-bf4c-b2b4b3ea97bc", "comment": "Malware payload (CoinMiner)", "value": "ca8b0068f8d740f97b7c56b4baefda4a76fd4b8295804e42fd6c134869cf1536e0819a1a8d1380e9602c9c54da315914", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781215794, "uuid": "29d2085c-736b-415d-81ae-aca768898c28", "value": "T19122072F7E450231E3A049B81176968F553D4633A387B3EBF3B3D5990B9A2489440EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781215794, "uuid": "bd3cd898-887f-4091-8fd6-ed31cc58ce6c", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781215794, "uuid": "d1137c59-ac16-435c-9c18-ab25ed6c7d56", "value": "192:gK5oJEWsKB6x+e+lgZPFJxTEZmFhSorcw32:x5oJEZw1yZPFwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781215794, "uuid": "07e97014-08f0-423d-85ff-52c84cd3e2e5", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781215794, "uuid": "746f16cc-600b-4e0c-a120-d7adf090482e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781215794, "uuid": "bdf7c3c0-810f-49e3-9bf2-bc12d18bd493", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93dec14-65a2-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781188579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188579, "uuid": "f37b7e2d-3fdc-48b9-be51-1c46739ba190", "comment": "Malware payload (PureLogsStealer)", "value": "7ac40ce10bdf9e9857df252361a55f53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188579, "uuid": "00aaf822-7396-42aa-b994-da706c65e65a", "comment": "Malware payload (PureLogsStealer)", "value": "2103f9166d9826bd3465d7f5b6c626cd9c8054e6b75d7b507abc096487bfd7c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188579, "uuid": "9dd65975-34d1-47b2-8c50-2db742a0165a", "comment": "Malware payload (PureLogsStealer)", "value": "1b95af542f61fad0747e10442dd87979aa1515d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188579, "uuid": "15cb66a0-3d13-42ba-b76e-c50c14d3d434", "comment": "Malware payload (PureLogsStealer)", "value": "7b1f47594ea131cf12e8ba8d7d60c0cb49058cf54f9f01ad3d4e0c53e77434ecdbd1280e83fae8c96424641a9087b0b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188579, "uuid": "e79a9403-0f25-4bf3-9b2f-5107259949bd", "value": "T148F4073DCC58412EE173DA29C499494FF8825A1B222CE90764C72B9BAF3394677C739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188579, "uuid": "c8cf7cb3-b3c0-4f60-a305-4f3cb5387bcc", "value": "3072:0psZZTkQhUVorSsBrU8hzF0mKv7uKC9Gq+cFx3NLPp8b6jr8OnUzHUdclfcvatlB:dFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188579, "uuid": "fdfe519c-8885-417c-b663-d9fe6eaee546", "value": 778030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188579, "uuid": "8d266334-2d83-4377-9eb6-74e9c9165d15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188579, "uuid": "b5db6781-ef6e-46f9-8cba-2df212ef5210", "value": "Fund Transfer Advice GMISI 11-06-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267482eb-656e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781165919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165919, "uuid": "f486f416-b7c3-41d9-a0ce-37d3002f14b4", "comment": "Malware payload", "value": "d94967b105474c3a616d7b370d9be91a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165919, "uuid": "f9c2c3ae-8266-4161-91ba-9189057c8995", "comment": "Malware payload", "value": "21526be81e0a5f9d744bb07c99849b47348ffb38cb0c58a27cc2041c593c3916", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165919, "uuid": "5df7f04a-2fdb-4369-a2ae-46397540f823", "comment": "Malware payload", "value": "a45b0e0f3b58c8219dd03dcbaa672aaa2200ec88", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165919, "uuid": "0bcfa0bc-5ef1-446a-af63-a9e1a18330d8", "comment": "Malware payload", "value": "21b4748df281b9c82bee8a05d168aa41de2800ad5329225417a46f9c0f7f23f6a84b253fb88f7aa0b8e45369bfba2014", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165919, "uuid": "21898057-6779-43be-87a6-d80633448a69", "value": "T11FC34E856F805BC77A4B15EBB5D7BC8C3B41067DC846B1C05A0D8FEBB8A7384652F84A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165919, "uuid": "833e0c59-2d5c-476e-9458-11f32f4e402b", "value": "384:vCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCeeeeeeeeeeo:9AUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165919, "uuid": "f328b359-532d-4e42-9558-0223657823e9", "value": 126178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165919, "uuid": "76482301-7f31-4890-a1b0-41f0ce56d5c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165919, "uuid": "4f4fe682-01cf-4bd3-bae1-3900251ae534", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691b3e05-653c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781144556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144556, "uuid": "49372d1f-a0e4-4529-9a51-e579ea03b8a3", "comment": "Malware payload", "value": "ec049f963c6444455f18254669518716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144556, "uuid": "81c136b4-8971-497c-98d6-375c0bfc1b80", "comment": "Malware payload", "value": "2210e580f9e0e99eca282e116cc5cafe3e0e4e1cc345d323ea3befd83ec57ea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144556, "uuid": "51902794-e953-4d46-a9cb-5d7f95eeb7d3", "comment": "Malware payload", "value": "fea5321c5746c0735f5792058b849f77f4ac93fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144556, "uuid": "58fd020d-e254-4f1a-bbbb-9003fe9e7ac2", "comment": "Malware payload", "value": "12ccc3705428cde3a354ed15ec3c7205102e10aaf3b96ed24e9b7f4884995cc26df98146cfab9f069dad5fabfb4da96c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144556, "uuid": "b11b395c-5560-4bcd-8ac2-dc9c06b460fc", "value": "T19524864A6E328F6DF678C73047F74A25D76D23D626E1D684D1ACC1042E2439EA41FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144556, "uuid": "3e6bc733-4563-48d6-9af1-7b7a7f871a2c", "value": "3072:TaOD6Cc2M6GZq0Us0ovTnZFAY8gnryZjEi67he+KKFo/:l6Cc2OTUKh1WGiazKKG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781144556, "uuid": "ab14974a-045e-49f3-8a17-f384a33b7146", "value": 218520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781144556, "uuid": "c62aaa92-789d-4f3f-923b-f26eb9fb11e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144556, "uuid": "2ad38855-c8ba-4860-b7f0-c8e802df5459", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff0efb-657c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781172275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172275, "uuid": "ea0e9580-3d77-4610-aab2-634ec5f2fddc", "comment": "Malware payload (Gh0stRAT)", "value": "eca2dadbf6a5df4c0c7e84c9999be924", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172275, "uuid": "2c16f79b-a17f-496d-ac63-f1e49660dffa", "comment": "Malware payload (Gh0stRAT)", "value": "258e579ba8eba614c77a415a4d68ef9a0b17917e4a9df8acafba9d935e49a434", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172275, "uuid": "a8267594-8a76-4415-9ff2-e3d19bc74ab6", "comment": "Malware payload (Gh0stRAT)", "value": "47fe779456dc8fa97665647b6d8af4e1fb614b2b", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172275, "uuid": "0b68e225-de64-4dd1-b19b-f1cc6fa9ba5b", "comment": "Malware payload (Gh0stRAT)", "value": "10fd8d78fae7dd12944f97762b6483b36c188c68a58f756437442c1e98b1afa43c1ede03087d901ee335d2bd3b8fa547", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172275, "uuid": "4a77e0ca-5e5a-4618-9144-405a187ede32", "value": "T16FD7333358FA8B12F5DB19414846A46501EDF2336BB8CEF0A64CD1DDA125BB2E0D978F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172275, "uuid": "c13f42d2-e0d4-43c3-a925-45b625b62346", "value": "1572864:Z6zv9K0cxgrpp+Iu9KBxN/+pTD7/gOvRcv3iThx9:Z6r9UMxN/yVpUm79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172275, "uuid": "e691b826-bf00-4202-95b6-8b4ea7539772", "value": 63357423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172275, "uuid": "236b7f51-f795-41fe-b159-3eb458b4abd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172275, "uuid": "25e779a8-32ac-42f9-8ddb-06104a17f9ff", "value": "testup-x64.6.71.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446fc5c0-6535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781141488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141488, "uuid": "89979313-677c-406b-a155-66e7636e8247", "comment": "Malware payload", "value": "a3003d99ff95076abb397465be48bc87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141488, "uuid": "3abd6538-d81e-48b0-a3cd-0bc0864f29fb", "comment": "Malware payload", "value": "25e3ac46ca9d6236933481284737c40ad15b6d96722f3f4b0d937f83ba90be69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141488, "uuid": "a28c6598-8d1e-4157-9770-f80bd53483bb", "comment": "Malware payload", "value": "c3e1fac2750903917030834ef9e678ac54b6a7bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141488, "uuid": "69e3df77-1a58-4679-bf36-79941849c742", "comment": "Malware payload", "value": "35465c1f6116097144285ea2f3afbdb9097649386666cd7380261dfd8d34ab6591ed0b5c9490632291e3d42179987fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141488, "uuid": "f9aa1dd4-1aa2-41ab-b80f-7b8f42aa6268", "value": "T1C1665B13EC9555E9C0AAE6308662D253BBB17C486B3123D36B50F3782F73BD06A79B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141488, "uuid": "dcb7b4f2-2c36-4ee0-a3f8-d5c1b637a785", "value": "49152:TsArVC86qTJwOI3NLaOAxFnR9TZBjJeNPy3fTZqJ4f9saFuG5RaFQb/mNE3rwFJV:TJw18TnR9UTJA9s+R0E76E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781141488, "uuid": "a6dee1f8-4e36-469a-a407-da1b4a4c7277", "value": 6492344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781141488, "uuid": "fa25d58e-5b92-470a-a789-d1ccd4c28bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141488, "uuid": "ff0958fd-e423-4958-a398-cd1ae546bd88", "value": "f2ca2b2051c2a98e23b80aab601369474006f6a6dd1dfb8f212f51a726b23dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e1acc0-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180787, "uuid": "6eceab6d-0ee8-4250-8ccc-14939a61eb63", "comment": "Malware payload (Mirai)", "value": "fc0f488152c0bb1188eaa63d95c1365f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180787, "uuid": "bba0202e-5b14-4c6e-8d54-e74fd14c21e9", "comment": "Malware payload (Mirai)", "value": "265652a0493d3542eda85763fee9a7d6ab9e1b10a4d83bb77a64b38ca9f8f117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180787, "uuid": "b5618171-c16e-4c1a-b419-0f4e80d53e81", "comment": "Malware payload (Mirai)", "value": "72b6293fc4f0605aee557a57eb7c5e197c3624e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180787, "uuid": "607afe93-ffb1-430f-b63f-614aaf8a0fa0", "comment": "Malware payload (Mirai)", "value": "1da0d6d6d9ad97d38e6f4d8148c422b80db453ff1b628b86f6f92330d87dc18e4f88b89ad04ecfc3e5f852ac3242e8fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180787, "uuid": "a536e12b-f690-4073-b22c-ba42a3556508", "value": "T12CA33B12B70C0A53E1530EF03A3F63D2C39A66E121F8F6897A4EAA45D2B1D365547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180787, "uuid": "510f0fb2-9d53-4f09-9c53-359b6fb57c70", "value": "1536:AW+7Qq/hufcDTyquCcKn6IK8aeHxQAv+K+rCgvODr+fq2DCd+:AHk8puCcKTVag+KqCDrC0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180787, "uuid": "5bc64a5f-27b6-4823-8052-df516592719a", "value": 97752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180787, "uuid": "15476cf2-3554-4279-b2d8-03c008459b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180787, "uuid": "78c19e8c-6c7e-4e18-943a-90c3207b61e1", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb53cb36-65af-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781194113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194113, "uuid": "a99cf69a-5669-40e2-88b5-7f32345ae4ca", "comment": "Malware payload (SilentNet)", "value": "f95a0a925faa8555f8772d05192c0ba9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194113, "uuid": "59eca72c-2deb-4240-a2a6-30040283960f", "comment": "Malware payload (SilentNet)", "value": "26599a4d2e4c7b9476a5077002d323ddb365dc55cdc0e6e63cb70b376811ff0a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194113, "uuid": "7ae7b84f-bb5d-426c-b62b-c9566edfbb5b", "comment": "Malware payload (SilentNet)", "value": "add0a9483a04904f40474927955c8f71f71db759", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194113, "uuid": "8c54213f-d5a3-4beb-9847-5b7311783241", "comment": "Malware payload (SilentNet)", "value": "6d1c2210ed314e48be09a53e68104e7145f98ed50333713d312acd96f0ecc0e828f14c5d4b2057282d6b382484ebeff8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194113, "uuid": "4895f875-20c5-47e6-8779-45a0ff3cc4ba", "value": "T1478302817673C657D6242831B6A1CE67D81B77BC9E8C286720F2D8354FE91BA0E06F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194113, "uuid": "bb994b60-b2e4-4ed8-b11a-5cf6f4ad9790", "value": "1536:iChktEv+q70Dl7+dtXX5iCTyTlFLLaJqQzcqeW8RtjxDRTGInR6urvQcpd:iZtE2qQDlSdtn5iCUncqgca8LVRJBQcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781194113, "uuid": "1ff32a01-3f76-4d94-b2a5-6a32380b54cf", "value": 88329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781194113, "uuid": "26e3ee74-ab08-4cc6-a79e-a23c12070c6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194113, "uuid": "d1083443-43ba-433a-a559-2180d0bb3a88", "value": "nebulaclient462773-4b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff878aeb-65ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781192912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192912, "uuid": "85b3feab-ea0d-470d-8c7d-dd56c7162fdf", "comment": "Malware payload", "value": "b72bee1701e9d3b920bf598312662ee6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192912, "uuid": "38362ffa-606f-4c42-a7fc-4d97baf3d347", "comment": "Malware payload", "value": "26ace1db104f81e53b9019e8fa08f6e7645e684d1629215dd36d3b887a44523a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192912, "uuid": "38f5ffe9-7377-475a-b630-90151083da66", "comment": "Malware payload", "value": "631e363a1396a57a476d7a0602a1e91212cf80a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192912, "uuid": "f28e53c0-3bda-4ec7-b150-d458a9b8ff95", "comment": "Malware payload", "value": "e4c2484d69c0c0d608ea0f63357d5df9c45aa1518a9894bf6afdeb94fc06f92fda3471353e7a18c66b1f40c273818d42", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192912, "uuid": "a67d98fc-0387-4d10-8833-5362ceaca2c3", "value": "T10D136C6526953C25AE99883B5C7E2F0CBDA983E2304491DDBF8B3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192912, "uuid": "f2bacfde-77e8-4419-8ba3-ce6743e2e3b8", "value": "768:zr9NyXsZztCG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:HHusZeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781192912, "uuid": "08048b2b-ba79-4db9-a47c-08aa646f4f59", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781192912, "uuid": "5a7e775d-d4c2-4a13-8ccb-8651ecb2ce91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192912, "uuid": "17deafd5-468e-4d18-aaaf-26563832c3d4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66519770-65bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781199527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199527, "uuid": "320cffb5-567f-44d7-9f1f-740a523f668f", "comment": "Malware payload (Gafgyt)", "value": "88b48fb5ba4000d940d9f69cd5ed9f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199527, "uuid": "1d3895c5-7b33-4ce6-bd3b-1ae0c0bff75a", "comment": "Malware payload (Gafgyt)", "value": "26b960f819948bda2faf9b2d5639353a9e89b98cefe17f7316463c3d188aa8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199527, "uuid": "f02857a3-638f-47b0-8268-489cf4e62277", "comment": "Malware payload (Gafgyt)", "value": "76248d785ac1b1759da774f35aaf6340d93e1668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199527, "uuid": "1c23e95f-d1da-411a-b924-88151d29683c", "comment": "Malware payload (Gafgyt)", "value": "5ef099e5b721d89fe11b5bf3ea5a6a49cf72bd09798a4c1e70026095c0f786f3106e3027526d5ecc6deb63df4360679a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199527, "uuid": "e4d9b9ef-ca83-49db-a274-7fb3e4761e46", "value": "T145B32A037B0E0B83D1573DF02A7F2BF1979AFEE215A0A184651EBDC062719B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199527, "uuid": "3ed580f3-3075-4b38-8640-6d4a5f559bae", "value": "3072:f9M+3fZWjBCkDL1s/2cPkyFGWQhu5h/kpLj:f9MeiL1u2p4GWN5h8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781199527, "uuid": "4c7fd06a-66e2-4eff-803c-53deb1ea1cb1", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781199527, "uuid": "c64ae9f2-56b3-4015-9440-2b11720ff149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199527, "uuid": "4d18fdd7-3ed1-4b69-b704-903b26bdee4b", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040802fa-659d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781186047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186047, "uuid": "2beb4761-daca-432a-a366-892f68067b46", "comment": "Malware payload (Mirai)", "value": "fb80c22ce03af8c0c423e701a254775c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186047, "uuid": "afc180b4-8519-41ba-bf33-62c534faeb8c", "comment": "Malware payload (Mirai)", "value": "26e761ec9fef441555f1ec1ce4df4edfe505a45aacebae978799cd9aa6e8d3d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186047, "uuid": "be0d45bd-45d6-4bf6-aa65-52299d8d3f2d", "comment": "Malware payload (Mirai)", "value": "27f524e79576fdcc3046dc457d4dd9ec81c445ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186047, "uuid": "4a2e9f20-c708-43c9-b8e2-800cb80a0b44", "comment": "Malware payload (Mirai)", "value": "864f8e350e9e66918f09b61b3394cce6cac986918558399bf0cf8fb81b33fb1c937e6ab1dfe358eca0bcd0e01620dbdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186047, "uuid": "6a4e748c-eae0-4a5d-a908-0d730174a9a3", "value": "T12EB33A56BD418F03C2C215F7FB9E428837176BB8D6EF3282E925BF60375A4D60E26590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186047, "uuid": "7ff51e69-7cbf-4aad-86e7-5bf4554cc5fa", "value": "1536:37WQkmPGv1a68erNtRUqFk3NWIxQxkCHDfNO8NChlw0fxMEUaMTvkw5hj3ppFD:3Ca680Rk9QVD6l35jD0t5hj3ppFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186047, "uuid": "0b65ca5e-5474-45a4-ad7b-57efd00f34af", "value": 107760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186047, "uuid": "4a32b8a2-7e53-498b-a05a-930b42657833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186047, "uuid": "2731834d-1638-44c0-941b-126df00f2d96", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5051984b-65da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781212374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212374, "uuid": "6a20a8df-ab3a-4927-a967-08a61f9e9b4c", "comment": "Malware payload", "value": "7c3f96f16f89e146f8747bc163f26efd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212374, "uuid": "e664d869-81a8-46c4-8302-6e63dc71dae6", "comment": "Malware payload", "value": "28cd473b26174f2859539298179f837ce4b3af93b07e425ca65e9ccc740c7c03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212374, "uuid": "1edc72b0-b2da-4719-ad56-cf0f9a612ba0", "comment": "Malware payload", "value": "951f8cddb85a461421abafc425d5ed7b864a0f7b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212374, "uuid": "36d30dfe-8694-4a0c-a70c-91a38b24b191", "comment": "Malware payload", "value": "90a16c1ef40a9bedbdd1521c540dfd969c56d3cdb6390f5ea0afc3e1ea46491cc747092df3fd096420a3b18d98a450f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212374, "uuid": "78e92f84-fa9e-416c-8279-8a0a59d5575f", "value": "T10C136D6526953C25AE99883B5C7E2F0CB9A983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212374, "uuid": "e1fa5884-b617-4e18-80b0-2b201503f11d", "value": "768:/r9NyXsZztCr9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:DHusZRco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781212374, "uuid": "0a02cd1c-cdf2-4960-8c7e-f2d08b0b18b0", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781212374, "uuid": "22ade275-8602-497e-a94a-47ccf0ad52d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212374, "uuid": "512f594c-5357-415a-aff9-3248af890ead", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae08c8e-6556-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781155833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155833, "uuid": "cde58301-5855-4cec-b5a6-b067f69ca21d", "comment": "Malware payload (Mirai)", "value": "70e1ac07d4eb4a4368fbfb80b340d747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155833, "uuid": "11f23e55-7723-40f2-a3c6-a1c2c7fd8a96", "comment": "Malware payload (Mirai)", "value": "2966cd4dc225c9a908804f3a110ac94b40500220cba6e8ec2cfda626adee9887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155833, "uuid": "071b789b-de50-4db7-84c4-bd85c3f68999", "comment": "Malware payload (Mirai)", "value": "51d4ef86d17809ca021894a400cec43fad242e42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155833, "uuid": "2505e41e-ff27-4743-9f59-d1ecc2b677af", "comment": "Malware payload (Mirai)", "value": "1ab1c7d7671f6139cfabde53c7200c061881239ea4d0105c0c7a155d2e9d1651283bde934b0a8c7f74d042ed7aff5758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155833, "uuid": "3a4501f9-ee6a-44ee-a52b-776595e6235c", "value": "T17DE34C56E6418B13C0D62779BADF42453323AB6493EB33069928BFF43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155833, "uuid": "493fd62e-ce3c-4fb1-85eb-ee6ae02bdc36", "value": "3072:yIUHDiOdUD3CSaOMXQfAmW54mZa5Tl5qibxtM/9mtczTnCy:yIUH2OdU+SaOMXQfAm247Dqib3M/9LPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781155833, "uuid": "6f3ae013-6927-4e50-8e98-526886599ac0", "value": 151241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781155833, "uuid": "d26fff6c-9a92-4b5a-822b-1b3ddb4227cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155833, "uuid": "538f35df-3dac-4a2b-8f56-7b423d417c50", "value": "kkk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33613e2-6573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781168410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168410, "uuid": "d1287b76-bf35-495f-932f-26be6b4cf88d", "comment": "Malware payload", "value": "1e979c8e949f5f56ed645f241a75c78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168410, "uuid": "44a5beb4-0190-4921-87da-e85887b9c98d", "comment": "Malware payload", "value": "2975c0e7fe42de6fd2985d4858bb4c686306eff53e5f205fb8de21b01123f9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168410, "uuid": "1f74f2d9-76e9-41b7-b757-d54b28293fdd", "comment": "Malware payload", "value": "5b67e5cf6a5b5964bb73f5b8b7531c69e0c8772a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168410, "uuid": "eea1170e-85ed-4ca2-a63e-5ad0535a902d", "comment": "Malware payload", "value": "58c8fd3e76e245ae45a5e1b05eae6eb6d3432b45c702c9efd4b87c4eb35137faa7a4316f78401535773ab755ce550cd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168410, "uuid": "3cb440de-4ca9-4813-881a-89bc1e1777ae", "value": "T130D733488E40AC4BED5CD13B47E19D55EA6B68192E834E8F23E406793FA7388457FE31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168410, "uuid": "af36254a-ab8a-41d3-94b0-140c27b3a8ba", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168410, "uuid": "adb9b702-0844-4f31-8e70-48f73ad5ada0", "value": "1572864:Yq+vWlM9ojCrD4WWJvKSc/JUNnzrn0oZHDq5LwKFodwa/:YNelKbDSc/iFz7DeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168410, "uuid": "c723cb18-cef4-4a21-b442-4ff78a4f72e7", "value": 63594033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168410, "uuid": "7378c347-0a08-416b-8334-bf1f06ddd590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168410, "uuid": "efe16b07-99a8-46a7-b0f0-e07bd5f51362", "value": "\u0411\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0440\u043e\u0431\u043b\u043e\u043a\u0441\u044b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f888c9db-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221247, "uuid": "7f07470f-ee7d-47d9-9142-54497de62bea", "comment": "Malware payload (Mirai)", "value": "16a1fb6ee583fac6b288e08e736a29ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221247, "uuid": "1083f7a0-b2bc-4792-9219-8392425d0458", "comment": "Malware payload (Mirai)", "value": "2a452f45c3fd85743084a37e9ff8872b5c07951d86d8a93132e97f1e6e9192fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221247, "uuid": "d0e18343-a717-43d0-b1c6-c247bc41f839", "comment": "Malware payload (Mirai)", "value": "62b6305820fc1fc3d4c9e87e9694a3c8af05beb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221247, "uuid": "b192c5f5-6d3f-4e87-bea1-b342159eefde", "comment": "Malware payload (Mirai)", "value": "587c023eebab38936ca48d0362b0b5427f6eca5a22f7f5bd3e8df126c82fa0d4ed9021f98ef10da41cd817e4463bec3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221247, "uuid": "701bf16e-9357-47c3-af15-02aa9b1ff07a", "value": "T13C230881BC819916CAE4137AF56E40CE332167DAE1EF73178D122F51738682F0DA7B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221247, "uuid": "f316bad4-dc62-474f-8c83-7e8308a9995c", "value": "768:TPNmHbwxZM39LrL/QYBfjvT1pG0sp5tndMiVKhrHHf5bcN9UBNCUcxT:rYHbwxZM3RVBf7T1s0srtnqiVwHHfBcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221247, "uuid": "05b7a3a3-fc6c-44d2-8e08-9d85b81481b8", "value": 45892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221247, "uuid": "fcef8871-961b-466a-8c13-d9d58eee6115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221247, "uuid": "aba161f1-20bb-4422-bd09-22a1b9b0ea23", "value": "zoryn.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e9fd78-65d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210216, "uuid": "6f8bea5d-437d-485f-9c8f-13b58508a762", "comment": "Malware payload (Mirai)", "value": "7334b9736f714923909a7c51deeb84a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210216, "uuid": "0b516229-c03a-4d3f-a6da-d53ba26b7a32", "comment": "Malware payload (Mirai)", "value": "2af30360ddc0af2335de6497debf18a159e2b5dce69a02e2474e058f12c01be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210216, "uuid": "1374fc04-fc06-44f7-a5b7-de708ab59f35", "comment": "Malware payload (Mirai)", "value": "a27087aa0d08bfadfe02a93a8589614b70594c99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210216, "uuid": "7320fbcb-becf-4d1d-a4d1-d2df58970ea8", "comment": "Malware payload (Mirai)", "value": "e19c358b1268ae31db513fe275bc9591a0e0981e0d0887eb4ec43b84d9c225d16780831d592220bef61f915aabaceab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210216, "uuid": "308f1171-09ea-444e-8ed4-00a849702ea1", "value": "T1F4C3AECBB24B5590C42106F01BC39F9E3F9362259D6FE8E72D1DA63B25765CB080A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210216, "uuid": "10bad1e7-f11b-4181-adf7-8d61656bd2d0", "value": "1536:e6WsylXraUkxF4umJ0g+JWE/Ao4j3G1v7v/NzlgOWEgTzR2b99gFvp/LWY:e+HUUWus0nBo7j21NlJWEAEb99gXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210216, "uuid": "8c30b15a-1416-46f5-953c-b9fec2ff046e", "value": 124080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210216, "uuid": "8b298b35-b737-4a3a-a1d0-d7535a543b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210216, "uuid": "b5afd23b-2d37-4a44-bd1a-140ff568287f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a0f3a2-6559-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781157191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157191, "uuid": "e1668ce6-01d0-4dd6-b0b9-5de8b825b311", "comment": "Malware payload (Prometei)", "value": "28b13229b0adbb3d06db4fc35b09dcd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157191, "uuid": "38dae22d-0b39-43e8-ab46-37f6a42ffee5", "comment": "Malware payload (Prometei)", "value": "2de823a92a3c9a49547be8df8cf686c8ee103ab4a6243fd1d7b765113286b854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157191, "uuid": "dd1b2b7a-7482-42fb-8d4d-4b1e280f4bf6", "comment": "Malware payload (Prometei)", "value": "b57382f52ea51827e51c145e5c0b3eecd305afb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157191, "uuid": "d790e2ac-47fd-4e2f-b711-5c8c6d418829", "comment": "Malware payload (Prometei)", "value": "b94280ed0935ae265a619e56a7bf6a86a03addaf93a74cb384207f499fe973cd342e50a113d32c6113db4d00fbf10b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157191, "uuid": "6992fe3f-3a49-40df-982a-64993a8a03bb", "value": "T1FFA423B4F9229E9F6DD76DB91B24831DE181C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157191, "uuid": "d64c6709-c20f-451a-9b15-3559b0bd39ff", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdE:Fs6pyCC/Ya2hpi6T6N4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157191, "uuid": "f18386db-92d4-4966-a0fd-1f45d6b20ab2", "value": 449086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157191, "uuid": "1c35c0b8-fc59-4942-a456-ec838fc00167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157191, "uuid": "a7c93050-332f-47ad-81bf-e060e8e6ecfc", "value": "2de823a92a3c9a49547be8df8cf686c8ee103ab4a6243fd1d7b765113286b854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc2627e-65d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781212046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212046, "uuid": "ffeed3b4-6f69-486d-806e-3340a251cda6", "comment": "Malware payload", "value": "713c7ea86f0f6138d2d70cea8a921393", "object_relation": "md5", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212046, "uuid": "2b46cd96-1b9d-48a9-85bd-c2cd515804ee", "comment": "Malware payload", "value": "2f7ea639407732dfdc8e9dc2de1eddff287a9934e244d11b060076ff4825f1c2", "object_relation": "sha256", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212046, "uuid": "fa197e4c-6ace-433c-9f62-1659af36a8e5", "comment": "Malware payload", "value": "bc9161f8915eff42130a023960fd444122455adb", "object_relation": "sha1", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781212046, "uuid": "25efc2da-09e8-468c-931b-052d953719d7", "comment": "Malware payload", "value": "20844263919c1fde0647bdd5a1eb01ae7cb32829b9cd26a5e53bf723eef2c45080701b23798e83705e5feb7abfed9a69", "object_relation": "sha3-384", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212046, "uuid": "bb52d0f9-ec48-4236-bb33-ceeb96a11539", "value": "T17A12EAF16238B4AE032149ED3FADC48C5980F5A6A04C4E28FD4C774987A72B155F77AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212046, "uuid": "6a0f5405-07f9-44fd-be0e-0c2128ad5015", "value": "192:3aqwBGjGNygwY/bmoOGYLpf0Sx8KDvq2TOaetdZEBqIGKgRBJ:3axBGjGNjwY/bLk9f0SxRDvTOaetdZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781212046, "uuid": "69d20cc9-4bbb-4250-8236-5d34cbb5c72a", "value": 9582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781212046, "uuid": "32498dcb-3835-492a-a1f6-b4daf3216188", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781212046, "uuid": "c4a03b42-24e6-4661-80b1-6864eb265cbf", "value": "952abcd7-56a6-429c-8360-c142a.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be04d667-65b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781195808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195808, "uuid": "34682eb0-9906-4903-9549-4be543bf421c", "comment": "Malware payload", "value": "7407b075c392d51aca735c243174fe63", "object_relation": "md5", "Tag": [ { "name": "Diamorphine", "colour": "#9D0E66", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195808, "uuid": "e902aa69-c90e-4e70-b433-44dfa01c1f9c", "comment": "Malware payload", "value": "344490c897c061b97dd4a443f995cc771f2d06611f1bfe231d2ca73631787bc6", "object_relation": "sha256", "Tag": [ { "name": "Diamorphine", "colour": "#9D0E66", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195808, "uuid": "12d8eaa9-a826-4227-837a-570a8789ef13", "comment": "Malware payload", "value": "721ab4ddb69fe996e676b0e5ef1f4272d512ab4e", "object_relation": "sha1", "Tag": [ { "name": "Diamorphine", "colour": "#9D0E66", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195808, "uuid": "4e937ba8-35e0-48b9-bc1f-dc0293ff60a3", "comment": "Malware payload", "value": "b7cf3a7ca8f6a996ab0c6c3bb8bf0f930948e81de6b9d18a1cd3172cd37a57cfa09df2e7f12c3c213f59faf4570b1bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Diamorphine", "colour": "#9D0E66", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195808, "uuid": "f118294a-9b68-46a5-96a2-eafe6ddf6782", "value": "T11B74490AEFE4EE1BCB8C423598F5573F3770C9895709A72781CC917A2CD33A85D2A885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195808, "uuid": "3ec49be7-2817-4bb8-80f0-ebd2510d74cf", "value": "3072:1rFkRN0opOf0LPAY0qXXcIAx8te74C56qvmLAnD4XmGcUZyLjMdG++vkp/dkGnDo:9F0Ot96e7l6qvmLU4WvuyLQdD+vkdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781195808, "uuid": "31726889-2065-4ec5-90df-f98c5930944a", "value": 362656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781195808, "uuid": "fdce3c1e-fc62-4612-9f12-234bc3fad546", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195808, "uuid": "29517e21-c263-4783-b9c2-06424e719c6c", "value": "bm.ko", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5544a03b-6599-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781184466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184466, "uuid": "def221da-0661-481f-b900-9e3b06977d38", "comment": "Malware payload (Formbook)", "value": "ff8024128354435dbe9676e8f0e89eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184466, "uuid": "9f2e4b0e-37e9-4aae-8204-384f1d9706b1", "comment": "Malware payload (Formbook)", "value": "34b0d10ee1f8927d630c9cfced038510a378f87e9908b6e6636f72ac9ee92a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184466, "uuid": "0a17ed9f-7239-4dde-b15e-b94579ead2cc", "comment": "Malware payload (Formbook)", "value": "3e1b278226a73db7d38497d3d8a827f246d53611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184466, "uuid": "42125b05-60f4-4c4a-a29d-deb301991ab6", "comment": "Malware payload (Formbook)", "value": "d17a62659b0818cbe24696c7bacb6d68a3b81506a490036d7b674bc932dccca14eb7ff537ee5015b42bfaa9d3aab6a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184466, "uuid": "00505587-b1c8-4213-9da4-fe4df6fea664", "value": "T1723502585A06D403DD41A7345A72F67E23BC5EEEB902D2239FDDBEEBBD769110C44082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184466, "uuid": "546b9935-f428-4948-ba81-7d6186c9b307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184466, "uuid": "322634c6-d338-4cb7-aed4-3ea0d94d1cc4", "value": "24576:tQ8YNML6tWXgjdXug9JhcHpbNGueGmHGiFm8ulIZjJ:u8YNWtwjd+k8beGOdFm9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184466, "uuid": "894cde4e-2549-40dc-a7c7-0004cd82a4c5", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184466, "uuid": "368c1d69-0c30-4c94-acf9-53f532909101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184466, "uuid": "45225110-da74-405f-983e-1f9e1bb506b2", "value": "ysTD_v11.7.4.6842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515f639a-65ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781192619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192619, "uuid": "7d9e393f-732d-4812-b65d-bac90fde6c81", "comment": "Malware payload (Gafgyt)", "value": "47ab8ba72d6159ff642b5ec8b5123c0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192619, "uuid": "a94f570d-20df-4171-ae08-641610b41ae2", "comment": "Malware payload (Gafgyt)", "value": "356bf3c803c094e98a62bf625d63fcdc57fbb88d30789ed6fade19deb7d54c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192619, "uuid": "d0a62671-48fb-4418-9cf4-cff19613de26", "comment": "Malware payload (Gafgyt)", "value": "c853de65259a0b530799ec6c62e5969905b5a9fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192619, "uuid": "08554e43-64bb-400c-befb-a9fe0194018e", "comment": "Malware payload (Gafgyt)", "value": "a480230eaa7610f8b1579d70f8885901c53898d65d1c5c1748b9b0c2f937bce09edf6c1b0fd420ffde37bdd2b3b07c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192619, "uuid": "49540ba3-abbe-457a-a709-34074d706ce3", "value": "T11BE3D706BF109EB7C81FDD3305F98B0124CCB49725A63B6B3674DA58BA5A58B05E3DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192619, "uuid": "3253aba1-0e6c-4efd-9608-517a26e59255", "value": "1536:QeHYPZXFZfqM97U6tdB3y02zxFE4ZpWzJIiOq75Hxq8pqEi5hspXhRE:3+JB3uz44KzThI8i5hspXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781192619, "uuid": "3347bbee-2341-4cf8-9f79-3b5fd52987bb", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781192619, "uuid": "b6eac3de-85d3-4a7f-a52c-f6d6e7ad6e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192619, "uuid": "8a9043de-3d03-4c53-afaa-cd37c754b8b7", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569a8fff-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210667, "uuid": "127578e3-97e1-4ae3-9b5f-4b03ff4a8e18", "comment": "Malware payload (Mirai)", "value": "e264e476c0b6a60a558ef188d875288c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210667, "uuid": "39c12604-63aa-4e73-a4e2-f32f0e647759", "comment": "Malware payload (Mirai)", "value": "35fadf514aeccbda7eaaef87c7680c08c09cc96ff10c940deaacaf7deafb60b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210667, "uuid": "273c0780-d779-416e-87ab-ac8ea723531a", "comment": "Malware payload (Mirai)", "value": "5d6f7407c12e45e38732d27ecebbf5dcc3861873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210667, "uuid": "0eaf06a2-ef95-42ec-b636-752a00393695", "comment": "Malware payload (Mirai)", "value": "670a4f40a5d60d9eab287e7cf58170b2f14aabe57a0d59b5813552ec4d376f728304d7f9b7ba4de28f7d33aff6936c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210667, "uuid": "47422d56-369d-4b37-a9da-9a783fee9bd7", "value": "T124D33873D835AF68C665D5B4B0319B7C2B8355A281871FAE94B7C3788087E8DF6053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210667, "uuid": "82107a9f-3547-41df-95c8-2f9bd2196b53", "value": "1536:MC2MAlXSaHzVsCto67nXzK6C1wJsf7pKPMVXIYsW2M2BIFXu3lf5jqBT7:YHJ1nXvgwJ+7QPAsWF2MX4jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210667, "uuid": "88e06c1d-0832-4b3d-9aa9-71f3b1589170", "value": 139180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210667, "uuid": "8c124924-dfcd-477e-b285-a5e2558c50eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210667, "uuid": "72ea4719-4307-4b09-b72c-3cafe2a0976f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f026cf34-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210925, "uuid": "851efe9c-2d3f-4b8f-aa59-d2fa6760323f", "comment": "Malware payload (Mirai)", "value": "2c8bd65b3b3bedc5122864fdadf64e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210925, "uuid": "1a211df3-0312-4e44-8060-7696e39738c4", "comment": "Malware payload (Mirai)", "value": "3660122704d06d191d55552f46f0bf60660f2cdb15a2704150f9cd1de96c414a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210925, "uuid": "1df91971-ee43-41ae-ab77-960ca698d63b", "comment": "Malware payload (Mirai)", "value": "e20ee7eb2ef253c39cfe01cfe033afc10bf18e4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210925, "uuid": "7545086a-2f3d-490a-9964-533f63ab940a", "comment": "Malware payload (Mirai)", "value": "e050f492b86e7fbd8f3e20af0524d7ee9c3caa2c877007c0bca6b8599e99e5903d9ae6d2a5bc8330746f69f6480c950a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210925, "uuid": "5cb1c747-312d-41d7-a209-0c9837c262ec", "value": "T121635AC5F543D4F5E96705344137EB7B9A32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210925, "uuid": "998af2d4-4d59-4e59-a76a-c9b20d528a36", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPq:zGYxpTGASC4XTfyyLpIoYPsPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210925, "uuid": "465dd8be-560f-4ce2-b2bb-6181a7ba30fd", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210925, "uuid": "1efc6061-4587-4ce7-92b5-c61b8880fe6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210925, "uuid": "b65b3572-351c-4e6b-be49-482b751c4cbe", "value": "3660122704d06d191d55552f46f0bf60660f2cdb15a2704150f9cd1de96c414a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287c8bc6-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146165, "uuid": "bd2e731c-6520-40d6-a371-bee957f2bb28", "comment": "Malware payload (Gafgyt)", "value": "2b44d6f1567aeec86e8a6a2372a7a4f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146165, "uuid": "56460861-d29f-44c1-9efa-60d6caa58897", "comment": "Malware payload (Gafgyt)", "value": "3704c29dbde14a3daa1c739197e4c0ae5ebbf91594f686a1be3dbaf5a95ff00d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146165, "uuid": "9d41db14-20bb-4f5d-9b5d-430bce0e709c", "comment": "Malware payload (Gafgyt)", "value": "c344cbbb6cdb782a60fb2b5642acb680a544498d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146165, "uuid": "0eea64e7-1e22-4c31-b3d1-aec88ae11896", "comment": "Malware payload (Gafgyt)", "value": "dd75256872ef8ddf0217eaba679c1b1f87804a5ea491428b515778db24136ad71d2d27ab8feffaef56827fe23ad66e78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146165, "uuid": "a9dd6e02-b490-4afb-87cc-e5bd31ca2cbb", "value": "T1C3B30997F801DEBBF40BA67600A708157130BBF60E931672B2667997EE761D12833F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146165, "uuid": "bc48fd3c-7a43-4e0a-9a5d-73b2a4500fde", "value": "3072:8l6ZoUl+fZV8yTd0+kU9ZjFILNOxsJ3MZC91:S6S86wyTq+kU9hgnJ3f91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146165, "uuid": "5fcd930c-49ab-482b-9ef9-7bc9bf204661", "value": 114596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146165, "uuid": "5a57db16-bf18-4fad-952a-709efff61241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146165, "uuid": "d48b4ac9-0d94-4022-9246-efc8798f18ec", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac57d7f5-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206945, "uuid": "4e09973a-7127-4623-985e-a4fbd53c28b7", "comment": "Malware payload", "value": "14ed904ddb91d57486701d358f42662b", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206945, "uuid": "9d8f09be-fd6a-4768-8cdd-985f7b9dbfb8", "comment": "Malware payload", "value": "3797febd957d9393acc9fe6d2a6c6f99d1cef6e811dfc9e2a38ab2870d54deeb", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206945, "uuid": "a27a036a-dbbf-49bb-912c-65a1ac0f5417", "comment": "Malware payload", "value": "7dd14357f6befc797056747102e626151beaddae", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206945, "uuid": "a59c4722-faaf-4e7b-97e4-1e5275868f30", "comment": "Malware payload", "value": "f36583b4cf85c4890b9f54848c49d78b5f50899f6341dcfdef4091df4a5a707a9552b9b641fcc2092ec9958210a73a59", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206945, "uuid": "dab0fe1c-cc29-4eb6-9620-527045c020ec", "value": "T1D622B581AFE85650E8BE0B7CA8F253001334F1458B36DB5F0EF4609E6DB3655A67371A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206945, "uuid": "6c98c6fc-d33f-4ae7-adef-48c22f57eb67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206945, "uuid": "0817a32d-eb36-4ee6-b534-41e30bb5f7e7", "value": "192:L3t5W0B+3fTtJVnXF70XVnHksuc4/5DnJII:LLWhTtjXFonHBuc4hDJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206945, "uuid": "8f9fb5c1-239e-4887-b523-2785e95a0a18", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206945, "uuid": "d58f47e9-1089-4ba9-92c3-b86e319df0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206945, "uuid": "bedeb2e4-a96a-464e-a7c6-f21a9f97b3a7", "value": "efs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26d561f-6583-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175173, "uuid": "efdab04d-f138-4ea4-9b34-bb8f66ac559b", "comment": "Malware payload (Mirai)", "value": "454b38cf93a6c820bfe4d985cdfb2c56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175173, "uuid": "53237498-58aa-4621-a9bd-efef835381d9", "comment": "Malware payload (Mirai)", "value": "38f0ec2e4d637fec1573bf41312b3bb09d3fd02ea4c8daf9247d2f24b01a83a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175173, "uuid": "23dfa54e-aed4-4e6c-95b8-31613eefe188", "comment": "Malware payload (Mirai)", "value": "d4918fdf8602012d60579fd42804a01a22633e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175173, "uuid": "4252e474-21d9-40b2-9277-030d9c161f55", "comment": "Malware payload (Mirai)", "value": "6cb9d996651fd1a4585050d74a6945659baa2b2cbb0d6a02d3b14e047eb80f5299c6413ba53d07a1df00cbf241bad32a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175173, "uuid": "ee2eb1b7-6fd0-404e-9c05-c2223b284765", "value": "T139935A1379C1C4FCC849D23457AFA236D962F02E2236B15B63C4FF26BD8DE502B6A594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175173, "uuid": "f9000ba5-1210-4312-bac6-52cd9b9c7ce1", "value": "1536:5NIDojOaSSKT/2o9HLPf8+fCQ1d9qxQkKZWl2b7gOs3z:5NIsjnWTe4X8+/1dwx4ZWl2YOs3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175173, "uuid": "99dd8325-1769-4e12-b6ad-5e71b8828aae", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175173, "uuid": "5c793e2f-90b3-482d-947d-e0579f6a7c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175173, "uuid": "e3273d8c-6987-4472-8875-8d505858f816", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d10586-653c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781144557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144557, "uuid": "d3851738-603e-4f22-a179-ed660ccf2d5c", "comment": "Malware payload", "value": "8809cf19b13b807a6b3e43ccd2bbbf88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144557, "uuid": "13d18438-4be6-44a4-883d-50543c988189", "comment": "Malware payload", "value": "3af6915cf2ed50ffb9fcf102eadfc0acd61b25467d63d90af8ff25ae0b4c1cea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144557, "uuid": "6a199774-9afc-4fd9-851c-87c02aad54f4", "comment": "Malware payload", "value": "4db841465df247bedaceeeacf6a1e5d862dd177b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144557, "uuid": "9a346077-0a6b-4aff-806a-9ac4806a411c", "comment": "Malware payload", "value": "1835ad41925414cfc4ee336101f045ee9ea93a4c795ae3e47d39a28359be2cc4460d2631b78a2f485568a12a927ec9ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144557, "uuid": "6c0f8950-da33-4bfd-aa62-fc08f5ab8412", "value": "T11201AFCEC102DB6041A5E49E73DB25847520C3CB16494FB8BE8C443DDBF9709B16AF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144557, "uuid": "c628e797-c10e-45d8-bbc4-990f69db5b1b", "value": "24:kXCKysE2hi0ziQvZohae8g39oHW8WPueQ97:e9Qp+Msb+9oHW87eG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781144557, "uuid": "94414c23-5e41-40b7-b83f-9f68d73ec897", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781144557, "uuid": "807a79c7-2719-4b8c-9a5e-a677951d8374", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144557, "uuid": "21cee16f-f7cd-4684-8062-fcaebc8d0427", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256afcab-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146160, "uuid": "9dd2cd11-cb54-48e5-9033-bb847e7846b1", "comment": "Malware payload (Gafgyt)", "value": "ac8eb91aca5c16eec6b8d2b3a803ddc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146160, "uuid": "25938dfd-17f4-430b-8e70-5135bba7010e", "comment": "Malware payload (Gafgyt)", "value": "3b02909d869aa642bc90ed51a9b45331d49bd66316a96e41ff63d75a1bffdc96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146160, "uuid": "e795419b-ea6d-494b-b790-533cc13af399", "comment": "Malware payload (Gafgyt)", "value": "5d0a8c264f3ca91cfc2fe352291b00776ef5d6ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146160, "uuid": "25847c95-8ca6-4454-ae3f-4efb3e1db5c9", "comment": "Malware payload (Gafgyt)", "value": "b5e923fa0d99baa7277f883fc0995dd5e4b16fbf86f4964bc8b35961aed1d2e6d0710c3fc8194c6f922cfcff425565ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146160, "uuid": "bfc08a99-ed23-4e76-b30e-0ee48e5e353c", "value": "T180B32A17B9528B12C1C215B5FB4E964976136BFCE3EF3212C9249F603B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146160, "uuid": "0f779517-4c43-458b-8e1f-8f6de26bdb56", "value": "1536:KLnB+N4MiIGsL8jUQh5sl+aranNTffIpP1MfirfA6RJZPHjRS5SY45h0pQBAr:HtJLEr7GaNz6fA6RJZPHjwwN5h0pQCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146160, "uuid": "ad3df1b9-2c5a-4198-ae08-efc30d5ea334", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146160, "uuid": "7541802c-7fd2-4dcd-9504-f75da2af6aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146160, "uuid": "44d4a431-5819-4446-8eca-4d1f416ffcbc", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491b4a8d-6596-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781183157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183157, "uuid": "ce838520-dca0-4695-80dd-0d25afc5d34a", "comment": "Malware payload", "value": "6d42715a4eb19401fdd33ff0acd80791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183157, "uuid": "254ca52d-c12d-4a5b-992f-45de23c182e1", "comment": "Malware payload", "value": "3c95762a22eea37c1315deb178799be74a703fe2702a3248ba9942010d99a5f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183157, "uuid": "36b4efcf-1ab7-40fc-b420-2de6f0e409f4", "comment": "Malware payload", "value": "176d7a4f500219638e289b3321b7e0f06ea379e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183157, "uuid": "d6ef8aac-6849-4ff3-8e13-a96f041ad42d", "comment": "Malware payload", "value": "c425cbd4c5a139da9cd85af531c667cb5bab06de2360828c1efc08c002ad2d838f641839dd6e78fa925ac4ccfff95203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183157, "uuid": "ea44fd74-ede0-48bb-9dba-3cb35ae74531", "value": "T12922E804BBE88335E4BF8B785C7343155673F6029932DF9CAC88259E5D62740CD92BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183157, "uuid": "49b12b41-5ac6-4be4-b660-34c381ef55c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183157, "uuid": "2ed3201a-adcc-481e-bf86-c359342d1ea2", "value": "192:LpLj1lbJUjy7jI3chwLYZw6KaOaC9ostGPy2M:1vJU8hwsZwraOaC9o7PyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781183157, "uuid": "c315d582-cdcd-4ad0-91f8-e5c8811790f0", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781183157, "uuid": "e968e4bf-1ffa-4e2d-b9d8-d2c4925b1117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183157, "uuid": "5e553a99-5642-407e-bf4c-72e95c44b8fa", "value": "rEduardaeMateusComerciodeBebidasME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6455cad0-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1781206825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206825, "uuid": "edf63a92-c938-4f53-8fb0-a125a2b32ee6", "comment": "Malware payload (FRP)", "value": "92bc3b1ba378c14e601c4e617ec7c422", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206825, "uuid": "6cb7a843-93b9-4400-a07a-ea753c49a43f", "comment": "Malware payload (FRP)", "value": "3d008cb4d346a95396868f786ec6d4fe7e12a0451768f957664abba7469f2cf0", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206825, "uuid": "43f2a34f-fb1d-45e0-8cff-fda7ad1838ca", "comment": "Malware payload (FRP)", "value": "e7026b2f6adadbf070e9926e1d4b79a65044cd5c", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206825, "uuid": "69c61073-50f7-4204-9311-71e408874fb7", "comment": "Malware payload (FRP)", "value": "f29d23e2bd6136d48698611d7e541f554157ab760768dca490252bdbb0baf22611d30c246e60193a0ce8bf88a0b5c7b5", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206825, "uuid": "b97ef263-bf75-402a-9cde-e319d10643cb", "value": "T1C01633E63F047DF6F2A9F538905A864B4960B03D666EB8114CC698F9AF5BF1A3C31D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206825, "uuid": "fecaf176-ed52-4321-be45-6fb0528a2679", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206825, "uuid": "e08e7782-33e8-4154-9a56-9f6c71551267", "value": "98304:ypbEi1zBxK+cGLc5GEVZlCgmOXRwleAwywSmsMeGU2wHwNc:ypbECiHDGEpgOh6eAbwSceGU2mwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206825, "uuid": "c243ab8c-56e1-46bb-ab51-feba100a9c09", "value": 4410880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206825, "uuid": "dd9ef0e2-ecc8-4824-9594-52112ab33d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206825, "uuid": "d0ad9d0b-7b6b-44da-b5e7-3449828bccd2", "value": "_frpc_upx_small.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e1f050-65db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781213033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213033, "uuid": "f57591b1-db45-4f91-9305-cd4b3dd5c1fb", "comment": "Malware payload (Mirai)", "value": "6232ff32036fc3dcf1bde2c25fd29393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213033, "uuid": "68e4170e-95da-4653-bd6c-317cb18438a2", "comment": "Malware payload (Mirai)", "value": "3e61bab436d9859762a3bd2c54eef39a123bc2489096325a027d43859dd52940", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213033, "uuid": "1385a4e2-983f-47a1-9682-d80c9073913b", "comment": "Malware payload (Mirai)", "value": "68ae57b0685408096cb4da373e1b73830cd3596f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213033, "uuid": "10e45759-adbc-47cb-b73e-61a1f9a8e7a2", "comment": "Malware payload (Mirai)", "value": "f762a28f637c3b22d57b5be09977ebf7b6e57b6689cc02f65595a16918647e65a557b682f65067db0cf00392c924d902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213033, "uuid": "9ce9a1b3-7bd6-43c8-acfb-bc6f619460c3", "value": "T1FBA33863CC262F58D664D5B4B0B28FBD1B93996081475FBE1977C2748083D8DF98A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213033, "uuid": "04be7971-023b-4e2c-b472-d36df24ebbf7", "value": "1536:r/aMtaac+ClPK4Q1T7Bs6Z6mSdvk+qPt4WJ/LeMWZicd:uK3c+R4av0mSNXS4WxLebpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781213033, "uuid": "f3dc0a6f-9277-4b29-890d-a81c97dac572", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781213033, "uuid": "0fbfde3f-17f4-40dc-9cf3-f3bc5c9acd53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213033, "uuid": "40e8b6a2-fc69-444d-adef-0a2dff4f6419", "value": ".Sassy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204144d3-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146151, "uuid": "2cd330e2-bdde-414c-a939-994b8b7a7a37", "comment": "Malware payload (Gafgyt)", "value": "b9f0460d9efe73b1e17181745fe606f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146151, "uuid": "706d450b-54be-4345-8356-e61165d849ed", "comment": "Malware payload (Gafgyt)", "value": "3e85e94ea0fc1e9eb741c123cdbff847ca194a6964e611acb715f22dc705298b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146151, "uuid": "e9258262-bc19-4a56-b3d1-008edb4f0b7d", "comment": "Malware payload (Gafgyt)", "value": "b87d1db4eb9242207639492c2b7af282c15db36d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146151, "uuid": "867d10a5-8e53-4717-b3d9-d050d46cd759", "comment": "Malware payload (Gafgyt)", "value": "b3f15031688f8dc7ea9c52babe62b250413e4536b9ed9627692bf52d26e78ffe6ea7dde3d387c26e6a26a0f8e1802f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146151, "uuid": "66231317-ee34-4a21-8df3-c870199cc72c", "value": "T175A32A26BD018F53C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146151, "uuid": "abc82d9e-7314-43a2-8dfa-56b35316cffa", "value": "1536:LqusRrjLj9Yw0FapnidqFR9K91fCL8r/OQ/WeUyNj4qG739y5hdppNq:Lqdh/99WYfY9e895d4XbM5hdppNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146151, "uuid": "08167d78-4d9e-4a27-9338-0e6de2fed4c8", "value": 104272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146151, "uuid": "aa2855ce-26a5-4ecf-a461-95e318e316ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146151, "uuid": "dd216982-5f6f-4bfe-9130-d584338a4139", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef9595c-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207084, "uuid": "8ef81568-80f0-4860-9615-ca97224819b3", "comment": "Malware payload", "value": "0df92bdfdbe2065ab61aaf623d81e1dd", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207084, "uuid": "a9bf4747-e20c-4b6a-9451-78e57fb8e8d5", "comment": "Malware payload", "value": "3ee1a6abde5257493030f4f4a3e833581c68080dac16ab098c9308106546752a", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207084, "uuid": "8732ec41-4c0a-4659-bf71-102c64326652", "comment": "Malware payload", "value": "6109d89119a359088e94476afab934753f5e0628", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207084, "uuid": "cea4a3e9-be4e-4f21-8e82-9f4c983715ed", "comment": "Malware payload", "value": "d60d317ae3937969cfb91579af642caecaac589081361096c36990c5b4c42e9e4e44b6763b1379a521e71a455d65b96c", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207084, "uuid": "8b922942-20ee-4bdc-93d2-85cae1426538", "value": "T1B24633D19A3083B0FB187FBAED56582B02ACC8CB2BD057567C15A5402BF3BD156F8B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207084, "uuid": "6b5e0e06-d84f-49f0-b352-dd26ae7d28ec", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207084, "uuid": "b9fd08c4-eee1-4f18-884a-15eb85aae995", "value": "98304:y7ne30VK44HZa9mnWVNMk7qVVv2NgZ2vW5258jOLrD1OljIRCzXW1tZB:y7qomWVukYVv2N/O5diwvzX+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207084, "uuid": "af61931e-2deb-4c55-9f5d-2985626d6c32", "value": 5764608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207084, "uuid": "d2f750f3-65d7-4961-8d5c-eb946fb8a8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207084, "uuid": "adf519a7-a25a-47fd-804f-089ce642423a", "value": "frpc_upx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e178e051-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186419, "uuid": "7775a7fb-a04f-4674-acb9-b2ade13780ed", "comment": "Malware payload", "value": "7b99a8259ae279f414a57b9b3186f925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186419, "uuid": "801a9e02-6260-490f-ada1-6063ac2f39d8", "comment": "Malware payload", "value": "3f0a96fbd919f224abb19e33ec9a75a71b0a706ed484f79f150c3ec7c18044d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186419, "uuid": "ba2f9609-66e8-4b72-b775-07039274adf8", "comment": "Malware payload", "value": "6fa11d0122ddaa90728a5605fb68e5cfa0e380ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186419, "uuid": "62b40008-c6a7-415a-9dc4-918408deeabd", "comment": "Malware payload", "value": "a0fd2c2cbec4275348ff367dd90cfde2f15807770a377ee6eedc8d30cc1ae08d772f941cf4eb8dea3f8041a3afe2535a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186419, "uuid": "58ebaf13-d1df-4795-b1c4-30578a4d7cfe", "value": "T16E22F804BBE98635E4BE8B384C7393545272F6059933DF9E5CC821DE9C326418D81BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186419, "uuid": "4e5e1675-75a7-4408-a446-53d37261e652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186419, "uuid": "4db40610-4d3a-424c-8495-4cc4d528c499", "value": "192:CfPo+nT7Y+NEzxq2vilZwULYZw6NaOaC9prjCfy2i0Wk0:coX+IxJvu+UsZwEaOaC9prefy7Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186419, "uuid": "6a368bcc-c38f-4752-81f1-73681a683b26", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186419, "uuid": "d0182baf-1054-4543-85be-ce82e679f0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186419, "uuid": "0491a319-6089-44b9-841c-b076a656104f", "value": "rRafaelaLet__ciaVieira.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa3d31f-652a-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781136862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781136862, "uuid": "4ab5981c-d0b7-4752-a0e3-019b7c83ea5a", "comment": "Malware payload (PureLogsStealer)", "value": "11272a39bd59cf14ed9e4757e9259c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781136862, "uuid": "4bd13c01-7aa3-4985-a19f-cea403e82203", "comment": "Malware payload (PureLogsStealer)", "value": "3ffcc57ec8c236ae9a7b8ab7de9bf0e5c4f2e29e6c9266b383cc845262b1c3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781136862, "uuid": "7780f2e1-c111-4847-97ea-bdf6177351ad", "comment": "Malware payload (PureLogsStealer)", "value": "6aac139484de6a3748e336fa8d1b3a0edc527684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781136862, "uuid": "2dc18114-66e8-4045-9953-149f928a2dc1", "comment": "Malware payload (PureLogsStealer)", "value": "3bff9dc64ea7ae94be9a15e23d550d94f807e75d800e78ef5a35645074065c799dfbf263e3db934a98c7facfbe9fbd35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781136862, "uuid": "5a468853-7981-4f25-9cb3-6aacfde52be2", "value": "T1D6F4CF5B33568E21D2841732C2DB550187E165877A7BE30E7A8513CA2E033BBEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781136862, "uuid": "9025b9ed-716a-4d66-8d1d-0fc38a86abab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781136862, "uuid": "96984c8e-8a1b-4b73-8ca9-65cf01c0fd10", "value": "12288:pkpspoB14LRL7HfB+bOAJzOYQkRrWQ3Ji5sTDPmIiBNRe59JXtSJaB7:pkERL7HfB+blzOYRRP3QY6xN8tSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781136862, "uuid": "11966622-d3e7-4624-be75-24e091efec18", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781136862, "uuid": "0fd1db53-8cd0-40d8-9ee8-9e192a5a021a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781136862, "uuid": "f36c12dd-9bab-4b67-869b-d0835eed9bfb", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.77783859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a5ab7d-6530-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1781139398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139398, "uuid": "9e321038-ca0c-4f2d-9037-b419175bbe7f", "comment": "Malware payload (SantaStealer)", "value": "be46d26694aee342a8067c62424144d6", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139398, "uuid": "e884b86e-7f63-4bc5-b1e1-702234d19876", "comment": "Malware payload (SantaStealer)", "value": "402d2be2a5186e3f8c035551695099c60b28d092969cc72bd9c7360453f8d63e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139398, "uuid": "9933a5e0-0f17-4ea7-8292-0ec17499d674", "comment": "Malware payload (SantaStealer)", "value": "f6e5d7cf1516840cc5ec320dbd7e71b00504f281", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139398, "uuid": "0dbaa5c6-c8c0-4230-b3ef-4da6e4e838f3", "comment": "Malware payload (SantaStealer)", "value": "e34fb39ebdcc7c4a092c5d21dcb89423e974c24476092e61b34c765dad3c81764cb9a8b1dc1ccf85ac87b41d473838b1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139398, "uuid": "9612b20f-5bcd-4556-b0d4-f06ea924f607", "value": "T1671623542608E607CE205BB92AB0FB7817BC1DD9B002D6145FE8ACFFBD76E046D05A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139398, "uuid": "728dd5c4-ecb0-4617-a504-3354ec95ee43", "value": "98304:IejRBC09AaYflC2sV0GkJk8P9v5ZHjS9nRWjRbKJBt:LuaSClK5B9RZHj1tK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781139398, "uuid": "7fa49e77-0043-4ff5-8604-8e54921f3ed1", "value": 4066816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781139398, "uuid": "f7ec0299-7186-4674-aadf-534300a550e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139398, "uuid": "5229ef28-d20b-47e5-bd4a-c11e04e2dd09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c991c-65a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781191081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191081, "uuid": "438d02cc-efd5-46bb-923d-1d71ceac16ff", "comment": "Malware payload (Mirai)", "value": "7d9c19f44e450e8a449cde7755ee9c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191081, "uuid": "320a2101-101e-44b1-a9d3-b054fd4bffa6", "comment": "Malware payload (Mirai)", "value": "418db4c3a63b46c2a44ec7845ef8bb4cc0dc108118967275489a84b4b30f4203", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191081, "uuid": "eac7edd7-b2a6-481d-8267-3d0a39ee5325", "comment": "Malware payload (Mirai)", "value": "ccf83a563b38167b6570d378f8202739635b869d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191081, "uuid": "1ee58b19-c5ee-49ee-b6a8-fa1d0756d955", "comment": "Malware payload (Mirai)", "value": "135cb0a2d2287f1405d8dc87821d897d1ee4319c661bd22ca90cbdcbdf999a78fee237914a1821e8744c2a39f5a065eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191081, "uuid": "539c3de9-4232-46c7-be4c-0c55960eec42", "value": "T191E3991A2E21DF7FF159C7304BB38A30D79476E636E18685E16CEA081E2038E655F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191081, "uuid": "10beb993-7c07-43f4-85a0-114c87a0c30e", "value": "3072:MXkItTLn7o07a3cXnb/TYt3hYX8j8E2wn7+h35hjwpsjt:MXkItTLn7o07a3cXnb/08YR6Z5hjfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781191081, "uuid": "8cdc3257-6797-4cf2-a267-0e3c58be2476", "value": 149180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781191081, "uuid": "e4e9456b-ea51-4f08-bb58-828968e6e891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191081, "uuid": "13137edf-01c8-45e5-a10e-04e4a2b2dcec", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6640b610-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781189218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189218, "uuid": "b54a2bcc-3c7a-4f4d-bd63-ce8c5e2e6717", "comment": "Malware payload (MassLogger)", "value": "c470e797329a81a32a496e39367da950", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189218, "uuid": "36676b16-80d9-4bfa-b71d-d42203ba430a", "comment": "Malware payload (MassLogger)", "value": "4254a216aec74ff8c5bbb58e5408ecd051b2966ed1a5ffab12c1e5eb2756fd8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189218, "uuid": "82d4400e-62a5-4677-86f4-8f33d986886d", "comment": "Malware payload (MassLogger)", "value": "312b7583f6e84a2e40b82a3f232dae8e98fc5727", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189218, "uuid": "965c7a1b-8283-49c1-899f-684a412c320c", "comment": "Malware payload (MassLogger)", "value": "7e2e47b2a456c7e4691cbde6cacdc50592f21a40ddc8e584357d212a0f565bbe7245d99c5dbedb5aee52a4febbf8ad05", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189218, "uuid": "10e2bc40-ce52-4413-8dff-a24ca63ce169", "value": "T1EDB55B17D66F974E180A7B61106A5D9AFE89CEFCEF726BC4E08F90B110EE1110B855B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189218, "uuid": "5dcef396-bc97-49a1-8f7f-c755c6040229", "value": "49152:Amn/xMY4lEmMrSoONaJQu74vG8B36TWMHziMf0F:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189218, "uuid": "705c2a2c-ab9b-424d-ab68-a808970b5931", "value": 2443028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189218, "uuid": "efcd7ca8-c57a-4e7b-9b6e-a68f07821029", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189218, "uuid": "a9ac66e5-7697-401a-b3ce-8849667d26e2", "value": "(RFQ 100401-2026-PTSC-GHC-03) -035.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fa9798-6560-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781159843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159843, "uuid": "cfa5196c-c6d0-4b98-9bf5-52c5ea57ae76", "comment": "Malware payload", "value": "ecd189b2e9b9afee75345542b052fc56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159843, "uuid": "9f73a719-ec51-4942-875f-53062ebd10bc", "comment": "Malware payload", "value": "426fdcf55f1bd3f8d6d687c861e1d50393bff904a8f9b0344eb5a5db581f718e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159843, "uuid": "02ec55c2-f809-459a-bd68-6a1475774620", "comment": "Malware payload", "value": "12e23bbca36e8aa69f6bbefead32e4c7b5f521a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159843, "uuid": "573eec59-45e0-47ec-a1c9-030fe3433230", "comment": "Malware payload", "value": "2b35b0be0333e5f7402c6ebc34e2c33f4fe14ac28a0624385387358db8ebf3bf93f5dd735632f9ae600f2f7b0dcbe831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159843, "uuid": "c8d93627-4a29-4baa-ab93-501b8a23e6c1", "value": "T1199633E194C3312ACDE16C357CE0F12663E96E3BFB91A429F07673426186DE44F9C6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159843, "uuid": "e275d749-dd0c-4a3b-8c26-32e462c21498", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159843, "uuid": "dd1295e1-ac01-4ede-927d-cd4a93967738", "value": "196608:jQem1hC7y5Wy0jvk5EiUeTD3Y0qrcVsFqYz3l+4s5z:0emyOWy0jcFUaRiFlV+4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781159843, "uuid": "a71da17d-0232-43bd-af23-d2356f4422e4", "value": 8919448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781159843, "uuid": "e3348bf4-c650-48ad-8009-1d944f28da43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159843, "uuid": "85cea512-98c3-4ad7-af0c-ed45abe05896", "value": "SecuriteInfo.com.Variant.Packed.Themida.20.24833166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa79dc2-659c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781185924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185924, "uuid": "a4a145eb-cd11-4bc9-a8ed-2811e9d460fa", "comment": "Malware payload (Mirai)", "value": "87b5c03bb4fd9878e187395829606d15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185924, "uuid": "c04ef148-7257-4b81-a899-64be35144143", "comment": "Malware payload (Mirai)", "value": "429358e772cadb3485bd1c489ecca04806604edf98cea3cf6b20966ded4a97d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185924, "uuid": "793111a3-13c2-490e-8fd9-74da457dd21c", "comment": "Malware payload (Mirai)", "value": "7f867f8e4376954c266fbd3750b9670964d9942c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185924, "uuid": "5d0b6a89-39bb-4ee2-b985-25f492a3d336", "comment": "Malware payload (Mirai)", "value": "8906c50a1cd36325d4e3c50bae716e8d744a3f9e99b7b44be76007f797b5d0a83bc85e4cb5f82559a73e8e419f8d0b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185924, "uuid": "77210a25-2b60-4c5c-85dd-2488056c6e2d", "value": "T1B3D33917A9419F11C1C329BAFB9E928933136FB9E3EF3112C9209F6027869DB0F76551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185924, "uuid": "9480761d-93a8-4fc3-a87a-ffeb7e31440e", "value": "3072:HyUT0v+9gnMa01mDWjsN+7im4UsZjAmB0q4R5hj8pZxe:SUgv+9IMa+SWjsN+u7vB0qg5hjaxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781185924, "uuid": "a2328a5c-5d79-487b-98b7-462f04797591", "value": 130388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781185924, "uuid": "fb3ee306-ac86-4546-a935-34b2a97253bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185924, "uuid": "7ee12236-9f41-4bca-8411-b9416a0e5365", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430fcac3-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210634, "uuid": "eb5cf940-13f6-4ebd-b55e-4b2ebd591744", "comment": "Malware payload (Mirai)", "value": "a3125c7fe369c96e538c9f9ac9879a79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210634, "uuid": "af6e7f18-a321-41d6-82e9-536d80a01334", "comment": "Malware payload (Mirai)", "value": "4368d304e81f4b122a47af2e2b716e0b228ea23112f9b6fc0a38ed49530d3eec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210634, "uuid": "1c75a35f-9a28-4d28-9d9e-b05d7450d115", "comment": "Malware payload (Mirai)", "value": "6a02dcd9f942591f8d6fe6ae5bb8bbb93f4692f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210634, "uuid": "2b6b6a9e-8e0b-4766-b756-93ffa0476f0f", "comment": "Malware payload (Mirai)", "value": "a9080614e0deb32b0ef52c5d8bd23a27faac10488e5b7325b3a86cfae95fb61572077dab8c09559b29a4729b5cd92bd8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210634, "uuid": "fc572f30-2695-4bee-9e9d-3014cd2423a7", "value": "T1D851C6C541846C39ACB7EA53F6B6C32C308198531CEE7F99DED4BAE9868EE14B140753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210634, "uuid": "93fc3032-ff07-4164-8851-20da7bfa691d", "value": "48:ipc70c7N7hpcvc6GpcgnczPpcfcKWpc1coUpc71c7o7UpcfOc3bpcEc9Rpchccgr:iG757N7hG06GGgczPGkKWGKoUG7K7o7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210634, "uuid": "787cf270-958e-4174-8acf-88adc88549c8", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210634, "uuid": "c6ed6f4c-f462-4d30-a2d9-9b286efe8fb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210634, "uuid": "93422645-bc96-4625-aecf-60a0af8ad80b", "value": "4368d304e81f4b122a47af2e2b716e0b228ea23112f9b6fc0a38ed49530d3eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f8052d-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180969, "uuid": "0217aa21-334d-45e6-9bd0-091d10e9e6c9", "comment": "Malware payload (Mirai)", "value": "d89d201754d304bc17d43cedde6f9075", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180969, "uuid": "37734a32-06b0-46d6-8b5f-005a89439186", "comment": "Malware payload (Mirai)", "value": "44334ccb3d756f16cde0b9f25966a0a61193da17234baab9983d74a87a003bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180969, "uuid": "b1da57ba-514a-4cbb-a983-f56a2df1915f", "comment": "Malware payload (Mirai)", "value": "220c40959f5de891988e8bb10c8da9f764882113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180969, "uuid": "07602296-bfee-436c-ae82-f96c524969d0", "comment": "Malware payload (Mirai)", "value": "41eb94f2e8f0af5ca58ba3308f141c44145b8e79a52ce45998854ef2cada1e8eafc84192af5bba2155ca4fe1a3f4dd5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180969, "uuid": "16c204d1-d6b3-428b-ae35-763e35d84fe4", "value": "T156C3AE97FB8B24A0D86206F003C75F9D2E937111CE9FA8E36C4DA63B567A0DF1916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180969, "uuid": "15fdd7fe-1c97-41f4-aaec-f7b0a050bc61", "value": "3072:5KR8n+GfdFh63QEgqM5XEqg6lTFKUgfq:5KRNEMHuESMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180969, "uuid": "76fdd59c-48be-4096-ad90-46a7ca97e5da", "value": 124536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180969, "uuid": "d7209d49-bd88-4223-8198-78a7cee834b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180969, "uuid": "598ed95e-aa6f-4f71-957d-fb5ed486e113", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c1e01b-6567-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1781163144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163144, "uuid": "10574d01-a954-43b0-a3be-7f3349877b45", "comment": "Malware payload (Gh0stRAT)", "value": "9859030f2303c9a1c1f423e2ab3d87a2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163144, "uuid": "7085adf5-9e46-4a2f-ad52-40ac328b52c6", "comment": "Malware payload (Gh0stRAT)", "value": "446aad1d86aaf82a32f7e63bd0dd34cb2ac85ca2a412b9bea2122fb5506ddac1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163144, "uuid": "01fda31a-3e30-4e88-8f63-27ff3eae0bd6", "comment": "Malware payload (Gh0stRAT)", "value": "57b83bd86c7d5c50fb5f895ec8b54abe059b626f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163144, "uuid": "f3492a1c-7e21-4d65-8f11-5493df5f1dd6", "comment": "Malware payload (Gh0stRAT)", "value": "c0a950a28e1d7840e4d5eb705a4d1ec5053a2d2b5d800595ffd630ed7af5ebcc83cb1523dcddd34a1f786ded559a4253", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163144, "uuid": "56d91ad9-f26f-49a6-b3e7-23f363a6fb01", "value": "T1B037338A9FDFE8B2C8E701B34542132B81C23E55A356B23C8857B5F8675F16B146DB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163144, "uuid": "4bdf5105-b0ac-4eb3-8662-3b1b35cc687c", "value": "393216:cNg3L6YqqqZpRUA2S32yR+2YySuBMzX4DezJ7+irbqmQSPbnnaNNxcH2Q/Jqttv1:2g3sDytSmMlSu6zX4DqZbewbalO9SkEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781163144, "uuid": "660b20c3-a426-4ee2-b3c2-7b0b3766f169", "value": 22475317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781163144, "uuid": "3e394737-084f-405f-ab0b-8ceec1599e87", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163144, "uuid": "275616c9-a530-4f4f-be86-126f869dff19", "value": "Government emergency notice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900cca5b-653f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781145909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145909, "uuid": "74b7f6d9-87a6-4343-9e36-925387797ae9", "comment": "Malware payload (Mirai)", "value": "e9e8a1aecc3a7c3e4d7e774b9d56ae30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145909, "uuid": "73929fda-ad28-4895-8b84-f043c1a275ae", "comment": "Malware payload (Mirai)", "value": "4580e0c10ac3f6b8b45614f840ed1d11217189a3abe848c08a0bb72115f52b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145909, "uuid": "e4d33a05-eeb6-49d6-872b-542cae99ca04", "comment": "Malware payload (Mirai)", "value": "ef95292bdc832f6b95e0af4abc420e97fd738fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145909, "uuid": "274fd288-33a2-4c21-92e4-dde6f631bc07", "comment": "Malware payload (Mirai)", "value": "090768e0e2eaab848af9f3dfbc1c768548373614d9d7aad00b7194da2126850ea874aefec1d9f70689fc1e0b355bbe48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145909, "uuid": "df6cbfd7-334c-46b8-aa17-11500d82f9d5", "value": "T16CB31A89BC818B11D5D626BAFE1E518D33134BB8E3FA7113CE145B2A678AC6B0F37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145909, "uuid": "6d232e76-3ae1-48d5-92fd-11c18b6ce394", "value": "3072:w/tRAXgYCkzxdf3EP0wRtqwUNP7P7ekxQzkpaT4RBW4sDBcDRXr5:Upqf+HtqbTP7e3zkpaT4TW4sDIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781145909, "uuid": "f718875e-0ffd-469e-8c87-9cfa5eb1ecd0", "value": 116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781145909, "uuid": "7c982f22-4304-43a3-8980-2ff6f29a9e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145909, "uuid": "55487bed-236c-41bf-8a7b-6d7459bae6fd", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bc38b0-6593-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781181834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181834, "uuid": "422dc0d7-dbb9-4baf-9aad-4bb6ef793016", "comment": "Malware payload (ConnectWise)", "value": "b47967cccd770889872f22ae75899458", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181834, "uuid": "f458f917-2f92-45cf-a37a-680e9ce3bcc6", "comment": "Malware payload (ConnectWise)", "value": "469c8bd296e5f1f11a5d57f206306eff2c17bab0d989077cc3f6be4876386ecf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181834, "uuid": "012ece31-b36c-4730-943e-5e87ba3a6d19", "comment": "Malware payload (ConnectWise)", "value": "b4ca1843b78ddd4a65eb3976ad4df3590b885f27", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181834, "uuid": "92503815-383b-455e-8ea2-33417e8f1da3", "comment": "Malware payload (ConnectWise)", "value": "e762e55cdaa449c6d2057ea46865c6c005a31db4553104bc268a67f71e2d6929cfdd3dab7b7c7fe0401e4ff2cead9aac", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181834, "uuid": "bd06d62d-8850-4553-b0d7-c7b6349b9464", "value": "T1A5E62211B3E595B6D0BF1678E87D92654632FC144722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181834, "uuid": "0243b22d-6f87-4ff4-a28e-62797d0c5b42", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181834, "uuid": "3222540d-3eb8-4f9c-a5a6-b11eff6ea5e9", "value": "393216:GCXvI5MvHxAJRCXvI5MvHxtCXvI5MvHxwCXvI5MvHxjCXvI5MvHxW:GZ6HxIZ6HxtZ6HxwZ6HxjZ6HxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781181834, "uuid": "9ef3a075-a0c4-4f8a-a7f2-38831bae284a", "value": 14892088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781181834, "uuid": "599f1fd8-bf9b-4532-a28c-2a857abc06bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181834, "uuid": "b5ffb5b9-9883-4d8a-8514-60bc207c5007", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4919b5-657e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172856, "uuid": "1149aff1-3da6-4fe6-9624-d5251ed909bd", "comment": "Malware payload", "value": "45ef1c315fd188c9e156006efb1ea3c6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172856, "uuid": "0c61e103-7931-4f5b-a8d5-32d34f6f18b8", "comment": "Malware payload", "value": "46a8114e2ab0e120ffa4f1a9f8ef42a558d58cb641f8973a6f039ec5a6b92168", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172856, "uuid": "21481b38-7943-47c0-b2e5-18327b4fc38b", "comment": "Malware payload", "value": "922965ff2103c6ecdc5ebede1786539343c66519", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172856, "uuid": "327710a6-1911-46c3-9728-232a5210d585", "comment": "Malware payload", "value": "b25ce2164a4132aca99023090e06511fbafcc54dfb00ce9237022850e29071df3f82c7e80d7113e0ec0b79eb39e68cdb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172856, "uuid": "bdb71c94-4e4d-45de-8508-91aadd28c49c", "value": "T15842B487B901C23BD2456F354EA6CBA907763C44CD5A011B3BB6734C2EB729039E63E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172856, "uuid": "f74d83f9-a300-44f7-af54-139d46b6b5c3", "value": "192:cQB134w+HrL5zH0CALp6U9zK/S3Uj4gCKY:cQB1oPfVHJSzK/GUj4QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172856, "uuid": "3b4d24b7-a9c3-4f65-ae5f-62e35bc28384", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172856, "uuid": "88055302-6485-4657-b970-3798f7294b58", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172856, "uuid": "72bc5786-45cd-4abb-823f-2307b4a1df79", "value": "claude.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55380e5e-65d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781209376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781209376, "uuid": "1ec294a3-dd4c-488c-a6a6-e32463ddf4a0", "comment": "Malware payload (Gafgyt)", "value": "cda28dd4efb77bd706e48572cc592c74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781209376, "uuid": "3bfba795-28dc-40cb-8cb7-7958b8c69c76", "comment": "Malware payload (Gafgyt)", "value": "46cef9fae843fab4e07798f9c8b757e7e60370c9ea11cbb67ef41a0400d0bd1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781209376, "uuid": "3f71158b-a76a-4e62-b585-9d564ff36fb9", "comment": "Malware payload (Gafgyt)", "value": "e34515de8e2155871187bdb2b6249b90bdf65f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781209376, "uuid": "5a041ed0-a3e8-4eec-86c5-fb11eb33de05", "comment": "Malware payload (Gafgyt)", "value": "d5a79d007e1569bf9261fec72f4b1bbafdf42473461d676dde52f0ec73e9d4701040a2f1206af8b77072296e648d0c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781209376, "uuid": "b3e71830-e165-49d6-a07a-b39ac5b2e48f", "value": "T1D6932BDAFA42CE73D05310F112AA6B218D71F9FB1C23E682D7647DA09D115C29A16FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781209376, "uuid": "908bec60-a3f4-46d0-8df6-f45040e95695", "value": "1536:nljF8nKKPQCJvzUUfF5ALtQE+Ho720PsESa7Y+5buTN9WROywJ33cZvEg:JiKKD5ALteo78kYIG71J3MZvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781209376, "uuid": "231199d5-f84a-4fd1-841b-75712160e737", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781209376, "uuid": "275dc4b8-03a7-4d65-869d-a7b32ba3ee28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781209376, "uuid": "6112bd63-f90a-4b1b-9124-532267fe913f", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabc82c5-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221250, "uuid": "40d79719-3e28-4f57-85cd-fd81c24ff287", "comment": "Malware payload (Mirai)", "value": "d28bc4c1a818fab22f52a9732297ad1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221250, "uuid": "beb4e60e-3a02-4038-90ef-40c2c6bcc184", "comment": "Malware payload (Mirai)", "value": "46eaa8f2589f3bfaa97c9cdde1f204d8d2d1c144df963ce655e1c4cbad0e8de5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221250, "uuid": "61ad2ad1-bc2f-48db-bdcc-94b8f142edbe", "comment": "Malware payload (Mirai)", "value": "13e4a08646e1e73236bad1680d2676b4f918c93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221250, "uuid": "ecdfd460-ea38-42e1-8931-0b711b5dcb78", "comment": "Malware payload (Mirai)", "value": "be88ce32b6afac270521999e71f8f89cc02109f0c4c4981cd98c7ec6d270e5bed78b08e933345a7d4281e68b9347e4bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221250, "uuid": "a5b4fbb3-f556-4a60-b477-0c7c2de1fb8d", "value": "T13F133A42776C0F57C5A21AB5253F53E083FFE95020F4BA89254F8B968636E37408AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221250, "uuid": "da359045-7245-405c-9a28-708a17257f8d", "value": "768:mBufQf3JUGUntuFODYKc1mYA+27dtzj1VmHuUeJoSqI/+K:3ndXc1Xa1lloSqk+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221250, "uuid": "df6e4117-b27f-44b7-8e60-5ca695256dc2", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221250, "uuid": "216d2210-67a5-4024-b35c-61fc7dedb5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221250, "uuid": "6ad3c969-59b3-4da4-afb7-d89c24b30f4b", "value": "zoryn.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb2fe60-658f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1781180317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180317, "uuid": "0c6fa3e5-8f89-4554-9c42-0fcf37da0ffa", "comment": "Malware payload (PhantomGate)", "value": "775966922db39bca854ac806839ce652", "object_relation": "md5", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180317, "uuid": "d6e3afc3-3020-4d9c-8e82-0da015b24ce1", "comment": "Malware payload (PhantomGate)", "value": "476d4ede3ef5c9a0bcc0b3d918274757ec72c41d2a5aae9fc73aea512992c23a", "object_relation": "sha256", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180317, "uuid": "b8ed2d87-355b-45dd-be7a-9ea715b46af0", "comment": "Malware payload (PhantomGate)", "value": "b27bd090ce6f07bf07f8b3c612329099dbfda646", "object_relation": "sha1", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180317, "uuid": "db9329db-8120-4150-b8dc-ff07479b81d2", "comment": "Malware payload (PhantomGate)", "value": "9774a11f0c82dd0450eb9d0c3a893eb65fa0a80951f1deca761da9021a30de5f239174f1a7d7fadd45fc8ca539e6ba2e", "object_relation": "sha3-384", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180317, "uuid": "9772c9d7-e035-476a-90b9-fed1c1fa6e83", "value": "T1912125401BF80714F6B36B78A97E62520876BD44ED32C78E0154209E44E1514D973F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180317, "uuid": "5fab8d30-7295-4f83-8e46-32003e5d3cdc", "value": "24:8XacS2AzWn+/CWMtnmyqVmgyAoyUMkWEzAUkLYAUkLN:8XJStsXmVHyAoyH/7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180317, "uuid": "e9418344-3eae-4159-a87f-3fca34a81390", "value": 1378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180317, "uuid": "d7051012-ba2b-43a6-ae55-7c6c02d90b76", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180317, "uuid": "874bc5aa-e1e1-4ae4-baec-760027505894", "value": "Only.fans.lena.paul.mp4.link", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2987b245-655a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157334, "uuid": "11f477f6-39e7-467f-b064-a4df8b4d1feb", "comment": "Malware payload", "value": "ee602c7e8468ad5bec281096d2bf1f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157334, "uuid": "79b48609-3d28-476f-b5c8-b427efb2a62f", "comment": "Malware payload", "value": "4a13c0c7149b293d90adeab7d906a9e5475f5d4a86a168e6cc602587977374f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157334, "uuid": "1f9baf99-5f89-4aba-95a0-079792034ec9", "comment": "Malware payload", "value": "40b98633385a83b2243772b5824c146498b73a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157334, "uuid": "6a383105-4ba5-40c1-a114-9d0c92f25411", "comment": "Malware payload", "value": "4966df3e21513b0c032389cf13645ee5ad0b43132242903b90eef549cf7f05df74aabd388b6b5650b45aa8e72c444d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157334, "uuid": "661ad6d8-ee8d-45b8-a2c6-ca57f2c4a062", "value": "T1B5564A03ECA505E9C1A9E1318A6A9252BB71BC484B3123D72F90F7387F76BD4AE75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157334, "uuid": "9c13097d-85bc-4d72-9d8e-7d96bc6f7a11", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157334, "uuid": "9bb41422-30e2-4c17-927d-891125e1d031", "value": "49152:gixtMpNUCiNUx1qjmoL14XuOf9M+ODPyRX78HiLswX4c1NZLCN2mg4H2Wq/OkXXh:girjrqtXQHiYwF2NjHF4jbP4yQE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157334, "uuid": "e29a943e-d5de-4e8d-b184-3cb51b87e2f1", "value": 6437888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157334, "uuid": "9bc33a0a-e89b-45d4-8cd3-5738fc2c401c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157334, "uuid": "db9d156b-3a4a-4828-89eb-6dcc8123d90c", "value": "steam3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49cb964-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186451, "uuid": "49e252b0-62c5-4553-ba39-78ba5b37b38d", "comment": "Malware payload", "value": "1c043fb03d7ef21f40246833226c6fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186451, "uuid": "0f7974a2-8b7c-4730-9577-2b2b9d14a0b4", "comment": "Malware payload", "value": "4a60d469eb055e0cde3511c1c6657126b5467858a827bb1ee1584641afa14545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186451, "uuid": "1d48d795-6460-450b-bd5f-e0585efdb065", "comment": "Malware payload", "value": "c1aa223725c436cc7dc90abc0bc19083878981f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186451, "uuid": "6d1305a6-0d78-4e3b-91a4-f4a807720fab", "comment": "Malware payload", "value": "b330901ff16e1cb64bf3d1c7feacaf3080eff4c62872b53cb74d61851f3bf1bb5112b5ca64a0746ac4455ba067369d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186451, "uuid": "ec20f049-847f-4389-a1fd-a5d848839d46", "value": "T18422D704BBD58331D8BF8B3C58B383551677FA159922CBADACC8629E5C327408D52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186451, "uuid": "d4cb23ad-2a3b-45f0-95a3-9b183072efb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186451, "uuid": "5a02cc70-e5a1-4d2c-a174-60402f584884", "value": "192:Lvljr4Ux7s660wLHRzUbliLYZw6naOaC96e99txy2Thq:9c+s6ZCxzUblisZwyaOaC96w3yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186451, "uuid": "06b98c07-bdbe-404f-8140-97c3a8ea272e", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186451, "uuid": "3fb36350-a1e1-42f0-b14c-62500ca9d57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186451, "uuid": "7a567ed0-8dda-4b11-ab5f-240ae8e89492", "value": "rGeraldoeBentoTelasLtda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538636bb-65ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781192623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192623, "uuid": "02550f21-1171-4b23-ac7f-585e911e0ad3", "comment": "Malware payload (Gafgyt)", "value": "cc6ee8e5acd5a62d9ad3c5db1f5f21d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192623, "uuid": "380e3c6a-d2a9-4174-af93-fd983efd1380", "comment": "Malware payload (Gafgyt)", "value": "4aeb71570fe4c7e5e01a24f36b81bd7f0c8e6ba725591074cc135993d8575202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192623, "uuid": "37bf9fd4-4a4e-4535-b966-7a72dc428903", "comment": "Malware payload (Gafgyt)", "value": "3df294a389e25f4160c8545545ec362eb538fe27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781192623, "uuid": "b3392334-461d-4603-a7f4-c12db31aaa38", "comment": "Malware payload (Gafgyt)", "value": "a27542b21e2ae560168d7e6eefd7689a20204e929bfb8f6239a18595ea09df74242574d3bc2c66f4c06a416a2598cfbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192623, "uuid": "e4cc384a-9e55-4834-b89c-80370081c4ab", "value": "T106A34B13B6D18DFAC08BD1F046DF6922DD22F4FE166371AB6390AD902E1DDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192623, "uuid": "eebd4ccf-7224-49ca-9cde-78c0d27e2281", "value": "3072:ORywFZd/mqXl0d42Pki02I8GHw9wJ3DugZmV:ORyw7JP1V2Pki5+wuJ3Du7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781192623, "uuid": "694243c0-fe7d-4efc-98a5-0227ef936178", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781192623, "uuid": "0ca68f10-a4ed-45e4-b2a3-2273c96e02b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781192623, "uuid": "c5a144e3-7f27-4614-a8dc-ef5e771b673f", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f86199e-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146150, "uuid": "1921f3df-d8e4-4dda-8137-34bd33c975f7", "comment": "Malware payload (Gafgyt)", "value": "3cc54d96ed956d9a230ea3512a2551ba", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146150, "uuid": "a713cfb7-9221-43e1-ad3f-d0284b1de818", "comment": "Malware payload (Gafgyt)", "value": "4b36a87f1cf4d953e6ab87ec7a33d875564e3669574ce5e9ebcd281523a09cd1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146150, "uuid": "48ea0713-b53e-4891-a79d-68cdddab94cb", "comment": "Malware payload (Gafgyt)", "value": "87ad7b2c3b2e3f9d464ab2d44ba9178929a00572", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146150, "uuid": "d3d4c711-9020-4b64-83ac-f4767fb9720c", "comment": "Malware payload (Gafgyt)", "value": "24379570708971f8c23c6c22930e16ecc3936d5a1f44f4662590d3f592d3ff8dfd059e32ff9881147165f06f2a6c9e76", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146150, "uuid": "740a52b9-e1ad-425d-be64-6872b604226d", "value": "T1E93114DB3011A833B57DEA5FB7BAE5985010C5F63297FB53ED894975CC89B183389A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146150, "uuid": "91cbb5a5-c048-4de5-8f33-c6cb8390fd70", "value": "24:I9LoBBtg7PZgLgMghTgEbDYN4pGC1r/oHhCNIZw/Nkg/wKRoPEDvuPX9:ScB8GR0xbcc17oHo/N5YUoMD2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146150, "uuid": "4b36068c-bf49-48d2-9dc6-2fe9b551503d", "value": 1825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146150, "uuid": "228dfb9c-831b-454c-97f6-306298d7af16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146150, "uuid": "219af217-5eb8-4e97-944d-315f7a2dbd77", "value": "Cia.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54bd66b-65d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781211229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211229, "uuid": "06197afb-bb3d-4870-acb4-80e2dce552ac", "comment": "Malware payload (Gafgyt)", "value": "96a582f16aa2620909adace4a968f98f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211229, "uuid": "601c4514-2202-4960-a8f5-6a4c9c1f9619", "comment": "Malware payload (Gafgyt)", "value": "4c30f4b90153a2aac38a85416cde62e6f78a9a3779a3c50196deb583ca336e77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211229, "uuid": "30bd10d3-8c77-4a71-b856-ab403c5a977e", "comment": "Malware payload (Gafgyt)", "value": "7d6144afdaccbde65ffd21c34f8902e19676b963", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211229, "uuid": "16569cbf-83a5-4a13-b471-e51af4215978", "comment": "Malware payload (Gafgyt)", "value": "55dbe7f9cbe92faddd537cffc27467cc3f6143e91323c776f6c9d83e9af3ce362a94d96d7e481fd999e7fec2c12e1737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211229, "uuid": "37a7b436-ca85-4e23-a88c-272e331442c1", "value": "T116D32917F9419F42C1C325BAFB9E964933136BF8E3EF7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211229, "uuid": "4ee76f3f-74be-415b-a97f-0e09f4942f82", "value": "3072:xwnMcfJoEsaID56iNwaqFgedHoCkBXY5htpZHn:xkMcfeEsaI96iNwaagTCkBI5hZHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211229, "uuid": "be9629b8-0cd9-4e02-b6d5-c177f7afaf62", "value": 130016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211229, "uuid": "4fe010e5-70ed-498c-ab53-d4c96f9ee5fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211229, "uuid": "0274349f-1ea6-4caa-bf36-b5342f5a6c80", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e370dd92-658d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1781179550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179550, "uuid": "cb094d48-2215-425f-ad42-0403ce358575", "comment": "Malware payload (PureCrypter)", "value": "3324c37370f7a20e4cdd598f7e5f1cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179550, "uuid": "63b64d8f-852f-419c-bb8f-b9f066223bce", "comment": "Malware payload (PureCrypter)", "value": "4d3149f1428140c38742e259143ab0db2a784d23f138c59cecf9edf235cfce5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179550, "uuid": "0882ba47-0cc8-4c04-b452-624727c998f9", "comment": "Malware payload (PureCrypter)", "value": "e1b84e1b8f928e9a93686baec824cc2349f4ed80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179550, "uuid": "8e67e160-f60d-4877-89ea-e09ebf74f7b9", "comment": "Malware payload (PureCrypter)", "value": "442ac545e7676d2610976ce84fdbc59bd168d8b2bf2a061fcea2697b7114f4733da44652dfa5802f118d3367fbb36e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179550, "uuid": "3faf920f-af54-414c-9141-b57ddbbb958d", "value": "T1B5C4231114CEA9BEC69B8B3F6866AC8DEBD1B3112EB3A87DF6BC0B500F5D954C51402D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179550, "uuid": "b98f127b-aa1b-436d-9a66-efbb6532efaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179550, "uuid": "9feba7b9-146f-43e0-8f14-d6c9c2de5b04", "value": "12288:9doXP00kcM9oKh03ArRjEaQxoKvfmOyNsyDUMu:9yXP059oAWArBYxmwyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179550, "uuid": "4f31fa53-c59c-40af-8451-dea742136358", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179550, "uuid": "52ee6b8b-3cb2-4b9f-adc7-8d3fe99b4cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179550, "uuid": "b80c977a-9eef-4e57-9628-f6cf6addc122", "value": "wins64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d117ce3-655e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781159192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159192, "uuid": "d2500476-b80b-4f63-bb0d-28df97bb9b6e", "comment": "Malware payload (Mirai)", "value": "b53a7bce51982edebb7f46eb154ba903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159192, "uuid": "c7093388-5baa-4738-9937-9e9de0e0fb1e", "comment": "Malware payload (Mirai)", "value": "4e39a67cff8a020793f3370e12d5ad7f0f7702e251e1370ad585b32c2b0e5061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159192, "uuid": "889ec4dc-70ef-4029-8cb6-bb8c3a073f22", "comment": "Malware payload (Mirai)", "value": "63195cdd62682348b175e02064ddcbe13b9a752f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159192, "uuid": "2f1c21fb-ce90-486d-b9aa-5fce40209073", "comment": "Malware payload (Mirai)", "value": "1dc028cfe91450599bd01b953be16d4110aa0e12a52ddd641fc8ee24a9e22a9390fd189dbabd1ae09a854095cb79eb20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159192, "uuid": "a2154158-e14f-4d12-bd18-ce1d8f946e1b", "value": "T1B663950AEF654EB7EC6FCD3706E90B0134CCA51A11A53B393578C928F65E54B46E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159192, "uuid": "3b6e3189-a91d-4523-b425-86f88da78efc", "value": "1536:IGknz7HCwR1TuePVq1gZYV/FzYzxIJT9Y:IGkn5dQ1g1MT9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781159192, "uuid": "4fe440ae-13d4-430f-a2cc-e0c1fde44650", "value": 72516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781159192, "uuid": "3c28b0e1-8d31-4a9b-b965-a8bbc12565bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159192, "uuid": "ec7f2a00-2ac7-4f21-855a-e039bb2bfa06", "value": "godisdead.3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01925c10-65b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781195922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195922, "uuid": "7c7300f1-cf5c-4c06-967d-8045daf5a157", "comment": "Malware payload", "value": "c37d07f103384cb7399897248245f725", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195922, "uuid": "acfd079e-3761-46f8-bbc5-b5b4afe72541", "comment": "Malware payload", "value": "4f1917a4dbb322b8f90f2bfd1dc5fed0c966369d516c0f599194429b16e940eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195922, "uuid": "4ef11936-6aab-41c8-863b-1ae613685eac", "comment": "Malware payload", "value": "18ef0cda1c50d8a319bcfbac8c5798c390f9d8ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781195922, "uuid": "1d9d4b85-67dc-445b-9f83-ef95e3474b55", "comment": "Malware payload", "value": "62746b5188c080ec51167646a8eaaa91a71c287bee0bb9c48aababcdfba45b0d7031b138dc52e6e31c6b23dcc0f60f8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195922, "uuid": "0f76e428-a008-427d-a3de-9066061ec407", "value": "T1B266ACBB6DEC361D3000B0C2F48521F5EA625335EBDE12C9B8F925327BFA49AC459746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195922, "uuid": "4bee9088-9449-4a0d-b699-5b25b7edb605", "value": "6144:E170CygVOAf/qvR5OZ6HCN0PH5jtmjz3FhSU5APryouPdyDhfnmGtWZRVVaSu4x7:EVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781195922, "uuid": "1cadddef-44b3-444f-9194-6bedfe50da22", "value": 6890060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781195922, "uuid": "071ad826-6024-4a8d-b674-8053c983d38c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781195922, "uuid": "0fb93ecb-f415-4c66-8a6b-43daf5a9c4d9", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab707ab-65aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781191883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191883, "uuid": "2cd56cc9-c66b-405e-ad3c-b11d2ff5a0b3", "comment": "Malware payload (Mirai)", "value": "0420cbbb9d046758a6af4a3e9d898347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191883, "uuid": "2124517b-9655-47f9-9e9b-7bb69e343bb7", "comment": "Malware payload (Mirai)", "value": "4f2ad828b1a3f02cbc1e415b82f95660a88706cc100cf0a6331f2a58f24279e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191883, "uuid": "3ad9a1b6-2a14-4534-b377-47dff6ace490", "comment": "Malware payload (Mirai)", "value": "cd30face97144cded3411f92a7b4cfe012bf78cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191883, "uuid": "824f668b-d8a6-4f3a-aaff-7922be571e7d", "comment": "Malware payload (Mirai)", "value": "6a2f48ae0a1e0b53a61029dbfccf6200d4cec20f2d97ee4800ef4150c90d87a229e146845ffb97f8df277b1048de3b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191883, "uuid": "f2f23d6f-e114-48e2-9c0b-22ab5e90d4b2", "value": "T1F5158D9DEBC6E0F1F16300F1025ED7F75934A12A5013FAF6EF462662B4327916F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191883, "uuid": "98c19140-85a5-4e92-84e4-ff0d095dcda8", "value": "24576:eeYjMu1hAmh4a4/lgWBBW/LttHlGYydS:yhAmh4a4tBByr1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781191883, "uuid": "87f7dd60-39d0-4468-a05f-388ed22c0cb2", "value": 935352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781191883, "uuid": "28709aef-10af-4487-88b6-3b0b12ccbad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191883, "uuid": "79ba9b72-aba6-4d94-9e3f-94e970efd53a", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df2f72b-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180964, "uuid": "7d8692d1-d3fa-4884-9839-31e41e905def", "comment": "Malware payload (Mirai)", "value": "b89de172c5feb66e3127c51212853859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180964, "uuid": "88870138-00cd-4801-ac8f-67414faa581a", "comment": "Malware payload (Mirai)", "value": "507abb56e2a45b07a5451ae7204718330b218582d9155f5db2c2f6d51c036eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180964, "uuid": "bd7643b7-1171-4d08-a4e0-a153f05f87e1", "comment": "Malware payload (Mirai)", "value": "ab4f80814787a47c6aeaafd1513a576ccf70e8af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180964, "uuid": "03e82ac4-a1af-46bc-a358-0b39dfc41cec", "comment": "Malware payload (Mirai)", "value": "cd49b7c4912255000396e49f10b0274546fed1c6681c2378bb744bbd889df83247c33459742b614c6ad99664c2819a82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180964, "uuid": "b88aa119-9de7-4951-a9f6-15bd7c4d4f49", "value": "T1CE93AF63C8362E64D4844AB072B5CF788BA3D415C55B3EFA44AAC669F083DDCB51A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180964, "uuid": "3da96722-de02-477b-8582-bee0d8288635", "value": "1536:ABKZNfxDMIa/dBDhHExNedaBBKvAki879Gh5KFQCfCDe:6KTfxslSeYKvdoh5KFQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180964, "uuid": "e4a19976-fdba-42aa-ab8c-1b672ec2944a", "value": 89764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180964, "uuid": "e19389cb-f1e8-4c59-8023-bc0395e17178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180964, "uuid": "c4186f3b-a985-416d-aeff-2c2a299e531e", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e19c0b-656e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781165993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165993, "uuid": "3a9412f1-cf4e-4f9c-a80e-dc348682a67a", "comment": "Malware payload (Mirai)", "value": "1b49ed7423cc34ca34ade5d971fb8f29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165993, "uuid": "9dd9c198-2664-446a-a82f-a3557db73ca2", "comment": "Malware payload (Mirai)", "value": "50af9e26aeac1c7d6b48b3b65afd6faddf091e11ea736d61185a291746bdf538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165993, "uuid": "c11d8b0d-4492-41c7-8e18-c679a2b03f6e", "comment": "Malware payload (Mirai)", "value": "1d62df9b0a6917bc2482785bde43649047bb7d9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165993, "uuid": "8b3293c1-a83f-4c22-a1e8-640073cda887", "comment": "Malware payload (Mirai)", "value": "455a1e714e00fb18aba347c9a6d56fcd63468042460ea67d2f8dee6575a546846c067547bbcc4f6bb96adbfe2be38008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165993, "uuid": "6f8f2c3e-0e2a-4ba9-af85-801fe31feecc", "value": "T11AC30A42BE419B13C5C721F6FBAE46583B136B7DD7EA3102ED247F90278B8DA0E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165993, "uuid": "37adf033-a58f-43bb-9dcc-93159fa54d3a", "value": "3072:UmivXFtFJSaTRqhRiLxJuDHKp72eux2L:oXF/Ma1LLxJuTY21x2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165993, "uuid": "4d018898-3144-4d1f-aa9c-8ad3d816a438", "value": 118540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165993, "uuid": "b1f9b101-b740-4fdb-b320-d92e2fb72523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165993, "uuid": "22cecc94-35a4-430b-887e-13c3179fee1c", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3795f8-6575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781169098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169098, "uuid": "5dc3bc3b-8920-41b0-8c91-a05e6031ec91", "comment": "Malware payload", "value": "e024a6851f24ec6fd2853c528a7d9004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169098, "uuid": "bbe4072c-83e2-4575-9392-4f5eb5b9cdcd", "comment": "Malware payload", "value": "51b9eb394d5b1a36bc2bf3264077cc400bafab7a3a88097e68bf4015b0655014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169098, "uuid": "253c64f8-d942-459e-a9f8-5d180f5f0a30", "comment": "Malware payload", "value": "da7cb5459812f22db53874a3d2de278d90c5c6e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169098, "uuid": "36397f2d-56a1-4f7e-ba79-f28f4fa04c95", "comment": "Malware payload", "value": "13f3fa9b16729ea60bc0b0cc06555dc5630c92198ea4f0043156303273306df7d8611986dd409d7a8fc3f6b78aea0a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169098, "uuid": "225f4e0b-28f0-4e73-9927-7c9b9fcd1634", "value": "T1F566F117FCA118BAC0ABA232896264567B317C493F2163D72E90B6782FB3BF05D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169098, "uuid": "f5532697-0e00-4626-8059-d2d3f5e78a52", "value": "f604c1c3e882e6a725b213d7fdcb6bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169098, "uuid": "3240f0ce-d685-4afd-9f94-5e117dab9e71", "value": "98304:6d9fMsgnf0wj3QmpE7LKnBnkYGri/KdvXAhhcdI7:6H+f0K3S5lriydEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169098, "uuid": "96ba058a-c163-4428-a04a-bdb62abbd3f8", "value": 6921920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169098, "uuid": "e7dde453-e772-4b38-a646-8d47f13ad549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169098, "uuid": "846ba813-4315-4ecf-8280-3fa92824722c", "value": "wingup_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faa3211-65a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187865, "uuid": "4df9aabe-44db-43bd-ae8c-8163926f14e0", "comment": "Malware payload (Mirai)", "value": "2b3007a422adcfd6f76ddd4d2450d6aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187865, "uuid": "8951971f-34dc-4fed-aa20-28099f0f6545", "comment": "Malware payload (Mirai)", "value": "52c44051f430747776a2d2639b80ad2b2681da139c5e3460ada27a8be5183ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187865, "uuid": "c937edeb-ee60-4ef5-aa1f-a9866bf3098d", "comment": "Malware payload (Mirai)", "value": "c33fbe6767046384b5d664d31c33a83249be21f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187865, "uuid": "631ed1ef-553f-4b0c-b526-1b1f18a96200", "comment": "Malware payload (Mirai)", "value": "14269fc197a760e487eb9691c2a8f7a6763d11c947a207fac3ef0818d16920d701fe5da081e9d4004291436831a0a573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187865, "uuid": "113c755a-0cb4-4fe2-9064-4edd439a0981", "value": "T1B7935A13DE165F4AD106A9F0A0F28E380F62FC7A8C5B1AD5A162DEE49143DD9F01A7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187865, "uuid": "aa07c22e-93ad-49c7-977e-d4b20d6dafbc", "value": "1536:LQcIG5qGKEB6Kaa6iIZtrqoWI0XyCMfKhHTYcr5hjY+pp2:/IG5qGKEBdaPtrqoWI0XyroJ5hjTpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187865, "uuid": "16e67237-c63b-4df8-ae08-55e1fd37959f", "value": 91924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187865, "uuid": "168f9cc1-fd89-44ce-bb70-22da58990d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187865, "uuid": "be3d5022-d044-4354-a54b-1e17d2cebebb", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c7525c-6557-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781156123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156123, "uuid": "6db5471b-9a16-408d-9fb5-4799776e9df5", "comment": "Malware payload", "value": "9c7e65b107fa50fa74e4957b8128fe86", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156123, "uuid": "7b6f51ee-6524-41af-8c1d-52d80db90d8d", "comment": "Malware payload", "value": "53ef6025b39f090f1313952a368a315e0a09886e84d3b67871ddcf6f87bd0b97", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156123, "uuid": "90373a26-e2fc-46cb-9ae3-db732efebf63", "comment": "Malware payload", "value": "d8eac5d2802002058143866763b551d728602c46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156123, "uuid": "252d50a9-9d46-40a3-9f8e-d6799e1d1b55", "comment": "Malware payload", "value": "8cdff99318f55332d2be9653db4d806265cf01e50e416d366b9e6cb4cb27a7495f3959f0c1f20d3ade8792ef75589276", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156123, "uuid": "484af235-345f-4fac-a9b7-ba24e36fc7dc", "value": "T1E182A6E95F70F9D85609152F64E20A483711C07BA2BC16BFB9CFB2260E5F53C6E5D822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156123, "uuid": "267bad11-7ca0-41d5-aa26-7d459ed6d6cf", "value": "96:8zvYLoPFZUhkoWyRVv4f2hv6swSBO23210qh2lsbJdD02fbC/MTWkjRcSvjYjT1J:8TYUnBCYMqXYjUsquNnO0VcjHc2SiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781156123, "uuid": "83c8e2a2-655b-4eff-b8cc-dc064afde147", "value": 17765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781156123, "uuid": "7642359c-8783-4738-ae71-8434bdf39bf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156123, "uuid": "ebbde1a0-5c7f-4825-adf0-3c4d4be85a64", "value": "script.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0541d1e1-655a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157273, "uuid": "9f1dc934-258e-4bda-ba0b-52690cd930bd", "comment": "Malware payload", "value": "f448e547879f951c2254a31380e8c78b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157273, "uuid": "438c599c-d449-4f9f-8f72-4f434abb265d", "comment": "Malware payload", "value": "55f29684e9ffd7aa0ec9e8ac14f12d4f3592d5287ca9c5564368b354a5b630b1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157273, "uuid": "5dfa11f1-45c2-4249-a244-f56c98552858", "comment": "Malware payload", "value": "175a3d98769ddd1fb968355b2ddd3eeb05e152c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157273, "uuid": "87a0376b-bed4-4863-a27c-bf3ac559a289", "comment": "Malware payload", "value": "75f3254fafce05a19f6851a3d2d5c61de9e6bb3c5c97bbb617b82789692be66810c0a777d35001a9bcdb6129e8dbe369", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157273, "uuid": "3ecad509-71c9-4d01-bb29-0ae79442b2a7", "value": "T11C136C6526953C25AE99883B5C7E2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157273, "uuid": "7e338aa3-fea5-47f7-90cf-bcbe30e6b7da", "value": "768:Nr9NyXsZztCm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:1HusZeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157273, "uuid": "260bda1f-a8a5-4644-9bc8-6a37e704dc98", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157273, "uuid": "3422968f-1915-4043-9df9-21c7384b6c6b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157273, "uuid": "2dbba81e-0c1b-457b-9394-9b89b7de0a68", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf51f58-6538-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781142978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142978, "uuid": "c19f01db-6e69-4e56-90bb-9fdb0cba9b1b", "comment": "Malware payload (Mirai)", "value": "e554302cd828272a42209336806594fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142978, "uuid": "be0aa8d7-f58a-4e6a-9f06-95de2c208f88", "comment": "Malware payload (Mirai)", "value": "5652cc1834356a81a8f1c24f2cdd723e5bb983dd2e684832e2bf35dbee72b492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142978, "uuid": "b30add01-e0f8-4b9b-b7c9-2b3a17b99c9e", "comment": "Malware payload (Mirai)", "value": "42f4d5ce2f0e788dbe545d9812c3b1b689f73843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142978, "uuid": "ab42fd43-91d4-4908-a434-fd96fe8fc1b7", "comment": "Malware payload (Mirai)", "value": "9b71cb2698be6dc9389f5299ee7b0790fdbbfd6ec5979eafcebc56fcee6d26169d94a6089db78c4752216f6f239d58b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142978, "uuid": "97a0cac9-a0fa-4dec-b053-2b6d0eda5971", "value": "T199E30945B8518F57CAC252BBFF4D4389372A17A8D3EE7203D9256B24378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142978, "uuid": "7bbc60ac-aefe-45c0-8185-726da1593e7f", "value": "3072:Kpw0DH0dQr3j5yLH6JzkoOj9a8tzw471bY+PrVbULValby:Kpw0D02r3joLH6JzkoOjM8Fw47dY+jVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142978, "uuid": "416560fd-9034-47c3-aeec-09d452a9ea43", "value": 153444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142978, "uuid": "f2237acc-e2d8-49f1-bd04-0b5e0f66e064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142978, "uuid": "6acc9623-a7e6-48ce-b14b-cfd766188ec0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c2a11-65ba-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1781198539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198539, "uuid": "73dbea43-ac5a-4f25-9ba8-bebd28898577", "comment": "Malware payload (a310Logger)", "value": "0ff94617c08fe032327753b286011da5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198539, "uuid": "5caaf29b-79bd-4106-b8ec-9372c4e953f4", "comment": "Malware payload (a310Logger)", "value": "574c4503c071e8e8892d267e786acdf811970d4f927cf4536a870c8ba2fc7a13", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198539, "uuid": "e21541f4-d40e-4a02-bfee-1064a2bea811", "comment": "Malware payload (a310Logger)", "value": "fb5a09899b06e4ed91b14a9e67f5ece2a558a877", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198539, "uuid": "5254dcf3-a09f-453d-8fb2-c52ce1577001", "comment": "Malware payload (a310Logger)", "value": "7d769307897e3c9a0aa7f1df4a59edb5b96cba0b7b1d6366695ea6428694b857d5a347424032fd9a40ade5e8a3cfdffd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198539, "uuid": "787642e7-f6c0-405e-93a4-81ec6cb8f535", "value": "T1C65502546A1BED03C560137689F1F17413B86FD5E806D22B2FDE6EEBBA26B854CC4213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198539, "uuid": "e2476d39-b3a5-41f5-b4ac-ee68710aefac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198539, "uuid": "8e709c26-c309-4a9e-9c59-45e5bc49f68f", "value": "24576:8KmOr+4eoNR/C+Whnoj1Vu4wVidwxrhX6eEAfoukAztl287:7+CeRhnUuLQ2rBDEPukSlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781198539, "uuid": "7e54acc9-99c2-46cd-824e-589ecf159179", "value": 1365504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781198539, "uuid": "9f057671-0596-4104-9c78-148edd3493fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198539, "uuid": "106e75f1-5e12-4981-bdcf-b3aed9312760", "value": "SecuriteInfo.com.Trojan.PackedNET.3586.8726.2501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8bfac2-6584-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175403, "uuid": "a083ae09-e8d8-4c3b-aabb-172e9327f614", "comment": "Malware payload (Mirai)", "value": "153ec5d6f61209e9cd9272eb6cc83b53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175403, "uuid": "6f9b51a1-78de-40cd-aacd-c4e0dc4b1106", "comment": "Malware payload (Mirai)", "value": "577b2a04927951b5e67347a778afc853d82ed22ae81798e3c4ab48c696f35325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175403, "uuid": "1ee7d40e-b936-4ffb-821a-4c2c6cb6850e", "comment": "Malware payload (Mirai)", "value": "c2903ab5c58c3d9388978205934ab880653fed19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175403, "uuid": "90c207b2-ff3c-47f1-8e0c-85b76914c185", "comment": "Malware payload (Mirai)", "value": "ecd54750b08376e69cd46bcfab956d43f0375721264e807bbca7adab1d47fa61483a7a812bf77d71468ebeba9e888d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175403, "uuid": "21391395-4a22-4ebd-97fc-b88880eb4de9", "value": "T137C31A96F841CB12C6D166BAFF5E528C33230B78C3ED31069D256F3467EB95A4E3A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175403, "uuid": "d24ce834-f495-4a22-a8aa-ad610f0ea757", "value": "3072:u2MHz/UpBpVCm5zgx5NBrisRoCN8PZCPZ5EaXKJ2:u2MTcpBnCm5zg3NBtB0ZCPZiNJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175403, "uuid": "db9bbde6-a4ef-4570-bc0e-a4a6f61e1813", "value": 127780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175403, "uuid": "51c15907-94f1-4686-9b34-8f4282480297", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175403, "uuid": "6830fe07-75a8-46d1-ba2e-e0a2b8a035c6", "value": "xnxnxnxnxnxnxnxnarmxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb1849c-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781188885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188885, "uuid": "05aedf7a-f100-4843-af6d-f398c33fa898", "comment": "Malware payload (Formbook)", "value": "20239cf895cafb48c3ba53fc506796d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188885, "uuid": "f1395efc-170e-4ec8-908a-a9842a8f1c90", "comment": "Malware payload (Formbook)", "value": "58d435f0675c233194f5515a2a04d1f1b0cf1c94d4a67f6f6c6220dfc99e8292", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188885, "uuid": "886273eb-be22-4127-ad78-6472ac991ff2", "comment": "Malware payload (Formbook)", "value": "d2543c978581092b1dde6c07757dee74fcb3cebe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188885, "uuid": "d3eb2c11-7e46-4bf4-ac26-2408f81c0ead", "comment": "Malware payload (Formbook)", "value": "2f665daf8f3dc42fec3d4b9a231fffe963e8186e612681be55725c6cac23b965b9f4a58914b7c429deb1d9dbac01f897", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188885, "uuid": "04772257-d3b9-4df4-8206-b2c4e3d67d08", "value": "T1ACE55B17D66F9B4E180D3B61106A5D9AFE89CAFCEF726BC4E08F90B510EE1100B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188885, "uuid": "c9614305-6e45-4153-bdca-bd2d5d1ec832", "value": "49152:tumMf6SVs5JCOzMQKUpISdcznd/8EHu3slPYVVV3cVuawuUIrKM0knolhk0FRA0Y:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188885, "uuid": "ce544e35-8424-4155-bd43-4368518333b2", "value": 3070548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188885, "uuid": "6b7a775d-1344-42cd-b030-aa5c5d1aa9d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188885, "uuid": "5085aca2-fc24-4002-865e-938471b5ad94", "value": "GLD-QTN-10422.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3365826-6583-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175174, "uuid": "df321d48-50ff-45ed-b255-a3ca465d3e52", "comment": "Malware payload (Mirai)", "value": "d4eb988b2c468e024e7f10753465014c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175174, "uuid": "a2bff9f4-d052-4b96-8d6a-0efb148ef19b", "comment": "Malware payload (Mirai)", "value": "58fde1db63f97c1d95f60a86d1df0bee17e213981e524dd581878e23524daab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175174, "uuid": "a75f1358-1632-471b-852c-bd05da75702a", "comment": "Malware payload (Mirai)", "value": "86193a399f92ed802539889ea7f85495dde791c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175174, "uuid": "8f1907de-f967-43d2-88f4-f9e0aa352750", "comment": "Malware payload (Mirai)", "value": "79ad7f465f5a053eef5befca98f230f5d52888ae7b1b068d85b852a610ec513f029504edbec012e754b4872d83d72908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175174, "uuid": "c7ca523f-8766-4ca9-9690-fee6d3323871", "value": "T114631995B9A2889BC6C4177ABB1E9789335363F5C2EF3713C9140B51A2CE91F0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175174, "uuid": "a57c02b6-fcfc-4620-aa9a-9a13a878f64d", "value": "768:Kz4Q0PLZY54EcUWrIUo/UGSJO0PnZ1v17ffAaabEeOoThmlYimb24bDlbQTWtfFE:KsQEZ8rWVoGJ9h1vBgRjOoVIP7ubyWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175174, "uuid": "bdad0d27-cf66-4fc7-a019-11265a767d4a", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175174, "uuid": "00930e15-b511-4779-93cd-17c44fe24220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175174, "uuid": "ae46e0e5-6d67-41d6-96eb-076547c6b996", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bdf94b-6575-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781169187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169187, "uuid": "02ea6595-5ccb-4073-b024-547bdddebf83", "comment": "Malware payload (Mirai)", "value": "c3e2b917833fcc9f7bb412693c1a6944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169187, "uuid": "19e0fb88-9ab2-4edc-8a5f-e04fd0f22428", "comment": "Malware payload (Mirai)", "value": "59547c577b51a50dea9c15efa087748e5f4f979a2996a95e22a7c5f66eed7d81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169187, "uuid": "e770bc6e-8ea3-418c-babb-fa0ddff7409f", "comment": "Malware payload (Mirai)", "value": "ba3c37ec3c15007be40d1154dbf26b94bcdd490c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169187, "uuid": "7f577f2b-fbb3-4c88-a6a8-06de60478d84", "comment": "Malware payload (Mirai)", "value": "d231b8309df3d4746f463f4cb8a2fc57089e5a1e4d3a0835b881d5d014a2021b3922b64735d4aeece5f883fd89336db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169187, "uuid": "be21bb31-a844-4c44-93a4-76a3ef67304e", "value": "T1F8B30942BD518B13C5C321F6FBAE42583B136B78D7EA3102ED257FA0278B9DA0E67511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169187, "uuid": "bdba1bf6-d541-4a5c-9924-48e07a54b8bf", "value": "1536:iOZPzj0lLcFoNs++qpDGY60f1T5U+j6dtbZxZx1cPW9+bbbOv0L/MI8QIeleznUU:/PzIlLcwGqdG+mndrx1cO818eKGB6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169187, "uuid": "73a6ac4a-fca8-4793-b96c-9f19630891fb", "value": 117620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169187, "uuid": "7ab6733d-b97a-4009-889e-20e5bf5f1151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169187, "uuid": "a502c7a5-434d-43bc-b454-73ae8e5d250e", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0089f93-6537-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781142608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142608, "uuid": "a8371d35-8ed5-4a08-90ed-a980909c1c36", "comment": "Malware payload (Mirai)", "value": "4eb77e8729621bcb1f8eff72633e744f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142608, "uuid": "05ea2b47-2451-4611-b0fa-694a280a1f89", "comment": "Malware payload (Mirai)", "value": "59cd06cad360e61d27b1112fa03b0fa88968679c59792d57871a4c46d9d818ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142608, "uuid": "18984d5c-e31c-4edb-b2f2-77eadb0156d2", "comment": "Malware payload (Mirai)", "value": "81f609f3b4cdc9e6db330ad79e8bcff7092de46f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142608, "uuid": "e05016d5-a9ee-407b-b42c-de8206286839", "comment": "Malware payload (Mirai)", "value": "3c4d09415012c922d8a10a6700534496ef9b6bf89a3c8fcff4d64749ecb979b82562934de3623c9f3b9638b7832e3abe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142608, "uuid": "ec1f77e9-c87d-470e-817c-ec4337e1b730", "value": "T171F35C17B4C090FDC8D9C6B48FEAE12ADA72B45D6138725B27C46F262E5DF202F1E650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142608, "uuid": "ee9195fe-e71e-44e7-bfbd-16359f19cff4", "value": "3072:QTw6VU8HKXCK/kLuI2DzoiIEnaxkfjRNLsNBAssy1nXw5F2VjkbJn94RJE:MwOgCEkL1Qr0qCnewQqRJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142608, "uuid": "57614acd-5114-40d9-9b62-57a15255f53c", "value": 159496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142608, "uuid": "b6e145bb-2c2b-4ab1-b900-2e87d21b0815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142608, "uuid": "aac89a60-2439-43ec-8659-ae4b571d3f6a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747ba265-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166909, "uuid": "d2865d52-4415-45ef-9f6a-8e0dbc182db5", "comment": "Malware payload (Mirai)", "value": "08d4a480fd13570b857982e643c14fe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166909, "uuid": "5a2d681b-4304-459e-ab3c-3b68a937a275", "comment": "Malware payload (Mirai)", "value": "5a0840101ac00fdd23708daecec52afa780602a21600d41202082d9d3e2d8aec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166909, "uuid": "712ea138-697a-4fe4-b6b4-33154b592446", "comment": "Malware payload (Mirai)", "value": "7d3a50708d5a9e4985373b009161f57353870afd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166909, "uuid": "5a1c74b6-8328-4c51-85ec-4feb1ae83489", "comment": "Malware payload (Mirai)", "value": "2a12feb5f717e6e718d855d51196849e4bce8699867cdd6ee8b621a21ae430cdb1589553d0221dde6000578af167d6f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166909, "uuid": "aededadd-491b-46ec-bf4e-68c02042c7f7", "value": "T18DC3080ABF721EB7D4AFCD3345A9474A289D660721A53B793674D81CF21B28F1AD3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166909, "uuid": "7b71ec97-78c7-4856-ade0-5fc0f9af99b6", "value": "1536:kQoK5YIBpxA19709audxxZM0xWQQ+BoLcdPb8TJJ5fMoO95aqyhAexp20PS7UgRM:k3I7dxxZMbxU7pZWzfY52SN1if", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166909, "uuid": "3009529f-2859-48d6-8f65-b0ae24f48301", "value": 119944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166909, "uuid": "dd0908d2-0433-45ae-b9d4-923bb0091272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166909, "uuid": "7139e353-05cd-46e9-b7c4-c596334634a6", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868bd80a-65cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206023, "uuid": "bc4a90a8-840c-4820-8f6d-dfb4f91cc9ad", "comment": "Malware payload", "value": "413fdadebcd95e91c36dde4a912b66e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206023, "uuid": "74573ca3-5f8c-42ac-818c-85f176f84942", "comment": "Malware payload", "value": "5b3a86479019b9017c51ff5395bc72a96e97f9ae191378dc79f2ef96a64f77e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206023, "uuid": "e77ac87c-d0ca-4393-969f-f94ab424dadc", "comment": "Malware payload", "value": "40f40ab72df6f4fc636675b8e344cd75babc6114", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206023, "uuid": "d2e89490-9b91-4594-8990-a2d1d7bfbe77", "comment": "Malware payload", "value": "48ddb6009b0d17d708744d214f9b77c1ac1fa3980c44e4fd78e534986535cd647647fb87eb5545e8e549dcafcb386946", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206023, "uuid": "48055215-9da5-470e-ad59-26303786d3d4", "value": "T1BF929523679A0AF2245C06794E8B1106631952CB02547C2C7BFEB3146FA5B2ED3F3A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206023, "uuid": "bc0f972a-09a2-4ca6-a233-85e7d3d461cf", "value": "192:tIWX4UIguGGdXrvmFMPqNLRyFGa15mv10uOz7OqGz19r8aiFVKFYrq9nMNt8Ifwn:NX4ouGQvg8sNyu/vr8aiORijPX8BFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206023, "uuid": "748b738e-fff1-42ae-9d9b-5a3c7b82ef0f", "value": 19862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206023, "uuid": "117532e4-0e50-4b70-9109-babedfee56db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206023, "uuid": "9d275460-994f-4a66-9b81-16e8fb507e2d", "value": "5b3a86479019b9017c51ff5395bc72a96e97f9ae191378dc79f2ef96a64f77e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbfb820-653b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781144050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144050, "uuid": "a256124a-d08a-4c1a-aec8-98f0864ec0b5", "comment": "Malware payload", "value": "11b716be4162fad4143a5afd9b530ad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144050, "uuid": "34fc3267-698d-45c9-895d-f5c47b268077", "comment": "Malware payload", "value": "5b431370067c409861698f438c6506b25443dce81ba384b92ba9c2e180e882cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144050, "uuid": "74fa1ec3-07cf-48d1-93a0-53c41fdcf5aa", "comment": "Malware payload", "value": "1668807b45709581e6c3514d48e2eb79e9e21fca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144050, "uuid": "70150043-c702-4e2f-a115-eaed019ffac6", "comment": "Malware payload", "value": "33342dce02f97190d347baffea96662ca50cc446b2af4e3d38885835d31d4fd56776a892d9e5e3eaaeffb990b68b9b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144050, "uuid": "e4afe27a-11a6-4d2f-a3a8-63ed4023a177", "value": "T178F32A05B31D0943E2673EF0373B27E1D3EF9A8121E8F644255FAA8991B2D321589DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144050, "uuid": "9430834c-3ec0-4765-9448-0f9d7ad3f405", "value": "1536:lFWDVJHLfqW0r8AXnRdiTlvCJFk2zHBQxwLWNPWYuZX9kOTxvwGUZMYycvAEn7wf:limHR0lvCJFVQxx0vwuJEIEn8+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781144050, "uuid": "ee97d1ca-e2df-45ea-9c6f-1133ec9d3265", "value": 159568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781144050, "uuid": "fac1a3a4-2244-423f-9284-c12a0ac56ac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144050, "uuid": "814ac103-46a0-4d10-a049-5edcb875a46a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcf9f8c-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207247, "uuid": "0794ef2f-0e6d-488a-92ff-5834979eaed8", "comment": "Malware payload", "value": "7300d2bfcbc30af8aea06bc651ab5a2c", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207247, "uuid": "7fb96af8-4776-4a51-92c2-18add41ad57e", "comment": "Malware payload", "value": "5cfb89dc45f3a80797038d7fe7f39683eb696c478047860bf3034c286456fd59", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207247, "uuid": "99f9afb9-5c8b-4277-a349-3c2b58ff1a5d", "comment": "Malware payload", "value": "f5391c6187237ca757d21ae3a8a13e5ce9ba70fe", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207247, "uuid": "114ab081-8ee6-4d26-9fa6-cbc2302642be", "comment": "Malware payload", "value": "665cae9ff57a82fe19519f0786a6e8d1e6834154533ff740dbfd04a0599801f2feb625651697e4853b1985da5570ff0b", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207247, "uuid": "386112a7-36b0-4e3e-bb94-602c26de7c4f", "value": "T143912E1177F8562DF2BB4BB91973930016B6FD519A32C3AF0984205C5CB13859E61F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207247, "uuid": "fd3682d1-2ddd-4c85-9d50-73107e82b4a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207247, "uuid": "b75f7b96-9c93-4263-97fb-d1ecde1241c5", "value": "48:6iygls7w14GcjbSQYTKbOCnolGyfPOhm9w1Mb/grZWewxCPvqtEOPulUU0lAWI:blAtHPo1Ghz1McZLwWIsyU0lA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207247, "uuid": "d7b15f46-c2b3-4e16-87c0-26a460d02661", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207247, "uuid": "aefbbff5-950b-477e-9bf8-8df7d89fabcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207247, "uuid": "55c63c78-1cec-4a25-ba05-5e49156ec077", "value": "gpr2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97c98ef-658f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1781180339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180339, "uuid": "ed97286b-3904-4b7c-b8c1-9d9a36ad23bb", "comment": "Malware payload (PhantomGate)", "value": "03892acb688c5b35f9ee9de3dab6bd21", "object_relation": "md5", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180339, "uuid": "56099753-5171-479b-957e-e651631875c3", "comment": "Malware payload (PhantomGate)", "value": "5d64566f33c94d1299c519ca906ac691aee8f0dcbdbc857e4c70d6dcef24bf84", "object_relation": "sha256", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180339, "uuid": "90da6672-1aa0-473d-b220-580981d33156", "comment": "Malware payload (PhantomGate)", "value": "dbd30d9333906f6e8015a7a5b136cc893ba851d0", "object_relation": "sha1", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180339, "uuid": "3890afa6-6cac-46f2-adfa-65fb46405583", "comment": "Malware payload (PhantomGate)", "value": "6cbfa9c698a1c3b06ecb600ea8934d3b300a3f146ae4dedb12a6c66232901897834f3a7d25659a224de2ec123f9b7424", "object_relation": "sha3-384", "Tag": [ { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180339, "uuid": "fd2f989b-418f-4cf2-82c6-e519a98f9762", "value": "T12C4149141BE61314D2B3CB39B8BAB31585763C56EE22CF9D029062CC6474224F576F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180339, "uuid": "064dd363-68f6-4ea4-be43-d9e89a185188", "value": "24:8y/BHYVKVWL/+/CW16nmyCVmgyAoq3UMkWIpj+/QT4I02rab7Oa:8+5aq4eVHyAoq3HCfMIFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180339, "uuid": "ccac542c-50a9-4244-9a95-3d7f5392297a", "value": 2214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180339, "uuid": "64decc15-1ca9-4425-a513-2d5b9c407db1", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180339, "uuid": "ae83e2cb-2c47-4e54-b2ec-f55a9ffc82e1", "value": "Video.link", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e0dbf0-652b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781137390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781137390, "uuid": "faef43c8-19f5-46d6-964d-debb3f98b271", "comment": "Malware payload", "value": "111cdd51e49cae2e8213cfe4bdf7bd0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781137390, "uuid": "e8f041ac-fa05-44c9-a954-3a28f6dbf2f9", "comment": "Malware payload", "value": "5fbb7ac2610cb8f8f9d042e594a74b652841c74dd8714fd2bb4dcc3c0a9eb416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781137390, "uuid": "542c08e0-08d6-4910-889a-2e410721af15", "comment": "Malware payload", "value": "d24ccddbb9111f02baa00044bb78ed81ba476b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781137390, "uuid": "156e69b5-35c6-447e-bf86-f030bd8ca6f4", "comment": "Malware payload", "value": "7ab8355819ad104022cf64f9c7a25f3e6f44c6d57edcb699a66fdf7d5545117747b88143020fc7b6a24aa3b63ca622c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781137390, "uuid": "d3cab49d-5a79-41b9-9d25-e698c5d9be16", "value": "T1F414754E6E228F6EF668C73047B74A25D76D33DA26E1D644D1ACC1012E2439E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781137390, "uuid": "a9c0442f-883d-4f82-84c2-bae3319ae30a", "value": "3072:HKo+iyQL/BCmX0WfA3YuBQNV4nFyA/EouPTAMZZNuYsN08Do:Z+iyQL/BCmPfA3TQlMukM9Tsm8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781137390, "uuid": "c7675bcc-e6f7-47b2-adcb-07c3781f3a22", "value": 206104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781137390, "uuid": "2be08ccf-c7d3-439f-b8fe-c0fc5dd3c9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781137390, "uuid": "bb98d5ab-417b-4522-a7f1-6856619431a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cdad4c-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781188924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188924, "uuid": "7aaf2355-7b85-412c-a22d-352f478024ef", "comment": "Malware payload (Mirai)", "value": "44e7217424d6ca387450557c020cbc3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188924, "uuid": "97d98e9e-e813-4ec8-a40f-70c2831e1cab", "comment": "Malware payload (Mirai)", "value": "5fbe02421d2a64401d7fa66a68dbc0833cd405512331a64919fb831887a5d5fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188924, "uuid": "66fea7fe-b053-4ce4-8461-780922dbc50f", "comment": "Malware payload (Mirai)", "value": "3840b39a0bcf86c101dc3735573218ba2d69b46c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188924, "uuid": "402fa167-b1a4-4e4a-8a0f-1e23e8054ef7", "comment": "Malware payload (Mirai)", "value": "318d64496f3aa71473db9edc58786461d74a17de5566c81d852218a40d80859bb977d771ce395a71faa1cce741c5a4cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188924, "uuid": "023f766c-12fa-4223-ad6a-c14e75e8b356", "value": "T14E4302A8D8857864C7EDCDFE609A713E50586310F29D1F60BB15CE893833BE7B448679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188924, "uuid": "ef800d1b-8026-408c-b32d-870f79d613bf", "value": "1536:nRUmQ8ZvpGInm/0hyYE0gTeGltv3M96D4mqbYcGlLYN:nRUWZvpGInkygTjltvfD4mqbYflMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188924, "uuid": "c4b1b55e-7cf5-4c34-afa0-2c87e944fb38", "value": 58012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188924, "uuid": "645e4c7e-bab7-46e3-b228-f7b8e58eea13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188924, "uuid": "ca6cb643-3057-4c82-ad4a-0c4c41bee847", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bebe2e-655c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781158376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158376, "uuid": "f9528c35-7acb-4878-9031-a036b46fe538", "comment": "Malware payload (RemcosRAT)", "value": "e1898150887bf933a314dc4056344ae5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158376, "uuid": "17fedb7f-ecb7-47a4-8df4-6e34bd830ce7", "comment": "Malware payload (RemcosRAT)", "value": "614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158376, "uuid": "70d2db44-d138-459b-a142-5c3eab42d46c", "comment": "Malware payload (RemcosRAT)", "value": "0fa4f9dd0ac18eea0bbe005f51009b613a49f556", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158376, "uuid": "5a1aced6-cbce-43f2-a941-9c8a09cb554c", "comment": "Malware payload (RemcosRAT)", "value": "8014f6947bfda4747ec13f013d8d7fbfa535a8ab7cf18cf7e24d76328269b38502d4f7abe71c86c7e56c323cb0da0a40", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158376, "uuid": "4b3d5f08-75e7-4ba5-95be-70e688541c31", "value": "T195D41EA2DEB7DE3ECB758F314AE28205A7745C52C731CB07A5853139BAE9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158376, "uuid": "94b6a3b6-bd3b-45cc-9c10-8a8d03679977", "value": "6144:GAhr1jRsug+8We0WgeMv9T9H1QGoa4eKwu4KYZ8kVfOWLFg4J8pIbzVFUCuNI+9Y:BDylH4wSoYA8EVZau7yLLw6OrB79I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781158376, "uuid": "b6ab7830-e63d-42d9-b763-96950c85acaa", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781158376, "uuid": "572f8148-7f09-4497-a9b5-38df4eadfd9c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158376, "uuid": "875fa30c-c454-488d-b8ed-44cc30890d8f", "value": "POTHX22-1236.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481b2540-6574-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781168552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168552, "uuid": "25ed1205-3839-435f-915f-d43b9c6173d0", "comment": "Malware payload (Mirai)", "value": "837cb66ec136b4bdd9c5c704634df1a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168552, "uuid": "d64441e2-7963-4011-b9da-8821ad2a837e", "comment": "Malware payload (Mirai)", "value": "617a02cb092e13eb780df29251921a4fdf11ebd83decb2fa47970e37b1ecf457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168552, "uuid": "69a6e7ca-1373-47b4-a3dd-5913b47e9788", "comment": "Malware payload (Mirai)", "value": "68dd019243369ab77802ed1fef1a0db30a233096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168552, "uuid": "3463d50d-09d8-44a4-a36f-0869617fd295", "comment": "Malware payload (Mirai)", "value": "90fd3c36d6854be785c53a2d97bb31e5a8c15077c32265cc563a63c8ae4ccd9b708c56033cbc10e04e91b35c754fd370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168552, "uuid": "445f1b01-762a-43a9-a7c6-6ae4d37e946b", "value": "T19FF3874A6F228F7EF269877047F38E31975977E616E1D680E1ACE5001F602CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168552, "uuid": "62577811-5352-4a48-a572-2d553c66210f", "value": "3072:igQknaIxaFvJwfbEPsRdCtgVgcoA+NACYKWk+:jQknBxOvOfnRdBNv+NoJk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168552, "uuid": "0b051fe3-281a-4ccb-8329-3bc8d451bb2e", "value": 158500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168552, "uuid": "274db5a5-1332-4a5e-a056-0dd957f1bb93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168552, "uuid": "ad8dcfa9-ab8b-4ff6-8be6-65b3c5573967", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a573485c-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184171, "uuid": "ecc05ee1-e32a-4bd7-88ef-69d384a7d5b4", "comment": "Malware payload (Mirai)", "value": "d09fc6cc627d754e902159aa4b06a93d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184171, "uuid": "e55f1b27-9a4d-46b8-aae9-6801f73d9d34", "comment": "Malware payload (Mirai)", "value": "632aaaf356c75ddc812afbf4c9ad75a9120e961b050996ee6ba607e4ea86bacb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184171, "uuid": "e25d5a54-7b5c-461c-8fae-8450b39ca566", "comment": "Malware payload (Mirai)", "value": "06c395b3e8484351b3db5977d069ce2f556ec62d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184171, "uuid": "f2eee381-a620-4481-bcdd-4fbe46321b7e", "comment": "Malware payload (Mirai)", "value": "f448b09ff3e2b2255385aaeba6a8efe777d427bb0cc103e580917369f095e047fccf08e2fe50da5969bd6c0fc708e063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184171, "uuid": "aa251fb9-90b2-44aa-b1a5-e2239e73ec7b", "value": "T117D329AAF950DB62C6D11A7AFB5D528833630B74C3CD3206DD159F3427EB95B0E3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184171, "uuid": "2d1edd55-c16b-4514-a4d8-15e886405178", "value": "3072:sggxNepUKAqX+nNSrkSBTQ1I31MPZi+nWQFy:sgg0AZErkS9Q1IT+nnFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184171, "uuid": "36e66d25-9be8-4b2b-bdab-12cf787e19c6", "value": 132788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184171, "uuid": "4e4c4c91-1fb7-493a-9204-594444d18f36", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184171, "uuid": "a9723032-4ce5-4223-a0e5-f1f3325b695b", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47a8ab4-653f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781145997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145997, "uuid": "316cec14-129d-4a27-8104-df1158441650", "comment": "Malware payload (AgentTesla)", "value": "54bf799435de735ea896acea1dc51524", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145997, "uuid": "8da0b6e3-ce8d-4b18-b609-1d0061663007", "comment": "Malware payload (AgentTesla)", "value": "635752ac8043d5c87aa6265aba7ba824d842c5372eecdd985ab571a0a3c03120", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145997, "uuid": "a7698f8b-6ebe-4b67-89dc-50e4594d876a", "comment": "Malware payload (AgentTesla)", "value": "01a2164d2e447c7a1452f1f085f50ffffadcb95d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145997, "uuid": "e29891a7-7862-405a-ab9e-e5beabd2a506", "comment": "Malware payload (AgentTesla)", "value": "5e9b78aa6c24e8e982b38e08058af4f1a578775415f2dcf54634bbbd453c10e1f858ae00051b79bc8d3e40fbf614c982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145997, "uuid": "b0fb1bbe-e953-4fbe-85ec-7b1c13edcca4", "value": "T1FEA55C17D66F974D180E3B61106A5D9AFE89CEFCEF726BC4E08F90B214EA1110B851B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145997, "uuid": "5dc89638-fd6e-4865-9b2b-0a9661e4152b", "value": "49152:q1SWZyu2QmKUT21jdOXkyiUaFUyC4tYJXuc5/uR8CpPBfnSDy4Hi:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781145997, "uuid": "fd3f5079-27c0-4dca-8c4c-602e4a4ffa1d", "value": 2136535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781145997, "uuid": "e3cea679-9f93-41a5-af9f-2e612492c1a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145997, "uuid": "21884ce7-8cfc-492e-a63c-09155644a3ac", "value": "Vessel_Main_Particularspdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d44c0c-6579-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781170879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170879, "uuid": "7243ad87-ed62-43af-9928-b6db528e00fe", "comment": "Malware payload", "value": "247247182c78763256a363d46fac3e53", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170879, "uuid": "cba12599-6c63-4516-b4ef-c059efdaf047", "comment": "Malware payload", "value": "6384e5655436b6d66b3d9d208b589135b258b5ec14149a2e8e83caaae952861d", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170879, "uuid": "98790629-b88e-4c27-9996-4bab905f170c", "comment": "Malware payload", "value": "5f2973acfca90b82153fc043319f9328696a059b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170879, "uuid": "68c534be-a0a9-4d94-8b39-b876e66e902b", "comment": "Malware payload", "value": "b719abca196e560f65c7ee93f88ff6205d5239ba02efdfbfd8c7377d631cb3ba30ad6998c2973317957ede12654b4365", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170879, "uuid": "dfd091a5-e626-4c63-be44-4bcbe0ef911d", "value": "T11AA4E005B7F500F6D27B8578D9521902EF72FC4617609ADB57800BA61E37AE0AF3E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170879, "uuid": "45ddbd88-0d95-4d96-8fd3-0bdb748e2018", "value": "bc9ef82c0da7dcffb60805858eeaa4e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170879, "uuid": "3df2945c-080f-44c5-85c0-9cd33a90e6e3", "value": "12288:Ry2H+7BMOTt3eRJiJEwB+Q/TRGgQ9T3GhY:4y+7mNREJEwn/TRlQ9TWhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781170879, "uuid": "b7dbc3d4-88a3-4240-ba66-fd8eece6a606", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781170879, "uuid": "520a6e65-094d-4ac2-b2cc-caa5d462c358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170879, "uuid": "3e40f576-4733-4514-801e-693289e38275", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544d4ac5-6593-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781181887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181887, "uuid": "b8df5c93-8d87-425c-947b-3e4d684f4b72", "comment": "Malware payload", "value": "bc516e380068b9938551a1a6803fbfda", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181887, "uuid": "d5a40e36-bc1e-4703-a36b-75da0d7c7c95", "comment": "Malware payload", "value": "6435c4ebe179630031b945e2a71acf4af8ea0bf1f4c17348b6c381c1bbee6c10", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181887, "uuid": "ec667d14-66da-4682-9fdb-203ff104dc92", "comment": "Malware payload", "value": "bcbe8e367e486be2b585d178c61bc6c5e46998fb", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181887, "uuid": "653e6288-933e-45e4-836e-aafe4b265935", "comment": "Malware payload", "value": "239f4fce43b7239f05be795b9d54995c21ad91af10394c9df092fd744e8f38999675f9568a0693bb7a32d474181df22a", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181887, "uuid": "16f95a0c-0d79-4dc3-bcff-3174e7cb0421", "value": "T1F75575202BEE1019F573AE71CBE8B692BB6FF7E33606E9DD1400434E5222946DED4539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181887, "uuid": "e05d15af-5250-4dac-94ac-3573d7a42394", "value": "12288:tJ67VzsteGP4DerTsp6gmfsJV7PPnEe+72UWEUxDrsVaB7JP+KKfk6ofT7BDnNqR:tJR0Dp6uLYviSoBlNXhdFN9MSQp1jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781181887, "uuid": "c90b232c-5c9a-465e-8bd7-24c6c52ef9b3", "value": 1407488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781181887, "uuid": "704ea7b7-0993-4cec-a23c-e670e95f6e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181887, "uuid": "50c3c19f-e59f-46ae-9af4-4ec67b1923dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb723748-6538-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781142976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142976, "uuid": "52fc55f8-d6fb-4bac-8850-edc7ed270a46", "comment": "Malware payload", "value": "56beb058a0213c8983b61d18b0cbb05a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142976, "uuid": "d86eed76-3392-461e-8352-b936a7739526", "comment": "Malware payload", "value": "64bda4421e92c7574bf068a52ce8c77af7be2afa48faf1689c7b347762a29b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142976, "uuid": "f335867e-4170-464c-8dc3-bfa8daef913c", "comment": "Malware payload", "value": "9b98ed8f79fcc318b05bbabdb2bd988d336bc273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142976, "uuid": "eeb8fc30-aba8-4be2-b175-3947198801b4", "comment": "Malware payload", "value": "80a58c538b38d4b7eb6fe3862f397a4bb83994014effbe37873ba8810a990afafde1cfc20947bf70f7f648764d9fa811", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142976, "uuid": "a71a6513-7135-4fd9-bc0e-d02aa5baae96", "value": "T1DCB309657BBA0A1BC5D4B47A72F34222F2B5C78910BCCA173EA10E4D6FE964031277E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142976, "uuid": "f32949cd-ad01-4868-9a66-1154e9d8f4ce", "value": "1536:2I/NGx55N7ML4FeP8pCP/3dBAMvbNZX96t1Orxu5LqtVQtenANr:ZFGxcPcvOFWW3Por", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142976, "uuid": "65006ed1-cae1-4716-951c-445f01350741", "value": 108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142976, "uuid": "f71dc7d8-97b6-4e02-9b52-b7243f057ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142976, "uuid": "bcf5128f-11f5-4f0d-b8fb-7a93b85dce08", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbf43e4-65a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781188453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188453, "uuid": "9bd3c821-a229-41fc-9287-da128e81f444", "comment": "Malware payload (Formbook)", "value": "4e1b1941ffee9c47595882bc50aecb4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188453, "uuid": "adc175e6-4657-495b-9591-5dd13d660857", "comment": "Malware payload (Formbook)", "value": "671c99fe3edc789c6f5995507a8745a1e0137e03346f31ffbe4092289931631d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188453, "uuid": "996b1da3-6246-4d97-b7f2-3eca7555bb89", "comment": "Malware payload (Formbook)", "value": "654f65cf34567ad08078981f1e29986517972e45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188453, "uuid": "06aabf68-b717-43cf-ba31-8cf3417a3ea0", "comment": "Malware payload (Formbook)", "value": "f03e05b58be69e1a9ab6fc76c5d8302354419ea5945ceaabf904b475e09fb36e43cff6eb1d030e5cb957fdf5f5a69901", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188453, "uuid": "79f74ec0-67bc-4b3b-83d8-b9d796e9b2c6", "value": "T1C3E55B17C66F9B4D180E3B61106A5D9AFE89CAFCEF726BC4E08F90B510EE1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188453, "uuid": "2869fe40-c818-4303-9d35-a1d2da1644fd", "value": "49152:zGP9FkhTHCLrblmm6y4s5aIW2//1RQiW5ZtztAzpk6b7m+sPPeQ3NuOVcBNJx+s4:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188453, "uuid": "21a45222-ca6f-4f4c-8b72-c2fc66906b5d", "value": 3068132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188453, "uuid": "aac53b4c-f3cb-481f-ba6b-1ba9f230e4e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188453, "uuid": "94f6fd46-e4ae-43dd-9547-ca862c91632c", "value": "Swift_USD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34b7330-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206984, "uuid": "bf604263-5d0e-40fc-afd8-d51be5ccba17", "comment": "Malware payload", "value": "48612175b35d911a274a297f5e941a0d", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206984, "uuid": "c540f546-7592-487b-94e1-8b08f36c249c", "comment": "Malware payload", "value": "677ed2c06146541d2d2c73fe3a1435d8214ba66f6b60e7642aba8fe843a8dca8", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206984, "uuid": "4fdc4cb4-059f-4531-b952-89c89e3c944d", "comment": "Malware payload", "value": "ab0b9032e74442fcb5b14ea41b1dc6dbf9ffc0cf", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206984, "uuid": "a4a8f8f2-624c-4821-aa97-a0e83992686c", "comment": "Malware payload", "value": "2d504875e9e0b914a774afa15ee95f5a105c7af5c21c26687c9a6438b323ca4111138745aa0dc83bda3bbe5f28bd0cb2", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206984, "uuid": "c4b10873-dfb8-4202-ac8d-98c3840724e9", "value": "T1A2E1C651ABEC0962F5BF0B3968F307021A72B8420F36C76F09D951AE2D31B454B317B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206984, "uuid": "ced192bc-592e-4070-b9a8-3d6866be099b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206984, "uuid": "ba135c83-c5b4-4cb0-9e40-e8c812b52faa", "value": "96:LkSgPyYDeEMW41KHlFY4GfL6mZ/j5iJE35qBzammidIrMQRIVa7mW0a6:oP/5v40HlJIZjowezvGr8NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206984, "uuid": "fed889a9-056b-47db-80d2-be6b595181a4", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206984, "uuid": "a6827b51-b3da-4bd3-8ab9-7685de543ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206984, "uuid": "1a40b500-cf19-4ef6-bff9-a27a1bdda970", "value": "exploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6795a78a-65a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187503, "uuid": "2a9d5877-f8ee-43c1-b92c-a277dc682d17", "comment": "Malware payload (Mirai)", "value": "38121c1ac08404d61e829aa0e6821308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187503, "uuid": "c09fec10-9b75-43fc-a808-73170512af24", "comment": "Malware payload (Mirai)", "value": "67f2b3f4a6d3e9a00651dfc79e1893c0022a00ff80cc103028f406e7bf2ace92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187503, "uuid": "8d1f906a-1ae0-4eb4-8e34-3d78e70337a5", "comment": "Malware payload (Mirai)", "value": "097582a108f40ea1a2f50649d1a1531b64a2d318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187503, "uuid": "28dd62c0-368d-4d90-b118-545b2aabdacf", "comment": "Malware payload (Mirai)", "value": "eb5eb48e16ae4f4f7818659c2ae6fe5cd68902b42d648f2839818b98c2e9bcf3ad6dec280a46cdf4bbfae49c466edfb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187503, "uuid": "a21ea558-1009-49da-98f4-9140e8ac0c4f", "value": "T111933B4BEF42DEB3E11310F112A7AB618971F97F1C27D182E3247DA0DD562C19A1A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187503, "uuid": "8481a3ad-ec2f-47f2-b061-3d03997b1083", "value": "1536:F4R65QD4/9c61CX9Vph6V8n6SlQlVMKlPOsZjXVsmLKHbGOgQYJ3NZNkg8:SoyycbtVph6V8+lVhdXnLyoJ3NZNH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187503, "uuid": "c672f3c3-fd42-4617-89c8-4d0eee96dff4", "value": 91248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187503, "uuid": "0104d805-77e9-4cd3-9591-e659fbba02be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187503, "uuid": "1a5d0f6c-f222-428a-ab49-6372e106dba1", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8b33cd-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1781207055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207055, "uuid": "60127450-3624-4082-8cb6-e6f10ee999be", "comment": "Malware payload (FRP)", "value": "e06aacd6139288d5bea4a676ee0c2404", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207055, "uuid": "cb0670b0-73e0-4391-be0a-07b49b4a7300", "comment": "Malware payload (FRP)", "value": "68a34fd6765d3a6d791e83c29e783fbe585579e08ea1ad569962e6644a3197a3", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207055, "uuid": "fd9cd0a0-b2c1-4257-9ab9-6a1851d89597", "comment": "Malware payload (FRP)", "value": "8314be1136b9d1fc76350f1c7ef4cf8fe52a4acb", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207055, "uuid": "c4cb0ebd-ca4d-444d-b0af-323b03fc75f0", "comment": "Malware payload (FRP)", "value": "fb48f9dd2cc5b5b31901af3b73afe8b9b416cefd312f3d4fc0d1072db5556a84a82bfa6f56f7d2896a90fcea7bf2b640", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207055, "uuid": "0d5c0d02-0665-48c1-950d-6283806f0977", "value": "T109F66B57E8A201F4C1ADD234C5A68263BF317C495B3127D72B50F6283F76BD0AABA750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207055, "uuid": "7fddec90-8a75-4369-ba42-bc19709c0f90", "value": "b196866f0bf37f1f128fa153413b744f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207055, "uuid": "b16a1a4c-0b71-44e8-9910-1742ceac3bbc", "value": "98304:3tCB9kT0DOgSppogSn41ZbhqkE8E/k2qvPJzfN3KAlA2rWr:dUvSpppdqd8EK3/lAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207055, "uuid": "8456ba75-4485-47e2-922e-98a9d6493fba", "value": 15403520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207055, "uuid": "3e99537a-edae-431a-b2e5-b5cde10699de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207055, "uuid": "87f76ef3-dff4-4b7e-b57d-a5e17feafd2d", "value": "frpc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224ede31-6573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781168059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168059, "uuid": "620bac28-3194-496d-85cb-da0649c4365a", "comment": "Malware payload", "value": "5b2fb4f68dce093f65ddeb4552d7f1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168059, "uuid": "2bac7f8d-72b0-41b4-87c7-64046018ba17", "comment": "Malware payload", "value": "68a639621b556f8b3e9cdfb694867ce2895a856702fb440f01c1c67aa05ac60c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168059, "uuid": "6827621c-30b0-4f34-8dea-30fc6f515a74", "comment": "Malware payload", "value": "8d5478f0391aecafb2f033c7e005e113bb5e41f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168059, "uuid": "f042ef17-601f-4246-be51-ef26e5c663e9", "comment": "Malware payload", "value": "7d3f1bf0acb32469327ec3336919f08fc4eec5d4c6ea016c8cef50f3ab38bb78dd315d80770fedf3e80707d10230417d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168059, "uuid": "1470fa48-1b6e-4113-ad82-5a2f6413861d", "value": "T13CA44A25BC819B91DAD16EBFFB5E824833130B7CE3EE7111DE155B3126DB84A0E7A442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168059, "uuid": "46ee895d-2b2c-4acc-8db9-dcee7abb2dd3", "value": "12288:EAPU5wPsJwiZsP2rbWr2FxZOWS+9DofGgGROsIaHJeCCni2+zE:FP6CNi/WrsKGomI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168059, "uuid": "d6d860cb-af9e-4ad4-85dc-bf5332afacea", "value": 454100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168059, "uuid": "21e57bfa-f1cd-4585-b06d-cee5c514f317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168059, "uuid": "7f324fb9-369d-49a1-aa05-15bfd2eee76e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7af75d-6596-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781183167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183167, "uuid": "4f3854d5-ef3f-494c-9339-45a067f4a706", "comment": "Malware payload", "value": "527143afde65c76eefb872b0916464fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183167, "uuid": "17b43389-9782-4c2b-83a6-bf9991a4a36c", "comment": "Malware payload", "value": "69914a875517cb21fa53a6959c009f394334fdb80bb432899f8ffd06229d6389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183167, "uuid": "b5cf7d9a-d397-4c62-8ccd-56a305f49d9d", "comment": "Malware payload", "value": "33b0e248b6374e94e053eacb77ffdfad4716d2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183167, "uuid": "65c46fbf-474c-46ef-b55f-5ae19ea02fe0", "comment": "Malware payload", "value": "fa7a0dff6314c2e1a3a3d5ef89b5dd41d81a9055eccdc8e88d24cc9da0b18d83592f1773d5ff8f53d65ca55e0386918f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183167, "uuid": "14b0700e-4275-4030-8088-fde612fcd9c7", "value": "T19B22F809BBE94231E4BE8B384D7393101673FA05D933DF9D9DC8219E5C726419C92BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183167, "uuid": "98b14359-0a85-40be-9405-84d90aeec448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183167, "uuid": "78ba9534-e98a-4609-9299-091ad37d4943", "value": "192:v19jTFGJkTlFQtgMzgV9LYZw6paOaC9RZY5by2p3:7AkZitny9sZw+aOaC9RAbyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781183167, "uuid": "17b87045-6043-4907-94c2-e2b719dc5ba3", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781183167, "uuid": "7affee2b-8172-45c4-98e2-098effa3d2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183167, "uuid": "b82dedf9-ad69-4da5-8586-25afb682b4b8", "value": "rMarinaLauraAl__ciaRocha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c678c5b-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207133, "uuid": "d11d6f0d-3815-4e99-8d53-0b2791ad8906", "comment": "Malware payload", "value": "57d9668e46606846613f5826d96939dd", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207133, "uuid": "b9c84ce7-3dcb-4dee-a5a1-b8e5315ac7b2", "comment": "Malware payload", "value": "6a98cfc62e9ec5913775795b7c5562f504ec05c66f14ceb0604e03a1d6527248", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207133, "uuid": "703cdf61-9463-4910-a1ce-cc0b1f9ad27c", "comment": "Malware payload", "value": "339f16f7c448dfd44d3c5bf4a81cc7ef68f08f51", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207133, "uuid": "74d5ca2c-044a-4196-8c7d-37076a0d5a83", "comment": "Malware payload", "value": "41929cb65be5a041b62630da47e296db6515d92ccd55c21a91fb19fc4edc0bda7e4dbb75864bc9294c27eca4f129261a", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207133, "uuid": "569eee3b-321f-40ef-9030-ce8d228f5726", "value": "T137B141023BF8072AF3FB8F795A734700527ABE129A36D66F09A8114C5C326845E21F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207133, "uuid": "e8f531a1-a8a0-4744-b774-96ba1456294e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207133, "uuid": "20baccf5-5730-4c0c-a515-aff294b0f089", "value": "48:6OMdKxePaapsryfPDJruVw7Q1MbK7PsqiPrB5VdaV7LfFwu33g+OPula0CXI:qKxePaa/rJrFk1EXrB5VsZLfFPhs0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207133, "uuid": "7c454a5a-57b7-4ef8-a6bc-51d5c9a14ba9", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207133, "uuid": "67634f41-8f5d-4d96-b720-4e3c39fbcabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207133, "uuid": "e2207647-faa8-4924-a7fe-e3cfa6982e33", "value": "GodPotatoRunner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbd9bb8-6574-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781168562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168562, "uuid": "161863f7-d8b3-4cbc-b2ed-501ac8efd313", "comment": "Malware payload", "value": "45ecdf2bfda95b60d7f759b6c5fb20d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168562, "uuid": "22e0eb70-3973-40cb-bfad-c568bcd4d328", "comment": "Malware payload", "value": "6d942cef8548437419a8de986fded30b6e0f6c00e6d8348574df30c43b9d87ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168562, "uuid": "bcd3c980-62c7-4025-81c5-347cc49f80a4", "comment": "Malware payload", "value": "d256766d7bcda94812d31a240c1c0296415e51b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168562, "uuid": "74d6e819-8d3f-4107-8d07-784e7a4c342e", "comment": "Malware payload", "value": "3099ce92918f28f748bf4b8cb3df4f29d64eec31880df7a9d809fd778ae3e2be9f47f8889b797f8aa94c987e4a2b4654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168562, "uuid": "51aff9b8-344c-4287-8f37-9d66932c1684", "value": "T152F733454A91A89BF95DD13757E84E52E53B781C28824B4B03E80B793E973C88D7FE70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168562, "uuid": "c9436c98-97c8-42a2-ac5a-059ba0bb5f55", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168562, "uuid": "c5a5a857-47d2-42cf-9d2e-8cf0b3e2c1dc", "value": "1572864:Und1MHru+vWlM9ojCrD4WWJvKSc/JUNnd180oZ/hvXXgzf0pnB:/LpelKbDSc/iFoDhvzpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168562, "uuid": "2e78345f-1917-4ee2-8018-041e43bc0842", "value": 71687205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168562, "uuid": "fd05f7ee-6971-42c9-80a0-0adc4f66b965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168562, "uuid": "7d319e84-e62d-40ff-a733-b3ee0e622eb5", "value": "BAIDENKO_ZELENSKYI.ZOVUA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58c7730-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221242, "uuid": "c21319eb-f68e-4ad6-afcd-4f1e5c1d34a9", "comment": "Malware payload (Mirai)", "value": "1e7be73bfbe1ffa1fd00113f0125096f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221242, "uuid": "7d1244f3-fd3b-47f9-a915-738080678492", "comment": "Malware payload (Mirai)", "value": "6e67d538972ff7741b6648b121727224fb4fbff76ddc8cff61b90bf4ec23a95a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221242, "uuid": "87848011-6f2a-4246-9bd0-aa871cd32d36", "comment": "Malware payload (Mirai)", "value": "778130d5ddcd15a467b28853f92791c5e6918398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221242, "uuid": "3f3f1508-bf22-4013-9cc8-efcce0305579", "comment": "Malware payload (Mirai)", "value": "cca2798be61f7e9875ffc824b1a99f3bf582ee5886cdae30b6b38608381bf144474e1c36ffd8a258a2f9ccdd0e8a93ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221242, "uuid": "40a000a6-2416-4ac4-93cd-2980cfa3a812", "value": "T15143A60D2E61DFBCFFA8863487B78E20964C339627A1C985D15DEA411E7074E341FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221242, "uuid": "877fcfd1-79c2-46cd-b95a-a9d4608c0762", "value": "768:dfd+nQIUeURmhrm5mqJqM/jNq7DgbUG1wGq/JcODJtw+wRYtrD:3cQrchrmwsZUGyGq/Jl/htrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221242, "uuid": "05422a8b-ea34-428d-b2c2-2dcc1ee60f4d", "value": 56208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221242, "uuid": "a4142fc4-3c8f-486f-8004-a915e848c70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221242, "uuid": "4f8d2f86-3a66-49cf-832f-cb43a4cb2695", "value": "zoryn.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02beea95-65d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781211815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211815, "uuid": "a58b74f1-d0ae-4d96-944b-2ff45c221aeb", "comment": "Malware payload (Gafgyt)", "value": "35f3e48e1306b820a9cf7aa61c5f3fd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211815, "uuid": "c441eafc-e5f2-483d-84c0-aa3cea50b6ad", "comment": "Malware payload (Gafgyt)", "value": "701b3b041763cb868e62fbf9921ae0d626922c2f81ebab6a197b97d6dc0c0d3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211815, "uuid": "88c931ed-66a7-4170-9cdb-0d84a81e766d", "comment": "Malware payload (Gafgyt)", "value": "cd62192dc165c79674d902e147796ca87d7ee806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211815, "uuid": "20e87637-457a-4239-b031-4d1ef1774fbf", "comment": "Malware payload (Gafgyt)", "value": "b913da31d960f2452dd0d67a046ea2eb171b6d93d311460fee602f228fb1488961aeb4dcba78997a0534c88befc3cc2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211815, "uuid": "6072010c-0af0-4d2b-aefd-e85dccfa007a", "value": "T196B31A97F801DEBBF40BA67640A30815B530BBF60E921672B2667897ED771D13823F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211815, "uuid": "3e7fd823-b810-4ca0-9b19-ed1986aff59c", "value": "1536:i97dOPY2l0Zj8G8vZSMEyzcvekZhf99lzDWg+339NzBu40gTJ33hZCGgh:ZHl0Z+ZVEyzcvekN95DWrtukTJ3xZC9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211815, "uuid": "5827ccac-beea-46a0-8e9a-6e3bae34f4c7", "value": 114628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211815, "uuid": "20f3b35d-c61a-4e6a-b60c-a151e944cf08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211815, "uuid": "2b645c23-7118-4b44-981f-458d3904dc7f", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee420864-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186440, "uuid": "c4f5ee4f-55c6-4f44-9b82-89f93cb8c932", "comment": "Malware payload", "value": "760038cc562ec90cd346b701728c896a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186440, "uuid": "db1b149b-162e-423c-900c-2609a4c6d4a1", "comment": "Malware payload", "value": "7191ff2ac936f3a874ae67f80db5fb14bf4ecbbb9996bf4375e4441612b7f20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186440, "uuid": "97b73dbc-63c2-4bb4-be1e-3b778681a1cc", "comment": "Malware payload", "value": "1c88f6ff05d4ee30d3acb201b232601a3b2d60ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186440, "uuid": "16536147-719d-4c2f-b8ac-207d5a558268", "comment": "Malware payload", "value": "4d80fa9211ff343b1bfb993bac114bff8b6f8d66879dafe7c2534631823d561c22ded1d0f1f71e0a65f5506675ec47a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186440, "uuid": "91a877dc-b44c-4a61-8dbe-9f2e8ae75780", "value": "T19022E904BBE94635E5BE8B7848B3831516B2F6059523CF8D9CC8629E5C227448D91FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186440, "uuid": "acbd1ece-e3b5-4cf7-acba-4598aec2fc99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186440, "uuid": "e15a53af-772e-4961-b346-30c8fb2178df", "value": "192:iw1pPJBFW1TVCSZitXLYZw6XaOaC9UKoW+y2S:rTnW1Q0itXsZwcaOaC9Ue+yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186440, "uuid": "8be5bd84-4670-442e-97e1-370f4d940d0e", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186440, "uuid": "c70f68e5-4941-497e-9d02-ed07d684927e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186440, "uuid": "ef5a7f33-0462-41e7-811a-2a6079457e28", "value": "rEliaseVicenteComerciodeBebidasME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cca012-657e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172810, "uuid": "5da9f4e6-7099-4b34-abd2-2ad12961c622", "comment": "Malware payload", "value": "b92e91dccd65c048517b2bef4f538da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172810, "uuid": "01f650d2-66ee-4961-845f-26df63523034", "comment": "Malware payload", "value": "71b2956d4fbbf6f028bf1ce42b7c1a325d75717e6fa45ab15d043716f0a8cc87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172810, "uuid": "81033dbc-b80e-4d1b-bfd8-987e6b9c672f", "comment": "Malware payload", "value": "76f4580258f8cbc68bc2e4e2f9c35c57d0048ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172810, "uuid": "0df1b03e-177d-4d53-a484-56a3181d72ef", "comment": "Malware payload", "value": "3d93db746f8b1bfd75e0b5292c319ce5d35e7f335567a4feabf1859ebf66370a89b1f737a48b2fa9d11bc2d71feaf6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172810, "uuid": "f7dcee2c-d055-4691-bdb9-9b639a23cad9", "value": "T1C212D704ABE94636E8BE8B784C7383152633F6019623DF5D9CC8119F9D62785CD82BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172810, "uuid": "120ec733-0e26-4950-b3ee-9deae17c7674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172810, "uuid": "b03ed017-0bee-4067-9651-96351ebc71e0", "value": "192:uCcrYuCYBSyfs0tX8wLYZw6yaOaC9h3hEU8y22t/:4NBSyf8wsZwRaOaC9h3hL8yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172810, "uuid": "488c4046-2456-4e4e-9257-ef4f518342fb", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172810, "uuid": "9a9a76d6-9211-4e67-bbe2-04feb19b2229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172810, "uuid": "91687a8f-9f9a-44e6-a894-fe6e69c53f84", "value": "rCarloseD__boraCasaNoturnaLtda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94473b9-6542-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781147348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781147348, "uuid": "6ad979f2-3081-4a9e-90e8-40b13a8e58a8", "comment": "Malware payload", "value": "f2602d2024f852fa967ddcb75ca89c44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781147348, "uuid": "14c36dbe-ab6b-4db1-a4af-9f292e1034b9", "comment": "Malware payload", "value": "71e947d830bdb4f9aec4b6dbdf36cd04222791defbced6f489800acee3eeed15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781147348, "uuid": "fe4a914d-ca4b-4d8e-9933-770fad2c0b84", "comment": "Malware payload", "value": "de2811cd58f8201582828010f27800d6e2c4e98c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781147348, "uuid": "124f056f-f142-4ad9-803d-147146413a87", "comment": "Malware payload", "value": "a1c9507ad089446e6f621afe316600c679fd7b4467335e0e4eadfb4795f3e701f890a6f655d6fdc8912b901bef3f354e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781147348, "uuid": "e51b7cb1-04ff-413f-be26-2495a39853f2", "value": "T15731C4BB0B1D764E1202DEA9B7762648E410E5CA204FE794FB1C08BDA2CD54A311BE0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781147348, "uuid": "78c543b7-e0ac-469a-8f62-5cf7d1325966", "value": "24:YEmarcu/EwEUBS2425pblote/o/yh7lr/kHpkY+Ne0EQvmcbgAJl9O:Bm0kxo/ZaHmY+00EQvmcBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781147348, "uuid": "22ad18e0-c16b-446a-8c8c-cd0acd5376fa", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781147348, "uuid": "29395eb8-d25b-47df-9c88-e2900a0ffe84", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781147348, "uuid": "4cad0483-956c-479d-9f3f-16a9b0cc4e6a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dd3bce-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1781206846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206846, "uuid": "4618d940-3f2d-4813-bb1d-47fd36c04d9f", "comment": "Malware payload (FRP)", "value": "93996829b15b3cf1bb4bd79f2091d72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206846, "uuid": "1a69dc8a-232c-402c-b1d9-158f65162896", "comment": "Malware payload (FRP)", "value": "73b2c01ca7f082bf4d999426e07886144b7bccaecead90e1acf661695fda39b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206846, "uuid": "786ef8eb-62a0-4076-b205-6c312cfc91ec", "comment": "Malware payload (FRP)", "value": "13d8b44123e6f9f9a58a9359d0a772566f4eff3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206846, "uuid": "e6c7b492-05fe-4800-b412-a24ea730808a", "comment": "Malware payload (FRP)", "value": "9b19045949b66595121d141a551d8ecd6d6dcfb924ec3b60940a5153177813a94bbc471429d8d83285c0571896321b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206846, "uuid": "ee0ba759-b375-4d45-a0e4-f5a12f64f526", "value": "T13EF66B57E8A201F4C1ADD234C5A68263BF317C495B3127D72B50F6283F76BD0AABA750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206846, "uuid": "b9d9cb20-b0cc-491a-ab6c-22df098bac82", "value": "b196866f0bf37f1f128fa153413b744f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206846, "uuid": "9502c69f-6c7e-4efe-ae19-d8d87d636007", "value": "98304:MtCB9kT0DOgSppogSn41ZbhqkE8E/k2qvPJzfN3KAlA2rWr:SUvSpppdqd8EK3/lAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206846, "uuid": "e3699378-8b91-41a1-8db1-9152efbc6a2d", "value": 15403520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206846, "uuid": "82c8ff00-cded-45d5-8306-9e12b3ce8a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206846, "uuid": "4d2f7b9b-d10d-4c9e-8085-84b6fd0bac05", "value": "_frpc_upx_small.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87f03e3-65b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1781196658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781196658, "uuid": "0687d134-4f72-4904-80b7-9cf95741b241", "comment": "Malware payload (Phorpiex)", "value": "700fab1c874a6e5948af14c7d122bd48", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781196658, "uuid": "5b6bd77a-9429-48f1-88c9-48e75c3d86a8", "comment": "Malware payload (Phorpiex)", "value": "7458d3a59fa6682ac4d2e3070ccbd0c223607eed768bd7a99d14f6dc5bfb88b9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781196658, "uuid": "3b5fefe9-04e3-41c2-8683-11381a18e30b", "comment": "Malware payload (Phorpiex)", "value": "07c5bd17e0d1930f324aaa02369fd7e85a6585d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781196658, "uuid": "1496463f-1506-44ba-9d21-af2af866efd6", "comment": "Malware payload (Phorpiex)", "value": "a67c7c905681ad4f7a0825e338a76f8e8a4809918ba17750b8ad72031efb53349a3c4d382c3f7bbaa6099fe7280d4562", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781196658, "uuid": "2b514dad-5c41-4268-a21a-e7c8ec06a1e6", "value": "T1B7321B2D7E894331D3A085F844758347653D1633A797E3EFF373969E19962488841E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781196658, "uuid": "f9d45ede-41aa-42b8-9f54-02a946101319", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781196658, "uuid": "dc28e56d-a4cf-4566-be0a-29ea4cb6214e", "value": "192:UYIovWsDZTBGmx+efWVdrVMPFJxTEZmFhS2c:UYIoZZMmwNVdrVMPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781196658, "uuid": "4a057caf-c99c-4653-aa4b-fc8761c4850b", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781196658, "uuid": "d143126d-d116-4231-8dcf-d7bac41a2dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781196658, "uuid": "39d7391f-e757-482a-9c97-fde457ba5759", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0504266-65e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781218173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781218173, "uuid": "cbe5e04a-9c11-483a-bcbd-33fb141fd43f", "comment": "Malware payload", "value": "a8584ce18b689aefa0cffeb9f43dd3f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781218173, "uuid": "1efea727-e9e7-4dc7-bc0b-1be0fe20f81c", "comment": "Malware payload", "value": "7583d3cfebe8bdda892a43b63ce3806f4f5dae3d9e4a9d5b8f3f80be13d83ab0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781218173, "uuid": "560afcef-4cdd-47fa-9051-3af37bd2e781", "comment": "Malware payload", "value": "6f9a85431f130e6adf168c4f30b25d804653845a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781218173, "uuid": "e883b222-4648-4d99-96d3-bc92a70fe058", "comment": "Malware payload", "value": "576c8553eb6cf74c91d6705eff1b3119c6d292e891dd2848d943c9a682a179a2d906f89b3f394982dac9c2580c718448", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781218173, "uuid": "784eef0c-925c-4b43-b4cb-3b89bf2d6d54", "value": "T186F512558AE9A8773775D37113DBF9E7F480018D8AF2E4C54D9392629B02AF48B30EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781218173, "uuid": "18de4247-cff0-4610-81da-990802d9e343", "value": "49152:kABkEjUEtJtyFw0nKOGtsD5Upd8QxxCwCBUnDEU:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781218173, "uuid": "e09ea9cb-5a96-4d22-bf13-2e68822d9abf", "value": 3350422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781218173, "uuid": "b1f70172-6149-4276-8968-be38b41489da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781218173, "uuid": "c0ef2831-cb44-4b01-a097-d648055504cd", "value": "001_Notificacion juzgado penal con funcion de control de garantias.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d6b2e9-65a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187501, "uuid": "b9a922a7-4d97-471c-a9ed-ffb67cc70944", "comment": "Malware payload (Mirai)", "value": "c11804f1b353ae2a128bc6ffe860c1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187501, "uuid": "7f2d9c7b-a222-4c86-9fa3-5a44adaf3774", "comment": "Malware payload (Mirai)", "value": "75bf9c21e6bf28a22dd9d787701bea253a4e7cd6e1c1da4f17454e1afcd9ea7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187501, "uuid": "d77cdc64-8aef-488d-9e5a-4ccc722c477a", "comment": "Malware payload (Mirai)", "value": "f30ee62682e8df69b7ee1ff2958d931a4b5e1b3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187501, "uuid": "05fa189f-3d6f-4787-8ee9-e38fd82d0e7b", "comment": "Malware payload (Mirai)", "value": "b225c62ba1293c50644d87ce039ff869edf10c4591fde4a86054eab31ed07c94e1979136d4827a06d1df49470b3a0a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187501, "uuid": "7b56648b-c522-4739-b54a-2e668cf57c30", "value": "T138234A12BA7D1F07C0D2A57A11AB8B5335A16BC91684DA4FBE720D9FBF213040D56EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187501, "uuid": "65188042-0aaf-4cf3-8d5e-cfaaa7079ebe", "value": "1536:uIDngdAgFtlcVCXUUonrNGjFp1HooQW4G:ZgqJDmoK4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187501, "uuid": "5a7e7ce4-f23f-4de4-9196-18f7a1b0b91d", "value": 49168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187501, "uuid": "13037e9b-0d90-4aaf-a9c3-56a85d736a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187501, "uuid": "4a137d4d-8bca-43ec-b6a2-a36e2307029f", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6542c77c-6584-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175473, "uuid": "c3f52433-4c57-4632-9a58-96c1829b12a9", "comment": "Malware payload (Mirai)", "value": "1fd82e98aa0e26b49aae41ad8177efb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175473, "uuid": "387620ef-610b-459e-9279-17a975577743", "comment": "Malware payload (Mirai)", "value": "75d7a2fb9c291354c3bead7c6182c3dbff803e068c72839771eb712ff1b3b6e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175473, "uuid": "2dd89914-65e2-4470-a4b4-dbb55cdbbc68", "comment": "Malware payload (Mirai)", "value": "4b64faa8cc0301bc4a61bec304e10a59b612b232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175473, "uuid": "20ee7a01-cbbe-4060-a7d2-78bcf45a887a", "comment": "Malware payload (Mirai)", "value": "44ce9f449168538e77d75e8843050bc3d6fa55067f994727ca11985deb129a99e725befa206af833ea64f40236917c3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175473, "uuid": "a94b8a98-a0d8-4f76-bd13-803cae3b825b", "value": "T183143B4AAE605AEBC46FCE30451EC30311ED989A93F5633A757CCF8C39AA7494DD3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175473, "uuid": "f5c1a658-a5cb-46fb-a6fc-d2d1e7b43acc", "value": "6144:GkpdtTCyKdi62W7GKXJ13At9HhVGuZtNxJkUmS:GettEuV7bJkUmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175473, "uuid": "fd2d369b-edd7-48b6-a748-484ef5a75191", "value": 200444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175473, "uuid": "1d85072f-bb34-4c14-8fef-cdef0119a391", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175473, "uuid": "38111c3c-109c-4ea1-afbd-334703f2bc93", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296ecf1c-6562-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781160770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "c3cafbe1-3cee-4386-bc7d-1d89d3e9fc41", "comment": "Malware payload (ConnectWise)", "value": "a10a1f88032b3b6fc608c0b63ba0e111", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "f5eb9f25-01e1-4222-9ac5-ffb5239b98dd", "comment": "Malware payload (ConnectWise)", "value": "771f18b67fc44d8e7b4e672dceafbe0d73a1d0ede26518f47aba4fd052e8fcef", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "851e574d-4358-45ca-b5a9-249e8617ac91", "comment": "Malware payload (ConnectWise)", "value": "4b197ac76688179dc2068c4337b6b3ad1f94a571", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "78401a17-846a-4964-964e-dd99c791b60d", "comment": "Malware payload (ConnectWise)", "value": "e09dbde9452b940ba8e4a8ccc38b0b0ef1e1b92c7d6a1e064954611d5a74bc0aa9f9aa914d6c6273173a9b6b38f9a729", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "f1ea9da6-c9e4-48cd-820c-25f6576c0a79", "value": "T1E7646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "7a3f927b-af40-4cba-9c38-72c131bd39c7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "6fc9e8f4-0b1f-40d5-94ec-4209f089d75e", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781160770, "uuid": "0d197f07-2af6-462b-929e-fc80c4fc400b", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781160770, "uuid": "dfbd2d7b-52d7-4670-9d5a-50c26fc7ea06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "be297ae9-3756-4ece-8ad5-9cbd74d777a7", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1976d9d8-658d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781179211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179211, "uuid": "cba20810-f7e8-4cbb-b575-f361e9465e38", "comment": "Malware payload (ValleyRAT)", "value": "4b5057aeffb27c9948e6b086efc6f16c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179211, "uuid": "7c804b63-c224-498f-8a20-18aaff65ff29", "comment": "Malware payload (ValleyRAT)", "value": "776a73cae3d11695efa9cc74eb5ede63896d4ba49702254dafb33d0215cfb581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179211, "uuid": "b30ecd79-234f-4664-ae3d-a6d79c821e45", "comment": "Malware payload (ValleyRAT)", "value": "cf17adfb892a2a13b37c0bad5e46ea4fd1504c9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179211, "uuid": "f5ea8fef-e68e-40b1-bd71-38753027efa3", "comment": "Malware payload (ValleyRAT)", "value": "0490611d91673891cd9a2a9da4e7236a18b6a9958c2b5cc5ef3c2a4e0e9b835d8fad1d8cae465ef2c3b88a587980535e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179211, "uuid": "32a1a952-18a5-4416-bd1c-78d737e59734", "value": "T13065129F760851B7C66D27756300C4E06DAA31BD0EACD334217BE6B20A7B772493E64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179211, "uuid": "b7196ec2-9d28-486f-ae50-ed1756d8e6db", "value": "7f4c1cca936fc3e6f60b4524bf29fcc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179211, "uuid": "621d1672-648f-4d6d-907f-71882c85f368", "value": "24576:i9j6mqd49307BBC7YkUJ1sCXcZItTkXTn4fKkjk/+knDPfjB/XKyB/iTJ1U+DuW7:Ej6q0iFUDtcZiQXTH1oHU0uMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179211, "uuid": "d5888f1d-54c6-4be2-8f4f-3025e4239e7a", "value": 1502224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179211, "uuid": "3ada3a6d-143d-4018-994f-c8182347df27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179211, "uuid": "bce82615-09d7-4af8-96a2-611384704cce", "value": "2026.06.11\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669a787b-65bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781200815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200815, "uuid": "eff56a26-7691-449f-9e85-5df16097f812", "comment": "Malware payload", "value": "e7b459e8bfa02d3acfff452688ca63a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200815, "uuid": "ace594f4-2087-4e99-b234-21a75effb1e8", "comment": "Malware payload", "value": "77d06cf1f2db718c22c320f650bfeadb3ad12ce1755215460e3e0eb8e9127f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200815, "uuid": "5cfe7cbd-58bc-4c2d-969f-e4a6c42a5b52", "comment": "Malware payload", "value": "07399149bf52a26e660dfd6de1c9c11dfdca5cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200815, "uuid": "5f36459b-d6de-4f68-a108-9aaa7b6990be", "comment": "Malware payload", "value": "17d6767a029a8300863dd9b4e22d83808fe472960f30c0d37450086f4bd90ce616a6560763eede5710acf2d344de5819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200815, "uuid": "1547412c-00f6-4394-b5de-5c16761e29ce", "value": "T16222F608BBE9473AE5BE8B788C7393150273FA059923CF9D5C88119E4C337419D92BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200815, "uuid": "d3656063-61ad-4077-ac9b-3de10339bb82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200815, "uuid": "e71e1a76-d628-477a-8abf-b635ef7aa106", "value": "192:pDZhQzludzLHX2XnW2WQ5BiLYZw6+aOaC96/oUy2F:TkupHQV54sZwHaOaC96wUyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781200815, "uuid": "6796548f-8a55-4961-be53-5d8cff4ff8a9", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781200815, "uuid": "52431f04-066b-4d02-b3d6-928cda8d2a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200815, "uuid": "a583cdf6-deb4-4e1e-a52f-1973013cff4c", "value": "rVicenteeAlessandraLoca____esdeAutom__veisME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27beb21d-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146164, "uuid": "dd660d70-6803-4437-99c8-2346172bf7e2", "comment": "Malware payload (Gafgyt)", "value": "50f37ec260836805b257e960927bf19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146164, "uuid": "a563e992-5072-439f-9fad-9ffdc2b7afc5", "comment": "Malware payload (Gafgyt)", "value": "793e22e2643231deab714c4c4a309d6ba9c0424fa41a320bfa72f42aad3fa5a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146164, "uuid": "0a31b4ac-936a-4d14-9193-c91312b2379f", "comment": "Malware payload (Gafgyt)", "value": "76eb944a3b85f386a9270737cc60f53dba960c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146164, "uuid": "cf778a4b-f812-4882-98cc-559affcb2fdc", "comment": "Malware payload (Gafgyt)", "value": "6e8e84a786f4aea941bad8728165fa8acdb046c394d351d9704cde3a685ea1ad471dd4b65e6e2af50a1196bd3ff5ffba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146164, "uuid": "0d7b2e7a-69bf-4ed8-aba2-62b314c070e8", "value": "T189934923ED125F0AD20BA4F060F59F351F22B8FA89975AD9E065DAE46543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146164, "uuid": "50151b17-97f0-48a6-9d47-36762dc6acc4", "value": "1536:mGhGranirXVZsKIdkS/ZD2iI4WCPG68Lze15hsZanmppm:tyaaXVZzIBD2iI4Wn6Z15hKampp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146164, "uuid": "bcbb3a6b-daff-4c42-8d1f-cd348209c24e", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146164, "uuid": "f8c4bb5a-782c-4c6e-87c7-9908a8a5dac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146164, "uuid": "c4598cf9-9056-4a15-8cee-abd991e0703d", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4df0839-6557-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1781156279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156279, "uuid": "f18550c9-e554-43c4-b99a-2082cc5f885e", "comment": "Malware payload (GCleaner)", "value": "42a34a9d03f3d784d56c71998bf7ee9e", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156279, "uuid": "2a1d385e-cd73-468e-abd1-8ff8c6d15761", "comment": "Malware payload (GCleaner)", "value": "796806861838945f646f06ed799d0b62fffae67e3517603fe29cdf3aa641a4d5", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156279, "uuid": "6b06bdfe-fa21-4bc1-8306-9b149fc05f70", "comment": "Malware payload (GCleaner)", "value": "9187b95c55dfc0e3b14a6b5481d0168327094e53", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781156279, "uuid": "5539bdf2-cc80-4305-a9fa-7e51103efb54", "comment": "Malware payload (GCleaner)", "value": "0da2404118352b05f03904cf5e0489b220975b2779b82cba615dbc0f46bc4207e12b34ae35e33a8e4de7fdcf2e9cec3d", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156279, "uuid": "e364f458-6539-4b72-b6b8-55540db47312", "value": "T15BF49E22B1E44573D1771A3C8D7BB678982BBD212E289C4A7BE42C4C4E3BE4175253B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156279, "uuid": "64f9cb16-3eb3-4f51-acf8-a7a7b2f93469", "value": "7916d8d86ecdc561619d308cf2ace8e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156279, "uuid": "d3697ffe-2750-416e-ae06-91df87452886", "value": "12288:qGkWSfphm99vVPApwpC5nJ4n59WSMFVWEWg8D31tlQEpt4W:GrpcxAyGk6HbW1D3KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781156279, "uuid": "c4d39f7d-cede-4c10-9fb3-2735268e58d0", "value": 765712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781156279, "uuid": "53ab372d-fbd6-40ff-83ca-4edfc222f7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781156279, "uuid": "da494914-798e-4cb6-ab84-d60d58cb57b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bbc8e4-659f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781187146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187146, "uuid": "8f1cce9b-c1cb-4a95-9d23-0ce78e24d783", "comment": "Malware payload", "value": "31f256a2e26f561bf45f9a66a257db5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187146, "uuid": "4892ab2d-6732-4e16-ba51-5eff9e532ebb", "comment": "Malware payload", "value": "7a0da4817028944db1fe577da0edec0360e7ab54675a5a2c0e0f64ecb654591c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187146, "uuid": "91ca5eb2-f896-476a-bfc2-9ea542732477", "comment": "Malware payload", "value": "6bfb9e397a17d7abdc6a269c0fba15176c18ca32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187146, "uuid": "59c296b5-4690-4436-b72d-5a4cf8b89a63", "comment": "Malware payload", "value": "267ef778b608652b31f1dbda5c7ea665cbe4ff1d761fb1ce55425debbf29d9e62f338ad2d88eeed4d6227c83e1ca7ff7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187146, "uuid": "e69b996b-819a-4839-bc54-0948f96ef3f8", "value": "T1C4236C6516857C24AA99C4365C7F2F0CB8AD83E6314491DD7ECE3CF28C4AAACE21961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187146, "uuid": "b20faed8-96e7-4fbf-bb65-ab70fff92a45", "value": "768:Tr9NyXsZztCe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnl:nHusZGca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187146, "uuid": "1cdf4858-07c4-4bd4-9693-88ed5dd24d6a", "value": 49244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187146, "uuid": "fe7e9dd8-174a-4fb4-8a31-ff1297ddead9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187146, "uuid": "19d6fb09-8f0e-47df-b44e-678bab830272", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fe6fb0-6585-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781176092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176092, "uuid": "d3ac5e26-0bab-418e-8295-6f1f1cc13b73", "comment": "Malware payload", "value": "01fccd45f8139fd57b925a0a9d35cf9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176092, "uuid": "cc2f78e1-9b43-4787-87e0-8746cc594d5f", "comment": "Malware payload", "value": "7bd843deb7436a21e49da50a5355c8ad3062c098dafe0c5b24fd68f02a708964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176092, "uuid": "ff0aa34f-48d5-4762-905f-1e8d0a27dc43", "comment": "Malware payload", "value": "a19d9a8c11f8257ffb487c72402148bf2697a34d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176092, "uuid": "6d9bb716-115e-415e-81b9-8e52d5a16e90", "comment": "Malware payload", "value": "4f6f1ff8ba1c7dc4b483bfc98c14fd107b0ef97cf3006bda76d2c119ac70eff76d579eaf404624d047af06ba91d509c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176092, "uuid": "cc0da8c1-5e71-494e-a51a-b061fe4a3656", "value": "T11C22D509BBE98739E4BE4B3C187393504277FA029933DB9DACC8219E5D727508D41BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176092, "uuid": "19873d15-ac1f-45f2-8dbd-e5197b71fe7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176092, "uuid": "884254d7-03e4-43eb-9b64-d50d6c3cf535", "value": "192:g5X9vHZGetUTYxV4S8pvLYZw6MaOaC90K3wy2z:kLGeN4S8dsZwfaOaC90iwy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781176092, "uuid": "eb2e80a1-d48a-434c-bcce-4885a52b3c1e", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781176092, "uuid": "5dc3d50d-6ea8-4f67-b546-4490fcc85d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176092, "uuid": "3771ac81-d224-4bb7-9406-21dcaa4b5b9e", "value": "rLaraeRenatoTelecomunica____esME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63bd707-65a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187742, "uuid": "be7cd4dd-e5b9-41e9-b522-85dc16c554d9", "comment": "Malware payload (Mirai)", "value": "4ab97e7e8af12e2b4b1e358c76b6c21c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187742, "uuid": "75e23275-8c01-4703-864b-7029175639f0", "comment": "Malware payload (Mirai)", "value": "7c41ace93e270c3cda74dda0eae84395713530e6b73b3d0a4a7b0a44f46b7528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187742, "uuid": "d19c93a2-ac22-47a8-8bbf-f53ef51a61ae", "comment": "Malware payload (Mirai)", "value": "78360363236d0a9de7f3e39e850b696ad89bec00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187742, "uuid": "50355209-aa20-439b-984c-4c03f67916cc", "comment": "Malware payload (Mirai)", "value": "82a6679742c4b30ff2871b7a2ac48c96e5007e73340b9c1515797487fb5b1ec9c6ab3712b5e6d6812fbae2bf1551f706", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187742, "uuid": "7e70c5c1-5c12-49f5-b2d3-9a4d5ae14e43", "value": "T100B32A17B9518B42C1C215B6FB5E924973136FB8D3EF3212CD24AFA027864EB0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187742, "uuid": "b1848ab2-70d5-4694-8fa4-6a5d1a0a36b4", "value": "3072:3ncNbIaWpTSZflHnuEWXsRV5hjXpQCOv:3cNbIaWpGZdUXaV5hj6COv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187742, "uuid": "294294a3-1bd3-4eec-b079-b323e42e221a", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187742, "uuid": "8db3483a-3397-46e3-9cc6-0c4c6b226ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187742, "uuid": "3340b750-f6e6-41f6-ac9e-15e176c74292", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4538aa8d-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210638, "uuid": "152494ca-0a54-488b-ae4a-33187d4963df", "comment": "Malware payload (Mirai)", "value": "7d6ad00ef10c929a437934e89f2700f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210638, "uuid": "45c92d37-29d9-4ca0-b7da-5ee1b47ac2f0", "comment": "Malware payload (Mirai)", "value": "7d33f4e642e2687158f9476dbe6a4c5fcf757ad38301bdd99e3fa259addf8d80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210638, "uuid": "7ade9158-2b83-46a6-98c8-0e51bef6eb24", "comment": "Malware payload (Mirai)", "value": "3d8a7cf999c1def88ab1b405c8009b7233565263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210638, "uuid": "bc13e38a-18bb-453a-9fa6-a058a62f1a07", "comment": "Malware payload (Mirai)", "value": "5578f870ace8c043c4d94de76b4347497b521f104ebf8e02e72a7e105d7b3d2eac69b5ca39f2e94cf0c82a476302e316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210638, "uuid": "6b36ff81-1c7b-4b6d-a2da-34a92a92de1a", "value": "T152830218AD08A4EAF19354FF0DF22F850C781BD11007BD236235B74BAAE96EE5345DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210638, "uuid": "150602e9-3928-4bdb-942c-9537232d9d88", "value": "1536:7csb/6C5Z2k0mymjrojTM8M66PPiRAuGzd6QzpSMgKVJudO+q:AEiG0mymjrojTMw6aApzd6apS0VQ8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210638, "uuid": "18f6e4fd-58d0-4f6f-ae23-18071f7dddf3", "value": 85740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210638, "uuid": "e2249fd5-581a-44ac-9d9b-e0a10b9c667a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210638, "uuid": "c3fb9871-5fff-4be6-9261-c8d4073a1fb9", "value": "7d33f4e642e2687158f9476dbe6a4c5fcf757ad38301bdd99e3fa259addf8d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761b927f-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166911, "uuid": "d20c13db-21a9-4be3-ba10-8bf408e48d06", "comment": "Malware payload (Mirai)", "value": "bbcf0c63ca85299088e17a6a23e0ca13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166911, "uuid": "d6d8fc69-e00c-4f0f-89a9-33e6bd9193fc", "comment": "Malware payload (Mirai)", "value": "7d5dc2ac9c55e3b0e5ca6b820f9cf1d1779aaec512d0fc29aef1d4c05cedf636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166911, "uuid": "9c64749f-5938-4de3-ade0-0c1a90c9d996", "comment": "Malware payload (Mirai)", "value": "cfaebbc91c64c95bc8258581faa884d50554ddcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166911, "uuid": "1e59a5d9-d17f-4a14-81f5-b0b27a1f0e76", "comment": "Malware payload (Mirai)", "value": "9cff17e6b0efe2efff163f36419132c0fe32b4d29119d372433b3b377a68996c597e523c67bb5a6ba7101a71640b18f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166911, "uuid": "61b5eb57-2464-4cc8-b18d-7d84cdf834a3", "value": "T1F3A31BD5BC818B11D5C116BAFE1E618D33134BB8E3FE72138E145B2E678A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166911, "uuid": "f255be5c-a02c-492b-90f5-04bdeecd12b3", "value": "3072:svvRAHJjm22dCyE3U2sZtITndp7Nlwk/P0/OXvvvtZhe5:niCJwnIxtNlwk0/UHV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166911, "uuid": "ea3d15f6-e340-48be-bc4e-90749ef269a5", "value": 101064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166911, "uuid": "dd10e8d5-f3ca-435a-91b5-1fd1eed0ffc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166911, "uuid": "c69a60b4-9b15-4858-9c1e-287ad5f8572c", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba9795-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210714, "uuid": "6efeff1c-46b0-4cea-ba0f-a1c6049ccb06", "comment": "Malware payload (Mirai)", "value": "7deeb031c8cf9b0543a0437b8b6b3e54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210714, "uuid": "58bc8876-a90d-458c-b611-7764e3968cc6", "comment": "Malware payload (Mirai)", "value": "7d72fb0fadd96556ca460fd3c12eea01c2b6a1fbb7cbb915146f783ed6cb9134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210714, "uuid": "8e93086a-bf90-4f7d-aa67-a3e24b92c664", "comment": "Malware payload (Mirai)", "value": "6fb27fe11fbea1028a444bfffe06bad8af0d74e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210714, "uuid": "e337027f-010f-474f-a311-7cb2ff58a262", "comment": "Malware payload (Mirai)", "value": "0ecace4f8933e3b8749a04bf654ff7fa79e0c509653d2c8ed5e97c40a9e70302511317284d44f60503ac4b6d0466f8a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210714, "uuid": "f567b49b-33e8-4cb5-b1c0-bdfc814948ae", "value": "T1D7933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210714, "uuid": "a148467e-5f3b-4eca-9fb6-afa7c7a2b0ca", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+L3R:KvjLrKGG4syfcIhXiuxpUN48L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210714, "uuid": "1b076844-e51f-4995-afef-72f7110f06c2", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210714, "uuid": "2c6da381-b369-438c-89d3-6da780078660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210714, "uuid": "484058cb-dcaa-418c-816b-d1560def8b42", "value": "7d72fb0fadd96556ca460fd3c12eea01c2b6a1fbb7cbb915146f783ed6cb9134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea8af7f-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781188803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188803, "uuid": "1a3a6aa7-8c61-4fab-b7c8-c4fb50598792", "comment": "Malware payload (Mirai)", "value": "961b666fcd4fb707d9cf3c2f19ab09e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188803, "uuid": "b263d69a-03d0-4f24-bee5-9c7f0a19c646", "comment": "Malware payload (Mirai)", "value": "7ee9c6c2c26eef34a8e751bc789ec89ed0303fa6100fb666e383b0e0e9205631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188803, "uuid": "0a6bfc34-57cf-41a3-bd3a-6281c2f988ab", "comment": "Malware payload (Mirai)", "value": "0393943dbc6e53f64f0281286e03188d53e08d25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188803, "uuid": "4d12f4d5-a8fb-42d3-ba38-d08987f0d551", "comment": "Malware payload (Mirai)", "value": "c6f4e98bddf501f7a345f4bce18bf3b6d0a4b168d13ac0a49656c2f041eb880da98c4900d6eca2a7d6571cb25757a970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188803, "uuid": "f48d7a1d-d1e9-4819-b0ab-26b60f90755f", "value": "T15C43F2D9B1220CDCCC9AC4B542E9C30219B11785B4856C0F6AD9F7478FBA270ACCB6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188803, "uuid": "1572c6f5-aa1f-4525-9b01-f5dfdf171741", "value": "1536:xBeEdRC6AlTt0LSw2ZBe/qWy/uU8bCosOKHBVJuU:xBrd+lTt0+w4Be/q0CrVBVQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188803, "uuid": "8e642355-3490-4a82-a045-4a6eef716b81", "value": 56688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188803, "uuid": "e64f91f3-5726-4276-83d1-f3cf446f3452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188803, "uuid": "06fba4c8-5030-4a4d-8699-626fb05f0960", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf67950-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781211508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211508, "uuid": "eb4f8190-b738-41c9-8479-4e0de5947cd8", "comment": "Malware payload (Gafgyt)", "value": "e1eaad5629eff568d3e318d70bd56ece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211508, "uuid": "0f3afeee-8739-4471-880a-662e1c535375", "comment": "Malware payload (Gafgyt)", "value": "7f05c4c8bd9888ebd457da8984c01bce95d5f0a95317e08ddb27888b82eed26e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211508, "uuid": "bc5980e2-9754-43c9-8486-fadd9fcbaded", "comment": "Malware payload (Gafgyt)", "value": "a78fb9550e59b1a7eb3736b5ff20948e9ad44e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211508, "uuid": "33301188-561b-4ffe-84a3-f72e3e51032f", "comment": "Malware payload (Gafgyt)", "value": "d88d81b81953de676e36e93c84b0df9a9f32cae2929fac1d66655518ee29e7ba7c26a95b4f25ccf360329dae2daf691f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211508, "uuid": "7415730f-fae7-41eb-8e7e-58f9588abfa5", "value": "T1B1934923EE125F06E10BA4F160F59F341F22B8F689975AC5E066DAE56943CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211508, "uuid": "e93669dc-ca9b-4afe-a193-0b882c5779ca", "value": "1536:a296LMI7YnO9DWHKS29tPXWvyI46nCvOajPWslI5hLI7Sppm:aTMAJ9DWqbKvyI40nalO5hLASpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211508, "uuid": "a2862650-209b-4c0a-b198-f3774e76a270", "value": 92192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211508, "uuid": "b1607683-1581-41d5-80af-ae94fdd0acf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211508, "uuid": "44cde967-1a86-4b74-9fb4-4e78e2713832", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92203ab4-65ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781221504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221504, "uuid": "efa2862d-e713-48aa-9a0d-9038c927fea5", "comment": "Malware payload", "value": "b52fd76ae54e6fdd20e2ec751fda5978", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221504, "uuid": "ab5221df-eb01-4ab2-8162-6630f86a0c81", "comment": "Malware payload", "value": "7f1f8162977db79019decd993a7ef9e3ad1d36a1111567a4ff0f11096d1ace01", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221504, "uuid": "0024bdbc-7708-4dff-a38a-a357e331015a", "comment": "Malware payload", "value": "5a45ebc7905fc7e7baaf86bfb869e902c279e28c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221504, "uuid": "0c0bfadd-1672-4b41-afb9-439e0d5490ca", "comment": "Malware payload", "value": "8765021d5305317dcd8a213b2f52d8db11d022bfa886067c8c9f4fcd4365a148e84288f9f67d2e3aeaa29b29077ae90b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221504, "uuid": "96d61589-dbcc-48c5-82cf-615cf32d14aa", "value": "T1D2D6013BA1EE65FBE0291639257392154E377F7064234C0E96F0B8E8DB35F70192EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221504, "uuid": "fd1bb87c-1c95-4577-9667-5edd27d0cefe", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221504, "uuid": "c2eaf985-2fa3-4ae3-bc77-035b802957ed", "value": "98304:i5/r+nxFG9aEAPzWsFV2bx7unseA7RpEH/kcVtLF3DFIpslZP9aU8P+FpTgbU:eazyaVv4J7RWfkGFzFwIZFBQ+XgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221504, "uuid": "962d73ac-7950-4722-9f74-1fdb7252699e", "value": 13363430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221504, "uuid": "9aa21d6e-1a7c-4703-8f07-ab24242e923c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221504, "uuid": "4e443322-0650-4964-bd94-94f45aac30be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ce3a3a-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221240, "uuid": "7fb53463-1793-4cb5-bae8-e2cbef71c1b3", "comment": "Malware payload (Mirai)", "value": "de02a377907713752fa974fe3eec1ba1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221240, "uuid": "9d878836-b914-4510-871f-fd58af3fd161", "comment": "Malware payload (Mirai)", "value": "80a044f9e4cd4356c15d7b68e02f476e2ac056b55b72bc46160f3e6829afe1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221240, "uuid": "c67e2409-5de9-498d-8ddc-932fe49a018e", "comment": "Malware payload (Mirai)", "value": "50f34b5427783de611d4616448225c7e9372f18a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221240, "uuid": "f27d84f3-cdde-445f-9737-509ea2341e59", "comment": "Malware payload (Mirai)", "value": "60747b017dde27533ad3aacf3d10f2f1e9c46cf4a2b3f6c905445703eb52a4c004c023a2da69ee754968ea82b9a4d22d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221240, "uuid": "e1742d2a-58f8-421b-989e-8a9caead1f2b", "value": "T1E703E7816C815A6ACAE0537AE9BF40CE3310B7EAC1DF761BCD111F14768691F0DA3B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221240, "uuid": "8e998976-0007-4c59-b188-fce81d7b4a56", "value": "768:6exxQUMvcyHmI/jEvjYBmSvTIdG06G5tlOMiTHrH+qflAwaBNl:6Eilv5HreUBmcTIo06WtlniTLH+qNAwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221240, "uuid": "fa23e469-0834-40a8-9844-4fd74d0b4408", "value": 39724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221240, "uuid": "2c909d87-7303-44e4-98e9-e5694751ace8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221240, "uuid": "aae67a19-bdf8-4735-8ca6-202c7442e52e", "value": "zoryn.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a505fa3-65d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781208123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208123, "uuid": "28374a84-2572-4f67-9e48-514832fff664", "comment": "Malware payload (Gafgyt)", "value": "22c562568bc67c2d0ec4abf606ff8779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208123, "uuid": "efa1d07a-5516-485e-942a-78ddf64292cb", "comment": "Malware payload (Gafgyt)", "value": "8135ef3eafab3daf2527cc27004f82afd59968edc9fc1724fd12759f35b30f82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208123, "uuid": "d29da165-ea2b-48ec-9832-8869e8cd315e", "comment": "Malware payload (Gafgyt)", "value": "7e92600e3258c1a0f82574919bae84390526ee06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208123, "uuid": "12cefc81-4e26-414c-8d7b-9662b50dcbc3", "comment": "Malware payload (Gafgyt)", "value": "929ebd4df501689eff9f4ba03291f5a6ae748621075292aabc279378f2fa14f7081f44dc4f22d4b715b72eed60058d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208123, "uuid": "62f6147f-b883-4966-9635-df143d3c059c", "value": "T141A32927BD118F43C2C315F2BB9F46887B1667F8D2EF3103E925AFA027565D60A27990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208123, "uuid": "71075c2e-a858-4486-8053-5a578ed37744", "value": "1536:BNwhaYCkxrUfbK0yfKFqQyk2pCxzriOY9Wt8DPCusTmJ45U5hqppyq:BNw5EJsrkbzf8au4hq5hqppyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781208123, "uuid": "35180198-af6d-4067-9e29-caeaaded392f", "value": 104320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781208123, "uuid": "5edee51f-3b0e-4c78-8651-a519c229ca63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208123, "uuid": "abc0078c-db15-476b-acaf-acfebcc12149", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46345e34-6584-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175421, "uuid": "74bb0452-9503-4677-828d-1d66dcc9c88f", "comment": "Malware payload (Mirai)", "value": "326f0b1cb231821e7e82dae889ddedc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175421, "uuid": "1a2e5be6-585a-447c-b47f-74fbde1c705b", "comment": "Malware payload (Mirai)", "value": "81614877b9a6a33fe6249bb9b6cc9a5f6084fff264a16a55dcf7c1425bf8f960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175421, "uuid": "1c4bd2f7-be1d-4080-9afc-fc3c7e7bc551", "comment": "Malware payload (Mirai)", "value": "e4ac1c1bb95e4f8e2275e939b05ffa6bf93c931a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175421, "uuid": "407780ab-089b-414a-bd03-9f22a414f886", "comment": "Malware payload (Mirai)", "value": "f39d8038d28190fcf7858a1223fc483413de78177c7a14ca2e204fbc9d91c485b9d20cb2617abab70a8b35647d5c7469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175421, "uuid": "9e25df5e-a8ad-4d76-a77c-4cd9088fe092", "value": "T13573021FF55978CDDFF831B8655104A08883A890392A2E5C6357DC2E9A72F02BD891EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175421, "uuid": "f463d0e5-98d7-4746-9efa-aabaa0416067", "value": "1536:ILZ2s27OS4h60U+PG98y94XhngmvQuJ+axkqBDSCLv3tBmDv9rd3bFWgEp:ILZ2s2774kuA+r4I+GkqRxLv3tBmvPb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175421, "uuid": "f8f77ab8-feeb-44e1-8733-a2b18dbf76d3", "value": 77992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175421, "uuid": "59c1a4f7-e44b-4d0f-80e7-c29dca9b5e0f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175421, "uuid": "5d5f5f95-6407-4451-ad4e-1125bf83fd67", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5212ce9f-657c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172005, "uuid": "184de448-0800-4cbd-8def-5845b6e16b81", "comment": "Malware payload", "value": "5212374bb96b21d540bd1710e078de25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172005, "uuid": "1b21bb53-d859-498a-8058-b1fe439796c2", "comment": "Malware payload", "value": "81f090be3037b0b374beaad025f9bc5554f0158e9a0a7671ab356dcd9d7ae528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172005, "uuid": "10fb0976-fc6c-4bf0-b8c8-fcd9a9faecb4", "comment": "Malware payload", "value": "682da078c6402fba8cf0412105051e7137a7d15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172005, "uuid": "9de55dba-61ff-4b8d-b4f3-bcfeade459c0", "comment": "Malware payload", "value": "7ed2b40bf10e05797307ed88a058cca93c888a41172fa602894bf8e6468c40f41fd7b65a89e682e52816435283d25ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172005, "uuid": "5e2eaf48-083a-447e-979a-47ee70e6aa44", "value": "T14722D408BBE84225D4BF8B785DB393551677FA029523CF9D9CD8219E1D227418D82BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172005, "uuid": "3cbcce1a-22f6-491f-bd1c-6ed33899f567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172005, "uuid": "78dc142d-b514-425a-ac14-d348507a9d00", "value": "192:hFm5j1F0JUjy8BlSmhWQLYZw6AaOaC9Iekvy24mR:hkQJU5WQsZwjaOaC9I1vyXmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172005, "uuid": "92a1582e-1548-45ae-961f-32efeafd1510", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172005, "uuid": "533099b5-5236-49c1-9451-19dceb0333e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172005, "uuid": "c5343b53-a535-446f-bdda-cca9bfafc29d", "value": "rFranciscaVit__riaAssis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e23905-653a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781143773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143773, "uuid": "fe39177c-cda2-4287-bc16-6d881b3a8a56", "comment": "Malware payload (Mirai)", "value": "414aa5370e86359330cd60ec3e2ee1f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143773, "uuid": "98e1e843-5f6e-4961-ac68-87b0805535ce", "comment": "Malware payload (Mirai)", "value": "829f5d036102d466db20b093d55b2153a4f01e4640c8f680ae5089a44cceac5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143773, "uuid": "a6b32572-1f78-49fb-af49-3c38eeafb573", "comment": "Malware payload (Mirai)", "value": "d9ad1aa1d3260fb11ff182cc2332ace315ef3947", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143773, "uuid": "8aa97c86-0b09-4a09-87a5-893362649797", "comment": "Malware payload (Mirai)", "value": "58b2329b0253150c0d40e9ab8d72406f199c5e9103a2c347aa4e3e03fb242490f0df59dac5529ad7753f723a2d62848f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143773, "uuid": "f090d37a-be4a-420b-90d8-2fbc56e654cb", "value": "T146A30986BCC1C612C5E061B7FB1F91CD3B2643A8E3E6B103CD19AB59774A89B0E3B155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143773, "uuid": "730161a8-a6e0-4dd2-8b6a-845dd701da97", "value": "1536:pyPE+QhxUn+zq8MO3zKiZc1U+W8zGhn7HZ0QmtUxfevBff:pyP+/U+zxjKiiTWcGhn7HZ09QkBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781143773, "uuid": "1b9ab226-e229-4de5-8ca2-89f7af0f4bc2", "value": 98716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781143773, "uuid": "a6e47d40-969b-412b-93c2-7b4003dfee73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143773, "uuid": "4d899579-a1f2-41f5-a9f0-1a5c9f7c7d64", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a2eee9-6573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781168303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168303, "uuid": "ccedbd31-21a3-4105-bc34-08b6fecedcfa", "comment": "Malware payload", "value": "167a328aa83651c4e2ade99c02ea520c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168303, "uuid": "04ca6b41-0c18-4a4b-a758-f593bb96889b", "comment": "Malware payload", "value": "829ffb02a7508158f96c2ea5a5690ed058313eddac02cee2874500a9acc67faa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168303, "uuid": "bc5d039c-a557-4532-96e1-4968170e08a5", "comment": "Malware payload", "value": "ada7ee0d9f84157101e3281ffe68c62db254f090", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168303, "uuid": "5b008e6c-5df4-4705-b91b-b4642d1ef96f", "comment": "Malware payload", "value": "032b606a69a4e26023477737d2185a704981009f9f000ae83514a724f1848cd91a2d9832104825004485bd572fa00157", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168303, "uuid": "16f579a4-7ce4-4d93-8189-156796f649ef", "value": "T1FC31EAAB1B19396D0904CDBAB3752148E514E2CB108FE7E1FE4E087D92CB549324BE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168303, "uuid": "4d6d4f33-7a4f-4a8e-8a94-582720b52301", "value": "24:b34GFvNtF8v6rErkQIgSfdMOB7lWCEGEcHwqd8RJ:b34UNtHOk0GdMRSwqGRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168303, "uuid": "0cdca67a-0a09-4249-a629-ec3d98f92800", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168303, "uuid": "3f48c3cd-03c6-420d-8b5a-a97a3c9b5572", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168303, "uuid": "ccefb210-ecff-4104-8726-031217dd81d3", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fcd0be-659e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186473, "uuid": "119f28d8-97ef-46f8-8936-b1de61fa82d4", "comment": "Malware payload", "value": "44e854291e66c8c4451318eff730b3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186473, "uuid": "9f3e7a4f-97c4-40aa-8e54-87c019a4c92e", "comment": "Malware payload", "value": "8436aa6f35489cc41bd80b18321c5f8903567ab752006e40f945426f1c0da403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186473, "uuid": "760015f3-733a-4797-be9f-57044d12f8ec", "comment": "Malware payload", "value": "3bae21844a254eb47741ebe719b45e11b121865e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186473, "uuid": "2a9a8a00-efa7-463c-a2f4-e780e99dab5d", "comment": "Malware payload", "value": "a753c3f0a5a2ccd64804be3544de79483cbd6b8b1a31f2d92a26161ec363df7b3de7ea6a5656362efa2c2c61936a8e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186473, "uuid": "10b68ade-5c37-4501-86b3-6a8d25b04919", "value": "T17912F705BBE94736D4BE8B7849B393514337FA029923CF9D9C8825AE5C32344CD52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186473, "uuid": "159c877d-4a83-4d01-b70b-df489ef49786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186473, "uuid": "65809760-528f-4d48-942d-f53a8bd4815a", "value": "192:iGPunUnaz9lnnOz6BJn7lm39nLYZw6GaOaC9dihEDVy2C:3e9lO07lmNnsZwtaOaC9dihsVyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186473, "uuid": "987300c3-8756-4dec-b414-9880e8764930", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186473, "uuid": "23450c54-68e5-4427-b38b-18cd7b671f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186473, "uuid": "14501f37-fd56-48a0-bf98-525ec695b6b7", "value": "rLuanCau__PedroHenriqueBrito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d03f8d-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781189332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189332, "uuid": "d90c0e2f-cfe2-4f75-81f1-c4e6050ed0b9", "comment": "Malware payload", "value": "9d155976ffa72b31e80bafe1cde0497d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189332, "uuid": "74d41cee-de85-4458-8ee5-9202b003e43e", "comment": "Malware payload", "value": "854257f1be039d9dd40464c206bd8c115fdd520eb9c2af7f7747633e5face2c6", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189332, "uuid": "0de306da-59c0-415c-8e80-00d82a0cdc74", "comment": "Malware payload", "value": "cd9c9b4672ab370c914f5986b6e49d171999180f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189332, "uuid": "eecd2fc5-5068-4628-998c-9277222e4c35", "comment": "Malware payload", "value": "27202f0900f11cf75ed36b585fe19247d7cb029decbb1e9d1f7b3a948b750bc685a85960ebe5739a17a334aec8cded6a", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189332, "uuid": "ee3458e1-3ca6-40f8-bdd5-4b1401175235", "value": "T10D340164590B5739C88581BB5F2E068784CF2BE86932301E49DD78F8CF57237E636E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189332, "uuid": "b0ab1266-3dc8-47ea-bf21-4fbe4c9ae6a8", "value": "3072:l4IV2+HLUdepmOklgJTYw7l+WxJaHSjELO+rZsZd1H1qPRHGIcl3Ylcc4TAhJ07g:lT2+HYrOklCv5xAHSjELzs/i9G73pL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189332, "uuid": "e8c2acc7-c46e-494e-878a-7d488365fc76", "value": 238982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189332, "uuid": "2a48a2a0-71ff-439c-a622-f1c2efda8b21", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189332, "uuid": "e5dfdb9b-80e6-4d6f-8e32-4fceac24d041", "value": "EINCORS RFQ-260408.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52d03b6-655c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781158454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158454, "uuid": "9a7a0444-2a0e-4518-adfe-55b37dc28698", "comment": "Malware payload (ACRStealer)", "value": "953a36b6b85390409be2af6dab773111", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158454, "uuid": "09175a76-0874-4b80-9e4b-e2db818d2549", "comment": "Malware payload (ACRStealer)", "value": "85e9c56646b76b89ae6e03480a732fc85a6ea6be3e6655adc55218d80ada53fe", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158454, "uuid": "41386993-ca31-46d7-a17a-4b23cc04cec7", "comment": "Malware payload (ACRStealer)", "value": "7bf4cac4b6a2d8e6c767dd1e001271ad756532f3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158454, "uuid": "02414acd-c512-433a-8487-0fe00dfa6cdf", "comment": "Malware payload (ACRStealer)", "value": "d8d67e480aa9b9bfc474737ec86fb14a1813fd1061f5683a4c9b336ff0541613c758f1b8ca4dcd324bc765884e3e1a7b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158454, "uuid": "629cb9d7-08c8-405a-aa22-e28ca2a00691", "value": "T19EE55A03BCA148FAC0A9B33188B266467B75BC491B3227D72E91B7783E727E15C39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158454, "uuid": "73ecb938-8b77-40a2-b366-df28888145a9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158454, "uuid": "1b9a0141-02ab-4c46-b1f7-0a2899421a1a", "value": "49152:3KUzpyl+Ppl9nCmvdzjaVuftt2J42YJjPbcw:39pzeat0J42U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781158454, "uuid": "3352bad7-1fa0-4087-bc93-07138fde57ee", "value": 3201952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781158454, "uuid": "18b0a62c-310a-489d-90d9-eb0d6993558b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158454, "uuid": "3fb0372e-2f57-4b34-af04-6c0602c3b95f", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e422f49-655a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157422, "uuid": "322e445d-e2ea-4f2c-86b8-fc0fb2fb4412", "comment": "Malware payload", "value": "5a7f8e742563053d9bfed12f7594eb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157422, "uuid": "e205c9ee-d533-4d4a-b41e-6763fe2ebb72", "comment": "Malware payload", "value": "868815dcc79a114aa8214c24226d5b3fd1a4262aee32b991bd876bf0a01386f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157422, "uuid": "168fa38a-f926-4ccd-bd07-6804486575c9", "comment": "Malware payload", "value": "ddc53a66781b2f38a138a3f7bf802b5cd5e352fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157422, "uuid": "2a87a19c-9748-430a-ba37-71c8baa5deb4", "comment": "Malware payload", "value": "ea8e82f5b513f8cdafbf38240574fd2feed0e6e2f4df51c7ad1eb1eb265b7beefc53e1b2267172d5df19759f6935bb43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157422, "uuid": "f6a83fc7-24f4-445b-9358-7d2aba642e94", "value": "T172968D03EC9549E9C1E9A23189BB9252BB717C480B3223D72B50F7386F76BD4AE75350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157422, "uuid": "72819a8b-c23a-4a30-bd10-efffa824e167", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157422, "uuid": "43a7d7f9-447a-4a07-be2b-2634cd956a49", "value": "196608:dsDgjYypu+zHHrN6pIcaMcplpgx7q4xKIb15A:d/jYyEVpIcagxO4xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157422, "uuid": "c569ddd0-5a13-4875-a37c-f8843968ebfd", "value": 9145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157422, "uuid": "60175256-107d-4eb5-80d0-0486fc0c1393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157422, "uuid": "f7dd3b58-49f7-4ec5-b8be-b76299524d30", "value": "client2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b413c1c9-6584-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781175605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175605, "uuid": "ed31bda6-ced3-49b6-9a3f-a77a56256481", "comment": "Malware payload", "value": "56f92ec4c66e655e15ca20ea21dd43bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175605, "uuid": "6c0ac0a0-0db3-45b9-a436-bc7440bda347", "comment": "Malware payload", "value": "8749292470dfe4aa44e8f291fa31bd5caea4051e64cbe87ed265132f9c4f3d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175605, "uuid": "5353a090-917e-4123-b783-58c76664f37c", "comment": "Malware payload", "value": "555a9194957469a3617067f95c780321565d2077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175605, "uuid": "04382f21-1b4a-4465-87e9-c313b6227938", "comment": "Malware payload", "value": "c0344aab79e6906d6b6d3b2b136828c0e52e7f16b09b9d522eb16e1fa13277ee1860a24893ce87984687fb69537acb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175605, "uuid": "984665e1-d7a0-493b-b0ac-b58fa7dc700d", "value": "T13812E605BBE8863AD4BE87784CB393151633FA059927CB9E9CC8219E5C237419D52BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175605, "uuid": "4857eddf-2826-454c-98d2-40ba3b86b9f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175605, "uuid": "8728a205-338e-4194-9a63-7ac08b4021db", "value": "192:oKFjiUWU/XN6iBCCv8yLYZw6naOaC9PphEmsy2rAv:Bm2XLB1kysZwYaOaC9PphZsymAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175605, "uuid": "676fb7ac-6e6b-44e5-a4cb-d07770035045", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175605, "uuid": "fb2c4254-b554-4089-8895-1935719645bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175605, "uuid": "708fa3d3-fe28-4b9f-bfb3-8f927c0d78f6", "value": "rMarinaLauraAl__ciaRocha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb8b48e-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180965, "uuid": "175e77ff-bb20-46f0-88af-be5b2c060a9a", "comment": "Malware payload (Mirai)", "value": "90d8cf716ecde1960bdcff1d7f5f19b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180965, "uuid": "fe6d1d35-d45c-4905-9e50-70004ea177e6", "comment": "Malware payload (Mirai)", "value": "87df268dadf7a70707a124c7b8c1bf5da3a9c3157f9094efbdc821029db01852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180965, "uuid": "7accc5b3-e832-489c-a55d-447cbf4bdf94", "comment": "Malware payload (Mirai)", "value": "eb0cd0997b27625c2926c9de22c8e2c21c75b386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180965, "uuid": "ad2bfb5a-d9b4-4e7d-a89d-47051a72f89d", "comment": "Malware payload (Mirai)", "value": "1eb7eb2b225575f3adab5e40f8d5d3cd419ec0eeda24cd922a5d0b6cb5099edb704c878e20272099c992ef2ab7e10747", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180965, "uuid": "716d1905-69ce-4ef0-914c-f99c0189d6e8", "value": "T147A34A02B71C0E93D1531EF02A3F27D2D3DAAAE122F4F688694EAB45D1B1D311586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180965, "uuid": "8561a32d-3eb7-4689-bfb9-40f8fb15d714", "value": "1536:Xllji5dT1Lrq/CNaaHSsVBKYYNek+WMF3yKAc5h3EjqSCWdc:Xl9GTY57suvHtKAa36vdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180965, "uuid": "a864b6df-d6cf-454b-87d0-6ea79271eeef", "value": 97696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180965, "uuid": "f1bf6ff3-cb82-4ec5-916a-d6be7c8c8a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180965, "uuid": "2c53a923-a45b-4340-b3f3-0f48861e94a3", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f29cae-6575-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781169065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169065, "uuid": "1b157519-e393-4905-ac34-fc378354ad48", "comment": "Malware payload (Mirai)", "value": "d04d0b595b7c20e35701afa3d20acaa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169065, "uuid": "6d8e217f-5585-492c-9788-729fa74c8788", "comment": "Malware payload (Mirai)", "value": "8908150087802ed4fc5f64ebb6615e8a28f7254d1d58c54ff41d490c74a0c57b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169065, "uuid": "bea4c6f6-1d9d-4620-bbac-2a78edb7dc56", "comment": "Malware payload (Mirai)", "value": "d693f19a676807f56678da6c7486ab2ce9bdd058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169065, "uuid": "1f62634b-fb05-4d98-a237-928b74f89d49", "comment": "Malware payload (Mirai)", "value": "0bd5ed9a4b92909a84fb971a3fc7db22688ff80a3e02cabb2ef86fef8e29e835fc14bd0a27fae2551e9fb8416e6780cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169065, "uuid": "9ce4de7b-ca2a-4c98-aa65-97daf831921d", "value": "T166145B83EE890EDFC457CDF086AF836B19A7A55B48C2F1F4947CCC08355D29A56E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169065, "uuid": "576d6b8b-4840-4c3e-afce-fe56c16d7fd6", "value": "3072:Q0zwFTiWVu1YkP3y03m6ffzzza2yTfu19QDJ6pZCbSQfOsWh4bzJq8:xzUTiqulJ3fzU69QDJmZChdWh4bzJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169065, "uuid": "931f18f8-9b5d-4108-a6bb-21d0edc1d3b3", "value": 208980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169065, "uuid": "4c612f2c-d11c-49a6-894a-cb2dd666522e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169065, "uuid": "324c3ac3-ea18-45ec-bcf8-983033794015", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc6b4ce-6583-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175296, "uuid": "0f58e2aa-0c34-43f2-89b6-eddb191612d6", "comment": "Malware payload (Mirai)", "value": "c9c1130c40e795701bc357fb3d5ef13c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175296, "uuid": "365bb8f2-740a-40af-aedf-606d76e50ada", "comment": "Malware payload (Mirai)", "value": "893f6ad1b4a893e8b2128017cdad14efcb005e93671536864d06f3524e983fc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175296, "uuid": "05dd5dcc-30fb-4ee5-9e00-d25d6ec8e752", "comment": "Malware payload (Mirai)", "value": "3fbafa9613e6c36b7053c61b3f6908eaa6e84287", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175296, "uuid": "c000b6ce-cfcc-4754-a985-bdff3947003f", "comment": "Malware payload (Mirai)", "value": "07b2dd90d922e5fb47359df9e7f6f5193bc1fd3f430bd6f49f692ce3aa3cdc068a62db906293a559e4eb4f2526fb2dd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175296, "uuid": "5ca9a004-e290-4516-bd06-d49ebd2d9151", "value": "T15C63124556F18312C12E43AE2DC835CD24906FB4F6C39F6A4921A7CDAEDB2469F168CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175296, "uuid": "482a51e5-9c5d-47f1-ab88-ef0969851b3d", "value": "1536:cjXJQYmldd247S0nBpKVm8A0ctytfIfgdZeCGSq11aJyDIWMf+o:n9S4PpK4TyZS711aHf+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175296, "uuid": "56f6cf0f-ed77-41bd-8f24-6b6e98aca20b", "value": 71324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175296, "uuid": "f8ed8878-46e4-4ed9-b1ce-6e992b54a6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175296, "uuid": "61df5954-c8cf-4019-8eff-9abca7ebf23e", "value": "xnxnxnxnxnxnxnxnarmxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f131d67-6539-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781143358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143358, "uuid": "46e0a675-0f89-4160-9754-df9ff2c8fdbd", "comment": "Malware payload (Mirai)", "value": "465c4821bab3b63700f5d3af67b11221", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143358, "uuid": "a679e7f1-e435-4f17-808b-0de2e981d4bd", "comment": "Malware payload (Mirai)", "value": "897b6f79119f39aa62c110d9efeb08484252eb0cc81db101b0512cf5b258f312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143358, "uuid": "e7001def-dd0a-46fd-aeb5-32de14d8f5df", "comment": "Malware payload (Mirai)", "value": "414a2133d23e869f5b11e8b55adebd0b9ba776a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143358, "uuid": "d4768b4e-d4e0-464a-a197-de4c7bcd4a84", "comment": "Malware payload (Mirai)", "value": "603043149dd1603dc8dc88993843b1c9aec0c9b02b3f78ba6a403d318f81d0996af8bc3930e7e80229eeeeb5d1bd0df8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143358, "uuid": "ae328f91-ef27-4637-b6b4-9501e1744e63", "value": "T17B242946EB408B17C0C61779BB9F434633339B64E7DB33069928ABB43F8776A4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143358, "uuid": "b655b30a-78f2-4499-9e9e-96845b7ec77b", "value": "6144:cmBiNLDcQDZ9i2tdt8gyoAOrGXcac4bAkXGKiL/KhqN/BSmdwGkNmI:z0NPcQDZ9i2tdpyoAOrlavbA0+/UgSmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781143358, "uuid": "d07ada9f-49c9-4791-bf97-7e5fd78973da", "value": 213391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781143358, "uuid": "a3d1b700-dd0e-4daa-b52f-d6a8b0ab00e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143358, "uuid": "41740cf1-719a-4379-83f7-b16b1f8f19b9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe507ae-655f-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781159841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159841, "uuid": "eb588e28-600c-4774-9122-00720edc9cb8", "comment": "Malware payload (CoinMiner)", "value": "8bed247894067d6e9eb902ec8d5ab3fe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159841, "uuid": "9eecf0b6-dde7-440e-88d3-e74544a11c04", "comment": "Malware payload (CoinMiner)", "value": "89d0e579a94542590d3cd6516d4d4069b2832327cb906ce1c11baf66d0e5fa07", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159841, "uuid": "64a543ba-8719-4e45-b0a8-838b44f2b3fc", "comment": "Malware payload (CoinMiner)", "value": "03cf63cb2216bebdf4deca467c918bbeecd73f25", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159841, "uuid": "c8ddb853-e41f-4050-9b6e-cdb1d536631e", "comment": "Malware payload (CoinMiner)", "value": "6bb3cbaecfa27dd6c0b84ee312bae6e5e02051a28e304aa5466509aa9cb75fa97e661e584e57dd2ffd5025d5061cbcc0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159841, "uuid": "a3958d51-3b3c-4bfe-80b6-3d283c2ce43f", "value": "T1B32633F67410BD48D16916B0DEB32C058C09AB8A4B034259692FCEE257B157D8FF2F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159841, "uuid": "d9794577-65a1-4935-9003-fc2addf9b105", "value": "838ad462f85f39765779831b659cc5f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159841, "uuid": "0a25e0cf-dc19-403f-83ed-5d825f8b6778", "value": "98304:BMqAC0BScIse2htnprELN6GgqT1+0vsXLNI1jv2trYhpTYs93FEtH/:BFcwc5tprELN6GO0viQy5YhtYs/Ep/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781159841, "uuid": "4b5211d5-729f-4823-96ac-49efe75c8f95", "value": 4461072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781159841, "uuid": "d46cd20f-42b3-4059-93ee-1ce598b2c4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159841, "uuid": "00d414e9-c871-4f80-8917-e2e839850563", "value": "SecuriteInfo.com.Variant.Zusy.606545.13926145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77854087-65c2-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781202132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781202132, "uuid": "73de20ec-1512-4e57-a25b-96e3e54e578a", "comment": "Malware payload (PureLogsStealer)", "value": "39a19118f2d38bfdb9421f69a84e5dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781202132, "uuid": "7b0bed60-74c0-4f6f-8495-a2e2f3f0e5bb", "comment": "Malware payload (PureLogsStealer)", "value": "8a82da328a3db0fca63f31e7b464b5989cecfd619ebab0b238c07b63544bf823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781202132, "uuid": "ea972b83-f974-4c20-af0e-e5b1ee225204", "comment": "Malware payload (PureLogsStealer)", "value": "be34707cb56d7b41393d14c67b4ad8626c4519d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781202132, "uuid": "f6079be9-c4f5-42f7-bdb2-1a7a2869e504", "comment": "Malware payload (PureLogsStealer)", "value": "ee1a3e2ed536e0885618b49f5c1af1d8c6191d51904c75690b64fe5c2eb2841901ec87e0b387c05efc5f7bb9e080f17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781202132, "uuid": "66029111-6203-4543-a1b2-4bb70e6fa656", "value": "T1E1F4BE5B32968E21D2880232C1D7550687E165877A7BE70E798423DB2D033BBEE4B7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781202132, "uuid": "882b52b0-8746-4308-bc03-7a5942cbb9af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781202132, "uuid": "05a18f8f-c987-4707-a771-b2320c22a011", "value": "12288:3/ShF+44Bbi3wOuJ4vJU5nwBByhnW6yDt+CF/XrAOfcYv:3I4Zi3w54i5LhW6yt7APYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781202132, "uuid": "de706272-a220-4a6b-8820-59aea52425b8", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781202132, "uuid": "186d1ecf-2280-49a6-a6ed-b38fb3fafd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781202132, "uuid": "8287c173-ed58-4540-a3b2-2222f461ae23", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.56762588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55ad787-6575-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781169245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169245, "uuid": "6f6e5b34-40f6-4ac0-987b-1b0e19c73337", "comment": "Malware payload (RustyStealer)", "value": "fa87425348ecd5eb4c9ffb7a168838b8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169245, "uuid": "c5f466a3-b25e-4307-8101-f085f8e438bf", "comment": "Malware payload (RustyStealer)", "value": "8d5ea190bce2cc9236a4687bf196150ef4b7849f6ddc1b65926a60e24c7e1de6", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169245, "uuid": "09fd3ab6-04b5-4c7f-9e2a-07727b09700c", "comment": "Malware payload (RustyStealer)", "value": "4291a8083bd31534d74970fda15f12d5ef101797", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169245, "uuid": "099d19eb-507e-4875-bbac-6a14ecf017e7", "comment": "Malware payload (RustyStealer)", "value": "1e3ffef10f1bb0617e55277d623f2bce945ebf973668013a83db3ef20d641c4100a9b4c9518a1fff36c72d0f34d9c569", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169245, "uuid": "ea73a3c3-4358-4482-a841-13c9f872210d", "value": "T1F8347E2577944CFCE527C079C6514A66D67278960B21EAEF03A44239AF2B6F27F3CB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169245, "uuid": "2daa5728-c6f4-421a-9d17-6e7949cedf07", "value": "4e7b016c0b476fdc646b4e71db658961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169245, "uuid": "5441d47c-3a7f-45a9-8733-05014506e81c", "value": "3072:eJiHYEMhtOl6Oi3TrW0MOQt8VRSNMPVU3uT7ipYY3UjugbscMKfc9tpG24F:rqnOl6Oi3TraOQmn+cUo2YYEaZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169245, "uuid": "a7a40608-bc0f-4103-8f0c-e51c68fed629", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169245, "uuid": "baac0a85-e504-439a-a5c8-a87f68c70c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169245, "uuid": "47667ca3-e55d-4ae7-b444-c63abc838c61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262879a3-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146161, "uuid": "79e8c5a8-82ec-44da-b2bf-320bfcfea163", "comment": "Malware payload (Gafgyt)", "value": "9d2650e79611e0fccd6a5ae47071f52a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146161, "uuid": "8a18f86a-ab1f-45cb-8485-49bcdbf8aefe", "comment": "Malware payload (Gafgyt)", "value": "8d808fb89a9f9b6428090e4b371715bc552e4db4ef4e09c814b0b8be374b729c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146161, "uuid": "f2c78124-ba31-4aaf-991f-85a5e5e7d39e", "comment": "Malware payload (Gafgyt)", "value": "38aae094ea96c275924a60c71cc221af526e5d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146161, "uuid": "1da58c00-a5dc-4167-b14b-e66ce852674f", "comment": "Malware payload (Gafgyt)", "value": "8b542a7e4d54dc29d79bfc61d7d7f13012d9d6e74a74b5984e918272f6888a9adbc4ac11245b80d3b1f021f054d1681f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146161, "uuid": "3e05e60c-dd24-42dc-8747-f48f7a5c5ed7", "value": "T187931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146161, "uuid": "ca1214ee-d76b-42e3-947f-9e268c8f3ed9", "value": "1536:Wg+k82vF8l2qbZckmjWGw57fobEOQryVwCiUH1FVLx8rbrbUkmyukJ33xZTe0gw7:WgldFE2qbhpRfobEOLVBiUH1FVLx8rbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146161, "uuid": "45f043fb-f134-4e90-b28f-b501bc86f7f6", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146161, "uuid": "f2059e0f-af87-408a-8bdf-af4d0d19a3f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146161, "uuid": "eeee4f90-c21d-4671-b458-810ebdc5f21d", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b45e39-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146159, "uuid": "0df2256d-ab10-4100-9247-d8c509407cec", "comment": "Malware payload (Gafgyt)", "value": "c0d0c60b9690fdeeb49f214181f37df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146159, "uuid": "662eaa25-f4d5-4e66-ac4d-468586daf0ad", "comment": "Malware payload (Gafgyt)", "value": "8dcc6d4480266b140eb989d6cbe68cb58352710933cd0b735366cf00644c44f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146159, "uuid": "1835c7e2-f159-42d7-9971-782a9e684cb7", "comment": "Malware payload (Gafgyt)", "value": "5ed917ca782fae804aa748154183a9e6687bb7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146159, "uuid": "a47e4c3d-3538-4795-b2a7-07b70b1b9c27", "comment": "Malware payload (Gafgyt)", "value": "f78c80a666c30b448266ca2a4050d79124130276aa7def57458596c4cd90a15ca021699e6772c55eb4b29cc3b84cdf3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146159, "uuid": "b95055f3-e657-4b20-a25a-9fd9ba959059", "value": "T106933BDAFA42CEB3D06310F116BA6B218971F9FB1C23D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146159, "uuid": "ea8ea99c-bb16-42c6-8477-f0fd1cba0036", "value": "1536:ODxHhBPQBM69XMar9wEeHo7mUvsEyabYB5bqNd2xOyQJ33+ZPEg:mXeRMar9eo7MEY/qbVJ3uZPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146159, "uuid": "e3ca1d60-188d-4ea1-88b5-4f360d461db2", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146159, "uuid": "0234f84f-fd4d-4ad0-a572-10c9950b12c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146159, "uuid": "be3e6bcd-b857-47eb-be84-e2c754951131", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1597b9-6552-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781154090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781154090, "uuid": "cc826878-f1d7-4204-b95f-eb52f71b782a", "comment": "Malware payload", "value": "23a52f9caf73aaa02a8fa94142333df8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781154090, "uuid": "13ee437a-65bd-4672-815a-fe907cc00268", "comment": "Malware payload", "value": "8e0a718ed319d51c6e875a9738cfcbd2f3332b16426f02adea40d5639ffc1542", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781154090, "uuid": "458a7a95-aae2-4d28-b7f7-24a0eda8c9f5", "comment": "Malware payload", "value": "1b28a7991295e1160c095394aa67431abbc8c5b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781154090, "uuid": "8be49d65-0999-454b-9385-01f89b88275b", "comment": "Malware payload", "value": "34ba9bbbcc9aa4e46898a9e6a22ada3ee225f011216ff027e010628fb2e95ee07a3a73f13b400d8b4a70013e0630d16b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781154090, "uuid": "f89d0429-15bd-4551-94f2-b2833393c550", "value": "T16A018CCEC029866041DAD4AD31975145B420C3CB39468FF4FEAC483E8BA9F14B069F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781154090, "uuid": "8b54724e-bd15-44f5-b752-04d08b5ea0bd", "value": "24:kXCKysE2hi0ziQvZohanQppojbUjV8mORFX:e9Qp+MsnwpojbUjV8mO/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781154090, "uuid": "406177f5-0bd8-441c-b85d-2b4a18f7b7f5", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781154090, "uuid": "7b17319e-d1c9-4c04-a3a0-aeb20b485d3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781154090, "uuid": "cddce7c6-e8b9-4054-9d0f-c5a0531abb3a", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dd6ab9-6573-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781168302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168302, "uuid": "db848648-a2ec-4277-8d0e-b795aac3bada", "comment": "Malware payload (Mirai)", "value": "e36ea437b8ada29fc8ddb1bbddd8bd6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168302, "uuid": "f0c98cbf-7f39-41b0-a0cc-7efc638dc4bb", "comment": "Malware payload (Mirai)", "value": "8eec5f951940043f11a93a019bb28f966fb45d28d967109f2cfc0c5e2fd8271b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168302, "uuid": "78f83bcb-e614-4873-93f7-5446b4c07c78", "comment": "Malware payload (Mirai)", "value": "603710c71ec12c69ac61244ddf7cf4a985cbe98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168302, "uuid": "4bdd0e7d-b4b9-4ea3-8842-801d75578da4", "comment": "Malware payload (Mirai)", "value": "5262339c90912cd36af31fb50c4f52b1ac01d3762c1c9b5e9c226f4fe84fb3afe11b1a0bae92b45c6b2e20bf84ba19ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168302, "uuid": "789a24d8-2bff-4881-b8d5-d149e6e44327", "value": "T198C33902B71D0F43D1232CF02B7B1BE18799BEA519F5E580A11EBEC65274EF62181ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168302, "uuid": "22bda73d-3695-410a-9c28-2c80d408fdda", "value": "1536:BAyIc37FQqEOA8xRqrVKHMu0MUuUzjMisWo+baEb6lOur+2VqcEqDpHcn+g7BUnT:BAHo7I2RqIbS0t+TYOoqcEq9HaF7La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168302, "uuid": "c9b7cbec-1ad1-426e-842b-cdfa141ae926", "value": 123984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168302, "uuid": "710d6832-a340-4dd9-a527-29217eefe9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168302, "uuid": "de929fff-f341-4950-8b61-373eaa666311", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4524b5a-6575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781169217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169217, "uuid": "72128c05-125d-4f56-b468-2963da3419e6", "comment": "Malware payload", "value": "04a65ec6b1cc49dc0e9a20c1d5ac9d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169217, "uuid": "61f44faf-6d3c-450d-9650-ddc9b05fc263", "comment": "Malware payload", "value": "8f7cbdf63a7d08ffc2035a80886081798ce77b519b514eea574781bb54120125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169217, "uuid": "656bf454-bb5a-42a9-b76d-8dcc63ca8c70", "comment": "Malware payload", "value": "2e34eefd491fd3990380727e58bdc80ff79b6cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169217, "uuid": "54cfba6d-c51e-41f2-b248-7836cad50a57", "comment": "Malware payload", "value": "ef39b670c177bce6c2f25bbd091a50df54ab4f435261d9295e9ce4631b24b84f5652a993bf2120f440202efc8444b56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169217, "uuid": "70fb5aae-3e45-41bb-a2d3-a52371021f0b", "value": "T14AE6335187D10C9AEC93A63D5EB3C652E3E0A9602B61CDEF1690137A3F77690443E6EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169217, "uuid": "6f383c92-4eea-4e0d-ad7e-ca26507c60ba", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169217, "uuid": "e2dc8fc0-f47b-447a-80ec-b735e354ebeb", "value": "393216:ECrSoKmJrNtZq5Xl4yvAHsxtEDweNLBu9Gf:HrSIrNtZq5V4ySwt7eFJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169217, "uuid": "d300bddd-e6e1-4747-bec5-57fd8246773d", "value": 14826640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169217, "uuid": "496a2ec3-48b7-4354-b214-1a92ca90f4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169217, "uuid": "c6257c78-fbe6-4306-ab2e-40305a05613c", "value": "VERIIZON-PINCODE-CAP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68c4957-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180790, "uuid": "74e7b69d-cf54-43cb-bc0b-6b7dff1732a0", "comment": "Malware payload (Mirai)", "value": "0d1217523bcd3264d732e4990c092bcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180790, "uuid": "7dc9d4b6-ccd6-42e1-be82-d0b20b39b3ec", "comment": "Malware payload (Mirai)", "value": "900fe7ec6338c05648105a2ef6f58fb27f5708ee6c2e4f9fdd81ba2ffd2a492f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180790, "uuid": "032162de-65de-4d00-9211-d935f863b390", "comment": "Malware payload (Mirai)", "value": "bef4716d00d74071eca2b40bae7ca953d5d904d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180790, "uuid": "b44f3e4d-7279-495f-b53a-d938ccf18b42", "comment": "Malware payload (Mirai)", "value": "cc2ac06ede880cafc00993ebeca07e2fb205de2a8318744e59310a909c95e31c8f39e92d92de5a96bc41ab3bd2a5fb52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180790, "uuid": "0e9415f1-ce1b-4ab9-b1c6-dabb9a55a6f6", "value": "T1E3933A81B94B84F2DC0748B0416BF33FCB72E5398064D65DEF5AAE25DA37A41661338E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180790, "uuid": "0cf1f3ca-497c-485e-93d9-83e856f77a16", "value": "1536:Z6NOYzdDC5XS2BZ3fVC0hmmtOsErFiceZWGK4nFewXTy798:ZmdW5vBZ3o0hmmosEQchZ4Fewjyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180790, "uuid": "2ad8fc01-3632-4524-ac27-fa795e079746", "value": 91632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180790, "uuid": "0fa00a74-565e-408b-905b-2718f4e9836b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180790, "uuid": "826a0951-5006-4202-91b5-418338656986", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0b16ee-65cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207619, "uuid": "a967d287-e2e1-41a3-b38f-5ccba8c7fd19", "comment": "Malware payload", "value": "356ebab3b67a5dc8e1eb04d3b33b6b94", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207619, "uuid": "c1b73f65-0737-4953-8353-a9a58f258f1d", "comment": "Malware payload", "value": "90b24cd5340f1380fcd47b5231c2fc94922faf52182cd912b02b524d1f7a9fe4", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207619, "uuid": "858c5e44-540e-4c77-a670-5c07f2ee29fb", "comment": "Malware payload", "value": "6dad04bc3f3280d018e3b30022af8d7aa02f8d78", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207619, "uuid": "2509678f-145f-4e67-bd4c-24e6b403eca5", "comment": "Malware payload", "value": "8bdf1a374602c21d144d0fe474059bad8e8e50a840bdbf1701080db6cb66feea56139c45199be76cb615acc48b1d5e84", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207619, "uuid": "2773bc54-bf4e-44c2-98bb-5d381924f2e2", "value": "T16651646823071134085A651939CA858BE613899707BFAC327AED43F1DF0522AD1FBF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207619, "uuid": "f55ca49c-a1aa-47ff-8eb1-a1feca03db63", "value": "48:D5jMCC6ntGg5J1K6+WtIRWWcMDF/okgygmXwQovsoINCo8NBCt5c+Ocq3BlgvNAB:D5jMS/gW1Yx5XPGDhN3ztNl800cWmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207619, "uuid": "c45adc08-131c-4e80-8530-08c3f0027ee9", "value": 2979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207619, "uuid": "bb660282-86cd-46fa-b494-f6dbf92c91f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207619, "uuid": "4d4c79a1-691f-4709-9cbe-4b3f018a3b17", "value": "token_steal.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae0b1dd-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781146411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146411, "uuid": "9d7aacc3-a19b-4d3d-9adb-6fd01cda0771", "comment": "Malware payload (Formbook)", "value": "d98cd925ca8116c5516cd3db545f0bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146411, "uuid": "15297ec4-aa0d-48da-bc3f-b638b54bd02d", "comment": "Malware payload (Formbook)", "value": "919b5cd185f5a5ccd07c619fea2bd66e753c01bb504760a6b01e4d4c04fa4181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146411, "uuid": "4d1046ec-8b39-46f5-9799-e4711057f56e", "comment": "Malware payload (Formbook)", "value": "27ab7b36c50534c69d6ec25652a1a60da0cc9d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146411, "uuid": "9cc87cd4-c3fc-4279-b050-7d0158938e8d", "comment": "Malware payload (Formbook)", "value": "2aad1c72ec0979ca290b9945c6c679fe6485aa2d3c7b27fb5a30bc2fccb4e9460ada4f311bde3527b3a795edefbb9abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146411, "uuid": "312c9557-67ec-4650-a907-56f5deb2f540", "value": "T1463501446A57E407C954573A8AE1F17813BC8EC8F412D323AFED7EEBB927B454D88242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146411, "uuid": "16e27a34-5f30-4cff-8566-c1abea45e06c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146411, "uuid": "121a4f78-92be-4238-b538-070e535479bf", "value": "24576:C91r+luTtko9Bsa84Ocqf8XG3JzFClD+tJX2dl0vMHv:W+lEkoAab9qEXGtUhUJ4yvMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146411, "uuid": "3d6950e9-6f04-4e87-85a2-4497dfc53035", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146411, "uuid": "0f4447ed-c580-481d-b90f-9134ad276fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146411, "uuid": "c061498d-1b4e-4ca0-9326-765f033abc23", "value": "MASTER_CTM_BREAKDOWN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e843b46c-6530-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781139615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139615, "uuid": "3db099f8-280e-4bf4-9ebe-1a1215e7e83d", "comment": "Malware payload (RemcosRAT)", "value": "462c7b6569058339d4e4466831ba12f7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139615, "uuid": "423c2da6-3b56-4c4a-8d03-e08dcd33aac2", "comment": "Malware payload (RemcosRAT)", "value": "919d18568ebd2cdcde7aeb972d0ba2f8fc0596d5fc7b00d35071f131a8e5011d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139615, "uuid": "7dadc3e4-cccb-427a-b920-2536c73edc51", "comment": "Malware payload (RemcosRAT)", "value": "d270b6486686c884be2bdc0d6348f6b233b52af4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781139615, "uuid": "65d91ede-1e1d-4de1-92f6-f5b2329f87b5", "comment": "Malware payload (RemcosRAT)", "value": "53895c72af1dd0afcfc919854cc3a4519e3ed55f01309cb74fcfc449495837e85699610cb1e7181120801d505f88c0d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139615, "uuid": "c75bd35a-8bad-4149-8564-208c329c716e", "value": "T18EE6E5A1EC630136DF763F862DFB13B9055B5E096DE671AA824592CE05B36F06C10EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139615, "uuid": "61391654-882d-4730-9f0d-7014a6a7df20", "value": "768:GRs/FpSADChA4YS6RGvhbswWgzcC/3w7B1+LYk8w6qjMYmYELD7F5ElCYW6ydEg/:GPWg1xpQVTYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781139615, "uuid": "9b54cb54-b135-4841-8f5e-877cbe2979f1", "value": 14221968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781139615, "uuid": "6aa6e9cd-65ea-4837-89e3-c7dc2a26027b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781139615, "uuid": "e195b61b-302b-4435-b97c-17bae7628643", "value": "SWIFT PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263774f6-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166777, "uuid": "aeae253b-23e0-4e25-9d6e-b069367bb31a", "comment": "Malware payload (Mirai)", "value": "cffb5daf1fdbc994565894b0f28cc5d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166777, "uuid": "399e0b13-2df9-4ede-9230-38b3371878af", "comment": "Malware payload (Mirai)", "value": "91e5ce134e0e9602bea7026928c39e05421b06261e45d44dde69a184f5bcb95e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166777, "uuid": "96c86090-1536-4daa-bce1-dfb963c59a03", "comment": "Malware payload (Mirai)", "value": "d100d62cf01a9f91091ef22d30534e7b286cf629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166777, "uuid": "58deca53-0b37-48d1-bc93-bbcda6f5c110", "comment": "Malware payload (Mirai)", "value": "502fceebeee55134b1b32cac22d32fc203b3db346b649a2470abc7f382dff5cfc058933e799cbed3ba7a8e98f940c2d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166777, "uuid": "f9af3c73-e6f7-4356-99ee-6597439b5755", "value": "T1C5C31B16B9518A12D5C315BAFB9E518D33137FB8E3EE3202DD10AF50678B8DB0E7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166777, "uuid": "c665720a-a85b-47af-86e6-c38b40113328", "value": "3072:S7JtkR4qjHPojtY6o8lgrEGp9tDDaX+YqhheH48aHnPlhT:SvirHQjtuoEEGPtvauYLH4FPlhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166777, "uuid": "dcfe55fe-8ccb-4ef2-9855-3d63a5b865ae", "value": 129296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166777, "uuid": "8d651688-ae0d-46b5-8a41-95555571899d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166777, "uuid": "25805aa1-e9f3-4630-8a59-922f2cac75c0", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70cb6f0-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221244, "uuid": "8ed53244-c455-4c84-a1cd-a31b34123ef6", "comment": "Malware payload (Mirai)", "value": "82da9441ff2d7417a02843712b8b43b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221244, "uuid": "488dffa5-f777-4a1f-a210-50d549e72d82", "comment": "Malware payload (Mirai)", "value": "956003d56fd0180e45cf42174e6683cd9d20c2ba535194c4b17bf075a6acd22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221244, "uuid": "e94db1e3-ecbd-43ad-8ce1-d66e199b1074", "comment": "Malware payload (Mirai)", "value": "5b5c223557763196b26b03c3b9048167e3bfc83d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221244, "uuid": "829207d0-b5be-4781-bfef-b4f45dd2022f", "comment": "Malware payload (Mirai)", "value": "4d2e5dacb214716ce7e142fb48ca664efb6453d28d6d1349fb979ebe32470c7841f52d32f4b97eb1450c06ba6dc497c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221244, "uuid": "c540b742-02d9-43f2-bdf3-502ae000d6e3", "value": "T1F043920ABF650FF7EC5ACC374AA8274620CD640A26957B397D30D818F24B35E56F39A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221244, "uuid": "0b22fd76-636d-4de5-8fb2-66c9942300d6", "value": "768:ZAaoZcfyp8cgKXdjxjNoSl3o3e05XiehQ5dV2rdXiwrheROm:ZroZWyp8KXdjDbo3e0csQrVShrhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221244, "uuid": "5539e5f5-74ac-416e-ab2f-ccfcd7291bde", "value": 59136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221244, "uuid": "eae60ea1-e54b-439d-a2d7-24de73846126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221244, "uuid": "5e8c09dd-eee3-439e-ace8-074796f8b4b4", "value": "zoryn.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c7838c-65cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207548, "uuid": "a022efc5-afc0-4136-b165-3b720e7e8aed", "comment": "Malware payload", "value": "bb8718b9427b6d108f35af694a584dbb", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207548, "uuid": "2e225b3a-17e4-4954-88fb-8967d8c955a5", "comment": "Malware payload", "value": "96c52ef185c7a5828f6a069c2fa3188fb030ff7a81f53e3921260cea0901a372", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207548, "uuid": "d78ed1d3-9b7c-4daa-a9e7-7aa43b53e8ed", "comment": "Malware payload", "value": "43e38eb81126eb241974d7de581178818298c60d", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207548, "uuid": "52273421-23f0-418e-a5ad-60446d0b20eb", "comment": "Malware payload", "value": "198c34742e57f4e2f774b436aae9c21003da9c3408f9a029658c4c41458139742d856443b585d9906b7d5f133e3d54dd", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207548, "uuid": "76990851-491f-4f6a-874a-25e2add69018", "value": "T12AD16151A7E80952F1BE0B7948F34B0216B2FC208B33CA9E09D0209E5D33B545F31BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207548, "uuid": "cab7e621-fe8d-4f0d-ae7f-cf18229c230d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207548, "uuid": "f5b30bc7-95f6-4eb1-adbf-0d8db4bdf35c", "value": "96:G6TIc0bOu2uX5U7+UkFssU8y0Ptd+olfxFjg1DNG0eC:G6ThQV9X5UaP+sJvPfjxJg1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207548, "uuid": "65bc8d81-4534-4d39-8a55-6d740c2f1368", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207548, "uuid": "503fde03-ae40-4f7b-ac37-a8c9faf0a2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207548, "uuid": "6560537c-edd0-4991-8562-ed974fbafa2e", "value": "ss.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b271ab7e-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781188917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188917, "uuid": "0f1208c7-8b50-47cb-9e52-4cf399a37439", "comment": "Malware payload (PureLogsStealer)", "value": "c1843d8ee9b19b1aee41958df0704a1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188917, "uuid": "b340dba9-adad-4387-82fb-8349d95a7944", "comment": "Malware payload (PureLogsStealer)", "value": "972a58bf48c75cf5f93cd6208ad6015fc35c53e9efa441b0dbeb27d7f187aae9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188917, "uuid": "ad2723af-4562-4755-bb4e-9d2d4a1742a9", "comment": "Malware payload (PureLogsStealer)", "value": "5c6f9fdd90d8a3cec4e36b27ceccae976d8a4db8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188917, "uuid": "316c599a-1ed0-4cee-b6aa-8c1b36eeca09", "comment": "Malware payload (PureLogsStealer)", "value": "a7941e407aa666e29d34ff69ec8eb79edf93bbcd343bd5c7dc33b91b10b01b004d45950b42e68715af55a4bbc8ae4704", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188917, "uuid": "30ed1d1a-f0da-46a1-833c-e1e0f2dcf62f", "value": "T1B1D5123516D3AA6D21DC24A8B9541F62DBE150C3147B64DCA8760BF09C82DBEC367FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188917, "uuid": "4862df9e-805b-4a47-a0a5-593d9a1ae42f", "value": "768:zJa7Fw8qhDn8AaJCdn6m7rIdcKfBPQnJ2KwP6ePkKixxQUdwDEojXettUErIJrIe:zJa7Gn8ATnHVShVwbdwHzshi4gJtivA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188917, "uuid": "5251fc35-ffa7-4933-915e-132c874c5bbf", "value": 2806088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188917, "uuid": "84706349-6e41-477b-8047-869f9a27937e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188917, "uuid": "6578059e-6903-4e74-8c4b-fa96b101052d", "value": "ORD 06112026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90541dd-65ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781219422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781219422, "uuid": "b32055dd-0ef5-4ef5-b623-15805444ec15", "comment": "Malware payload", "value": "49fdd86c7ccf13f75357af5a1b821e6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781219422, "uuid": "c1436052-f657-4c2d-806b-5b7a53f51523", "comment": "Malware payload", "value": "979d9c589126db66bfb0b37af810dac9af4b0c6956323057648cbc5510ae5cf5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781219422, "uuid": "86e52af0-62b2-4bc8-9fa7-22f4b64b87ee", "comment": "Malware payload", "value": "2ac1192c04e062aecf9ba1b2d3583b3eb96c0b21", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781219422, "uuid": "4f6b298f-dbe8-4054-85df-a6ffc88a4a0b", "comment": "Malware payload", "value": "ebc3c9bcd6efca6dee3cba90922fd25af3b64f1b2ee5520bcdc1f6f15869bd789adb2d55866e3da801b973990cd008b5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781219422, "uuid": "b51e5afc-441f-48e6-94a2-1e7a473357b7", "value": "T139825B0FF9424326E0D100748A62467BE979A87A73C454D7FB919AED1B686C2EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781219422, "uuid": "d3a2a6a2-9038-46b8-8cd1-053b0e0aa9e1", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781219422, "uuid": "89b57dbb-234c-4ceb-b2c7-c5cd9688dff0", "value": "192:ls6hSCngTBvPV0K3EdRgqUPGle6/C/KUSf8zwAVYNd5Fo+EI2DoCGJxTmv8U9ctf:vIPVGUPG0Ud8xVOdHo+A0jav8U9c1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781219422, "uuid": "b8c40a18-0888-4043-bf9b-52d1c350812b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781219422, "uuid": "f5cc6cf7-8305-4981-9984-3dbbe0290c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781219422, "uuid": "20792b48-9a24-48e5-814a-20dc7a14a6a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6cd0ac-65a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781189851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189851, "uuid": "fbfc59b6-ef1a-415d-9a88-5361dffa1438", "comment": "Malware payload", "value": "ce36b7924362db98f5a6b69622c849f4", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189851, "uuid": "18daee0d-f99f-49bf-8c45-8cca5027f20e", "comment": "Malware payload", "value": "97cbe593421cffba1fbd5969bca89beb416e0f47971026297454f86e148426b8", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189851, "uuid": "63f24cf9-6044-4b0e-b2a7-e40237c2690f", "comment": "Malware payload", "value": "89b508e016b8e3150e53cd4e5e044844ba463bd8", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189851, "uuid": "bc7bfdae-bbc1-46af-aefc-0356b4665507", "comment": "Malware payload", "value": "58093cc872c5f9a814bcc7688e6d6a8e02394dd630b488fdfb599129405d7c9106907e7475149800b7e3bcd4bba1828e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189851, "uuid": "3160e8ef-8b12-4452-9ecb-594c586a7842", "value": "T11AF58D03ECA149FAC069A2318A6752927B74BC491B3777D72E50B6342F737C06D76B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189851, "uuid": "023f29d7-3152-4665-a81b-026d07bcec72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189851, "uuid": "f7b6f34c-bc48-4676-8c9e-1c374b417335", "value": "49152:ldgxM2ul7n3yu6Pp3AcVkwlCjMrpvrSfiscvsvNueze:lqxujUpGqMlun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189851, "uuid": "2c97eb8a-1ea3-4d92-8cea-f626c93cc575", "value": 3543424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189851, "uuid": "300d5483-c39a-4e16-b270-1d5373cd1268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189851, "uuid": "be39709a-e456-4a2f-a9e3-9f5293ca9f9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89219870-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781211611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211611, "uuid": "930327a7-b097-449a-b519-7eb7b55a6332", "comment": "Malware payload (Mirai)", "value": "98c5d5cbaee62ed1da98e2dd3b57b717", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211611, "uuid": "1d2327f5-f1f4-4364-a2fa-85dfe34289ac", "comment": "Malware payload (Mirai)", "value": "984b1a9e6a33a8e72c317e5a979a6e3648fe5a366a5a24e8696adf87342d65dd", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211611, "uuid": "8ddc7073-90ad-4b14-80f1-b0bc3e544770", "comment": "Malware payload (Mirai)", "value": "90d252b99723b3167da08963a34cdfab9442c979", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211611, "uuid": "b49b90cf-1175-4880-a242-c476c19d8ec6", "comment": "Malware payload (Mirai)", "value": "be1c1a12470356c1f7781b8e656609cafc5b45699038f43898f9e0b26fc6b31d35acf6cc83db54eeb9d845846bf9c5c9", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211611, "uuid": "6f8e90c4-7d96-40d9-b943-48e6fd28043f", "value": "T1B014CFA3FB8B1461C86102F85F8B8F6D2E3311461E6B84E36C6A353A6D771CF65117E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211611, "uuid": "4d44e458-f417-496d-8c64-4fb133e679f1", "value": "3072:LRkBXZuKUahFqdsv7MfraSLc5azWU1FnRqL5/KtfU6grCS1Ya9p9gnq:LRkbu9d7dc5FMFRA5/+fUXCcYaDGnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211611, "uuid": "2125bcb3-fd0e-4ef9-aedd-02851f6e5f18", "value": 206340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211611, "uuid": "177bda3d-686a-4c3a-b1b8-967f022cb141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211611, "uuid": "13c40e3e-aade-4cc3-854d-14d7cabb72f5", "value": "984b1a9e6a33a8e72c317e5a979a6e3648fe5a366a5a24e8696adf87342d65dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44cd9d8-65af-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781194101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194101, "uuid": "f934c01f-5d10-47dd-9c00-16bfe551ef6e", "comment": "Malware payload (RustyStealer)", "value": "173e47952a519cedcbc37d7468c0afe5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194101, "uuid": "452af3ae-3584-47e2-b7be-63fef44e8fd1", "comment": "Malware payload (RustyStealer)", "value": "985a2c4839ac4ded904d1d9b354d2fbe9e24c36e963d171d7e21130a4c0f66d4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194101, "uuid": "3aba7bea-0b2a-4081-9303-f8a43fb4dd44", "comment": "Malware payload (RustyStealer)", "value": "e562387236169b80911a4081e772ac1151942462", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781194101, "uuid": "52867c28-5a92-4977-a21c-d293b1e6382b", "comment": "Malware payload (RustyStealer)", "value": "9c5fd69b6985d7c0cbeb122eea50171559d540e195a86726fd5ba222c68ef6833e1251ae3abf4002a3c521cf9eb98aa0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194101, "uuid": "ac4c064b-28ae-4c48-afb2-f0da115200c9", "value": "T1BF264A22BA4A99EDC05AC07483478A726A3574CB0B35B9FF44C496783F69EF11F3D258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194101, "uuid": "bc8e2d41-6038-4780-bd25-8e93ae72d9c1", "value": "ec3e47ef945cbf71ffd58b883d4e116a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194101, "uuid": "24766e80-dc00-4159-9cbe-80127736416c", "value": "49152:oVlMarczD+zkvL3J4cKC8i7uD+zqBuvOo+oJLbLrU5YAIUjV+IU6iXS0I/Fa4bf:o3QsiDRxNsjVJ+Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781194101, "uuid": "61c3823e-52e5-4f92-bb39-a8a6c5548bbe", "value": 4490240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781194101, "uuid": "9eda717b-c955-42b6-b961-de86fa4b40dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781194101, "uuid": "44af8a67-274a-45d7-a846-27ecbd27d64f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac703ef-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184179, "uuid": "d762c5cb-60bc-4d64-96a7-58a4eba37e25", "comment": "Malware payload (Mirai)", "value": "61ec848c8c388295b62432e979d3a127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184179, "uuid": "0959b954-798f-4eb7-9be8-44d013ca3b5c", "comment": "Malware payload (Mirai)", "value": "98ad516d6e2df7f750bd32acb52b7c34b78878b80b4cd3bd8bd9c24609957cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184179, "uuid": "0485dbdf-e41c-457a-9016-404190d761cb", "comment": "Malware payload (Mirai)", "value": "d79b9771e05ea6b9e07818a5e00425f76c2e39a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184179, "uuid": "19de5b09-fda8-4b18-a983-9475fc738963", "comment": "Malware payload (Mirai)", "value": "2e74c3726ece50b4a4e9ad279cc2b6ba3c0b730a0a05fd3957af3dea22ec69f31401369120ba13035a969b387c91e145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184179, "uuid": "7b509057-5ba0-4f8e-95b6-26b80b7dd285", "value": "T1C914F95A3710DF61D369D1300AF3C753A7E926922AD2894AF26DDE082F70759682FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184179, "uuid": "f54fc06e-64a1-4a9c-9508-aecdfc6272de", "value": "6144:L0nPxta3pVMvQo5pVOXDQ/s2McQY5uJ3sFhtUvv:L0nPxta3pVMvQ4OX+xQQhUvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184179, "uuid": "2d647f08-f1b2-4daa-bf8b-6839f7c328ba", "value": 200444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184179, "uuid": "57320516-a609-4baf-a34e-ca45039c3f6a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184179, "uuid": "6c65c42c-e516-4efc-aebe-3e508b56b578", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24767fad-65c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781204140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781204140, "uuid": "98e7ec76-a148-47c6-9c9c-2981652c7c33", "comment": "Malware payload (Mirai)", "value": "d616148ea55d9643b9aa5554d3a02b5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781204140, "uuid": "1d63ed5a-58e0-4ce4-bc85-427b8eaf9999", "comment": "Malware payload (Mirai)", "value": "99a19b9d8a73c357a3734c3d028391f73cd4497ea09e91b27d318ab8e1e68a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781204140, "uuid": "b3839576-6512-4c99-b984-949ec1318070", "comment": "Malware payload (Mirai)", "value": "9be417670479c288679796de4e727b91b72b5e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781204140, "uuid": "5d1e0789-4656-46f8-8b64-f1618d7c3f74", "comment": "Malware payload (Mirai)", "value": "191658b79fe299803c08ee777531f47ffb366537f7e6a99a510140a2e45ebdae031d7133fa4a74c1b79a6632e7f82cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781204140, "uuid": "88146183-e689-4ac9-a633-c4112a5ebda0", "value": "T1870418D7F900DAFAF84AE3374413480A7130BBA254925E376267356EED3F1881577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781204140, "uuid": "93ddfa89-e31e-41e6-96db-6a6458e6c268", "value": "3072:gfmYP6+RbUyaXfVePGcoN+WpyCBgDGO8umiE3cZJVLjbi2LUij3QkaXK4:gfB6XrTyCqDGOSncZdLhr8XK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781204140, "uuid": "7ebcb7c1-75ec-4bf2-a875-3673c5d8dc78", "value": 173540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781204140, "uuid": "715d18e1-af37-45ff-a9c1-ff6d8635cb6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781204140, "uuid": "164ce733-6353-4315-87b4-de8a37d19006", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5cde6a-65a5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781189499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189499, "uuid": "3a581921-e79b-4f9f-bd37-a0d9e40757e1", "comment": "Malware payload (AgentTesla)", "value": "18b93f31c49e4302e3fd26764b6ad37a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189499, "uuid": "badebce6-3746-456e-be65-7c6dc56f6883", "comment": "Malware payload (AgentTesla)", "value": "9a04ce5c1ed6e353d8d8d936fefba4517ecc8f6777e5f866178dba084ae90d8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189499, "uuid": "5aaaceb5-38d6-4aee-88ce-98a2b8c587d9", "comment": "Malware payload (AgentTesla)", "value": "cf5058b0d233abf4abf55bd13597f9b07c5d2eed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189499, "uuid": "2c7a15b1-f992-4d21-980c-18052a4db651", "comment": "Malware payload (AgentTesla)", "value": "2da2db4e338972dc62eef14e3a61b2dc1191e249f01bb790482734b5eebfcc12ce40afe0e9a1dbad507349af179af487", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189499, "uuid": "3bcfcd2c-2807-493b-b3d7-5522b633a987", "value": "T1DC35CF116E422F84D6AF0B78C416081473F2CEA39F9AD7E72EDC59F56963B84CE02953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189499, "uuid": "22ecfa88-4290-4aa5-8e5f-7c3267e5fec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189499, "uuid": "6f841c76-0de8-4799-b7bf-2ad451a4acb3", "value": "24576:7eCWKKsjgbd3vAtr77eHC4s9hCwCQgL9GR5L5+bG3Oc4J4z:6CJjq3pHC39EbLwPcasJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189499, "uuid": "8ef0f782-f423-4eb8-993b-57d0cc892c7a", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189499, "uuid": "2dc8f16f-3b9d-4aa4-a7ae-57f2833f3ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189499, "uuid": "fdfd3ecb-69f7-4948-ad65-ceae298eb883", "value": "Total USD $36,477.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce6fecb-657c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172211, "uuid": "bcd34bd5-0794-4ce9-9df9-e92b48fb438f", "comment": "Malware payload", "value": "cef84660903f722f8c361764aa7f4152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172211, "uuid": "3104e20e-968a-4c57-9752-8cb2f48721b7", "comment": "Malware payload", "value": "9a26aa9ea05b8d73f839020a9661f089aae8d957038fe26337945e6988942d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172211, "uuid": "60b5e04e-0c09-4a27-be7f-d745b6fda400", "comment": "Malware payload", "value": "ab91e72c543f3ffccf4b611eb4bb172a8583c799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172211, "uuid": "69dde6eb-404c-4ed7-bd8c-d1003da75933", "comment": "Malware payload", "value": "8c12f69524b8b857bab6c69e1dc58aa7a222417ed64beaa4c5fa72a76c1ef87f04deb460bef9377ea823f16c172af462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172211, "uuid": "4c14bbc0-ced2-42c2-a332-8f21b3ee7639", "value": "T19A12E705BBE84726D8BF8B780CB393155673FA069923CFAD9C88119E1D336148D52BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172211, "uuid": "ead73d25-e5bf-48a0-9030-ae31b4c98da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172211, "uuid": "027bd5ea-9627-4017-b6c6-44e5db648b16", "value": "192:2yq19SAhzZjn96Db8D5l9L8+LYZw6waOaC9LluhEWvy2SW:WJ55nUgVl9L8+sZwxaOaC9Lsh5vy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172211, "uuid": "b90a100a-b1c2-4ee6-96ba-ae126792b91f", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172211, "uuid": "4a6e910c-8eb1-4e81-b6fe-050bf640de19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172211, "uuid": "f960c69a-b8e0-4120-9163-927d6c594af4", "value": "rCalebVictorFranciscodaCruz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7632210d-6572-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781167770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167770, "uuid": "0b36a7d9-2bb6-4b9f-926f-7132b9c2a1ed", "comment": "Malware payload", "value": "d2e95f0d02f6efbf4493b5eb22d9c4c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167770, "uuid": "79b49a60-1ea5-4ad2-a5e5-bd5252abe3f5", "comment": "Malware payload", "value": "9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167770, "uuid": "2403bedf-744b-4ded-bcda-41e9f04f33cb", "comment": "Malware payload", "value": "24baff273e7f5f0b4c47ce1d069a8a49dec36971", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167770, "uuid": "49764002-86a8-4269-acc1-d4f595c417bc", "comment": "Malware payload", "value": "982008c73793312361f346fa7537009868050600ddb299b6d97b28fd2a1beab5aa92bc7a551a5906fabd23d2af5774cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167770, "uuid": "45972534-7160-406b-bf6c-c4e5f0b60aca", "value": "T1DF31A8AB4F193A8D1900DDAA7364218CF124E5DB208FE7D4FE4C847DA2C9559325AE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167770, "uuid": "b7a9410e-31be-4a08-bf9d-41b03aac994e", "value": "24:HvFHO7+sxdKs+qi+wTysvpJzCe6lQf+YCZ:Hg7+sx0qzwTysOlQf+tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781167770, "uuid": "bdcf1196-7ee3-4a3c-a33d-d5ef333d3a49", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781167770, "uuid": "1d83e22c-3fbc-4025-a2c7-e69a9b7728dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167770, "uuid": "f5f37696-fff4-424a-9849-3a3a7eb5f359", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79717070-657c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172071, "uuid": "4c3f330e-c32e-4c2c-8db1-d46ddc15b741", "comment": "Malware payload", "value": "d11c0ffda0dab0056434902d0866f14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172071, "uuid": "18dea2d4-fac6-4c44-989f-3370c1aef0ea", "comment": "Malware payload", "value": "9b149e9e4682b712fc8715f18fd7a84e4fe34fe8881b0a549d0bf6a5067b88d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172071, "uuid": "df9353fb-01b1-47b3-835c-d1429622fab7", "comment": "Malware payload", "value": "d7591d85716fa2e06604f4d6e3eaca09f2c3f701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172071, "uuid": "e7b53d04-d0fe-4207-b014-bb5b73314494", "comment": "Malware payload", "value": "3a1e770141a7dcf79d1fb069500cd5ec06b9d89f76bf0e67947df7c82496d1125a3d24affb8114f2cc3dec9fc0daac9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172071, "uuid": "fda4bc65-4aed-458c-b0eb-1a80c9d9ce73", "value": "T16022E604BBE98335E4BE8B784C7383111673FA05A937DF9EADC8119E4D227409D81BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172071, "uuid": "00d1f8ce-2398-4388-92fe-6cfc0f99e622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172071, "uuid": "0e1a9833-3e5e-4fd0-9297-a60c790f6f37", "value": "192:S5BjeMtpTTMgHaeqY14RF/suQLYZw6+aOaC9luUZIy2Gr:gek/MgKRF/suQsZw1aOaC9lVIy3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172071, "uuid": "823df69a-6bac-41cf-9a8b-5c6542444efd", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172071, "uuid": "14a0930d-cc20-4b27-967a-1791d40e209e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172071, "uuid": "9812a728-d533-4103-87b9-476470ad6ab7", "value": "rBenjaminF__bioTeixeira.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255fb20b-65cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207578, "uuid": "fb5054d9-3838-4785-8712-60788a36ef36", "comment": "Malware payload", "value": "2a7f41f49d233fdccaddbd3bbb8155e2", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207578, "uuid": "3dfdec3d-fd03-4ed4-8364-53933d5d2604", "comment": "Malware payload", "value": "9be014600ebfa80c304f27b39dedd02613d42672dd944d83ca6945898cb68eae", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207578, "uuid": "c8babab6-84d2-43a7-a064-cf7cc0c9cc54", "comment": "Malware payload", "value": "d473a0e75c2d7687ec894c42ab983e75d822ce54", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207578, "uuid": "b82aad2a-6764-42bb-a9ca-58ed3985b7a9", "comment": "Malware payload", "value": "4834692b9417edb840143003af8f89ccd4eba20e0452226a4fa2f17d21aab341e9e98856beb2038fe583a94b9608ef0f", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207578, "uuid": "fbdd8043-b352-469d-811b-ff58542c14ac", "value": "T1C0E18142FBED4565E4BF0F3929F2070246B0B4130F3BDA6F0AC511AA2D663469B627E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207578, "uuid": "1095521a-8a0f-43c9-b41c-1b7a0dbcafcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207578, "uuid": "8b058210-ce59-46f9-831f-0a3f8973468d", "value": "96:MyQIetg9kSJZpCawMPFD6jupn+dX/lrkoQ0m+:MypeRSJzwMPFDyuIdXNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207578, "uuid": "e42c9865-b0ce-4235-8a11-38661cecc7af", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207578, "uuid": "a7f1391a-26fa-4fc1-adbf-64c335c4dc56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207578, "uuid": "9efdbbdc-5813-4028-aae7-cb34f58655b7", "value": "ts.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74447a1a-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206851, "uuid": "f67d645c-5b56-4beb-8a62-8d22d9cc32f0", "comment": "Malware payload", "value": "9aea6cfe6711f9af73a217c2969f469c", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206851, "uuid": "4f1624bf-16c8-48ea-b857-4302d36990b2", "comment": "Malware payload", "value": "9c254c53b66a0d2fde4c1d3e4bae0d94f228b9fccaf7752d1e2dc6c75884463c", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206851, "uuid": "117515f9-88dd-401c-8c84-832874762442", "comment": "Malware payload", "value": "570a8318a9dc8665f270522bc32f812226c380dc", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206851, "uuid": "66162033-7579-4da7-a4c2-9bf879b08b0d", "comment": "Malware payload", "value": "11fdbf4c49cd05c597524a7601b4601faf049c67a6f54e0e6804dfd804c0041572daa47b0e59670d65370fd7680ed804", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206851, "uuid": "3c60438d-ca12-415b-8e94-1c5a14ef3842", "value": "T1D55151243F9BAA5905D300B3BE7394C99E141B7A48E97C20B5ECD590BF6B160C276758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206851, "uuid": "4701a4bc-bda6-46c5-9698-7a78abe45772", "value": "48:VgGd2Rc8OXj7vMZ/+FI1wt3i3bGzQPA0lEt4K0lEzt6PK0l42r0lZi:VgGXvvOmFT7b0lEtf0lEz/0l42r0lZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206851, "uuid": "1f328272-82b2-458e-90a2-b818a09ea602", "value": 3019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206851, "uuid": "5bce2b77-b280-4834-b707-d739e5870abb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206851, "uuid": "6b9ac51a-4814-4ad2-bbed-f7a1f7c83642", "value": "adduser.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3a55df-657e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781172904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172904, "uuid": "aeba288f-5619-46de-b3d0-75b595ae2146", "comment": "Malware payload (NanoCore)", "value": "c313742a45bc8d9fce1054eac5904666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172904, "uuid": "0032dace-64e9-43dc-b3bd-6751e42e4f40", "comment": "Malware payload (NanoCore)", "value": "9c7a36522169ca7b2b1bd2af276da1224aa7cc2eb3e7fba8d0847c7f25bc5ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172904, "uuid": "740e1a76-d8dc-4182-9622-92da1df39bb3", "comment": "Malware payload (NanoCore)", "value": "f21f5f45e02ee7dc80a3934f69c60030e87ad4ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172904, "uuid": "14bd6425-5ba3-482b-ab65-f94faf7a92ae", "comment": "Malware payload (NanoCore)", "value": "deb8121574ca035ba716ce0ac069a4a3e521fdd295f21dfd90242e490009bddca01476ebe09c69794db36573895e74f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172904, "uuid": "ae148f6a-d575-414d-9bf8-eebe02e75893", "value": "T11014D0553BA84A2FE2DE85B9712212139379C2E3E9C3F3DE28E451B64F567E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172904, "uuid": "27cf131a-967b-4f93-a3b1-08095e2f28bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172904, "uuid": "e7c12e44-a8fc-4fde-ae62-5309475927ff", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIVCsC6wwBLsjAIZnB/nFgMbszH:sLV6Bta6dtJmakIM5t+LsjAcW/zhIRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172904, "uuid": "38b4ecdd-fbd5-4074-a6dd-ff1bb527a507", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172904, "uuid": "eca54ad7-b495-4776-ac53-c146463778dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172904, "uuid": "228842b2-cbfb-46b6-9e03-32911f5a160d", "value": "socion.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c60ca2f-657f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781173284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781173284, "uuid": "c2b6fd6b-568e-47b5-9cc1-0e0fe509d3f1", "comment": "Malware payload (MassLogger)", "value": "0cbfcc3573399368a2a9abcfa42af134", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781173284, "uuid": "0600ad58-601a-4057-bd7d-cfc149ee5680", "comment": "Malware payload (MassLogger)", "value": "9d6c0643e954b2f82ca423628543e0d58f47c9fd7e9fddf4ceea404a0dd918bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781173284, "uuid": "061c60a8-5b2f-4fae-88b1-59d987e61612", "comment": "Malware payload (MassLogger)", "value": "806e8112a21b00f143fda422d0307d40973a6ff5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781173284, "uuid": "085045d0-9952-489e-80e0-88fac7c3436c", "comment": "Malware payload (MassLogger)", "value": "aea7739cbf28587caa2b58f25d10b0900e3d590bf50ad5da8b7b63e63e5d390430b3dd9b15147a8fd1159e95b5ff0138", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781173284, "uuid": "8528db22-0929-4932-9209-5becffb4bbb3", "value": "T17F161A3DCC58423EE5B2C92CCACA491FF8922A17621CDA4754C72B5F5E63683B7D211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781173284, "uuid": "dee4022b-0ce4-4ddd-9aa8-2f245e5d4e8c", "value": "3072:wR1wIc/wKw2LAup3Ihi009yuRFymlqMGf2wui8onpcnKc4cFBoGOQ7Z/rQcIkROa:roKXAWnUp78AWjQKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781173284, "uuid": "09fd7678-ad43-4f92-a47b-7ee3ee9942fb", "value": 4050374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781173284, "uuid": "a6db1341-f728-4d96-b5b8-3bbfe42ef576", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781173284, "uuid": "6d55c6f6-cdb2-43a0-b14b-bbd63ecf6be6", "value": "RFQ _NEG260005904.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784d082d-657c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172069, "uuid": "febeadcd-227e-494d-ba24-4cad917f8367", "comment": "Malware payload", "value": "abb1fc008971ed8e7b9344ca8727b0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172069, "uuid": "c04a97ef-0783-433f-bd6e-df77e3654597", "comment": "Malware payload", "value": "9e514a2edc365a832771c67c6e37d72c2c31733183da40f8940cccc115371be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172069, "uuid": "9e1c5cc8-30a5-47a5-be0a-44e8c23f2a4d", "comment": "Malware payload", "value": "5e55a17f90941aad8d77ca80a80fbb7c466a7bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172069, "uuid": "23adf447-e3ee-48d6-bf5b-5b56da7f7751", "comment": "Malware payload", "value": "74d99c144d73c78a092b1308baab681e55b6e867a9caff758ae7175d8481925d1b9821d8762f027fa127cd424700c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172069, "uuid": "daf205a8-89d9-41bd-9f63-f1c118d24ce2", "value": "T117F701779FA21CE8CB36813159CE14DADE7E774313704ACF214A8BD60F17AA05AF9258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172069, "uuid": "feb45d85-10fe-4357-a80d-285d72d05a62", "value": "0ce3c6e1fcffaed26129ce5fdcee5e76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172069, "uuid": "701042ad-ea4e-4aed-bd66-ea9787d4d064", "value": "196608:cQt8Ib40JQxvN3ib7izTul+PslcgseYyt:cFNxvtiv4V+Uyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172069, "uuid": "58fcfff1-d4c5-4056-b4e4-df69b2f78c81", "value": 74895360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172069, "uuid": "482a3b06-8aae-4448-9944-326d11d8290a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172069, "uuid": "e6b0d6f1-bc36-4d34-b70d-f1be02c44061", "value": "ms_worker_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b61107a-6572-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781167833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167833, "uuid": "5b2270b2-160d-4655-9dcb-d21146195dc6", "comment": "Malware payload", "value": "be29a618f6b3eff115370d45e477c098", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167833, "uuid": "938258f2-dfaf-4088-80f2-02b86760f65b", "comment": "Malware payload", "value": "9e690ad9ad3f8a7aa1583179326928c42e6277be91dca807fb7d21f20f8ee305", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167833, "uuid": "16fad68b-090d-4d36-8227-6f23b77f06d4", "comment": "Malware payload", "value": "4b4902619f1db816ec52fca89142f7f95082fef9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167833, "uuid": "822e1cd4-386d-4d3b-bf8e-ec4c3d5a6435", "comment": "Malware payload", "value": "8efe1b5d1367ae57b49ba8e1433965046a8ed36197d1371aaeb8d61204c7817dacdc6df3897f8751da7746f308821308", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167833, "uuid": "a9b1e2b7-4312-45f3-9705-0c7e878db4f5", "value": "T19FA4230D8113A07039169E23F6237FBAE85D16794972797DE7C32F84A8662195CFF222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167833, "uuid": "c60ab045-3e1a-47eb-b765-3e403b2da75b", "value": "6144:DVj7m0CM7ZGtmgVWIoQxQMDaY63uYnewyJovHKs2a6JBzcko10cBReTjaQ:DVe0lZG0gAbZMDv63hMJo/K6wubYTjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781167833, "uuid": "fc72c795-6795-4c11-ad04-b7d0c19b5243", "value": 459223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781167833, "uuid": "cdb10179-d139-4693-a592-0dfa282babd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167833, "uuid": "781e13e3-960c-45d1-92b4-5af15c465517", "value": "Laporan Bulan Juni.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df64fb2f-6556-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781155921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155921, "uuid": "ef49a2e3-bc22-4de9-a2bc-c252a3830662", "comment": "Malware payload (ValleyRAT)", "value": "e56f24178e773e07253624451304c533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155921, "uuid": "91023341-3ced-47a7-a8ce-b73130f6eae4", "comment": "Malware payload (ValleyRAT)", "value": "9efecadac10fbe58de8f3af3b25370b81b4819cd5c3c95d4a0459ffe50890775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155921, "uuid": "ff451928-62a6-4f83-b9c1-eb427eff9464", "comment": "Malware payload (ValleyRAT)", "value": "820f5412958d9c142e3982332a194d5fc578c160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155921, "uuid": "c0b7542e-e4d2-4632-98fa-3ea89f942eb4", "comment": "Malware payload (ValleyRAT)", "value": "ee5fe002b63f6798dce92e064672b0bc83507deab5b937c4643bbd4f4ac0ecaf09b4f3556bcd67b828b91b39002f6303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155921, "uuid": "bd3d7114-7a2b-428f-871c-f577cfceaacc", "value": "T17A469D07B3A406E4D527C235CA96D332E7B078941738C68F1598E61A2F33A909F6F7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155921, "uuid": "ba130db5-ca98-4ebc-9748-8cb3f7722f66", "value": "b441ac1d5f72b040508242b45fdaab3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155921, "uuid": "e7229484-1717-455b-8883-64086b33c0cc", "value": "49152:+OFvb84hsAchKbwHRJmUD7FTRHKuvODRdXCWum4VSO9ZifO64k0tK1+GZiXrdTR9:+tezUTBjYZOKEGArd26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781155921, "uuid": "d139c86b-8faa-488f-bdde-c935c1c7c993", "value": 5502464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781155921, "uuid": "221d755a-b368-464a-8e7e-6960a9aa41c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155921, "uuid": "a260e97c-7bc3-46d2-bf6f-031498f602d2", "value": "\u70b9\u51fb\u5374\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978ae8b8-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206911, "uuid": "67469850-6370-42d1-b00b-131d3965889c", "comment": "Malware payload", "value": "61d714146c1ff7035c481cb15635c7eb", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206911, "uuid": "93b4f74c-f85e-494e-9bfa-aca039621979", "comment": "Malware payload", "value": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206911, "uuid": "48d95daa-477a-48d6-8b8f-dd970169d409", "comment": "Malware payload", "value": "8fe501afbb3b82329b26525699f0138286295bdb", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206911, "uuid": "df5771fa-c113-4623-9bf2-013609597ba3", "comment": "Malware payload", "value": "a20c5fb06f1c278f879de8e47dfc9ef4207a5731444920c47c64f081fcb965d8ed0fb8321a83fa2bb6930f5caea7f079", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206911, "uuid": "d054731a-4545-4fc0-8e50-ea8a79a050d8", "value": "T1DCF0DD05F6E08DA48382C8A3E8C754177522A4E71EDA69B03BBE604D6F68817C7002CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206911, "uuid": "e56063cd-58c9-496e-87cd-530c4bcfcd43", "value": "12:GgxWegio0o3opQGonQDk77MK1M8WF9MjL4JyPMrBGJQk40VVp:sf3MbCN77W8W2UyGBGeYVVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206911, "uuid": "2020f200-9b21-4c5f-838c-d6e8620f7995", "value": 654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206911, "uuid": "e46dfa0d-091a-4c20-9768-5f41235950bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206911, "uuid": "f9cf8f4b-896c-4861-bae8-b80523e47fb4", "value": "cred_test.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdc7ce5-656c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781165156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165156, "uuid": "4e1fbe2f-9620-462b-a926-c0707f17a0db", "comment": "Malware payload (Mirai)", "value": "b7d39060a433603a03574131184e2631", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165156, "uuid": "d5e90f62-ec73-46ed-93e2-0d7defdd537b", "comment": "Malware payload (Mirai)", "value": "9f571dffe444c9f21be1601407fac597bf82af23598bc3107aa90d4d5a038102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165156, "uuid": "654c228c-cd09-43f3-a316-3f4bbf900bc7", "comment": "Malware payload (Mirai)", "value": "82a394a1ded08de0b5fab3c21ad49afd93af06e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165156, "uuid": "c435a037-85ba-42c6-9753-41183f770f27", "comment": "Malware payload (Mirai)", "value": "c4f015fcc0222cdc67ff2d916b29f9a863c91c239bffaf8a9497b759ead86dda418ab9f27c3ba00d7d2550ea012d10ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165156, "uuid": "7f1108d7-78c0-402c-a50d-9f19b91940c6", "value": "T1AE156C4BB2B374BDC057C43043ABDA72A935B43542216EBB65C8D6303E27E701B5AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165156, "uuid": "15c9bce6-a38c-4875-9556-ef6f76650fac", "value": "12288:ZQ437xJ+34s08D/bk69iIvKSjvbMvZd6BE1EBMu57X7+yf7tKppdzuFD6pJyJ/D5:W4rW4sLk69rZjjMBd6BE1EBfhf7to49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165156, "uuid": "973fda66-5737-4e88-8cf0-085840b420bc", "value": 906440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165156, "uuid": "fb37f90f-2947-4f62-b889-036459ee4595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165156, "uuid": "94e8c96f-ed7c-443f-b9c4-03b017fe86b8", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83714305-65a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781187549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187549, "uuid": "fa5ec79c-799b-4b8c-8175-0d046ef9508e", "comment": "Malware payload", "value": "cd4c5432f711091de29d86c7c607ea28", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187549, "uuid": "c147e30a-7ae9-4699-9edc-b168171aaab8", "comment": "Malware payload", "value": "a3dc39952f6114ab598d9154241c4e4eff1c1a01c80c83a969e703cde68a2748", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187549, "uuid": "b3521386-4af4-44b9-badc-e82f78d175ff", "comment": "Malware payload", "value": "4537497fe16909ad96afc7d86fa63a867870cb99", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187549, "uuid": "4eaa77b2-4bb8-4ed9-8204-88b2fc8a5055", "comment": "Malware payload", "value": "897dac8d73486b4329d1d2c9534c4259b8d8cfb93d53d4ac1c22ead7bce2e94de66361da9cd284ecabe66280c5255446", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187549, "uuid": "bee081c2-92c1-4869-933e-45320d25ffb1", "value": "T159414F7785297E64A087257488404162AB35EF8E58611D18FE8CA3C0AF2FC6F05337FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187549, "uuid": "f3cd40be-1550-4783-b29d-d435698eb8df", "value": "48:kFf9bAjw/aPv3yVbv8xmx2Ir3KAqM9Ho9066jLgfHMTI:bPqVbL3KA99IG66jLgfsTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187549, "uuid": "c90799d9-60cb-4a45-a4fe-f21868512a32", "value": 1937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187549, "uuid": "7d0bd329-b770-4a93-8664-48bc075bda07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187549, "uuid": "e47c3cda-388a-4ba9-acc0-2b8b8054cd32", "value": "seed.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71db974f-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166904, "uuid": "450bb930-8a37-4c07-b720-0e6ebc5448fc", "comment": "Malware payload (Mirai)", "value": "e5d12730a18b75570829f586fa91347f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166904, "uuid": "2280c059-f178-4d1b-b5ee-7ec282b6ecb9", "comment": "Malware payload (Mirai)", "value": "a502bedf0fd60ce27596709127d9bdf393d81ebab616c2cf22e43543c560f377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166904, "uuid": "a7f34946-3b9c-4db3-a1a9-95634356af54", "comment": "Malware payload (Mirai)", "value": "976e2e2d988a360a0789ee9e07a4230df67a17a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166904, "uuid": "9ec47e6d-e050-4188-a393-5bc8590e3d9c", "comment": "Malware payload (Mirai)", "value": "44b85d3b3b44e018182bc355bb2b5e0b01bc76215d0e48c350ef7edcd285045e166213e1257223b6614d8d0f765ee1d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166904, "uuid": "ec8fbefc-6055-40ee-91d1-d63693c8ffe4", "value": "T17193AE128C645DA8F03A2D3410F98AFD8B27A544981B6DF73D474266500BEDCF5EBBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166904, "uuid": "f7addf2e-472a-412d-9315-e156c49a0d0d", "value": "1536:TPQVF216XAFM9w3EVUgMyBoQO/1F5Z+HKAfeP7fFmCkC+W5ff:TPQVM16XSj3EVUyBxW1F6ZUzFmtjof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166904, "uuid": "6297648c-2b56-47be-b3cc-d7bc3b2c1ccb", "value": 89044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166904, "uuid": "dc1491d2-0801-4e96-88d4-f66fb9c3ccb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166904, "uuid": "db6cc8e7-93ff-4719-a01f-c3d3fd51ac2a", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87883ff-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184176, "uuid": "afa9f2e1-3c5f-4a83-a5ba-28572962969b", "comment": "Malware payload (Mirai)", "value": "4c7b0ca99a5f26dead79388347280a65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184176, "uuid": "96867d31-8f8a-4a44-bab4-463847538b85", "comment": "Malware payload (Mirai)", "value": "a5544e82e84d30e361b53521145397411dbf2842fdafdc1f35b8df1fa2623fd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184176, "uuid": "ed13c12c-3e5d-445d-b7cf-813fe7570341", "comment": "Malware payload (Mirai)", "value": "63ef7e17ba1feb1a16cf0976d8ab5ab1743d1ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184176, "uuid": "f488dfc0-6099-4fb5-a237-8eb89e13a9a8", "comment": "Malware payload (Mirai)", "value": "b4789ac4a23900401280fa57c69dbc5276d2fa006e0aaa5a0718898bae4130e75ba620780468d9c55f81255a0b2f6879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184176, "uuid": "7cc29738-41d0-4e28-b2ee-9008de6cafc4", "value": "T1B8C30AA6F950DB62C5D1267AFB5E4288336307B9C3DE3202DD149F3427E795A4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184176, "uuid": "5bac16e0-9d22-48e9-8745-49af88932c6a", "value": "3072:wxjWhmrnHcBQPDpNnhJhKa0o1mYzX38Oyiyg:wxgI8BQznhJU3o1Zzxyiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184176, "uuid": "992302e4-19b9-488c-ba24-9b7ed481c849", "value": 128696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184176, "uuid": "822ef933-b78d-43a3-a30a-706a1bb150eb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184176, "uuid": "50eb061a-8e47-46a6-b057-f43a323e30cf", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ed8242-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146163, "uuid": "6d7a2949-0b6d-4bc3-b71b-e7a9fd7a5eef", "comment": "Malware payload (Gafgyt)", "value": "e94c950c35a24f0c6080386299b865ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146163, "uuid": "52ae4dc6-a4c2-4fb6-8e14-46ff541b622a", "comment": "Malware payload (Gafgyt)", "value": "a60e41c57e3931dcee1520e1401e404302b643e43cb72470e8e79cf351f5852b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146163, "uuid": "4802c1cd-5afa-4ca2-809e-561c2746618d", "comment": "Malware payload (Gafgyt)", "value": "6b87386d42ee3c2783a91363c811dd82955ec6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146163, "uuid": "28715093-5ba2-47b3-b5cd-26f30c3a12b5", "comment": "Malware payload (Gafgyt)", "value": "4111529fea612be08536fd2533b0cbd62d6081f4e06bf845d3a128337486e7e658be7f6a77ecbb467514e14444ef4f18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146163, "uuid": "9e8eae2f-62c6-427b-9600-320acaaa7419", "value": "T101E3871E7E21DF7EF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146163, "uuid": "999a56d1-aea0-40ac-989b-2f8491248f4e", "value": "3072:j7ip4E6s1gSpuIgQiRxaykCEAweIcqs8Ek32o4KqKf5hspYt:j7iV6s1gSpuIgQiRxa/OCZHBb7qi5h3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146163, "uuid": "8188780b-df94-46aa-b84f-1c7b06d31dab", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146163, "uuid": "9d6bae2e-111a-4c58-979b-545975f28718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146163, "uuid": "55fdac74-81f4-4a37-8bf5-15c8567f8ba1", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41975a60-6578-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781170259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170259, "uuid": "0b2c3161-48c2-4d44-922b-ffe232db3a2b", "comment": "Malware payload", "value": "b53181f632fe32c0a853f9f8cc0d59ac", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170259, "uuid": "896e7524-a22c-4ba0-bbe4-f5802235d5e6", "comment": "Malware payload", "value": "a71345d92a16458f96106cb3d3813c4ac67f42df6af4e8d6d64f8ec20a2eb114", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170259, "uuid": "f40cdff2-4bd4-4a9a-b7fc-f45a584b0bdf", "comment": "Malware payload", "value": "0b43da2246223821ae8c445274915f4dbab06634", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781170259, "uuid": "ccf17c46-f3ac-41f2-bb76-7effc1e5a964", "comment": "Malware payload", "value": "749e736c9f583920cba0ec97c383cdf65c0410cbe1a9581c624ef2dda105d55ba416efb7dee0daad3e0cf23a1fea7a3f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170259, "uuid": "c11cb556-3cd2-4c52-b3aa-ead14f52d19e", "value": "T18AD664C3B3C6477D46A442C4700BA696E22394B4701E4A6F8CDE317818DB6AD4777AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170259, "uuid": "0ecd3ae9-b41b-438a-a333-fc245fa826b3", "value": "24576:eRmHC53KZ7jDQVYwklsppH9bxZ+w+rHToY/jqDdLzOoZt0IcRQLKxK2qPqv8lrN3:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781170259, "uuid": "8a64fb99-bf3c-4eff-8afa-6be8dff2fdce", "value": 13144975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781170259, "uuid": "8054f53f-75e9-46f7-9a5b-6cc97ec21a21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781170259, "uuid": "ee68c61c-3355-4d27-9901-0012ca47fe5c", "value": "39bwhpUVN.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a019bf10-6539-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781143359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143359, "uuid": "4e1fc5df-e98a-4e26-8d7f-fab976f66653", "comment": "Malware payload", "value": "d38a94f272aa1566b1aab74c37ed5584", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143359, "uuid": "b2766309-936f-4385-bfb7-3f4ca559dcd3", "comment": "Malware payload", "value": "a7d0ff970ec2ef2f697c7e91fa04124eef106126dd906fa5eaa6bb84590c0f66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143359, "uuid": "3f3bd0ec-885a-483d-a0fb-c70850b50ce1", "comment": "Malware payload", "value": "a16b1b65585e7beae2a63d3a25030be6a45cd91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143359, "uuid": "20e183a7-800f-476d-b4a2-9e3a5b0fdcfe", "comment": "Malware payload", "value": "c26e38300529816f10fe4348ec743815b52e75b902d7da1d1ee37e5d8076c2424cf03e029033f92c50fb8cb03790ccc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143359, "uuid": "57a0a2f9-0bc5-403d-889a-e139afa53904", "value": "T1E124A70AAF510FBBDC6FDD3706A9070239CC645762A53B793678D528B50AD0F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143359, "uuid": "ad2e0254-d7bc-49dd-9c4c-1759c508b950", "value": "3072:lF5ucZl5dRkTsDHfj6zSvrOMZmI9q3Ms:lnucZlGTsXwWClI9UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781143359, "uuid": "0343d743-cee5-472d-ba9a-12d3ff566185", "value": 222616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781143359, "uuid": "1a23f583-3b23-42ba-83f5-4684b464f593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143359, "uuid": "e771b5e4-c2ef-44af-8605-cd8758c08ab1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cfde6e-655a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781157492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157492, "uuid": "8c1041cf-35d2-4d01-a09a-50ee44629816", "comment": "Malware payload", "value": "5cbbfc220b8ec669f4343b9236276f1d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157492, "uuid": "2983d79e-4922-4980-9c0c-4011ce2d2651", "comment": "Malware payload", "value": "aa48f10e969760111e4ca5dc812b380ea362915fea5f6738a8583a7c7648e7db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157492, "uuid": "f1a76488-49d0-49fc-b154-aeddf181ab18", "comment": "Malware payload", "value": "1ad2da3c5e0821dbb7ddbcb386dd2c16c42be252", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157492, "uuid": "ca5d46e8-b113-4cdb-8b0d-bfcc61b66842", "comment": "Malware payload", "value": "3b44221eb6d48e25728bcfac05f3809eb0f8ba0435b1edf010d21a418137312ace6f26d49405566175ba37ac70168497", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157492, "uuid": "fe6b5191-3ac9-4441-a471-5400e19d9131", "value": "T111B012385680D541373A2C0135C84556AE853D2A53D49801529660A0E72D611123C614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157492, "uuid": "c1701383-7b83-4161-ae73-8e1b96ed38e8", "value": "3:cJom5pgiekMLIUXWp+MUk3T+PnrIQJAxe:+77QL5WQMyPrIQwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157492, "uuid": "9435042a-b3e8-42bb-b39f-c3a7a1ae161d", "value": 97, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157492, "uuid": "2cf0e6ea-6282-41c1-8c1a-bc778a8f9892", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157492, "uuid": "a4751e50-3bdb-44e4-a986-29820167e04b", "value": "aa48f10e969760111e4ca5dc812b380ea362915fea5f6738a8583a7c7648e7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee16d352-6587-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781176991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176991, "uuid": "81ec5330-1806-4c9a-8b88-3e58f1dd4c86", "comment": "Malware payload", "value": "94b44f5423763fa72aa33013b5f62558", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176991, "uuid": "e3bc76a6-2c9c-4b89-9874-4d6883a84e67", "comment": "Malware payload", "value": "ab765ac116a1950b9f60afcc2758aee5e78d8b13ace7f2b9769a3d272198fc5b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176991, "uuid": "1073d209-cba9-4c27-a2d3-f28ac4509b00", "comment": "Malware payload", "value": "3f637459d9096cabbac500881038348c7cd9eeb3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781176991, "uuid": "6f5dadd5-c868-4743-8a2c-0abd34b8a341", "comment": "Malware payload", "value": "c1a30a938e28fd136ad0a84510ce6ab2967c9f99cf213a7c631390941f4d84d213e9b1e4ec16629e5cb978c1b356f2cd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176991, "uuid": "7a8553e9-0669-4529-8180-0241af22c5f5", "value": "T1A69523227445813AE7FA163BF82E99A29D7DBE344B64869ED348FE0C1CB41C063B7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176991, "uuid": "c4372715-a347-4fde-8fc1-db3a80c82617", "value": "49152:74leF3WXlKZ0zgd0EhP5gLWKoigdZ6Qt/lZ558x9:ICyw0zgd0Ex5PKAt/P5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781176991, "uuid": "10c49b67-48d9-4bab-8649-f4502e97f599", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781176991, "uuid": "5de6a9b8-4610-4e96-a766-eadcd3ff1071", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781176991, "uuid": "83a6fd69-1098-4f1e-ad5a-286b0bae8664", "value": "small.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1079656a-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781211408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211408, "uuid": "f60bd5c2-e244-4f4e-a09b-c3ebb0f68b99", "comment": "Malware payload", "value": "c356e7279d6ba644f7fe3b028ad06fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211408, "uuid": "f46a82b6-0032-4989-8bc9-4fa99b1fe9ae", "comment": "Malware payload", "value": "ab8d20a57b1bac601dcdb61a5ed05eaf1b741fcbb88ffe0f75245526138f2e83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211408, "uuid": "7e7cefa3-daaa-4e6f-a595-ed586d0dd52f", "comment": "Malware payload", "value": "c9956316dbec42ac3505846e5e6166bf328011f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211408, "uuid": "865d5952-4e5e-4312-ae2f-0c10ddce586c", "comment": "Malware payload", "value": "4b63d6480face7dffb80d7a5dfcb708591f8a23dfbb969b8b87b93de590262b23ef787d379592f6745b4bdb0b08f654f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211408, "uuid": "76669f6c-2a50-4926-9ca2-d5c5d2e59145", "value": "T17DF30756B8819F16D5C152BAFF0E528A33131B7CE2DE72039D246B357B8B86F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211408, "uuid": "c61649b5-8814-4c2b-8da2-0214055df59f", "value": "3072:9earbCoCasb0dKRKVARyRQXeba0WUlT4/aPjkoeASK6bUCkw:V61asgdKRKVARdXoa0TlTiark+SKBLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211408, "uuid": "a5a2ac35-4fd5-45f6-ba60-ea6b22fe983d", "value": 171080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211408, "uuid": "f51f3caa-d40b-4bf7-b03d-1262a7447167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211408, "uuid": "dd2c2a0d-5710-476c-89d3-686e62035d17", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8acbef2-652d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781138327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138327, "uuid": "b1d33c8f-69ab-417f-8ca5-1c335ae05505", "comment": "Malware payload", "value": "5b4cc2012f1c1ecbbf52670d0b36b6ab", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138327, "uuid": "61847668-c9c6-4d49-8e60-a422e096a16b", "comment": "Malware payload", "value": "adb91a5e42c600ba11623f0394fd4880ec7142af5cb473b02965100a03db0e5d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138327, "uuid": "c73add67-1d7f-47e5-a5cc-1931b24b3d00", "comment": "Malware payload", "value": "5588a0b5b9155d236302be224ab699b915bee657", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138327, "uuid": "dba4de32-5935-4114-a1d9-79ea0fbf253f", "comment": "Malware payload", "value": "9d82deca03bf39cc31280df257cc418626bf12232beebb87abbb118269d03a6e389d3a61d3cba43fa39022e0d2ed078c", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138327, "uuid": "e7158231-ff93-4f57-bdff-a2a71ea659d1", "value": "T188F6013BA2EE25FBE0690739657392054E377F7164134C0E96F0B8E89B35F70092EA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138327, "uuid": "557432ef-f53f-4d01-812c-380226b3b5e4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138327, "uuid": "f16ab094-92f3-4355-ae0c-d0ff92e7c0a7", "value": "98304:i5/AovRHDDotFkq8ycIK8rHh5pJMHOInC27DFgV5zXPmHN6A0ROCclCW2D1+FpTP:enN3oxuIRbh10C27DG5zcN6eCCY+XgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781138327, "uuid": "b239018f-f126-4b19-ab66-c9d29dc380bd", "value": 15488881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781138327, "uuid": "c71a84cd-4f54-4f23-8c9d-329dd4e78971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138327, "uuid": "9fb241a2-a9cf-4674-9998-498bbd2f255b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305ee68b-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179250, "uuid": "95cb3c8c-9474-403b-b911-867791966675", "comment": "Malware payload", "value": "673de1dcf8eab196856676a093c0675e", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179250, "uuid": "0cb8700b-f56a-45ac-ac35-b4d68aaefb0b", "comment": "Malware payload", "value": "add60b71f0598949ae5446335b12f9221dbf2dbdaddee76c5b9d8fdf2957b7d8", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179250, "uuid": "d5d1a0f4-f2a6-4b31-8096-6986a4313e89", "comment": "Malware payload", "value": "ae337ac3fe6390b9a0a6b5122c6d654f2ab048dc", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179250, "uuid": "2c2e2bd6-bd78-449f-830b-9ab17d889c9c", "comment": "Malware payload", "value": "035bfcd7321aa42ee431dd5fb99f8a321ca1a4420013b6e9bca0819d92dcac6807ee4b923e576c20fc5c975b55612015", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179250, "uuid": "703dbfba-69d5-4bef-ae27-8218de1ca987", "value": "T17EF44B29656442FDD4BBC2F08E435813E771FC4E5335AD9F02E06AA61F6B5609A3EB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179250, "uuid": "de8d3889-4079-4b45-bbce-5f8866ba2109", "value": "70b021a193371868182b869851c0f045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179250, "uuid": "28b46a7f-ccd3-4b97-a37a-ad31886474b5", "value": "6144:gSJzI+Pj5uKjnZ7vfg2rVWNGvMwD1cpDAPYhz/yHDJTy8Uz6EmsbIhXs/hRR0Zst:7I+xKCWM0wD1cpDVGH42XafZRR0Zvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179250, "uuid": "2738d7b5-2795-44b1-81f0-169b1c49195a", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179250, "uuid": "b263a606-6a10-49a7-803f-fd465fe0ff46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179250, "uuid": "34c4ecc4-bef9-450c-a242-9e5b3729f57e", "value": "SecurityHealthService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f04eea4-656c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781165155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165155, "uuid": "39ac3a70-0e58-4ccb-b8f9-7d98974215df", "comment": "Malware payload", "value": "e948d3f8de6199b805ce300b120bcaad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165155, "uuid": "0b2190c2-606a-4bc6-8e56-ad61c8047c07", "comment": "Malware payload", "value": "b0b3aa4f87ed7cc28276fc8a284bf3883107863f0b147e92f6786b0616cc0c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165155, "uuid": "40743192-4f5d-4d1a-8b82-dadcac5c326a", "comment": "Malware payload", "value": "980683d25b70d58c8da605ce6c75e4d1a5bb8209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781165155, "uuid": "4b71f517-2e1c-45a3-a5f8-f69f5463fccf", "comment": "Malware payload", "value": "308135cbc1451ef8b26710f40f04049f258d0a3c467bd7b7630658881578092553f7d800003a201b6d30a50ea03c11e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165155, "uuid": "b6279708-c0ea-4a32-b3f9-e6807ea1e05d", "value": "T17B3533F09B278589F8B2246679BE4110A2F672F63E1CF6211511BC783964FC6D60F4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165155, "uuid": "59fe6eb3-84ed-4526-9320-79e5132e6e3d", "value": "24576:5IrSo8lbGgoJWdBfZlTp8hz5bWTLIKV6x4WjyBgZbMrdo98hqrpi+F9:5IrLqbSJM5ZlShz5uIKVGvjyAD9kqrpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781165155, "uuid": "facee10f-1977-477f-a70c-e3a28f3706e9", "value": 1110803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781165155, "uuid": "579d5f37-1779-482e-98e3-9ac737b2b816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781165155, "uuid": "26435264-aebe-4289-9682-9155df65e45a", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fee392a-65d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781208884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208884, "uuid": "91d0e3d7-7a0f-432f-9e2c-67b78f656b20", "comment": "Malware payload (Gafgyt)", "value": "06638fa012cd7b726e06f77538deb3c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208884, "uuid": "791e22db-ac3d-4bc8-9ba8-5e3a88fd9387", "comment": "Malware payload (Gafgyt)", "value": "b1d7a3984b2f7c7152aa6531e5a18f2565982ec908fdb62182e8dff9af73cd60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208884, "uuid": "c4efceb1-eef2-4943-b1c2-f17d505bcf8c", "comment": "Malware payload (Gafgyt)", "value": "bc934e6cbd426e27671b0658b07d6366b4b5da5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208884, "uuid": "688f8e52-fb08-4eba-8e85-b56ce38f471b", "comment": "Malware payload (Gafgyt)", "value": "eb9daa0454d2a2e7e2a19520a3f988e1483b39f2fb48e47b48f71aa84dac131bdc84b959412571a8c6823210183cf9fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208884, "uuid": "06be6168-3760-46f4-8ae6-804e81cf08fb", "value": "T15CE3971E7E21DF7EF559833047B38E30969436E636E18285E26CE6481E7138E245FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208884, "uuid": "cb7420ab-70ad-4cc7-a67d-07c5f9c0ae1e", "value": "3072:A7Ps3USEanFOJjTzixR6B143wKVnKxxLkG2IlKKTf5hspYIS:A7PJSEanFOJjTzixR6BYLK/AKUKT5h3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781208884, "uuid": "bde7b6cf-b103-4eaa-ba5a-2af31d87ffd5", "value": 148160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781208884, "uuid": "57fe279f-03b6-4811-a970-3f69a708a053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208884, "uuid": "f132ab5a-b197-4a44-8437-110a2dc27bae", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e238495-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166898, "uuid": "4c668bbd-42cf-447f-936b-96b459c14741", "comment": "Malware payload (Mirai)", "value": "3579736c8e1dab84420a01dcf3d5660b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166898, "uuid": "c26412ce-0ecd-49ec-a73d-09254d9a1078", "comment": "Malware payload (Mirai)", "value": "b3cf9534f8095dbe67c09e2c279922044fb033ce34ef2f8bb5ed64264c536b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166898, "uuid": "00053203-5e3b-44bf-86f7-910febfac9e0", "comment": "Malware payload (Mirai)", "value": "b62ff4500b9a1f24696b268d663863646bd6254c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166898, "uuid": "66022693-3a39-4ebc-9d34-ef4028d3410f", "comment": "Malware payload (Mirai)", "value": "22d679a4fdd9673f612ec5a850cde5d1913321241db0427cd2ad9b07c90e9b7b1189a9d7d82955c38efb6e3a13354e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166898, "uuid": "25330a58-b671-4955-bd72-fe87177a2c7b", "value": "T127931986BCC5C602C5E061B6FB1FA1CD376643ACE3E67113DD18AB29774A85B0E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166898, "uuid": "ac44f337-248c-485d-934f-dbae8df78b1a", "value": "1536:a1HSOGhL1ipEjVMX9vce+Q1BNhyJbbbTp/obBTqTyff:oyOsBiCjI5cexvNUbPTp/obB+Tyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166898, "uuid": "733949fc-e4b6-4791-883b-45999125c7cb", "value": 95872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166898, "uuid": "c455ac98-0a23-4842-b671-68afc6e18244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166898, "uuid": "4bbc3291-9187-4879-8781-eb01590f015e", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ecaabd-65a6-11f1-a769-42010a9c0008", "comment": "Malware payload (XTinyLoader)", "timestamp": 1781189966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189966, "uuid": "3111e552-d838-4868-aef5-d183b1dddbee", "comment": "Malware payload (XTinyLoader)", "value": "d13cad682fd5abb767313f79c1732822", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189966, "uuid": "ecb5b600-7324-4439-948e-6f6654aa4278", "comment": "Malware payload (XTinyLoader)", "value": "b3e6200b05e579b9577686e9f510338b197fe392483f3d2eb50398d3097573cb", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189966, "uuid": "89f6aca3-8cd8-4c98-9626-d404645846ba", "comment": "Malware payload (XTinyLoader)", "value": "2a6ff4571b915d61b60ecc2922d342f07bdfb71d", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189966, "uuid": "87391865-afab-4039-8db3-9c2c3724bb95", "comment": "Malware payload (XTinyLoader)", "value": "fb9563a30e516d83e1f54dbbc2302faaf28f0521140c152abef6c2bb09f00643cbc56944b84337e8188b411d872dc533", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189966, "uuid": "efbff6b8-dcd2-4740-bf0b-d4b5a1d2932c", "value": "T1E734CF5BB3A034F9D5768278C8145A06E776B8350771DBAF03A043A67F232D19D3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189966, "uuid": "cbc5942b-2b33-41b2-a11c-e5cfeb67f1b8", "value": "3026ee54c6af015fafd94f2b564c4ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189966, "uuid": "bb1df5d0-396a-4687-b3a0-92cfdcebec13", "value": "6144:p0WoKA+vzDrCztsMcwW00M+wbv2dB+c/s/kO:iyzDrTwF+Gv2+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189966, "uuid": "b503d567-1671-43ce-8fd3-d56f2f9e5fc2", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189966, "uuid": "290b4675-10b2-412d-bc1d-bbbf26dad9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189966, "uuid": "844c0bd6-8c8c-4d6e-b869-9ec4909cd6c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267306ce-655f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781159476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159476, "uuid": "d8c7dd50-d650-471e-ac23-083a544c5e8d", "comment": "Malware payload (MassLogger)", "value": "17756f152d77af6985be797950c3d947", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159476, "uuid": "0a32cf0c-c9de-4135-9e45-11c945f2260d", "comment": "Malware payload (MassLogger)", "value": "b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159476, "uuid": "695e4049-3896-4aa0-bf8e-c586f92f2f84", "comment": "Malware payload (MassLogger)", "value": "0aa7681b7cbaca2f0445197c9e13ac4f5d252800", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781159476, "uuid": "f73472d5-dddc-4596-ad95-7208d3de1884", "comment": "Malware payload (MassLogger)", "value": "59b113c7086b01c173f49fc4cedec420986a4d8b618c5704cd990e5afc665deade832efa9d6e2ac40a296e392dc3a62e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159476, "uuid": "675c1ea5-f861-459c-9f2c-6efd2c9513f2", "value": "T162F4083DCC64413EE032C619C996055FF8925A1B222CED0B60C73B9BAE7398677D729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159476, "uuid": "a0876dbc-bc34-408f-9ed8-256885308025", "value": "3072:E2J0uWO7eFQB3G9i2L0vFCV1PortM78K2DUnRFXnOk7N8RNkYwD9P3zDpqHFVnrN:UhiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781159476, "uuid": "4f0f51dd-fbda-4e47-8872-74600565b1ad", "value": 781216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781159476, "uuid": "fa415d88-35ad-4d63-8806-ccd207a2f80c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781159476, "uuid": "1c04140e-4727-4e5c-b636-935382d49634", "value": "RFQ- PR 115322 NBP SQD700 INV.973G.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cbec13-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221160, "uuid": "2031d8e2-560f-47f4-9239-fe53de35717e", "comment": "Malware payload (Mirai)", "value": "a297042082828f3f59a6fdfd43566bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221160, "uuid": "349bbbe6-5707-4fae-93e3-b236e33cd30b", "comment": "Malware payload (Mirai)", "value": "b4b7fe0c4f1747f75546cbb0b20dc4b7ea2eae0cb935a617b5af239c8462a091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221160, "uuid": "5cbd8711-e356-4913-a5b7-7f2efceef468", "comment": "Malware payload (Mirai)", "value": "4277774afa0802b372dcbd50e972d0460fe9b774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221160, "uuid": "3d70bc16-a899-434a-8d60-917e92ba16ac", "comment": "Malware payload (Mirai)", "value": "0d97af91381aadc1111a4eac703d291a3a48069889a0ff48365aca5d8bd28a566ecfcb391ccfdd26e370b9bcaab2f2f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221160, "uuid": "dbe60c54-7661-486e-a587-3c770b2a5ac0", "value": "T1F0035B67C41E9EC8D529427CE0645D3A1B13F01893671EF62E4A8251905BDBCF61E3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221160, "uuid": "b484414c-e156-4a70-afec-baabc7c7729c", "value": "768:Nag/QC1hfCi6Yd8rgJkNeyeVqteKeCeMoKNACfoduqpv:Nag/RhfB6Yh+NbY8zDboKaT8qpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221160, "uuid": "ee0d8751-656e-42fc-be5a-80d87e7f657b", "value": 39976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221160, "uuid": "3ec599bf-5d28-42dd-b856-cebd978ceea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221160, "uuid": "4f6b3377-8dfb-4168-a496-72e756f49fe0", "value": "zoryn.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f172e7ad-6575-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781169266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169266, "uuid": "11747f73-4516-422a-8331-032955c29787", "comment": "Malware payload", "value": "8d874f12ce20227c87d4941a331577da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169266, "uuid": "7b8acc5e-5236-4871-8f15-769c596ba991", "comment": "Malware payload", "value": "b586fa5f52db4174903bbf53eaeb0537b4e7ee9b9f2f42c514536b07f471c754", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169266, "uuid": "ccc98bf8-5b49-449b-a6a7-f2baa07d0f45", "comment": "Malware payload", "value": "b3f49c5ef8aefcf2a71b7a4d9b3e3db828858b12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169266, "uuid": "3b2eb339-f0da-4490-84aa-eb081cf0f5ec", "comment": "Malware payload", "value": "6061fa33462195dc8e63fa6fb5abb48774036796f6567709e14a93cb18dc58b0fa7b08b6c4cb067e13f35ac569eca741", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169266, "uuid": "04cbe491-60e4-4e38-9536-98160507e4ca", "value": "T18005D43DCE14412EE872C519C8A9855FF8922597222CED4790CB3F5FAE73886B3D225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169266, "uuid": "26afa5c5-1c3e-4f23-ad99-2bdc799a88fe", "value": "3072:UCRtknm7qLibbu8kMJQaA+IZxgdpO34zkXK3STt8fISQ4xljSLQiOHdSEAnxhV91:bXkqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169266, "uuid": "fefcfd98-48d1-4117-830e-1dd6f26e5556", "value": 808248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169266, "uuid": "7b9ee219-8ae4-4e13-b1e8-960d358340da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169266, "uuid": "435e9772-9d86-4fdf-8e4b-db8fee338502", "value": "output_p62tsoft.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b485b2-652e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781138664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138664, "uuid": "553596a6-40e7-4792-afcc-b8d1fd4bee68", "comment": "Malware payload", "value": "5e24498d49284ee399d9e9405d54e460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138664, "uuid": "db9748b2-7e3d-463b-a4f4-2d3f7ea25849", "comment": "Malware payload", "value": "b6066cd5af783f2acf601f3218f221418fdfd1b90191c14d3f92c27f5a7e57ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138664, "uuid": "9a14083b-925e-440f-8d85-47708caf9431", "comment": "Malware payload", "value": "28e2ffcb5a104ffb4d240f5c0e90d94afe9c4662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781138664, "uuid": "ba46839a-ed62-498f-992f-bcceaf1632c6", "comment": "Malware payload", "value": "6ba1f0088cb6df6fa533250b8b465372a4afb4b97c3762b4a4dd1047e4a87304d4e06ee32fddf3906b63e931d680162f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138664, "uuid": "47bf3686-e2e6-4ecb-9a1e-3ead4bbb1f13", "value": "T1CA56D047FCE108B6D0AAA2314D6261B27B71BC443F3123D72A92B3782FB27D06975B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138664, "uuid": "5d24081d-7696-4e82-bf77-84d20f62e2d0", "value": "72d8fd7d53a64b79a1028f9534045520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138664, "uuid": "07d0b340-c879-46a8-9f2f-e929e0399473", "value": "98304:6bkH13JQSiQckzGRaoWqMjPWCtGUVulDpGYvguWbzCF1:6bAtJQXdCVoW98UVul8YgFbzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781138664, "uuid": "870149d2-6458-46eb-b019-4d1e8b6a3ae0", "value": 5885608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781138664, "uuid": "f8b37377-9e0a-4948-8546-780d003776fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781138664, "uuid": "442d6484-549c-4030-92b1-3eb70544f7f2", "value": "wingup_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319ad145-6575-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781168944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168944, "uuid": "11ede9d2-2533-47b5-ae79-2bde6d68b0e3", "comment": "Malware payload (Mirai)", "value": "8a535b2298bc775b34d807a607c88099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168944, "uuid": "e1e8ca08-8fcf-4e85-ac70-a8f20d333a82", "comment": "Malware payload (Mirai)", "value": "b6867be08581fb44e71a877e66a05bcf5962e9b2412ab0212babdb5a2b019a69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168944, "uuid": "33c7f6a1-8248-44a1-b9d8-66019080b446", "comment": "Malware payload (Mirai)", "value": "523d21f94df04f574690b8fbf0036ae163250502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168944, "uuid": "ee25f7c5-e94f-4f48-9b35-4b4d13a42694", "comment": "Malware payload (Mirai)", "value": "f0fac35cd9867c5c41f0f42e51e75773e2a956143576d73428af58b1374a019a27ffd7c45d432720ec7d165745c140f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168944, "uuid": "38495819-6bd0-4ad9-8cf3-9ac5a94dd7f2", "value": "T140F3E70ABF600FF7E8ABDD7702E90B1129CCB85B25A53B797534E818B50A18B59D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168944, "uuid": "1cc00ec9-23bc-4bfa-bad1-5d6c31b8ce4d", "value": "1536:ohDZhZw90wmXbPHX6l5TpnNTcPNfDvk1ZS+001ThVPegzCGwwDdgDvcvqDpsZxgZ:SIFCPHKlRpIrkJRwmdZ1UrZxqkDDY1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168944, "uuid": "1bea6c7a-77ab-41cf-9f3c-9dd9fb5081ec", "value": 160244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168944, "uuid": "9a4b5340-0513-497b-bdd4-f476099cb73f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168944, "uuid": "614db8fc-4089-431b-871b-0a836169668a", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22765a65-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146155, "uuid": "034c0846-e743-4c0e-8be6-ba4152c29f05", "comment": "Malware payload (Gafgyt)", "value": "62a6f7a1cd9571de3314e325635f33b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146155, "uuid": "236c7d59-ab8b-4067-a67a-74401fd70c47", "comment": "Malware payload (Gafgyt)", "value": "b6b0dccf402d349d93ed1220675be4d63fd506e1a207732924a98caea8813ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146155, "uuid": "f92b4112-6c74-4420-ac46-5a64ca378b7b", "comment": "Malware payload (Gafgyt)", "value": "3e753d40d288bb47e652fd2ade717f345117b418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146155, "uuid": "a1a21de5-71b0-49ef-b930-ddf33d1f32b8", "comment": "Malware payload (Gafgyt)", "value": "6c6de14abf53011b4db0905a1faebf3d17c1f11fa200dfac8d3d657f1e81fd3aac32dc5233757067159afa054f6a0b30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146155, "uuid": "c10a7ce1-19f4-4513-8c61-dbfc36dd2015", "value": "T117E3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146155, "uuid": "f3df529d-b746-492c-ada6-f03c3aabf568", "value": "1536:JxYmb4Bo+0NFgNShEyX2zJuoaZ8jCSRCt6+5Jx0XJwqo5hspJ6xD:bthEdzPasCB/eBo5hspJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146155, "uuid": "58a9c505-9456-4f77-8ab8-fcf60e215b0b", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146155, "uuid": "b895954d-d3ce-4d9a-8861-dca56f3bc957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146155, "uuid": "c0cd1777-9fac-4d20-a74c-5d093c0e2d8f", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a7d8b3-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781166801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166801, "uuid": "906fd3c5-60d6-4a76-878d-9d34f855f5cf", "comment": "Malware payload (RemcosRAT)", "value": "4d354a9e84be7b09d80e23e7b5953375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166801, "uuid": "5a44c4ca-0e29-43f5-b1ea-85fb95badaf4", "comment": "Malware payload (RemcosRAT)", "value": "b7317e5c11023c625bb77d6e6eac0b585e51d041ea039d2c0285c8f548b88d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166801, "uuid": "eadaf1db-ae3b-41b6-bd84-bcfcbb9feb5a", "comment": "Malware payload (RemcosRAT)", "value": "dd9cb29df61e014c4e950aa56b4f074abcfec18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166801, "uuid": "ea7362cd-203c-438a-8856-dc33f93a0103", "comment": "Malware payload (RemcosRAT)", "value": "ebb62b6b4976c6e2d3da415118f31eab5327e300e7c25b07a3bb0519a4622400cae4b565a0c014a15427278de00a3cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166801, "uuid": "1ec0c38f-3825-4cb6-8452-230e2fc761dd", "value": "T1186512586A5BE407CA59273991E1F1B403B84ED8B802D2236FDE7EFB7927F850D94243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166801, "uuid": "e2d2ce94-ecce-46e1-ba59-647baf911cdd", "value": "24576:K/r+X8H1Twd5+wZPEnEfqsib565BGVt8kxY5DhrQdRwrHe:0+MVTc+3Eyso5sGVJxY5Vr6ere", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166801, "uuid": "f5419e32-259b-4543-8bec-6e2cc4cb9e83", "value": 1509376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166801, "uuid": "2862f2e7-25ec-43bd-8da0-133d75143029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166801, "uuid": "a36e1eba-495c-4969-a0a7-2f230534ba59", "value": "PO4505489897-CCM-202605008 & PO4505500903-CCM-202605009.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a0d14a-6547-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781149509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781149509, "uuid": "1bffded8-e0e4-49d1-9fe7-e820499a6284", "comment": "Malware payload (ValleyRAT)", "value": "c59645288d393d0f1a33c25c5b73fbbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781149509, "uuid": "08c9a58d-56a3-49ec-8fa1-469050e25807", "comment": "Malware payload (ValleyRAT)", "value": "b886bbb4f4fc626b0c2656be62b713d62118a90e93a2695a582d213cb8755353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781149509, "uuid": "0a76581a-9c2e-4d2f-ae98-9dfa16c5ff97", "comment": "Malware payload (ValleyRAT)", "value": "47a81a69dde1edd19ffd4458a57e1e95482b8c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781149509, "uuid": "fa6714ed-a50c-43dc-a1f8-5aa0b6f7274e", "comment": "Malware payload (ValleyRAT)", "value": "f0a98ee41e16b5b7c2bbea282c6255f1c15a8d1d4df87d40986ee9ba07146b03e4c1d16c411a11067890d8db2754afda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781149509, "uuid": "175185ea-be9a-4753-bf94-c60920b055b3", "value": "T152937C1275D2C871F5B6153518F89A719A3EF8100F249EEB338817791F346C1AE36EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781149509, "uuid": "e08ec312-2e51-4c85-9128-8ae01b103071", "value": "238679b279f70f7f070b8983de0c8bcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781149509, "uuid": "a92df11f-ec5c-4d84-9f93-07810b9c5772", "value": "1536:00sjQkJQsG/GjJF1LAUVrKXAYnHbcDet4mbNy/G60A8/Gwy/Cu/zcsWI/z2cdR5N:lsjEOt3PVlYnHbR4mhy/GZA8/GJ/LLRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781149509, "uuid": "add142a4-b578-43e8-8085-b1cda09e64e6", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781149509, "uuid": "73e8c4af-a63d-4a5e-a6a4-6abf0e59a4f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781149509, "uuid": "ba202d8c-b8ec-402f-a775-9935a996ef16", "value": "C59645288D393D0F1A33C25C5B73FBBC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11499a69-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781211410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211410, "uuid": "5c3b7146-47dc-449b-a292-896b75bb641c", "comment": "Malware payload", "value": "ff34675928dd940191fa2a3225ba3388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211410, "uuid": "ec955951-246c-44fc-9208-51963e4ff032", "comment": "Malware payload", "value": "b96da8e7db8a2601eddc22ff824e8fd7c6f63ce482c532177c1b8e0b98feca42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211410, "uuid": "b0ceb7ec-afd8-4b84-9a82-ab32c515fdab", "comment": "Malware payload", "value": "125f9f702de2671663881fbf65913c90ddd761ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211410, "uuid": "1f077088-3452-4eb9-b28d-2e0e350e1908", "comment": "Malware payload", "value": "3021f4a6e5bb447766a94ec753d1d19a13d333ab20673e3c7ace385c4c811b92c2750efd0c998b457563df8bb7a3ac08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211410, "uuid": "c4beb9fd-bc26-4979-8b2b-3275e6ea6bbf", "value": "T16624A61AAF510EBBDC6FDD3706E9070239CC645722A53B7A3674D528B50AD0F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211410, "uuid": "9655536d-9a0b-4838-9cd0-5510d38c0790", "value": "3072:1FTw6cH950pAmCXFFVauHO52wjLBmSV4WuEm5:19w6cH9OpAzFGuuAU9r4WBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211410, "uuid": "2de511e0-fd5c-474f-949c-f7e5a7544736", "value": 222616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211410, "uuid": "5cef7ade-4b17-45e1-af06-651d9bceefe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211410, "uuid": "1ad0327f-6d45-4a6a-97c2-7b5681d43838", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3328c8a6-65ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221345, "uuid": "2493f734-c424-40cf-8703-380f2cb6eb17", "comment": "Malware payload (Mirai)", "value": "ce6b96ee5389606c5fe02274ae71dbc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221345, "uuid": "3e633bea-2705-4828-8cd0-6167bd9273e2", "comment": "Malware payload (Mirai)", "value": "b99ede1149e6fccf761b7ad5bc0664a013510c88c53ec304b3531322500808d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221345, "uuid": "13be8783-39a0-4bcc-8f3f-49547a789ea3", "comment": "Malware payload (Mirai)", "value": "8f23c56375f833c967ec7b298e546e29d6b642d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221345, "uuid": "d25bc38d-7228-4113-a7ef-0a9d555774c3", "comment": "Malware payload (Mirai)", "value": "eec5c4666f7b21c5443e4966dcb0d668d7ba12f3e39987a88ef47819a3f6c40112c3eb05f711142231e0ea12c9453962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221345, "uuid": "9f8a1b63-6647-4da4-b2c3-3f177d39a022", "value": "T16B134CC9A893DCF9D9140A71317AFF329AB3F53E615CD863C39CD9277942602E00A95D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221345, "uuid": "e6670c06-e5dd-4f64-ba01-0b062761eea6", "value": "768:52tXO4QW3UYcgGzhsFhKU1udHMZEO4kbQ2/SBpFa3m0z:52A4UYcgGzhsFhKU1udHQEOL6BpF+m0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221345, "uuid": "f57933b3-c7ee-4d48-ba64-dea88fcc3677", "value": 41560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221345, "uuid": "f5abd438-de7e-4f79-8bf9-4e42aa132106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221345, "uuid": "e57dc796-6feb-4a09-a0bb-562f82fec8b8", "value": "zoryn.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cdfe82-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207389, "uuid": "25258038-7ed6-4c38-8ea8-cf9b0200c71a", "comment": "Malware payload", "value": "92c8bb9a8006c82529d08c208bc6d11c", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207389, "uuid": "4773a515-735c-4c70-95fe-1d765d9ad875", "comment": "Malware payload", "value": "ba9bfc1e7e3491ee28252cd23b394aca7ba28b1d7d6dfc232b0c16c6ffbbe22b", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207389, "uuid": "d6ccbda2-621a-4896-889d-cae7fdb3f45f", "comment": "Malware payload", "value": "54c4c41de7c906973eef99fa849f0fb1c73268fd", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207389, "uuid": "25d44415-ac7c-4247-ad8a-c046820ab5af", "comment": "Malware payload", "value": "3f60cd5e3632fe375973d079d85748bfc35ec9bf9f4b5786cdb069a0bdc5508725aef0586398d79afa8f87247e3b04f2", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207389, "uuid": "704e9db2-bcbc-4068-887c-aaf86a3c400d", "value": "T1844121286346463004576805B5C2E2DBA213416317BFA8357DAD83B24F0B10BE0BBB7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207389, "uuid": "8c3fd516-cc01-4125-ba50-4421bee01180", "value": "48:lEjM/cWa7Z5cMRBYgegYHXjjKclC63J1Krj9v4w12G4yu2:lEjM/6SYg3jj9C4gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207389, "uuid": "7bb4f7ed-9613-4496-a7a5-a7b579848e17", "value": 2326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207389, "uuid": "81ffd5ac-5406-4c4b-90b8-caf2ab51b0ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207389, "uuid": "b889de0e-639f-4ece-85da-19f7e187cc57", "value": "potato.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5965c6-6535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781141446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141446, "uuid": "059dc33c-ab40-449c-a455-87a07e36d106", "comment": "Malware payload", "value": "f0c5bfbd892d6127527a509819b16fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141446, "uuid": "6837d041-6575-496c-9ad2-fdddd65dd255", "comment": "Malware payload", "value": "bac36910024afb012f125fe71354c6316c5c122688a92607756a69c7dab613bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141446, "uuid": "abada549-2030-42f9-9da5-e8f28bb08fdc", "comment": "Malware payload", "value": "9a8409fe51d8d1d0ab9fdc43a2f1d7079158e561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141446, "uuid": "20c2c4b2-6ece-4180-9387-d337265de40e", "comment": "Malware payload", "value": "b610f364a2e6dc3b2fcce12c3b0afcde5669371e0bba33fadc39bb133c83ee17d05fafb540daa079352a0d20a6c313b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141446, "uuid": "7fd27b34-01c6-4273-81ed-db2417e564bb", "value": "T1EAE68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141446, "uuid": "d18a649d-3a84-4be4-b368-5dd1da970362", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQB:cqYUQuVDt0TZEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781141446, "uuid": "945a41ce-e079-4af1-92de-36d8bd89ff09", "value": 14319616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781141446, "uuid": "45f8524e-8374-4373-af64-41a60d8026ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141446, "uuid": "94c89d5f-90be-4a1e-99e5-ee7a970ddecc", "value": "bac36910024afb012f125fe71354c6316c5c122688a92607756a69c7dab613bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa9ced-6572-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781167772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167772, "uuid": "acfd7de4-7fb2-48e4-a77b-ab8e8118a3fe", "comment": "Malware payload (Mirai)", "value": "46a517a8ea84a5377ceec28f018a8eb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167772, "uuid": "c0b21605-37a1-4cab-8d59-79abe3986c26", "comment": "Malware payload (Mirai)", "value": "bca78ae6833b32c822215b8386e8d957483232983fb790a9bbf52c78055baa51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167772, "uuid": "be829b71-07ae-4ddb-bf22-f64cb5ac00cc", "comment": "Malware payload (Mirai)", "value": "86f334c798fd2b2ce22d9fb2f5e72febca589c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167772, "uuid": "40ef0ead-35c0-4a15-b200-c8a411c48d8c", "comment": "Malware payload (Mirai)", "value": "022259b0e9111aec02663fa1195d2d92c05b8c0b9510d19dee3363d2570ee9e229b39b42d3b780fe3463829390541d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167772, "uuid": "42e900ec-594c-4ab0-aeb1-87b0489000a4", "value": "T137C30942BD429B13C5C311F6FBAE42583B136B7DD7EA3102ED247F91278B8DA0E66611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167772, "uuid": "b77af263-2b56-4e8c-aaf7-c1b5d9e2762a", "value": "3072:aDrblZNgxK34r1BRtx6mr9XxAIU/Cekp8f:aRKK3iB7x6cXxAIuGp8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781167772, "uuid": "135e9b2f-b02d-4d04-a759-ffe7f046161e", "value": 121152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781167772, "uuid": "0e52a576-5154-4c72-b220-ae48d8684b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167772, "uuid": "2cb6097b-0bba-43aa-9969-4c81b9f10ee2", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0343ced8-6574-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781168437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168437, "uuid": "a178c20c-a10a-45bf-a423-48f4be3d2cf2", "comment": "Malware payload", "value": "698701174b0f112de09b7521ece0d502", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168437, "uuid": "a72b733a-3711-4686-8423-5d5de7093c51", "comment": "Malware payload", "value": "bd2c7ecb9035d3e9a14858d2a66e18f498aea4ebf680fc16ca3a09707334d0e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168437, "uuid": "3a83bc1d-28e2-456e-bf3d-1472b4886f5c", "comment": "Malware payload", "value": "1a47b6379ffde8b99413eb5fb612622ca33f539d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781168437, "uuid": "d50cf079-ae95-4e4b-b1e8-cfe202d6c8e5", "comment": "Malware payload", "value": "cc7f32620068d67b0118af646381931c31f39866448c6f5cafee6767c4d17094f13f82ffd6368569b736d9043b9c6cb6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168437, "uuid": "a27a7643-dd90-4dbf-b66a-a348db3c736c", "value": "T1BCB279D080CA58B3A51BFF18F164C406E9B9ADE8C95B3E12B0AE5F4D8E0E58C771D6D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168437, "uuid": "b8b58081-6ea9-43ef-92fa-7b72e2eefd9f", "value": "96:9W3fw/AXPkOgh0nktIHGqbOsnE9zGlnkUPaaa/69is22AJtJcpWHD/2lYoYN4rMB:xxlxuRErHMsYY2e/SIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781168437, "uuid": "bf855e3d-18c6-4170-b2d4-d286b2c80185", "value": 24125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781168437, "uuid": "1faecc8e-3a39-4a43-a38c-11f95a889edc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781168437, "uuid": "68f18912-554e-4421-8af6-f58bbd00d3fb", "value": "bd2c7ecb9035d3e9a14858d2a66e18f498aea4ebf680fc16ca3a09707334d0e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9bd2aa-6539-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781143516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143516, "uuid": "394a720f-2489-49ee-8bf3-39858d484917", "comment": "Malware payload (Mirai)", "value": "3e5061db489b2a3d7b73098ae2288fce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143516, "uuid": "4e63d04b-16b1-4673-939d-99930f5f1cf8", "comment": "Malware payload (Mirai)", "value": "bda8d6766190639818b504be346cedf6d7b59a618a0395816d59be527287a1c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143516, "uuid": "ae0a897b-d145-4880-b19b-d9956f02ea2b", "comment": "Malware payload (Mirai)", "value": "f97cb491941cda4ca11a833d520e965e04a6989f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781143516, "uuid": "f21b13aa-d848-45f4-9b53-5a04e6351777", "comment": "Malware payload (Mirai)", "value": "79bd7114da232570248491aef6751a82cca12aed20f7bf3481f19e662d0e3f21706d04cd232cfd60595818c1dd08aa97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143516, "uuid": "11aee741-90b7-4136-ae38-79b53d49c197", "value": "T192D328B3DC352F58C128E5B8B0318B792B93996581472FAD94B7C7788087D8DF6493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143516, "uuid": "1727f020-f6a5-423f-b83a-b46329e77ca5", "value": "1536:tQC9AFdS8Wvra+cyzFE/2Cthtj8wKL+AW9hvFWaxiWnF4QymB+f7D:tQCkWvjzFzwtjYLYvFWMiWn3BBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781143516, "uuid": "f3b54b8c-b188-4acb-b26d-ae07d6498a31", "value": 138700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781143516, "uuid": "2421ac3a-52a1-4675-a3fb-aff58208a459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781143516, "uuid": "f019a3fc-ef4c-4cc8-9832-3bbf71650aff", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c4a28d-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781188753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188753, "uuid": "85d67d25-e145-4b96-976a-2d561d31cc3c", "comment": "Malware payload (XWorm)", "value": "e4a863c245a08f0e2216d89d6d53aa2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188753, "uuid": "0235ba26-3c3b-4be3-b17b-7993ace21c7a", "comment": "Malware payload (XWorm)", "value": "be4308b1266c148eb7c778aa68d58dffb1350aa556d7bd58d8ff3a0d2ad449fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188753, "uuid": "bd480bae-9204-4652-8487-d2e951c1c9f5", "comment": "Malware payload (XWorm)", "value": "6e5b84a067f94c243164e77a8a44540477c5f8dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188753, "uuid": "941ab99f-dcaa-45d1-94b3-d91eaede0d94", "comment": "Malware payload (XWorm)", "value": "716b2432739352005c81397144c3caaa7b44f1c88506c0e1081ae4b853557728bc47cd9d41f4cc5a7140324a90137e8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188753, "uuid": "b63d06b6-9278-4d7d-8466-6b6788d0add8", "value": "T1F666F0310354DA71C26C5AAEA6F97118140D5DCE98F9FB093A6A47B10276833E3BF7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188753, "uuid": "12c06d26-3b8e-4b02-989d-d3c7acb3857d", "value": "98304:3czVhSKY79lb53jihxgKWH5orFrWLtyiNpGNMsl/8FquA63uuD0PUAIj9Ce:3YU9TwbQUB/cEUtpCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188753, "uuid": "f6d8db5b-df08-4c89-8af1-54a92a1874df", "value": 6613271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188753, "uuid": "6f6b701a-343c-4a93-a10f-2e4dd0f45ee9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188753, "uuid": "a0304849-7159-42d4-b319-74e5ecccd1a8", "value": "26010073- singed.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afa01d2-6588-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781177254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781177254, "uuid": "cab48e81-b4ce-4dee-8cad-aef060426d43", "comment": "Malware payload (Mirai)", "value": "dbf1ea4b96db80c3f937743c9d88d714", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781177254, "uuid": "da27667d-68a4-4a0d-b3e1-b01896f5b146", "comment": "Malware payload (Mirai)", "value": "be51675427222c8c3ae43017a6108b1812d7a00b1cd0b49467fdb79b4010fa33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781177254, "uuid": "5f49bc4c-7ceb-469f-a298-6280de55b883", "comment": "Malware payload (Mirai)", "value": "e74d39af02de459e3418714b7340bb455b2ceb26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781177254, "uuid": "ac7cb348-3a41-4a10-81e9-6a43449e83fd", "comment": "Malware payload (Mirai)", "value": "cb74cbea5f30e6ae8833c8f42b0d309d5fc50b6bbb86f420df524ddd22dd858504e393fd9ced662468aef08b1a45df01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781177254, "uuid": "f976356c-f556-4847-95f1-98d960b41968", "value": "T1FE142B4377224FA0D356D6720BB38B5A5AEB11C21EE258D5932CCB143A20BE9585FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781177254, "uuid": "553cacd8-8eab-44e1-8374-228b50e1b411", "value": "3072:QFlpdQ9p6HxqAxKCJQkMG0c8osvE+GriLK1yZkFppE09nx5pNMr:4uvSxqxC8xEvUap3nxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781177254, "uuid": "998d59e1-579a-4a34-a078-36987b9c7952", "value": 208976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781177254, "uuid": "a443a1f1-0094-4b2c-b026-c7661b2197de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781177254, "uuid": "969f0102-ba31-4b2c-947f-9c4c63800eef", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c3927c-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166906, "uuid": "136f7094-cd22-4eb7-93cb-716f830651bb", "comment": "Malware payload (Mirai)", "value": "9887d2f33b6377ff0f1cc430c2eab950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166906, "uuid": "24a19073-cb0d-435e-94fe-106f87af7e21", "comment": "Malware payload (Mirai)", "value": "be8047a822c845b5eeba0364a3863321de4110dc780e8eda440990634cf8950d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166906, "uuid": "224e55e6-2b70-412b-ae68-dde97a2ff5ea", "comment": "Malware payload (Mirai)", "value": "5486b9a01af556615d1fea99a98a000bf332c9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166906, "uuid": "ed2d6646-8b62-4685-927d-9364b2e85151", "comment": "Malware payload (Mirai)", "value": "92b7fb444ff112ae558d18ab7fd4eab4da1447fae2bc1ba7acf6c75a4a37a25a3a152c52df8a67199578baf2b24a32c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166906, "uuid": "3b13df80-d778-4c36-988a-cc8c0a439088", "value": "T156933AA2B400DC7EFC1BE2B784574B16B52067A45F122F27B226FD63DA7A0B41C27D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166906, "uuid": "42b42782-ccfa-472f-817b-817e9f333a76", "value": "1536:Cij87UMtJ6V8v4ssYiEBotVbNKO2aq4Usbi8Cf2XQ:CM87UOJ6ndqorR2n4UsbG2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166906, "uuid": "53775811-3d01-4ed2-9d9b-b1ed07d322ab", "value": 94752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166906, "uuid": "142c192b-fa84-4676-b606-c3d8cc3a783d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166906, "uuid": "42e93f1e-49b4-4cd5-bbf5-bf3ea97e9c17", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9485958a-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781189296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189296, "uuid": "fa4983c8-b738-40ef-855b-413bf1250575", "comment": "Malware payload (Mirai)", "value": "9e6929791b387f28552964812d299bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189296, "uuid": "aed577cc-0795-4d81-a04c-65a3fd3737fc", "comment": "Malware payload (Mirai)", "value": "be94f42567c4ca5b9aac3a2c0a63b6ec2de4c1089fc8b2784f46ab015754e3ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189296, "uuid": "eb681176-0880-4c8a-b4a9-e57692a8120d", "comment": "Malware payload (Mirai)", "value": "7c699f9282cdcc479f733cf98dd4158ab9baeb01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189296, "uuid": "b541c815-50a8-4351-b5e9-d56fae251aa9", "comment": "Malware payload (Mirai)", "value": "85e24ab5671aa94f417e1f88aa86ad4f60993c655b2cecd62fa635110f6358fbd2a33737d780d52352f2d2ce80da9e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189296, "uuid": "bc050994-28ff-435c-8c02-4b12a6abafa2", "value": "T1C7C33917A9419F01C1D729BAFB9E928933136BB8D3EF3102CD249F6027869DB0F76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189296, "uuid": "147b6d97-c0b6-4cca-b6b7-39efd5a4b132", "value": "3072:vu62Lo3QaR4wQEyg/3LCSz+p1AroIB5hjBpZj7:vu62LgQaR/QEyg/7CrAroE5hj9j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189296, "uuid": "3e72fc09-9b18-4bff-876f-1b387868d1af", "value": 129620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189296, "uuid": "300e0152-729b-439d-8a90-a9e45c5944b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189296, "uuid": "f571d519-06a1-4eb2-a4b2-fc5b80753ebf", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecea7f62-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179566, "uuid": "5510aa14-df4f-4432-8699-48066392392b", "comment": "Malware payload", "value": "00f4412c484dbc4598578e6423a021ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179566, "uuid": "3b0e8574-d001-43c6-abb9-55c6fae682fa", "comment": "Malware payload", "value": "bf212917956f4b3b259dcd628dc4ee0a78fe29e7f19518b940d3b1f5ce36447b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179566, "uuid": "3e067c78-a954-4cdd-a543-d739b62d798d", "comment": "Malware payload", "value": "4e6ba01b757860ed60e2ddbf18f1f3be283628b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179566, "uuid": "a9b84882-7b55-4d03-969f-0e1e16b567c9", "comment": "Malware payload", "value": "18f58a0ebd287e75194d7eb90f7e289db6cd860faad8f3467577eec9b91f9b3965a10b66e33f1b8c07f3d36b4f11c91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179566, "uuid": "2d1cadbb-fc24-4529-ae68-b1c5c97c0fa4", "value": "T1F122F504BBE98239D4BE8B780D7393551773EA05A923CF9E9CC8109F5C623419C81BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179566, "uuid": "c37d2e6d-47e6-458f-b3dd-31587c763e66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179566, "uuid": "2998883e-3c59-4c8d-ab8f-c1b35edf777a", "value": "192:PiVo+nT4+N5p12W6LYZw6HaOaC9xIeZy2ON:+of+b6sZwyaOaC9xtZydN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179566, "uuid": "d95a4ea4-ec13-4b7c-b0ea-7703898fcd7f", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179566, "uuid": "94a20244-ce26-426f-aaf7-c681fc125374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179566, "uuid": "e1ef19c4-f4c3-4ba2-94af-d470d45bf14b", "value": "rCau__eRobertoTransportesLtda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43422ef-6549-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781150292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150292, "uuid": "ef325996-273b-4dca-85e8-d9d18ab76de5", "comment": "Malware payload (Mirai)", "value": "d78505e981bd3d9579c026f5677df49d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150292, "uuid": "78ddc3b4-ae0c-487c-8761-7fd6a1be5db9", "comment": "Malware payload (Mirai)", "value": "bf265af40f99d3466f6eb88c40e70ce8c97d6c5b4f63ae0b034fb51bc4adf112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150292, "uuid": "9ba90c0b-8d98-483f-8370-b6269ea2f0f4", "comment": "Malware payload (Mirai)", "value": "b3de4b23ef33017537849b179b0e42bddf16f5e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150292, "uuid": "b48b2e66-9fa5-4f61-ab9a-2a05952d80bf", "comment": "Malware payload (Mirai)", "value": "939fc78b6ab0a095a98e0ba9dbc64094b6a9ab5a0aa23ff746882388c88b455cb83fe2eb1f5845cf8a2742c5e28d36a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150292, "uuid": "1795b9eb-deaf-49c3-b882-5be2475995fb", "value": "T19463B54A2E228FEDF76CC73447B74E2167A923D622E1D784D29CD5001FA434E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150292, "uuid": "0c79dbb7-f5b1-4093-bdf6-927aa5bd8831", "value": "768:p1JGwH5JcVLXJyUOZMXWqZ03UKmOZuua16WrCTb3mW/vie9CH3/ysCopLse7MJm8:pywk9JROZMnZ03UYa1MTb3QFdyeQJmUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781150292, "uuid": "650d47d8-38b1-434b-9e40-c57b5f728e44", "value": 68500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781150292, "uuid": "4a9ed01b-59b5-48a1-a53a-e26499d1ac2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150292, "uuid": "13657b88-8de5-4bb7-8529-af85e17367e4", "value": "godisdead.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d216e0-653f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781145911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145911, "uuid": "37cc7af3-5403-4f1c-b631-ba1c544c84c2", "comment": "Malware payload", "value": "73a821f176ebbada291620dda97d69f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145911, "uuid": "c3bf31ca-a168-4275-9763-ffe31e8456ce", "comment": "Malware payload", "value": "bfb56a752d9ff85f4a5e21ed9a9eeef45f77072e94a9746ff15d77585d3b6b2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145911, "uuid": "71fbbb02-6f93-4802-a657-d5d3fd1b9dc2", "comment": "Malware payload", "value": "0f97a147672aa33d989ec7de8aa82c04debccfba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781145911, "uuid": "abe9794f-6939-4a75-9d76-f8c44da45727", "comment": "Malware payload", "value": "ce2790e7cc4578ebf1ec7f2787d1210767fbebcde6c34e47d7f206c09b0234ec20976bc526dc83eac57c58e9d95ec152", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145911, "uuid": "d9d54358-2587-474d-8dc5-c6d09653931e", "value": "T129136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145911, "uuid": "f9cc5e07-031f-485a-8111-0a1e788ee747", "value": "768:0r9NyXsZztCG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:yHusZ2co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781145911, "uuid": "46e5302e-7e40-43ce-b49b-d12e8fbd8bf6", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781145911, "uuid": "715629ef-65e7-4096-b161-2d335fde66bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781145911, "uuid": "26be7bc7-29b2-479a-b1ca-65e5d762ff97", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c426eb86-658d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1781179498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179498, "uuid": "bfef8425-88d3-4197-af5c-f044b5fc5434", "comment": "Malware payload (PureCrypter)", "value": "997eb63975458a79b192e3ab7435eae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179498, "uuid": "913e10e1-be1d-4c65-aac7-aa6d18a2b500", "comment": "Malware payload (PureCrypter)", "value": "bff1006dfc320fffc550175f06176d6cfb16b25a248b3bab1454ec8ad1cf3cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179498, "uuid": "1c7434ea-965f-4a6b-9b83-016f0e3255f7", "comment": "Malware payload (PureCrypter)", "value": "fac4810a4ddaa4002cfee7f764cd50f7fd3fa1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179498, "uuid": "8f78dbdc-b359-4462-8c8d-b30b1ecefa50", "comment": "Malware payload (PureCrypter)", "value": "f8bb3aff2cf5f4f6c24dd8cb53801bb45f11b6afa31f530066229c906cc3733b1f7db0f0638099c108e674942f97c5b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "winsico-com", "colour": "#0A54F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179498, "uuid": "03165be1-15ee-40a1-acf5-ba388c22a2f3", "value": "T179B733988EF181B7DC2119772CB4BA70837E85686E93D55FDA2202B5A7836F1F12131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179498, "uuid": "62c08314-a64d-437d-82c1-c22c19298c2e", "value": "15d53913ba494ccc61512607f46fddf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179498, "uuid": "2d0436ae-7214-4c62-b196-04b093ed9cd8", "value": "1572864:AF8WWxUUddRnFphBZd5E7UolFJIJp6hCxdXYe1R:u85xUUxFprZ87UIEJoKXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179498, "uuid": "81182a8f-a7d7-4965-8451-926dd4ea42bd", "value": 51275286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179498, "uuid": "95c788a2-ea19-49ba-bd92-d1582ed48e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179498, "uuid": "d2689758-f2fb-4c13-a5cd-02d1f3155d6c", "value": "VNC-Server-7.14.0-Windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3e50f4-65df-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781214433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214433, "uuid": "0c665c3d-fc71-4107-83d6-7c07ccdd3663", "comment": "Malware payload (NanoCore)", "value": "a59b7602663fb130c5a85507fbbe29a2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214433, "uuid": "8945d08f-eb88-487c-8861-cb0b1a073f62", "comment": "Malware payload (NanoCore)", "value": "c0b18beb746f408a76371760e64ab37b350419da5292a6fe5b9b83bf7e225257", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214433, "uuid": "de8252c0-e33b-4c8a-8d60-a05efe6a2620", "comment": "Malware payload (NanoCore)", "value": "87bc65dccd4cb91d55afc1afd257c23acd14570c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214433, "uuid": "081613f1-60de-49ee-9991-da86c1fac544", "comment": "Malware payload (NanoCore)", "value": "a8c4f045ed2f87f06571edc831593222744b4f00378fc252ca99b73f2903071a1088acd8e7962012313ebd3db5063bf9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214433, "uuid": "1d238955-ec86-4dde-8d4f-c431240f0b02", "value": "T19ED3BF58F3DA8A52C7AE2BB890726E0113BDF5135A43E36E99D070BE4423781C7553B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214433, "uuid": "db6af51a-e6f3-4196-b0d7-308dfe2a1390", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214433, "uuid": "4cc0879b-19e7-40b7-8890-a4ed1a805dea", "value": "3072:Vbc0SqOSkjM49oRrk4vGLjq4cDBbgJsdpqTkFv97VpcFKgsE9SoEY:VPS/4RjvGLjq4cDBbZpqTqCF5F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781214433, "uuid": "1474386d-2a2e-4b2e-96d9-ab531ebc4c36", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781214433, "uuid": "9cf10729-9c39-4b11-b774-4547914f6697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214433, "uuid": "43bd5a03-0b83-4e9c-89d5-36cf522f0715", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed97f69-65d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781211996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211996, "uuid": "2f1aeb10-6d60-4ac0-a6fd-de7a4fa555d9", "comment": "Malware payload", "value": "65f012a631ae360246f7dd2b39f1d4d5", "object_relation": "md5", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211996, "uuid": "f01e4f87-b808-4864-aa11-7c76f6bd7c3b", "comment": "Malware payload", "value": "c0fddca3373468304301c18cd134fd13c2c434edc57e384e8f68472209ed8108", "object_relation": "sha256", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211996, "uuid": "37e7cab6-838b-4c85-8783-eed10ddca296", "comment": "Malware payload", "value": "859241909faab05945a7ab5d8d2b9d178fc202a8", "object_relation": "sha1", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211996, "uuid": "a4521e34-07d1-4433-95cb-972386330831", "comment": "Malware payload", "value": "aed88c37e004d114da78ae1e44eb0e79d98210d2698a9c744a099c6574ada51d50966b8c81d66463ccf66737eb0a39b7", "object_relation": "sha3-384", "Tag": [ { "name": "client08-com", "colour": "#978FB7", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "prohoster-caiao-com-br", "colour": "#A1B35C", "exportable": true, "hide_tag": false }, { "name": "verimail-agrobrasilnegocios-com", "colour": "#CD93CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211996, "uuid": "350a4389-3de1-4138-b589-fb7d529e4159", "value": "T1D9E30263B1586732C98257348A57A6E84BA26C082DB23DD2754AF36C1F301D01BBF9DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211996, "uuid": "b419da56-236c-461c-a301-9e080e649b28", "value": "3072:+xcyHoKgnFsseBX4rO48zsab8Oorls11Hgjh7:kb3BXu7NaIO+lY1Hgjh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211996, "uuid": "61e0bbf3-2b3c-45f3-840e-885cb66b04e2", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211996, "uuid": "d3512945-fd31-4a37-a510-59ad550c1528", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211996, "uuid": "d2356169-5c55-4b19-a05b-b274cabe18c0", "value": "RApidOteL.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfdaefb-65a5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781189634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189634, "uuid": "25195399-39c9-4ac3-87c2-7bc7c979c142", "comment": "Malware payload (DarkTortilla)", "value": "624eb52464199c7dfea8f082c5b4e9f7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189634, "uuid": "e2978a9c-fcdd-4258-8b99-d256fbb7f814", "comment": "Malware payload (DarkTortilla)", "value": "c2a383a0dff5e69299443a119bb73f2b76f3f9c0f3951330ffea5db26fc3797f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189634, "uuid": "ad40c136-73ce-40b8-8aff-2d5f0ac5cde1", "comment": "Malware payload (DarkTortilla)", "value": "60b2674a3acda83abedd7173355a9473f2904f17", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189634, "uuid": "754408d5-99da-44f6-97ff-57c44f746510", "comment": "Malware payload (DarkTortilla)", "value": "8ba0908f61322e8c00f0ec54759f019eb2743967bfa898cfc84b67839a88c743afc7c5ab8b4d10d7b408eb1a27a1fa4e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189634, "uuid": "e4d8bc5c-6564-45e0-807d-c1de9258ba8a", "value": "T1E325C0001E0366C5CD6A6B74C6633E942BF4D403C297E74BAAFC14B85A67FDAC98F611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189634, "uuid": "856e453f-d5d4-40ad-bca7-b3c4f45b9a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189634, "uuid": "240104a6-a245-4658-b720-057526b8085a", "value": "12288:u5KPM5o2N1KBvlG8vxLs9c+xhqAImnubYUv5HDtpHe4uRr33amO7LDNhk:Vqo2ulRLsebAI57hBE4uROmO5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189634, "uuid": "55a1f3bc-14fb-4bd6-ace9-0759a0d75e07", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189634, "uuid": "d45568ea-9f88-4956-a21b-ededeffac71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189634, "uuid": "5c2a6294-2b39-4090-9976-e48e2a4842c2", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4578d9b6-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179285, "uuid": "8ff24f0b-0e8d-454f-b99b-60f46f2a6428", "comment": "Malware payload", "value": "01a0f1c09a832c456e8319b418f28592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179285, "uuid": "bf2aaac0-4624-4ad2-a10e-7492f62a415e", "comment": "Malware payload", "value": "c2b3a6e434c520cdea23686a1bb2c33f5cba17a68505d9bd9e7ee0cda1bd606d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179285, "uuid": "65b57952-1f09-46f2-9137-1f4f2337dd9f", "comment": "Malware payload", "value": "41fc643e17d091a41f47e5c780c28c52d96058d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179285, "uuid": "27b2e961-7814-40d5-a454-3bfdc7b7e0cb", "comment": "Malware payload", "value": "4db1e7d21d104921fbf118889b078f2f381c9f007f3c3f6612ffca9d5adfeea90396bafcab0d8a59880648d68bb629b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179285, "uuid": "7333c5b4-c93a-4532-9543-805169ffa72a", "value": "T117120704BBE84735D8BF8B7808B393151273FA019922CFED5CD821EE5D227449D42BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179285, "uuid": "f6a92791-25b6-499e-b1ed-3473d7872c3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179285, "uuid": "4fa7217b-416c-4ac0-8bc1-234602dcf986", "value": "192:E3VqeHUKHMnSBjEYXACJELCImpLYZw6baOaC9/ChE/xy2Y:GjMSBXS2IusZwiaOaC9/Ch4xyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179285, "uuid": "93897d77-5569-4d33-909b-4c98c866c068", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179285, "uuid": "eed6fe88-0e33-4aa3-998b-8a77866e24bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179285, "uuid": "b1232ef8-a4e0-4f7e-b27c-821d7e9da926", "value": "rHeloisaCatarinaMoreira.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d18aff-659a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781184943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184943, "uuid": "379bea74-d7ed-4413-b041-af35cc588879", "comment": "Malware payload", "value": "aa97e81e32e24655dd00a98676613f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184943, "uuid": "306d0c4d-374c-4cca-b677-b2601f18cc60", "comment": "Malware payload", "value": "c36190496bb245686f887896a46ee2bd31facf10bf6e4eed6ea7e7211b7fad2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184943, "uuid": "84b1c4bb-880f-4ad6-9f0d-06837fbdd1f1", "comment": "Malware payload", "value": "f70c53fd023c935d060b6cb76849957d6122a839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184943, "uuid": "f3c79d54-b26b-4845-bce3-f2fd1432f1b4", "comment": "Malware payload", "value": "77e9684d64ac7b110afe30632bdfbf7da9cdca0c18ac7be89530d902af907066bd86c8e091223c1e9b4268af9dfbf391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184943, "uuid": "595495e7-46cd-401f-a6c0-bac833a61c9b", "value": "T143560106BCA104F5D0BAA231CD6356517B71BC881F3123D72AA0BA782FB76E1DD78395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184943, "uuid": "40a2be66-e3a2-470a-8636-457e5706d4b9", "value": "703c33eb82cb860e4e70f6478d707fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184943, "uuid": "1179cd04-3204-47a9-a563-ab9ed4ea0061", "value": "98304:6Jxm36lRtUwlSCyqZyiIQGugJwooOkmNQRjSlarg2KD96aPJ3OM:6SqPtUwZGPhoyQRWV2KDht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184943, "uuid": "8d4760b5-545f-4a50-bac6-483a3176f841", "value": 6259200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184943, "uuid": "58044bf1-38a1-4b49-9420-fe2c1718f6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184943, "uuid": "8d051794-ae58-42c4-b2f1-783d73a08a34", "value": "441041364.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d38871-6590-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180794, "uuid": "91b759fc-6202-427a-873f-e8916dd6c10c", "comment": "Malware payload (Mirai)", "value": "28e493ed8ddf346bc2b93b2912b8f651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180794, "uuid": "da21031b-e17f-49b0-8270-b13574da9e7a", "comment": "Malware payload (Mirai)", "value": "c4c0b9f745b0347c4aa1e49cf335c8a9921b67a6d26b0567099ef76996750684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180794, "uuid": "df035f51-38c2-404f-bb83-e22625128ee2", "comment": "Malware payload (Mirai)", "value": "fe9ea8c127e260564ff7dc707383e5323965c40a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180794, "uuid": "6f186697-01c9-4b1c-8824-b7cc79f495b5", "comment": "Malware payload (Mirai)", "value": "0499f0e13b93e84cbfd59951e54086f4be5b07d7ebe94362dc4b37045b86cc423d08a0a654db25f5b713293e9c405dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180794, "uuid": "3785f286-7137-4450-b76f-95457cf93939", "value": "T1BE938D87BB13D5F0D95504F0216BEB3A8A71DC332014DD6BEB98FD36AC72242A52676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180794, "uuid": "bd90668d-600c-49f6-94b3-63877a6bb1bd", "value": "1536:hPp1DKkiiIl/KDvJak6qsZUn3c/WUK31URWoaQH2Ge74fbrB:f1DHiiIlSFak6qsZU3FalFeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180794, "uuid": "d59c7ef3-f6e7-4a79-9430-138dd0be4941", "value": 93044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180794, "uuid": "f5abec8e-6a52-4bdc-bd28-ee6a2f1587c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180794, "uuid": "2a50c43b-f428-40ff-92a1-de4f3823ff4b", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bba7bc8-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload (GodPotato)", "timestamp": 1781207186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207186, "uuid": "d20e66ec-222a-4e13-9dfa-1a507c1d1c85", "comment": "Malware payload (GodPotato)", "value": "2e4973a854f88682666c77394ec3e61e", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodPotato", "colour": "#445B46", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207186, "uuid": "fb128e35-5d37-4a3e-8e7f-f4c839f6011d", "comment": "Malware payload (GodPotato)", "value": "c8889ebbf9516b00d148dfd3b2aee781deb30d27f654039903d31a8ff39d1f4e", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodPotato", "colour": "#445B46", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207186, "uuid": "2d766bbf-3a1a-473a-8bc1-06bdce4e6417", "comment": "Malware payload (GodPotato)", "value": "b1e46ed3f539868edb60e25b523e77dea71868c2", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodPotato", "colour": "#445B46", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207186, "uuid": "cee5c4ab-057b-4d9e-a3b5-c1628fdb49dd", "comment": "Malware payload (GodPotato)", "value": "597ddbaef2afdfe320fd7b534bd9f6dc29ba0a88f690f5ec6d1cacac3c18851dd4cd39b52002cb2817add21bde05eb94", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodPotato", "colour": "#445B46", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207186, "uuid": "d427c882-0851-40b7-8231-920d2d342a5c", "value": "T1B7431B0066B99661D1DCC6B9E0F9170243F3600E76B6F7A60EDD82DE2F5778292133DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207186, "uuid": "8bcee94f-532e-4073-8a09-4e4306a84dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207186, "uuid": "841939e3-45d3-4cc0-900d-81a85787b9fa", "value": "1536:R1qjvtmwUEzGtNmgkWQdMQanDz2OZK600QmA7U6Y:QwATg5QanDz2O7A7U6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207186, "uuid": "4a712adf-1d62-4d76-b2a7-46f1d1a4bec7", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207186, "uuid": "db0f2648-b825-4f36-9860-da241a661431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207186, "uuid": "99d098d0-8c8b-43b6-a7c8-df21519400b4", "value": "gp2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ec12c4-65d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781208512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208512, "uuid": "7340c26d-d7d2-4718-a685-fd2dc6808aab", "comment": "Malware payload (Gafgyt)", "value": "ad071a83e6b4c660f6582083c8fa33f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208512, "uuid": "587c2c58-c392-4326-b7dc-a4f5d3e2fc8e", "comment": "Malware payload (Gafgyt)", "value": "c8eb71a443fd8458012163d077ba3e069f0384efd474f2fbf62cd6beb055c485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208512, "uuid": "7b571d67-7d51-4526-8deb-7817e9531149", "comment": "Malware payload (Gafgyt)", "value": "f75f989be98cbfcee75f8304c440497d6f6cd21e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781208512, "uuid": "5da47523-852f-41c6-abae-566b3cc9836b", "comment": "Malware payload (Gafgyt)", "value": "b5d0b380937820aefd4e22ff5454a7604cd2151417bccb8171321c64615f13571f330b8ca8f51c1f67be7eb517a8ae4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208512, "uuid": "59843470-0ae8-4514-9c0c-4404fc729117", "value": "T176B33A56BD428F43C2C315B7BB9F47483B2667F9D2EF3203D924AF61278B4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208512, "uuid": "aba491f2-5aea-4c59-a907-1a3de2208739", "value": "1536:JmOwji4eqYzdH4dqFxUZyUjC0ar/O0Y26W8ElxonthqQvQ5hKpphq:JmJ4t/4yaaGxk+XLQ5hKpphq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781208512, "uuid": "ba23cc2a-213a-4c98-a8ca-21e3cc8283e5", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781208512, "uuid": "dc3a9752-d8d6-41ac-a708-d6294c712479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781208512, "uuid": "61d72d25-dceb-4f5c-bf42-cef56227a2f8", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab81b737-6556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781155834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155834, "uuid": "656cd357-6a73-4888-a4bc-8e7a1479da53", "comment": "Malware payload", "value": "771f86f86c9ba96cbd44678784e4852f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155834, "uuid": "4d8ca410-ed3c-4e80-9be0-e695a0c8b85c", "comment": "Malware payload", "value": "c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155834, "uuid": "31ceaecf-363c-41db-aff6-0433faaa42ab", "comment": "Malware payload", "value": "e847f31b168842f96cf59e2d8f5129c6b7cd99fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781155834, "uuid": "06017c2e-bf0e-406a-a076-784251e85c2c", "comment": "Malware payload", "value": "201373e5b9ddefea077873a2b46121ae5dc71c57a4cb9f15340cc11570a074dd4688132d5a5b03a7b25ebb913c2dc61e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155834, "uuid": "69c9887a-5db5-449e-8fcf-3f7bf903b2fe", "value": "T17DA1D4C60372E652C8867D61B17F329C64EB1AA16B98CE6CF7A64CF15C458D2F022751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155834, "uuid": "f2cb2abf-5225-4371-a0b6-c539624f8043", "value": "48:Qv8y24OT/fgwEf6y8d3+r48Ijiyu8UrHRrGUOT/ftax+3+ruSajQEuWCrHnrG61O:A8B69HTRC2X7TnCTerF1MbLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781155834, "uuid": "c18bf8d1-f976-42d1-9d71-47573924a878", "value": 5019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781155834, "uuid": "ad6e857d-9afe-4d66-845d-0405c2518bfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781155834, "uuid": "02419f1e-83aa-4f05-85c7-a55ae53d5f5e", "value": "asusrt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d3131d-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166902, "uuid": "135e1e12-51c3-490a-9546-fe5f5bc95f06", "comment": "Malware payload (Mirai)", "value": "55f7a97a9333dd3a7f844597777b7bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166902, "uuid": "b111bfb3-7778-47ff-b857-f7529f533b4c", "comment": "Malware payload (Mirai)", "value": "c9727a1237b59d5331a1d682e427056257415e13d8772b742c1777a69288bdde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166902, "uuid": "f3662023-7ce9-4c95-89bd-89d40b608953", "comment": "Malware payload (Mirai)", "value": "eb95c0a65a1ce52616e1741397066e1114e3eb97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166902, "uuid": "aa3e8565-2e02-42cb-aa29-f61d1c92a9e6", "comment": "Malware payload (Mirai)", "value": "cf67b571c202cfa84ed6698fb884f61d07fa25337c34c61c9a173e5051dc25484ab4a9f48e176dc518647742b7fc7967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166902, "uuid": "8df2f9d0-ceac-4e6b-ae0c-388d528272bc", "value": "T187836AC1A643DCF0ED19027524AAF337E672E9B50278FDE3FB1096B25825A60B04775E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166902, "uuid": "d8ed3e8a-5a97-496b-977f-b9bfa6cbd8f9", "value": "1536:TXmTJjc9efi6a2PODl4d//ENySt3H7mWEGU3AMnYzXgdcX1TT:TXudcgi6BPODadntaLmW7mRYDlTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166902, "uuid": "36318875-659f-41e9-a36f-52937b60d62b", "value": 84240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166902, "uuid": "811b1615-1dc5-4080-8077-e2a7092ae8d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166902, "uuid": "b41a1efe-a2d3-451c-8e37-cd8543b7e5c6", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f0d44-65df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781214805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214805, "uuid": "b41fb80a-e09c-4ea7-b268-11d46c1e52b3", "comment": "Malware payload", "value": "af98c7feef5663da07cc3d08cb195903", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214805, "uuid": "e15a768f-64a0-4cbe-90e6-a49cc4eec7d5", "comment": "Malware payload", "value": "c97650086dc07c0bbff6e844a651e02b716e002125dde174d77dc58610655604", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214805, "uuid": "481fe08a-1bf0-4116-a123-ad70b30ff4af", "comment": "Malware payload", "value": "a7abb17a2eeeb38860528aec1f1f10f7b754979f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781214805, "uuid": "e8b2868c-2a72-4475-b083-1b75766c5409", "comment": "Malware payload", "value": "2dd5ae8010502e1dc88b3510e6efa49cfffc6b07c8f071d499c450bd296e9a02635a90c4fb89fc11c2df5e93df16a576", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214805, "uuid": "ce9cca39-47af-4187-a1c1-66ea819b0f3d", "value": "T192252B57E2A344E8C62FC1748BB79372BA70B45942347E6E1E94D7312E21E605F2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214805, "uuid": "ec081c5e-609b-498e-88b0-753c0a21744c", "value": "1a792fd3a6f88106707307334f06fb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214805, "uuid": "ad9971cc-1108-4bce-a6d7-7e408abcc73f", "value": "24576:hfNJ/99jRUhy0aTrRkSZxRDH1gds3fGNJoc:hfNV99WqTrRkSZDHidyfGNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781214805, "uuid": "685def5c-100f-42f0-be37-6ee6ca7e2fbc", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781214805, "uuid": "f72501cc-fe4c-4db8-a532-11763f617d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781214805, "uuid": "4c23eca3-e0d7-4b42-ab76-65fc8f5fd169", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7db45c-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180966, "uuid": "45a094bf-73ba-4b87-ae18-f401527c8c11", "comment": "Malware payload (Mirai)", "value": "d76f6b9f611e71e8077fb7ccdf28a4e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180966, "uuid": "64ec9e68-b521-44eb-8631-ac1b39876de4", "comment": "Malware payload (Mirai)", "value": "cabd1b6d3e3201ed36d29e8acb3127503737b2f7b60988f0fc13768a9938db24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180966, "uuid": "51e5ac8b-1bab-47b9-9593-b1cb6793cda8", "comment": "Malware payload (Mirai)", "value": "fd2a5eb94280d176acbae1b6bd704a9236a5b5de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180966, "uuid": "e64485b0-624e-4d96-810c-fc9dc63c4be2", "comment": "Malware payload (Mirai)", "value": "e8bafa765b00e0eda2285fefb84350fb39a17e5fb7ec83b79d81083d3be5160611adb39ee46c77885cf1eacb96511e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180966, "uuid": "4520364e-f058-481c-99ea-c2a124354025", "value": "T1ECA35AD7F401CEBDF84EDB3784534506B172A3620B825F3A626B7963ED361A51933E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180966, "uuid": "791e8c10-ebbb-4391-a481-fd08150d2a82", "value": "1536:okFlgevzR8KF+74t8AUJ0pc+j4gx7/Vz1ZZj8oc0yZGqFdzTGlkd8ThtFt9DbYlv:okHo4qOc+Eipz1ZZJyZGqFJy7FrLKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180966, "uuid": "675595c8-0635-4a9b-ac4e-f6108ec91e67", "value": 105888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180966, "uuid": "5e49a25e-b213-41ed-8f7e-84d8d1ad25b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180966, "uuid": "8dba5cb9-f617-43ce-8fe5-97ef7841cc6d", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2aeb39-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180962, "uuid": "45ffa6e5-7af2-41fb-9fa5-bcc9e2b5b028", "comment": "Malware payload (Mirai)", "value": "916e802794c14e585e9d6dade72e16fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180962, "uuid": "c4b13e52-7658-42cc-8629-754033d542ae", "comment": "Malware payload (Mirai)", "value": "cb4fab95997ceb96ca3a750406c72ce0e7d807080c38abcc4987392ec2e06354", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180962, "uuid": "a909f041-a213-42a5-a56f-3de3ceeef662", "comment": "Malware payload (Mirai)", "value": "2919bd264e77cca10607d8fd68ef9926fbcbe4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180962, "uuid": "e8636fbc-cec6-410d-92ef-2f8c37f4fdaf", "comment": "Malware payload (Mirai)", "value": "5735d4f1272538731c49e9caa0c4c64f36e2c267ed106f6b28f6e75854b015db8d18cc867bc5c8eb7da8c16ad71fbfbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180962, "uuid": "c699738b-7d85-4e1f-b627-47e1e230d249", "value": "T101633912E5BC293BC5C0A23710A74373E2E70B895194E64FBD610D9FAF693101B6B7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180962, "uuid": "bcf1610a-46aa-4a90-ad0a-c5d75a8d568f", "value": "768:UlcI22FO1cQnIZ0piRAcXsJyzhGDPnifFhtz0UhyE++VzMIZJ7V:6B27a0ARAesJMhePifFhtz0UhyE+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180962, "uuid": "658eb081-6cb8-442f-bfbc-27c283385574", "value": 68184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180962, "uuid": "21082e46-6039-40c4-8222-b2ad7e757481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180962, "uuid": "9dbcb99f-1e98-4c27-9fa8-ef976988370f", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddb1101-65b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781197419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197419, "uuid": "3e5b419d-694b-443d-b3b6-2d6d4e7dca1b", "comment": "Malware payload", "value": "08b0e33e88aead2f3e07d454f03e893a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197419, "uuid": "0db72046-a08f-4038-be37-f99239cf8f8b", "comment": "Malware payload", "value": "cd980b082e928cb7998e911044dd98daf8d04eb9d8a74976bfe3b752d2d3a9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197419, "uuid": "b7af8c43-d79f-4ec5-883c-56ff4cea2931", "comment": "Malware payload", "value": "5887865dfc9e6b170a4b22c6d4b33e6f4fe8b6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781197419, "uuid": "80eec254-e930-482a-b0cb-4a11de17adf5", "comment": "Malware payload", "value": "59a3c40c62207071002c16e4579a714a99c109fe9ea7f4d4ca3f866f055ea59658de865a8ef1b1c6f9b0113b8705d006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197419, "uuid": "c4a23583-09b0-4aa1-a4b9-49eccca995ee", "value": "T115F58E07EDE549E9C169B23289B39281BB75BC082F3213D72E60B3782E767D06D76714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197419, "uuid": "ff136a23-9e8d-4666-a3ad-5c720cef744e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197419, "uuid": "28bccdd8-5037-419b-aa1f-ef5d64e1bc2e", "value": "49152:7d4l3Ts3moyOvC6PvCX7wZw9iHaqZM0gFqent:7uws7gjayOFq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781197419, "uuid": "c39586b4-0bd1-4854-a3b7-20a05156f079", "value": 3549568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781197419, "uuid": "6ca79161-1b72-4fef-a07f-8c7589032870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781197419, "uuid": "bf02017f-4a63-4f45-8347-466701f71579", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafab0ae-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186408, "uuid": "cba4357c-923e-4c32-9901-57cd687b66f9", "comment": "Malware payload", "value": "a0831d5779f7b9841f17b9a7f0e350ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186408, "uuid": "e273ba0b-e6d2-4bb4-ba51-c66852c6e759", "comment": "Malware payload", "value": "cd99a65e91a670494d4d49fe92d60a9ec25aa9d96ce94bd621e85f26884d9051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186408, "uuid": "bf8ec9de-6a48-469a-8f1f-eb1df94f18c4", "comment": "Malware payload", "value": "c04b345cf27afac64d4f33fd39872693c48873aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186408, "uuid": "b23a8af1-6da3-440b-90db-34e7f8e366c0", "comment": "Malware payload", "value": "21d98da138f5eec04b849a26320dc8918c2d035a86786dfaac665f8dfa99800eb05f80a94d100bdbe65ecc390cfc48a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186408, "uuid": "eb1adefb-d916-49f2-9c95-33a270d38637", "value": "T11922F605B7E94325D8BF8B384DB393115677FA059922CF9E9CC8529A5C327448D42BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186408, "uuid": "37816769-0f1f-407c-9e7a-2e97e1b2edd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186408, "uuid": "93267bdb-6481-4728-a5a5-b1c2bdb01f31", "value": "192:00Xv5tQoffDbRD5ljrCkXJLYZw6jaOaC9GW67Nzy2MhTrh:/MoDFVljegJsZwqaOaC9V6RzyHTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186408, "uuid": "188e024d-2d48-4972-b4a0-1cfe0898d58a", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186408, "uuid": "cedc492f-eaeb-4288-b7e0-7b02a84cfa8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186408, "uuid": "ba7e6ff4-8b6e-4160-a652-b045fd83dc5b", "value": "rEmillyeOliviaPizzariaME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a0e58-655b-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1781157973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157973, "uuid": "c58fe1e8-dc4a-4b67-a35e-c6e39ba3cae3", "comment": "Malware payload (DonutLoader)", "value": "62ba7dfa13d33df7da3222fe141c6fce", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157973, "uuid": "f3f2c3aa-5afc-42b9-935e-e6ed3cefa9e5", "comment": "Malware payload (DonutLoader)", "value": "ce029de4ec0f4096a2e396366fad0f0ab512952556de00bb571a4048b0679224", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157973, "uuid": "42309cc4-d205-414d-8eec-7456a882506a", "comment": "Malware payload (DonutLoader)", "value": "3b499f6fc294dc3060c10f7be5a1b50805e78143", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781157973, "uuid": "44a10ede-8cca-414f-adbc-1e65fb506180", "comment": "Malware payload (DonutLoader)", "value": "669f8e8f7e5c5cba309293c28b6f4445aea7f622b063b847d77847cf90563c9e808a8af6396992bbc943428e1605a234", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157973, "uuid": "0150aca4-bd1c-47ad-9a22-f85624f1e72d", "value": "T1DC557D44CE0457AEC75CAE34B5980BB238277656073F89A62EBF401A664BC6C0F1F75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157973, "uuid": "ca90ea10-0673-498f-b2b7-e8ebeb3968b5", "value": "3f9894d2144e24d93dffec126a0ae2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157973, "uuid": "e9fc7dc1-8d7c-4f4a-9894-30a83fca9b04", "value": "24576:8UWoll+fFKlhIp2btyWLc8JE/0/F2hzMSfB34uGD:8Unlsf8lep2yWLZEM47fGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781157973, "uuid": "0c68b6ae-eab4-4a96-a2e1-da85031ee748", "value": 1390992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781157973, "uuid": "ee90f3fb-2de4-4cf1-a8c9-2c819c9cbaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781157973, "uuid": "de9ce6d7-49e5-4778-b725-ab0c78ef8452", "value": "0xtunX1NLqtPe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4ba62e-65de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781213977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213977, "uuid": "7405ea0d-e4d1-4f9d-be3a-71424a479af9", "comment": "Malware payload", "value": "96737a12f6159e6fc2f197c82f6276ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213977, "uuid": "25ebf20e-1d81-4436-994a-15e3104304df", "comment": "Malware payload", "value": "ce0f7dd310cddd05c6726e8d9ba186c28eb38257ba84e52e68279b7f333605ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213977, "uuid": "02430593-72eb-4730-97bf-f0f3519c95ae", "comment": "Malware payload", "value": "b52360c39fa0703bfc36820b0ca2e350e168e96e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781213977, "uuid": "3be00aad-cf35-4496-a316-8cab2810a94a", "comment": "Malware payload", "value": "63d5a2f3d23732a9f81c96d4e53c94ae15d5eae569628c115fd1499044fa884411a0013d506ba8fe025019581be0e759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213977, "uuid": "ac9dde68-5925-4d91-9f19-98f483ad8e9a", "value": "T124B309217BBA0A1BC5D4B47A72E34232F2B5C78910BCC6173DA14E8D6FE968032577E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213977, "uuid": "49e4a31d-2901-4b84-84cb-ff599cb00dce", "value": "1536:eWbf6NzjQFKN7ML4FeP8pCP/3v+9Ylax5UsiR72wzS5qfw8tsuteIkNT:dbfEzjQYJUB52wi6w8u1ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781213977, "uuid": "ab5853ab-e4d8-421e-81af-b53d7783842a", "value": 109096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781213977, "uuid": "0ac179c6-e45f-4603-a46b-b4a7ff66a114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781213977, "uuid": "fd5478ce-6aac-4386-b4e7-b2a7ba211fef", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40659253-65b9-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1781198174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198174, "uuid": "b564b792-621a-4bb3-8382-7c6eb5bd07b2", "comment": "Malware payload (GCleaner)", "value": "c843d4538bb0f0c1b31e057ec7d8d8c1", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198174, "uuid": "78bffb82-ccb4-4e42-a790-733b1418a3a6", "comment": "Malware payload (GCleaner)", "value": "d049d136b7c8aaf342ffd924e09d23b2ca168552b3a6b3cf68913657b68fdf37", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198174, "uuid": "95e460e5-f72d-444b-9a38-43948789f733", "comment": "Malware payload (GCleaner)", "value": "0ca01817ecdf07b17f89b5e8a070e541c5dd922b", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781198174, "uuid": "c8bd885e-0228-4dec-bd18-85ba6d3b189d", "comment": "Malware payload (GCleaner)", "value": "6fb2737e6d11d60bd0652bf206d66a7fcead61b29d65799430370935180f8fe671e06bd83b153d531a4335d66bce672a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198174, "uuid": "73fe32a1-3ae2-4898-9d5c-04a6427176ba", "value": "T11BE49E23A6E84433D1631A7C8D3BA678583BBD302D295C8626E47C8C5E37F41756A3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198174, "uuid": "48ea92c4-8ada-4c42-ada8-746c3d085edc", "value": "2e3c3e7df2331021cccc2488b7b535fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198174, "uuid": "09924914-8440-4882-8f94-a24934c456e1", "value": "12288:kzVFse3v4WpuchDXm/D0IKmp8D31tlQEpt4W:CffvpucFY2D3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781198174, "uuid": "b9ba56b0-1dcf-47eb-887c-8f23ff457980", "value": 670992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781198174, "uuid": "0e905220-7296-4106-9ce8-010337764270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781198174, "uuid": "403af97e-4133-405c-83c5-d91699e21447", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee30753-65bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781199568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199568, "uuid": "f580d935-abc3-4525-a230-4fcbd602907b", "comment": "Malware payload", "value": "4228341ff69a4b2638a0b47897d1dbb2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199568, "uuid": "07487415-66cf-486d-946d-560c6a944cff", "comment": "Malware payload", "value": "d0e79fd039575862664fdfaeb700fe49b458f51d3b48a8bbd85c67d780befda9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199568, "uuid": "d0252eb8-4bd1-4c06-ab20-23e80a34f9c0", "comment": "Malware payload", "value": "bff0e5bffe9bc74da699bea8dc3afda26945a8a4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781199568, "uuid": "e7cd1376-eba1-422b-8322-cf11742b64b2", "comment": "Malware payload", "value": "f406823d88761472ab3dbff9d31527d9ba1f81b4ef1e21194cf97f8a6c0ef9fdec3302e7cf0f3f3d8fc56504a0833459", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199568, "uuid": "c6dc675c-0e4f-4d1d-a6dd-11e7a1dc83b0", "value": "T11365AF5B1E6DF428E5C5D03D2FC916B3A523F4740122D82A2BA6872DAFE59B18317733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199568, "uuid": "eac1fc33-9580-409a-a01c-f3a4257748e8", "value": "24576:nhDh2IhTpZM/yEc/sA7tY2nfkCSe216Vaukcp+I6725suUf1Wyj:nph2WTA/ZUjcCS140j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781199568, "uuid": "ebb9dc5a-1c10-4849-9cf3-a47ce3b38729", "value": 1427456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781199568, "uuid": "710b5dce-ea68-4489-92ec-617c0374b01a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781199568, "uuid": "04f74f50-36f6-45bc-9e83-ee243accae7d", "value": "SecurityUpdate.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa010042-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221249, "uuid": "4f52f554-ca9a-428f-9961-e26e97cdb708", "comment": "Malware payload (Mirai)", "value": "da8c57042f09296183c9c5e59247d6f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221249, "uuid": "83154d9e-1d6b-45b5-b92e-a36e5b0e44db", "comment": "Malware payload (Mirai)", "value": "d16a604300fe3a9fbc6928bbef86a640ec7df6d29745a78e9393713cf788618b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221249, "uuid": "4ac6ede8-db04-4f1a-83db-98b92ba20541", "comment": "Malware payload (Mirai)", "value": "ee6fb009dd1fef145b3ce770c1cf1bde16262c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221249, "uuid": "3b84c37b-4fc3-488e-a0d6-b83d65af5c82", "comment": "Malware payload (Mirai)", "value": "fa245ef67183b5c5aa77c43bfcea2cc0c1637b1aa6e8403499892071c90a967d11817433e2b9c77b87e203a30d1490ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221249, "uuid": "ed9531e9-9d77-4be7-b212-3507e5d66cc5", "value": "T101132CD6B805AE6CF667EABD54224D0EBA61734250D30B2B67BFFC836C321784E12D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221249, "uuid": "1b6b0a84-38d3-4467-b059-28eadc3f3508", "value": "768:eACQeE9ZC0iwYueK7gBZ7xQeN+amrEifbwtFpXiQBlPTBCV5Bq8Cdx:MQdwwSvNQY+QFiQXTBC3Bq82x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221249, "uuid": "d24325ad-5a10-430f-8ea3-8e698a808f19", "value": 43444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221249, "uuid": "f8953dbf-7a07-41a0-9a38-17897546e83f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221249, "uuid": "6b186d18-ab9f-4e3a-b419-7b1d0dbdad6f", "value": "zoryn.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4c53f1-65aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781191886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191886, "uuid": "942979aa-ae4d-4107-b49f-bbf4ef3e3d54", "comment": "Malware payload (Gafgyt)", "value": "b5a748c1476418a625f1af1417446329", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191886, "uuid": "28bcb9d2-cd8c-43f6-844b-8da928927602", "comment": "Malware payload (Gafgyt)", "value": "d43e8aa7e149407c3db7d84bba248c1b9af67677f98c7a46196c69d57933882d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191886, "uuid": "e2061431-3abc-48cf-8fc9-ff98de8444e9", "comment": "Malware payload (Gafgyt)", "value": "c74f1b740198b81441a5d4c830ca6952dd049116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781191886, "uuid": "e2750504-cb98-4b9f-afa8-1122b10971fc", "comment": "Malware payload (Gafgyt)", "value": "b197977c660c1c4a02e1193f2afd0fe62e6e95f92a4174e112b7696ac624450c71980485f13dcbc90bdc01162e06315c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191886, "uuid": "c6bcfe9e-42ef-4105-83fc-8e7b109f8e34", "value": "T1AF931A9BFA02CEB3D41310F112AA9F219E71F9FB4863D642E3646DB4DE150C25A15FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191886, "uuid": "bdc14ec3-05a5-45a9-b957-3fd5185b7f4f", "value": "1536:2OL3PgLs68Ox86m5ckyXWqw5qQwS5Q7UBE77NVQ+OurJ33aXZG0g:20PWLx86mJNwI5UUBE77jQ+FJ3qXZGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781191886, "uuid": "055ea38e-dce1-4ab5-af98-eae70b6c74c4", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781191886, "uuid": "2a01b1fe-7b4d-4878-a664-0290ca924759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781191886, "uuid": "4cf50827-a39c-4ce3-8a73-88ab868d4de9", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da18e31-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781188855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188855, "uuid": "81f6b15c-5d7d-47f4-8d76-d61141926c6e", "comment": "Malware payload (Mirai)", "value": "b2a4545889c2af69a9e9007fcba0e105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188855, "uuid": "3db15cfb-2be3-47d6-a75a-31d90ad6da81", "comment": "Malware payload (Mirai)", "value": "d5d7b0d8e18e7e18caca56169e992aa76adef5629b123d1d1f53d26fd0c15774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188855, "uuid": "bbb3e9fe-0257-4d47-a462-a2faed25fe8a", "comment": "Malware payload (Mirai)", "value": "5fed7ae9855f31be930fff8a1c87407fd361b31a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188855, "uuid": "c0f6ec37-5865-468a-88ed-07c17954926f", "comment": "Malware payload (Mirai)", "value": "3bb23798adc55b781f0b34e18e1a53653bb3c633d51243d85f53fb8e3769a4dea1048be14cd51611b6a2d1d7bae2bf96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188855, "uuid": "ddcb2214-a642-4128-b91a-5892ecd43b84", "value": "T1D904B81E6E228F7DF6A8873447B78E25975C23D627E1D684D1ACC2105E6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188855, "uuid": "4e18f889-d297-4ecd-87b5-6e97fcfa739b", "value": "3072:EnBT4EnPtAIFpKhhZr6yB6/LA4lWR7iKDkNWeTtt/8nHKuQ:c94EnFpKh7rzDKC7QNDtN8nHKuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188855, "uuid": "23b74d10-8bcf-4352-a673-c1080eb6b4d7", "value": 186700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188855, "uuid": "691bded3-c871-493c-b63c-a0250d473847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188855, "uuid": "2c21f558-0b5b-45f5-903b-b572a340f5ab", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d5e935-65e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781216434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216434, "uuid": "06d9368d-3093-4cd2-8696-2f10ec7b82e5", "comment": "Malware payload", "value": "47703af91f7b3db6986b333a3d147276", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216434, "uuid": "95dd3d88-a843-49af-8deb-f936c01e8c62", "comment": "Malware payload", "value": "d6ac4263b78a4d77ca1361d6c117ab6571b9cae9fda73a2468ad824d5637975a", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216434, "uuid": "4f4eadca-2a3e-48e1-b2fa-0659a5697bf2", "comment": "Malware payload", "value": "d69f752f2ca09d8597b777bb9db24f72b256c560", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216434, "uuid": "68eb2ddc-c473-43d7-9c4c-b19d3be8c9a1", "comment": "Malware payload", "value": "79563820d03b071e3affc151571abc03ef283943d349d5dafbf843c48c7c93100e955e49ec682ec2e2b778d97ebe36d7", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216434, "uuid": "50e93a7f-3283-4878-9dfe-59a5112b1c05", "value": "T1AC567D13B6C4643AD4A71A3B8C3BA648683FBA612E15CC4B7BF40A4C1F396817D36757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216434, "uuid": "b7910c3d-22dc-4e60-8e23-13b0eabfdf2b", "value": "0a8c4a4f37cf3c0ef08dbab272fca40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216434, "uuid": "229426ec-731e-4428-bdf6-14380d9c5668", "value": "49152:QWJsZT9OMhuSgA8er7lWzHLrMsgMlv+XPs9F2Ml6c6Z2IPEjGWNVFPN8S:zJsx9Oq0XrMElmfs9FzP02jFiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781216434, "uuid": "b6466162-1350-4232-908a-3f84af7451db", "value": 6085632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781216434, "uuid": "6b2ad551-b508-49af-8b91-42eb314bee70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216434, "uuid": "0c2a8fd0-3fda-405b-ba38-9a75ce587b00", "value": "d6ac4263b78a4d77ca1361d6c117ab6571b9cae9fda73a2468ad824d5637975a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac9f57e-65a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781190515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781190515, "uuid": "b042564e-deeb-4b89-b115-d261841035fc", "comment": "Malware payload (Formbook)", "value": "a44b67d4e2626557bbbc11f3e50c258c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781190515, "uuid": "6e9f9100-db27-4de5-a6ae-88ff28ef48b9", "comment": "Malware payload (Formbook)", "value": "d6d6f9c0160cf7bfa97097f58f6acf8cafc8bd657b7aebbd326fea05e9bc3165", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781190515, "uuid": "2647b7bb-3047-47fe-ac98-f614aaac991b", "comment": "Malware payload (Formbook)", "value": "26a89db4d0fb5cc3eee4a64fe91a7312f6a47664", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781190515, "uuid": "cc5d4d9b-e4f6-42ff-b7b4-3d50041a6a42", "comment": "Malware payload (Formbook)", "value": "a010454a01b0e6909951b77c0dd5493a0266b5fb94338fe70e7e4d5200b012b6ce77b995fefb4c4e79fedd99a656bdaa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781190515, "uuid": "a0c23931-c432-4a09-b52a-bd5f3948c29b", "value": "T110C58F83944D4C272535D7C024C43BA8BEB999FC18E788697D639FE231859CE98F5C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781190515, "uuid": "b5be5567-2420-4800-ab26-994b25ed7e5f", "value": "768:MNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNS:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781190515, "uuid": "be65ae56-87e1-4078-9d29-42804e850010", "value": 2590099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781190515, "uuid": "1012b650-5220-49da-bba8-c8224243c246", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781190515, "uuid": "fb96bd53-09c4-445f-b367-612df58e7bde", "value": "RFQ 11062026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d010956f-658f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1781180377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180377, "uuid": "03099abb-86ff-4555-b3fc-81d19537c75e", "comment": "Malware payload (PhantomGate)", "value": "9f15126afb012ef3321f53a646bd26bd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180377, "uuid": "f9eda917-71b0-4e43-84f7-3a35d2698638", "comment": "Malware payload (PhantomGate)", "value": "d9bd24bf0ddb420e0aa699a221ef615ef4f0637773cbc04e80ade06c755084f9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180377, "uuid": "1ea8cf96-203a-436c-8fad-c41c89dc4bf7", "comment": "Malware payload (PhantomGate)", "value": "14b118ebad737d651ba13738dfccb78019a24562", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180377, "uuid": "25e6b441-ebee-4be0-b7ca-241b94e005f6", "comment": "Malware payload (PhantomGate)", "value": "d8404484df374edc001ee8f8fcead7f42e86ed275204dcd57672c673fe1001616fbd0efaedad8a70396885826c949fa4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crixup-com", "colour": "#418786", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180377, "uuid": "86b8d853-1d37-4123-ae56-cf55c411b48e", "value": "T15652C9BCC4E1BDC0875BA2D0B8DEFAC6018E9B177A6B1B6CF9D844510751394EBB858C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180377, "uuid": "028406ad-50a3-49a9-b8d8-b1904f106e66", "value": "384:YYcLejTDh+qE2zA71Koqbh3bq9mTqITkrYzOcfIxe6hyg:YYBTjA71KDbRe/IY8zB8e6hyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180377, "uuid": "02a43d79-1d8c-4723-b9c7-1f87134fe209", "value": 13766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180377, "uuid": "e6a8a002-2d7b-4351-a25d-935079817dea", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180377, "uuid": "e69756e7-9e83-4d0c-a704-9b2d9879c90c", "value": "Faix2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16186338-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179206, "uuid": "aa31db0c-ab8e-4db0-acd1-4474de92831c", "comment": "Malware payload", "value": "6648f64b5e31d4850c292782fcd70e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179206, "uuid": "3f5ad81c-8619-44c1-a0a5-91222b8ed453", "comment": "Malware payload", "value": "dbe59cc128a2799189d1f29da1993edd63de13ddeac85b52e6633ad85324857d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179206, "uuid": "e81332b7-5043-4078-8b32-ec75c924ee57", "comment": "Malware payload", "value": "c65c5db94e56f7d26c54610fc0ec3dc1e46c1f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179206, "uuid": "7b07e881-9b5a-4c06-9dd2-240f9babb474", "comment": "Malware payload", "value": "029ea43cd987b6ca5570256bc2d124189c9b9cd824c0db2835a149ce800f84c61723451bdcd290080485b9905d91c50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179206, "uuid": "96805c0a-356e-42f5-baa0-f60f181bfea8", "value": "T19122F704BBE94339D9BE8B784C73935146B3F6069537CB8D9CD8629E5C237408D92BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179206, "uuid": "76c6f15d-06f3-400e-97e9-3ed170b47f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179206, "uuid": "ae9cdf2f-c37c-4db7-869b-5c32320040d9", "value": "192:5MmV1E1jkmlvxe9DyRFEZtzLYZw6daOaC9iOyRcCy2e:5fBmtFRFC9sZwmaOaC9JBCyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179206, "uuid": "61d1b3be-819c-4429-99c1-8688bf894eaa", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179206, "uuid": "58a05801-b85a-4e9f-aecc-2918b1a4ef34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179206, "uuid": "b6ccbd4a-f262-43a5-99cc-be1144aeb102", "value": "rLunaeMait__CasaNoturnaLtda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e9b0e0-65a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781187792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187792, "uuid": "e38076ab-a722-4b44-abd8-afc1df047b70", "comment": "Malware payload", "value": "237e83c91fb694ef11607a16d84faf5b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187792, "uuid": "4f2d4639-437c-479c-86f7-cd171197dcf1", "comment": "Malware payload", "value": "dc9458a71074ddba883f77201a00b10660438b3230e584cbee18edd276325ddb", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187792, "uuid": "a832699e-cb1c-444e-b5a0-818e173e36ad", "comment": "Malware payload", "value": "316afd0d086094c05e214100e0e58f5b68d8b501", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187792, "uuid": "42ddd588-2f01-417f-9737-dea85f248030", "comment": "Malware payload", "value": "f47bbeb6a8a97e166aff2e40b27bf409c3c6b1075a5175c1d9b7d754d7a2ad32a1df9489236ed8ce49311fe2941dcd16", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187792, "uuid": "d699a357-9b97-4dd6-a6ed-750485a30b5c", "value": "T1E8F57D07EDE14AE9C4AA6232CA7356927B70BC041B3623D76D90B6382F37BD06D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187792, "uuid": "481bf51c-5149-464f-b736-463fe621a335", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187792, "uuid": "c40d0d37-e313-4606-a0ab-0523dd388c99", "value": "49152:SW8FeviCY+brhp6SpqYGEVcFBYFulPk+Shezzv:SK9qyVcFBYFulP7Shu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187792, "uuid": "594c1334-b216-418d-bca8-8bbd978b5fb0", "value": 3549552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187792, "uuid": "d3a16bda-6cf6-4509-9af3-28cd915a3a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187792, "uuid": "5a9af890-60b0-497a-bc6f-71234a846a3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64df2a0-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221243, "uuid": "54f7b892-1294-4134-a22b-7bfd107b5d9f", "comment": "Malware payload (Mirai)", "value": "8d1e63533cb142418055bd06cd0dc8f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221243, "uuid": "46c6d545-113a-40ff-b992-4bd7a3cb1a82", "comment": "Malware payload (Mirai)", "value": "dd12968ada7d16e31d1d98a8e7c8e728a1f0263bd25e3e59f233814f040a32bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221243, "uuid": "edb8aeaa-a252-48e8-a6f2-2b2a8264e16c", "comment": "Malware payload (Mirai)", "value": "e89a4bbe1f28a85cee6816301b02b7395cebaae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221243, "uuid": "3f1ca8ab-c402-44f1-9a21-ed551cbf3c49", "comment": "Malware payload (Mirai)", "value": "144de44fc44f9272949f3750c808557fa5c0bda077da25599b1389bf0545f375f9dbc1d12d6a6b4f78b2e82779508dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221243, "uuid": "e14b11dc-590d-4a19-8721-5c445b869512", "value": "T1D5B33B46EB408B13C4E51779BAEF424933239B55A3EB730649186FB43FC67AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221243, "uuid": "67a53a76-affb-4205-b82c-6107c288e9be", "value": "1536:DdnUe9Z4OoUEYEu87tg9MBd6VD4jq/RdWlVRirr1/71XHqQ+ojNzw/9VY9Qw:r9eO3q6VD4jqQArVBXq9oBM/9VYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221243, "uuid": "e4fca53f-77d5-430d-bedb-2a678c25aa6a", "value": 117497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221243, "uuid": "0d1ad853-736e-41cb-a460-5b7296df0ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221243, "uuid": "4602e452-25ed-4f58-a8f7-fe60cc22d507", "value": "zoryn.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121a4e0e-655c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781158154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158154, "uuid": "4baa134a-601a-4b2d-bcfb-a8fdc8965edd", "comment": "Malware payload", "value": "594984aa3656ef8f6221c8c03d31e46c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158154, "uuid": "77b046a0-ffb0-4ef3-a2c9-77db15e653d9", "comment": "Malware payload", "value": "decbeefb88f6deda17330f7690eb836ea7cbc915c4790ff6d9716f525e6e473f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158154, "uuid": "e6238820-ab58-4eb3-bffe-727593ce3fec", "comment": "Malware payload", "value": "b06e77b0d4352c7e443c2465c2f00d0634d6c934", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781158154, "uuid": "9b8f14fa-09fb-4815-9ef3-9bdc1e978e38", "comment": "Malware payload", "value": "af26b833dc6117f223551dc00f5cd115578c307df8722ad776c7238e4144c9a75fa043dcf412f97bdc0637a3c818c2a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158154, "uuid": "38926287-b170-49cc-9bca-92b4ef91e9cb", "value": "T1D93196AB1B1D3A8C0500CD9977752648E224D9DA214FE7A4FF0D08BDE2CC588B31BE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158154, "uuid": "7710b2e7-6dfd-4d73-a2bb-281699bcbdf5", "value": "12:5VOrVD4Zjr9PrqrriXtdr720+8y87GprGWOxjIyX7rF1pNFXOrssRej6ryLp1XIX:iOzzX9dIUldFERedLdsZCEGOwWs5mRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781158154, "uuid": "a091ab08-d3e6-46a9-9c63-f76596c4725c", "value": 1620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781158154, "uuid": "2e0ffab5-b0b6-440b-b5b5-6be2eb081696", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781158154, "uuid": "c9bf53e3-62e7-4a44-9e07-0877c8cd7289", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74740d34-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781146293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146293, "uuid": "1e47b6bb-93dc-45cf-aba3-6636b0f708c5", "comment": "Malware payload (Mirai)", "value": "8992adfc3a2143e45acbac6f80e2af25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146293, "uuid": "1166a4f9-4ba3-4dbb-8c36-8bb14981e2cd", "comment": "Malware payload (Mirai)", "value": "dee3509350d96f3b5079607d9049a99acbd85a87907c3800461fd01e75cf057f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146293, "uuid": "a623e18c-426d-4ffc-b8e0-495d06c7aeeb", "comment": "Malware payload (Mirai)", "value": "c7f271e3e3e6de93c2e422b90078ae7e9a60a687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146293, "uuid": "683c7078-094f-4d43-aba2-f71238730be7", "comment": "Malware payload (Mirai)", "value": "27c8f341148ff951ef8f52b5b0a0d8a3861664d5009a6536094a5674207e1261c946fae191d5bb5944b0572215f82b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146293, "uuid": "1d458103-e4c3-4502-8dc9-06803c665a08", "value": "T1B4E3F745BC518F57CAC252BBFF4E4389372A17A8E3EE7203D9156B24378B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146293, "uuid": "1fe30213-3339-44b2-a614-af857c0ce674", "value": "3072:p3v0/DYJQX3jdzI7dFZkLO4aa2RcZ4tm6AmHZnJjXGsPjB:p3v0rYiX3jVI7dFZkLO4P2KZ4t5Am5nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146293, "uuid": "c350f63a-d575-435c-aeb5-f9bff4b90f48", "value": 156516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146293, "uuid": "cf526424-23b8-4f47-857f-bc9e5cc9d12f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146293, "uuid": "3c5fc54a-b70a-49be-acba-3cc51dfbe731", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230f3ddc-6571-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781167201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167201, "uuid": "f35ba567-27ff-4743-be0e-748a35fa8b8c", "comment": "Malware payload", "value": "3aa46ff1dc94ae197dfe3d45a9399d71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167201, "uuid": "d134b64c-740d-406e-8e0a-0d9d39264579", "comment": "Malware payload", "value": "df6832dfba5c046e2c199bfdfa1eee5821ea0c4459d0a14780c59b2c49d40673", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167201, "uuid": "0510bfe6-1125-4077-95eb-5d6759bf75ba", "comment": "Malware payload", "value": "28d59e6a1d04416cf32c496d77a86804b7051f54", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781167201, "uuid": "6a2f4032-236f-4279-802c-10808edecbd1", "comment": "Malware payload", "value": "5c25dcdf0807597093d766071077838b13d0f039a5c52e7271ac4a60af2e2a74f5b1f38078461db97bbb351a64f71f97", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167201, "uuid": "4ad0c1d9-574b-4904-9d3e-c55deeff18c1", "value": "T123067B03FC9058FEC19AA33189B256867B75BC051B3627D72E40B6393E76BE1AC36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167201, "uuid": "0c4d6e59-4ddf-4a81-a88d-0e9af42efbf4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167201, "uuid": "1830f983-7344-4293-a321-e27c114757ce", "value": "49152:h6NZpVC1EG9Oz2sNDW6pqsMHeg926J8POLUinYJfxvUcTA:hSfDWsZMHe42LG4inkFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781167201, "uuid": "821009df-b0cc-45ae-94c6-7614d7478779", "value": 3660712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781167201, "uuid": "c3bcb0ff-b43d-4134-96a7-57997f283e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781167201, "uuid": "1eec9392-c081-4c32-8d73-c343f5f1d7b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55dfc44e-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210666, "uuid": "f4ab8ebb-25eb-4dae-beed-008af3fea372", "comment": "Malware payload (Mirai)", "value": "05cb1b0690a384be66d23ff9d6bdbf33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210666, "uuid": "cd3a2c90-a3a8-49ec-a91c-02a690c76275", "comment": "Malware payload (Mirai)", "value": "e03d379c50e33315aa5bc0b2676aa8f0036f88dd3345b2cb5c1cf3c71c98a77e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210666, "uuid": "5a4d1911-9702-4d7d-b3f0-74625ea34dbc", "comment": "Malware payload (Mirai)", "value": "c46f470daa3f790c9341f3e23032e120dd2c0136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210666, "uuid": "b656c2f1-b1ba-40b2-bfe9-dce2f934ab6e", "comment": "Malware payload (Mirai)", "value": "d125c2a5d4d3c2ebee2e9eb01d1eb7ef9cd0bda6b05391bb83378d17b5da85a3a6d780c108509f5dc7f2b6efd9cbd572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210666, "uuid": "a6a654c5-9fbd-45b9-a39a-df171f495a8b", "value": "T1FFF33B17B5C090FEC8D9C2B48FEAA12ADA32B44E5138715F27D46F261E5EF206F2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210666, "uuid": "598207d8-eb60-427e-938d-e29bdf88fa87", "value": "3072:gvnhHMRvKv5OVK1OPnnide87jevXsj6YIUH0gfphD+dla06bKgDn:S2vo5OIrs/W0gq+3Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210666, "uuid": "175624ed-9152-48f3-9a40-197277f01aa5", "value": 159720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210666, "uuid": "9ca22c84-97d8-405f-941f-f1dc19a95c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210666, "uuid": "ce1507b0-5cc0-4d40-99a3-e82450a74db5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390cd10-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166907, "uuid": "44576bca-5fc6-4563-9fad-ddcaa51b6cd0", "comment": "Malware payload (Mirai)", "value": "e56f69fdead0fa82210cb7593699cd1b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166907, "uuid": "8a66ac8d-615a-4eca-b82e-f02c0e86168c", "comment": "Malware payload (Mirai)", "value": "e0cacf66e2aa5c70d23f41420d254986117ddee77a65faff39ed8bbf9d6398e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166907, "uuid": "758e147f-25b5-425b-bc98-7b3749391836", "comment": "Malware payload (Mirai)", "value": "f28473c4134ff73b473d0714b5aa47252dbeac0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166907, "uuid": "f87482f6-89de-4976-9ade-c4ce5694197e", "comment": "Malware payload (Mirai)", "value": "bf357a6bf394b4836ca66d81655e1a1c17b3a98cc533cd36afd125c2a8a6507a67f1e7392e59764d4f7f0b43508ddc6d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166907, "uuid": "8bf8ade0-b494-422b-bd07-6140f239e138", "value": "T1F5316DC018816B7FCCD899557362A06E10296CCA2FAA6FC0D5DA18D8BB987C2B520F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166907, "uuid": "8e7cdec2-a96f-46db-97f4-b286bcc4ef49", "value": "24:HEBvi1uBFBvK9hhYTtqBvTm7Ta1BvWPzBybEByTvDp86MtqBVSjRGBjtpTEBUBcB:Hovi8B7v8hicvIGLvAt107py6IsjYYcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166907, "uuid": "82228b7a-2608-4ea7-9d4b-e7c959e48884", "value": 1499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166907, "uuid": "e4cfe40d-026e-479e-8222-a2afc68ae7f0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166907, "uuid": "8e6b2c1d-a031-4723-a121-79d358cc6e6b", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596d5263-6593-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781181896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181896, "uuid": "30f73872-98c8-4c03-a756-0118aac958f7", "comment": "Malware payload (RustyStealer)", "value": "4e6e7655292c8acb9df44b8e421d80c7", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181896, "uuid": "9a4f7ae4-5d82-4174-9d1f-a987355adc52", "comment": "Malware payload (RustyStealer)", "value": "e1054e54cd83b030e80ec1cbcfd4448a21ed1133a880fb411be5a89ae4592c8d", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181896, "uuid": "f4743492-8027-427c-a1e9-a8dac8936303", "comment": "Malware payload (RustyStealer)", "value": "49d85b6b13729d45650af171844214318e9eb403", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781181896, "uuid": "4fedef6b-fc18-4628-ad8b-db2928f9722f", "comment": "Malware payload (RustyStealer)", "value": "3d554ce5c89578604a7dd6d90ee1edc5f6912fd26fb9f151ebb4b391e68994bd50def832f76f324fafd5f4398e5a369f", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181896, "uuid": "0959a317-a4f5-4867-bd31-7777b10783a9", "value": "T11DA46C43B69482BCD15AC038875A9673F637BC8A0630BEBF13D466302E79E915F2D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181896, "uuid": "0efb11db-1130-43ca-a829-6e7a2850774e", "value": "7c7600697bfd83c890b010268efbf21f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181896, "uuid": "a9bc54c9-0d67-4ac6-939a-3e7c6f8a3dc4", "value": "12288:DqTHPdZhngqg48lK6wDrnBdN8o55885w4OtEb1:DqJvFawJdN8o55885w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781181896, "uuid": "f184b262-3816-4331-90f3-6fe11a76cb81", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781181896, "uuid": "284d179d-14ad-47fc-84bc-431221a59ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781181896, "uuid": "3f39044f-3a97-44c4-815b-2cdc0453f73d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd4a16a-65c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781203968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781203968, "uuid": "a4a40d40-0f67-4bc1-ab64-d93c09cd9cad", "comment": "Malware payload (Mirai)", "value": "dcb7fd05fb240db53d7c7f0b2a1f780a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781203968, "uuid": "e4d55fdf-f09d-4d5c-b183-37dbfcd3c683", "comment": "Malware payload (Mirai)", "value": "e24b3cfedd4712c1f75391f96576a772ca262e66e05ff8f1b9ad8ccf63b459a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781203968, "uuid": "2a5e529c-e80f-4b2a-9aac-2283f79da818", "comment": "Malware payload (Mirai)", "value": "bd848b47ea34730e6f43cc7a2034a63bc02c1827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781203968, "uuid": "378a12f8-bbb9-41e2-baaf-3de12e73c5b9", "comment": "Malware payload (Mirai)", "value": "699cf0a8aeb37c3f12679468b910959d5f0c75f1575db8bd283ae3881fae506c01a646b970e9f2d1a972c717315c6d3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781203968, "uuid": "e0661cfe-e660-49f1-a098-4db9290e090f", "value": "T1E8E3F845BC518F57CAC262B7FF4D4389372A17A8E2EE7203D9256B24378B95B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781203968, "uuid": "9cea9808-cfa7-432e-ad09-422cabacf506", "value": "3072:5Q2bFGjDYX4ezznyGSArLBkFVCUQaOtbK4XfQLdv52jeq6is:asFGjMoezzyGS6BkzCUpOdK4XYLF52jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781203968, "uuid": "7487247e-e319-4d5b-81d4-ba534dda0694", "value": 154052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781203968, "uuid": "ea9a5eca-a557-47db-a415-b61c4c340264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781203968, "uuid": "775b2982-cc21-4644-ad10-d5024194f86d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4875431-653b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781144306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144306, "uuid": "caef911a-3a8f-45f3-ab75-82cdb6f40fcc", "comment": "Malware payload (Mirai)", "value": "38cb3a672e3ac1cea50981788230c6b8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144306, "uuid": "a0db6d2d-1945-40b6-b048-f2e763ea17b3", "comment": "Malware payload (Mirai)", "value": "e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144306, "uuid": "df23add9-244e-4d10-a659-7c4ad707bd55", "comment": "Malware payload (Mirai)", "value": "af53233fc1c8e8955608acf179b06a9d65dda69e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781144306, "uuid": "1bf16200-d8d1-435b-9985-1eeaf834465a", "comment": "Malware payload (Mirai)", "value": "701a085fff05d544aad500dec74c2ec7d7379bc60c9665691504319b1ba0a1f0c50ce47f39d05188a378574c26b97283", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144306, "uuid": "789ed16f-84b3-4348-88c4-939c2e0dbf0c", "value": "T167D05EC764215660CE8E9A2977A006CC708A4ADD11C74BD9ECBA0A3C64AC6442144B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144306, "uuid": "d13eabff-01d3-4b07-94ba-4975f31d2003", "value": "3:TKH4Z8bXjWygFWKIvJjWa3zOdBhYJXn8cIFuBNRFbXjWygFWKIvJjKDOdAlYXJXr:zKb6XhYlnZlFb6Dglnzug3dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781144306, "uuid": "2c894b75-8ef6-4eb1-955f-8be475a8e0c5", "value": 254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781144306, "uuid": "4c8b8767-7021-4f4f-b5c8-11f77bb75fc1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781144306, "uuid": "975e3dc1-8e0c-4945-aa60-f3accd9a481f", "value": "nigger.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c58c15-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186317, "uuid": "0344be3b-9b0e-4c0c-a3ce-42be228698ea", "comment": "Malware payload", "value": "707df763f09e7af302419f26837da820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186317, "uuid": "87d99c0e-a364-4295-a5f9-9502c14344fa", "comment": "Malware payload", "value": "e49ae60dcf71b0a34a03bd6d0449e4a315dc13f986910041443eb94861899e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186317, "uuid": "50a1e741-b680-4b30-8ca1-f98c43295cb9", "comment": "Malware payload", "value": "4cbd918600203583ba9e0a5ffd291f8a08a2a316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186317, "uuid": "decaf427-16c8-43dc-a101-30eb0dbaed11", "comment": "Malware payload", "value": "a11f8f8718e5e9269f197b7117cc034efeadaa9f5aac037578acb184d03a522ed83e7068fbbe0fcaf3b11796ea8fe211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186317, "uuid": "c6786ba9-49c2-4ba6-8e3f-755487bf1a3b", "value": "T1A6B46D2BE4B7D1A8C297F470A3BBD1F1B5307C9D06742A3617D1EB703546BA0A768E84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186317, "uuid": "6ccb5458-ea90-46f3-9e06-7e199a55ebde", "value": "1a10068ad4c3a26d022e35c2e5594428", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186317, "uuid": "a68c907b-2a5e-4eda-93a2-13b395b3f4f7", "value": "12288:kApeUm08/lw2YwBfU29GDgT1txU9U2Arg+bbM3Y:kApeUm0KlFcDgTHu9UZTHM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186317, "uuid": "fb009fd9-bfaa-4bea-bce6-bcad3ffd452f", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186317, "uuid": "53549970-53c6-4748-b838-f235cba2ed74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186317, "uuid": "d33253b7-f904-4e98-b6bd-a1c66e1d38cb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.59695316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb1a231-6576-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781169310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169310, "uuid": "a5b4b867-b18b-42ad-8f72-cea657dc0fb9", "comment": "Malware payload", "value": "a261c0fbef5b8ada793513a663080496", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169310, "uuid": "989a9db7-7d41-4176-aa45-bb7e65593f15", "comment": "Malware payload", "value": "e56688b7b9b2d78ea962b1366be7ef10992807c562b6e25edbf546337c699ae1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169310, "uuid": "dab5baa4-4055-4b58-b08e-150ec2c4b7f1", "comment": "Malware payload", "value": "3fb0df51a4468cba061790ec5da6bfb69e8075b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169310, "uuid": "fdfdfdff-6d83-4216-9a0b-733745c3387f", "comment": "Malware payload", "value": "dfdc48168c4b9e16e216081c968fd6d23cc1adcdaeca9b7542c5145eb6c95f346a594b9aeaa4abeeccb6bc393326f3f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169310, "uuid": "74423ec9-0d63-4ef3-beb9-29fa2ab60783", "value": "T1D7137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169310, "uuid": "29d3a21d-e63f-4749-ad50-c7d1b53f8c39", "value": "768:j+h9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:j+Kco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169310, "uuid": "a8df4768-a985-4ab6-bed9-39b8c3969619", "value": 45497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169310, "uuid": "cd6c9750-bc48-4c45-9419-5ac71b9a41ec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169310, "uuid": "24a0ab28-35b4-4f2d-bf9d-7931ec9ea586", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd88358-658f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781180403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180403, "uuid": "d36da444-40c8-4e38-9590-e0422c89c406", "comment": "Malware payload", "value": "d9434f967365a0825ac48ebb1fdd15ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180403, "uuid": "d961d8b2-ab8a-4af8-93de-b706e3d33303", "comment": "Malware payload", "value": "e79f02e9176a3cdd4696bb88040549bfb16471ee486f717a7f8291cf21c0d59d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180403, "uuid": "0d3b8253-7583-459b-823f-07c4020f2a07", "comment": "Malware payload", "value": "5c53a5bd75bfd2c84837c6d82282739f4016c9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180403, "uuid": "5abddf81-129d-4442-99ab-c10ba4e0e371", "comment": "Malware payload", "value": "c3b6aad7bda7f8b18c24063759cdab4668286ee28e4f882edeb015a21d5316840c8e62c8704bde6aedc0773a6c87a1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180403, "uuid": "c3431f4f-9901-458c-bb6c-260dd57f3913", "value": "T12BF733E07FBA249DCE50807EB5887A20F52DDCE00AF77198566E69E0E0B8CDDC16855F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180403, "uuid": "34310623-d3a4-42d7-bea5-e4e597dcc8b7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180403, "uuid": "d864ceb9-cda7-4f91-bb1f-1c680d2a5484", "value": "1572864:DejOYfFfX3oiCP4lWhCeuk/UyI5mef6CeXmr/D8cINAt:D4584Ze9/93ef3/DLINAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180403, "uuid": "b46b7b55-458d-4d04-b461-87a698b76113", "value": 72358576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180403, "uuid": "2312fbf5-415a-4788-95fe-9c03057d56d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180403, "uuid": "24ca7e40-7b0b-4525-a5cd-c0ea5f6f3d72", "value": "Webex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb691b78-659c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781185925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185925, "uuid": "e0ec3a75-ddba-46ad-9757-1667e779b292", "comment": "Malware payload (Mirai)", "value": "9423607b56f240ed492194a2cdbb7053", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185925, "uuid": "590f2b12-1de0-47fe-99e4-ea47c458ca6c", "comment": "Malware payload (Mirai)", "value": "e7e098dd0c3bde8e26be6356a66408ec4bc9bbe6b1318af109edd67b708a8a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185925, "uuid": "c706a501-8bef-4d06-817f-4286f41f167c", "comment": "Malware payload (Mirai)", "value": "847ab918100bae9f2b1d02fb04bbb09690e3aef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781185925, "uuid": "a796b92c-e95e-42d7-9050-823aaddb1e27", "comment": "Malware payload (Mirai)", "value": "d03e94eb70ccdfe35b702911039f05f8c3659939625a30dfa68914f8590ccd9b8008fccc1fb4eb882f798de32142f21f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185925, "uuid": "5b3e0be4-9f64-479a-b034-11c4f2050fde", "value": "T18DE3981E3E21DF7EF169877047B38E30D79476E625E18685E26CE6081E6038E245FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185925, "uuid": "9a923d1a-4793-4cb5-ade2-eafb74383cc2", "value": "3072:bKH9humIfPfTNBazGNn6q/aT3/uPmgPbEqHbCbyWRh5hjepK8:WH9hQfPfTNBazGNn6q/aQZ7gH5hjD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781185925, "uuid": "5346a072-79dc-4b26-9135-5baa0b833235", "value": 149672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781185925, "uuid": "227c8c98-75f5-4cd1-bdd8-63d87116fff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781185925, "uuid": "07bbf0bb-6fd8-401f-93e2-d1ad6a0ddcba", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd86488-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166901, "uuid": "989c69aa-b1c5-451a-a799-9e8ef7562a1d", "comment": "Malware payload (Mirai)", "value": "0d810688bb5074517ab25072a8109c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166901, "uuid": "e3209e91-bfb2-43bc-af9b-bf11ea872395", "comment": "Malware payload (Mirai)", "value": "e893578dab11a7eba0437a6c2aa6eb7d4e7dbd7c24c9fda328e70c8ce2ce9f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166901, "uuid": "f205fcfa-8bd5-4e94-bce6-ab999cb423dd", "comment": "Malware payload (Mirai)", "value": "4329cd9c24127ba0dc88864d90b9feff91df34c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166901, "uuid": "51adff6c-72fe-4086-bfa7-37655e125c39", "comment": "Malware payload (Mirai)", "value": "255f3d522c2e936966ed156149f6706b17ec55dc318f1f36760504b7f0b83b2c537ec0142274fc24031ba4c43d275776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166901, "uuid": "03bcec9e-4295-4ad4-92d3-48b1ba0d81d8", "value": "T1CBA34B11FC752D27C5C0B17A50E34631E5B253A925B8DA1E7EA31D9CEF14360323FAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166901, "uuid": "7aae3662-3fc2-454e-8a14-c9f7a298cf72", "value": "1536:wRwMAtOtBZdABW2L1sz28UsHSQESzMDp7BQNWUC81gsETPo:UwdaGW0HkNSCETg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166901, "uuid": "8ef8fb76-9757-47f9-8147-a639fc85df1e", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166901, "uuid": "2edc6733-f46d-4462-bcf1-c8610e55266f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166901, "uuid": "6827fb03-dcfe-4a12-9ed3-f5e3441705e8", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ec6d7c-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166913, "uuid": "ba2560c8-b29f-4892-8601-38b5beea8bb6", "comment": "Malware payload (Mirai)", "value": "7a572175836969f45e269ad5e0415c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166913, "uuid": "e17ec106-66f6-4b7c-bcea-7f6442fbf82f", "comment": "Malware payload (Mirai)", "value": "e89db7d3447601ab2530b7eb147d95a50057205b2de739ce28101fcae8b951f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166913, "uuid": "7abb7aa2-eaf7-4084-a85b-08c3ad8bb6bb", "comment": "Malware payload (Mirai)", "value": "2ec6283dd2733b42e84fc0d642962657045ffb42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166913, "uuid": "458a7900-0b54-4d4f-a6bc-3ff5b7fd4588", "comment": "Malware payload (Mirai)", "value": "d76c84ea0ff8443ab0c09eb33ae3025769f5d3396eab4395283f4da41763de918dfd9d930ebe7191f278eb4ec7e8b58b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166913, "uuid": "3e347495-b7dd-4c77-9519-51e15d2bba6a", "value": "T18F934B4273694407F2A70EB11C3F6BF593EFD5A122B0A185694EAB0F8175E322586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166913, "uuid": "e3752800-dfc1-43f8-84d7-adff78d33622", "value": "1536:h9+n5AFk14aCdkrLYIHiv2LwmZwdVn0O2KlUeiRhqO19HHrRyNzBOvffa:T+ukOywWov2fR9nMOvfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166913, "uuid": "a4ce4ce1-61d2-47ca-928f-d3a9d1f6c263", "value": 95968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166913, "uuid": "1fa893a7-e91d-41c7-a789-b60dfb8662fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166913, "uuid": "56c6e820-6830-4896-b4bc-9976cb0ddaf5", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f35708-6583-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781175175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175175, "uuid": "deb27ac5-ae7b-4eb4-84f5-c6a801f3a6e6", "comment": "Malware payload (Mirai)", "value": "2751b76e2567162e525464514ca01a2f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175175, "uuid": "c7a65fc3-890b-44a0-9966-313bd53643ff", "comment": "Malware payload (Mirai)", "value": "e93e68c0d00eff562d9912569f043885e4d9e8a6bd90235a5970b0e253472afa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175175, "uuid": "7ecc2a60-6264-4b19-b09e-fe3dba6c5c87", "comment": "Malware payload (Mirai)", "value": "9a4158877b27a7317e1551446b16c2cae402cd78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781175175, "uuid": "fcc41d41-a89f-40b9-9dc3-2219039bfbf7", "comment": "Malware payload (Mirai)", "value": "ae84ef62265c04a74a0625ae164109c30724ce9c66461e71674b5742da6ef389f5b23da1cdf42a6d5611bd4c048c8886", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175175, "uuid": "7739b879-1185-42c5-a842-2efe1628503b", "value": "T1A201B5C1633550B034E69CEB6A320C9C70A5D1553D8A3CFCBDAEB0DE4A95D04B0930A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175175, "uuid": "3a7d1b36-d3e6-4e05-8c9b-9d76ba00c44d", "value": "12:YkF1kcClZF70S3HF1HFCHFWOFSsFM5gFcOFSCFMDgFkA1LRPb:ZDkH/Fb3HF1HFCHFWOFVFM5gFcOFDFMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781175175, "uuid": "26fc1f75-f30c-4361-baa9-80b648034d46", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781175175, "uuid": "9f44559f-6a61-4fca-aa18-1100ab9f5d16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781175175, "uuid": "9f3ed1f6-eb52-4d13-81d7-82cc9f5bb356", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb05b7ee-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781211695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211695, "uuid": "62f535d1-896d-4d45-96be-bbb32efc57db", "comment": "Malware payload (Mirai)", "value": "1aaa6a27c1080ab6d6319cf8e0c0bfd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211695, "uuid": "ce3e4fc0-9dc2-42b5-8698-a02de6a4401a", "comment": "Malware payload (Mirai)", "value": "e940150b2d2e9744f9053c7db8050a074f431923259a852562d2eb3cf470d549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211695, "uuid": "dba0fd30-d855-4479-adcf-eff3a3663563", "comment": "Malware payload (Mirai)", "value": "6047c3fa12705d68b6d993de0dd1c851e86ced46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211695, "uuid": "f98c7166-1df6-4703-93ec-d0ec3f951603", "comment": "Malware payload (Mirai)", "value": "63f9d3ef590a46f752e42ae8fe162d29e9f83cf0cbd2114ff174aba9a78ad205dd803f8a52be203306b3d411e456b416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211695, "uuid": "66af1ed5-761a-4c95-bbc3-212c7a8d29ff", "value": "T1E6241946EB408B17C4C61779BB9F934233339B68D7DB33069928ABB43F8775A4E66101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211695, "uuid": "67ea3029-f03e-4047-80f5-772be17927f5", "value": "6144:0JoGUNjEnOpNee7uKzLAClDnJarrfBfXPK3L/KDMHmdwGkNmI:CoBNjEnOpNeeLzLAClda/fBP+/1Hmdwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211695, "uuid": "0a56a913-fc3c-4a86-8d7c-5083af1680bb", "value": 213692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211695, "uuid": "70bc0f2d-7c8d-40fc-9afd-9deb253c77dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211695, "uuid": "12eec6af-6b8e-490e-848c-6985e043fd9e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc324001-6538-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781142977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142977, "uuid": "c7c6dffb-5979-43d1-9094-df94497cdebd", "comment": "Malware payload (Mirai)", "value": "65e3c539592f26a7f1aec8f7255387f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142977, "uuid": "649ab681-80cf-40e4-af8a-a03a8bc87dff", "comment": "Malware payload (Mirai)", "value": "e9bb6a99a8ca1403bbb2a067e71c78aaf4467832ef03d48b19d8cd0be4bc5e95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142977, "uuid": "60da337f-025e-4caa-8885-b260cd29d1de", "comment": "Malware payload (Mirai)", "value": "92a8142a80efa831aaff8853471dd48606014e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781142977, "uuid": "502824d7-b771-4c2b-b27a-8ce12461681b", "comment": "Malware payload (Mirai)", "value": "d26cb839f4c25da5fc957dbc71756d11d55c9960c47bc55f25cbdd15dc9e97c0450a8bc8926bf4f1e342e987ac14aa89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142977, "uuid": "8ee1456c-b2ab-4f0e-9b08-56dfb2e707e0", "value": "T147B36B85E953E4B5F16200B2296BA7738632D436643BD987E3692F35CDB1640CB2E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142977, "uuid": "a1f7fa54-d57d-4938-b33f-8e2209c76d87", "value": "1536:2s+iZ95nnC+A7w+It32t26KYnhKhCZlrjUQB8NzSB8j67nmVGugta:25u7C+A0+ItGdZlXUQBYeBE6N1ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781142977, "uuid": "f234193e-afd9-46ff-b747-e6650372cc43", "value": 114016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781142977, "uuid": "07621d09-ad44-4f2e-bf67-20488b9c64d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781142977, "uuid": "3445ebd7-17c9-4366-94c9-be417635cea0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae73160-659f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187025, "uuid": "007fc79a-3698-445a-85c9-c9992f58b5e5", "comment": "Malware payload (Mirai)", "value": "b1f940957417fd4b0242ee79439aa9c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187025, "uuid": "a47d982f-6c5a-4a64-86b9-f59c36b92671", "comment": "Malware payload (Mirai)", "value": "ea4d1306fc9b763a84dd4b1f696ff95bb182d6724dda35cb48f96b0fcd499a42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187025, "uuid": "2e1107e1-5551-483c-8509-d1179e6a423a", "comment": "Malware payload (Mirai)", "value": "e321f134a701ff5e9f3b4b252ea75566ff5e3615", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187025, "uuid": "7c8d62a4-2347-451a-b72a-45d34609d1c2", "comment": "Malware payload (Mirai)", "value": "dfaf482d2a59d99362bec5f572279a83feba8b64b6a59a89ccfeb20708bc7e5fa1817dc80c4482e5465c02646e2eac45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187025, "uuid": "256f5a5f-185f-4371-a436-d9c85b0b04cc", "value": "T1DA21A6C4129354707CF54C2BA26AC918F6C97A89EEC14E40A0DDF5F5A4CCF45F905A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187025, "uuid": "034a3993-2de9-4b34-9979-ffda472ee97d", "value": "24:xjrmKhEH8fEHHsTE1QXcU2VWZaXcU2wWUaXcU2AWkaXcU2FWJM:IKhEcfEnsTE1WcflS3kkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187025, "uuid": "587ce301-7153-4e11-a806-76dbd67d2f92", "value": 1389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187025, "uuid": "e9b4c195-d626-4f2d-82a0-43780ab7f890", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187025, "uuid": "f3f54530-15d0-4bc9-9508-8920f0f80410", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f233e298-65ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1781207492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207492, "uuid": "bf421ad8-1ae8-4a21-9ded-665bd043fbce", "comment": "Malware payload (Cobalt Strike)", "value": "32c2d9b22e98a7c99a107bffcacb0ae1", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207492, "uuid": "932478ed-510e-4211-9e16-1195a4f27aef", "comment": "Malware payload (Cobalt Strike)", "value": "ea88a7490fd412381bcc050c6aaadb4402ba15f6a7af604d9b585af0e52f8cf8", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207492, "uuid": "8b01ba4f-06c9-4774-b511-5ef2e0de5a2c", "comment": "Malware payload (Cobalt Strike)", "value": "6ac94a60adbee2681074f0fd3c0e9f1da8107b86", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207492, "uuid": "4de7875f-519d-42e2-94ff-0a6889b2a262", "comment": "Malware payload (Cobalt Strike)", "value": "a38d74c48e46c67c480a72a30597c95f0977d08d4eb97c0bbf0b3a14137bc2a468b4c1cda7982d13629cfa36370da5f3", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207492, "uuid": "7570f475-4c63-40c6-b916-d61b420087db", "value": "T1897186342AEB6A6909C61067FD73D8CAAE111F7744E97C00F5ED9591BF9B620C273344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207492, "uuid": "7d5060fe-2bfe-4858-812c-6ad524d31752", "value": "96:hgCYvvOmlYMcIX7DEliPPG0lc30lcjA0lo0l7:yvOZMc0dbVgnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207492, "uuid": "fb80e04c-6e28-4e13-bd26-0346b32f2839", "value": 3487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207492, "uuid": "a9a0a9f4-9fdd-4f2b-9972-f83fc399759e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207492, "uuid": "4f75784a-8059-44c8-a674-1ec13b5f0b62", "value": "rev.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd87531-658e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179834, "uuid": "f0ef592a-e7f3-41d3-bb77-20b943f591ba", "comment": "Malware payload", "value": "765e1ea163831fc4ddf9323714d02b1e", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179834, "uuid": "1bc5eee0-add4-4882-b07c-a980ef6acfbf", "comment": "Malware payload", "value": "eb3f8dd0bb2071ae5d99c087dc7766230398558b91e4d160956b701bf8ac5729", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179834, "uuid": "082c7cc4-11c4-4256-8ae3-a489240d52d7", "comment": "Malware payload", "value": "d8c07fc88017dcbd7ec1458e5ebc9db3ec228125", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179834, "uuid": "98a391e0-0092-402a-86a8-46c477584564", "comment": "Malware payload", "value": "15cb66e06b1c8ac2f8de150735131836728d6b343844fcd6cd03b862f7405042b757f31489e4e0889bad6bfe605d43c9", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179834, "uuid": "365257ed-1ef0-4850-8e39-f3fc35cd22f7", "value": "T17C5585202BEE1019F573AE71CBD8B696BB6FF7E33206E9DD1400434E5222946DED4939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179834, "uuid": "9418d4c0-93ca-4e55-be61-742672e03a2d", "value": "24576:wPIuuOU77cCv3/AXuBinkaChEKiIIex8Pv2Y:AIjPAe0JChxio8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179834, "uuid": "245f9173-867f-4cea-a313-e68b6b18ca75", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179834, "uuid": "708deb9a-2813-4709-8fdc-03082156b1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179834, "uuid": "8d7db818-40de-443b-8c99-1d89f9a126a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b6646b-65e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781216544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216544, "uuid": "bb8f6da8-ca80-43fc-8282-57a88f7df6e9", "comment": "Malware payload", "value": "6b73f9e50317251b8e07b3fd882cc5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216544, "uuid": "dad513ac-4393-45d2-9f39-8e1c8ee1554a", "comment": "Malware payload", "value": "eb426166dc76814916571a326cfd68396d113974e6d964a220914fa36aea0b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216544, "uuid": "bb0e8d41-ee02-4ad3-b137-715bd771237e", "comment": "Malware payload", "value": "1e8cbe46a795456674c9f46cd58e3be86481e95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781216544, "uuid": "a8cf1707-56c5-42b2-b80b-7c51b696d2f5", "comment": "Malware payload", "value": "529d2ad6c1b75e2d9545b1dad7e0920ad168298889e889f0d995ec763648b232453ad2616e87fea743ec0969e2a2ae89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216544, "uuid": "23b66075-5175-4651-9cb0-0a28ee64c457", "value": "T17AF71B4AB702CDD2F556923498C7CBA43B72FC71C666830332957B197FBF2884EA2594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216544, "uuid": "457a5903-559c-4db1-9841-a07d59731a80", "value": "a5396d0e3a0b90f35cda230c0314ce27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216544, "uuid": "c94e22ed-c1c5-46d2-ab17-ebc2328864e2", "value": "196608:DFdcQwkJ1elHbEfM3rbjS1eHItEfM3r/Tun0R6qGrqNDl8fyYGPh:/cQwfHWt1uL8tRMrqND3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781216544, "uuid": "9dce99c7-aaf2-4d3d-a8c5-395ab6a5d8a9", "value": 74207232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781216544, "uuid": "253c8b9e-e08f-412b-8cf7-74ace8ef4c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781216544, "uuid": "c41c6ca8-7b91-453c-8ae6-b408861dbdf2", "value": "app_softwae8635208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5badc79d-65cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781207669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207669, "uuid": "d4ec103e-aef6-42a5-af0c-9bb0f2666722", "comment": "Malware payload (Gafgyt)", "value": "2cc4346c1c5ddeacc23835fb51b92d0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207669, "uuid": "5816230f-c67c-48ac-a382-8989ebb0e866", "comment": "Malware payload (Gafgyt)", "value": "ebc40eaa63531302bc2e06d3031495898deb2ebfc6f45c0acf19bcf417b580c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207669, "uuid": "d434d764-f103-4732-b267-f85e5bfd35ac", "comment": "Malware payload (Gafgyt)", "value": "9f080c5bddfbe2373efb24d502044862d90027d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207669, "uuid": "2832d95d-f36b-4efc-a5ae-bb143cf5f935", "comment": "Malware payload (Gafgyt)", "value": "a5b18324c1e35afbd1ee42c0004e5df84b7fa0c420047cf17af5b424e09dacdf2c4d13638777ffd51c6bee51a94a1eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207669, "uuid": "ac7b8f47-6c5d-4900-b0a3-971f33cc912e", "value": "T129B32A17B9528B02C1C215B5FB4E964976136BF8E3EF7212CD249FA03B874DB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207669, "uuid": "f15ff405-c903-442d-b40d-327aa90bcfac", "value": "1536:aLny+q8IYUccYn+S/kjOiOabDTLVO9xgMOwiQtYj+RnxGGpVU5/Y45hHpQBEr:jTccsZHaPH+tYKRnxGGpS5N5hHpQur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207669, "uuid": "e7a4239f-b371-43e5-bc35-5592dad42acd", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207669, "uuid": "b8798f1c-bd31-4a71-be03-e1561a92f7a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207669, "uuid": "625ac56b-712a-4495-b1e5-873ee2cd8fde", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8644fef3-65cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781206882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206882, "uuid": "76c97f47-6d8d-4fda-aa14-2bad51c06024", "comment": "Malware payload", "value": "35d50230ab5e627c2962f38afb5f5189", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206882, "uuid": "2353c826-f262-452f-b43c-180de27a9c72", "comment": "Malware payload", "value": "ec07e202c24fd1e6ea92ddc95f14a117c5e2f8afb2c8ed6a00dafdddad599bd6", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206882, "uuid": "f2078a47-ebf9-4e4b-9340-b00c555a23e2", "comment": "Malware payload", "value": "90b8a694b2e26b6e58d7bf31c1a2fa65de662528", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781206882, "uuid": "0340467b-e192-4edf-ae68-531723a20fc7", "comment": "Malware payload", "value": "244e357af5bf7ec7df5ceddf5186a03139fc5e80f989d31a86bf99d72fc3d0dabd2556cfbc22c6c60bbb7a7e03ae8460", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206882, "uuid": "9b1f83d6-f9fd-4211-bd16-0b0b24b3367f", "value": "T135F142CAB23A1CE7F2760FBF838BE66611FE66116AA5171E0150110C2456A8E35A5F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206882, "uuid": "6aee8298-35f2-4ac7-a5f8-ea2f28c281c1", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206882, "uuid": "f082beeb-b5d0-4653-8c37-2921757894a1", "value": "48:qkfjD4iEpnehthEdAzzddqRBBx0z4ODalfB:/bU4zdgB30bDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781206882, "uuid": "d6114d01-5a8f-4e13-a849-215fc13b7833", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781206882, "uuid": "f1b4cfaf-8270-409d-87d4-e24514fa61d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781206882, "uuid": "f773a399-38c7-4515-b0aa-545e2d205c66", "value": "bp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d818b38-658d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781179245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179245, "uuid": "f4f00a8e-10fc-4e27-97ab-60bd5f3fc5b2", "comment": "Malware payload", "value": "ff8b9e28bb46762c49da62f66e08272b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179245, "uuid": "19dc775d-d420-49c9-98fd-e6e3ba3e6be6", "comment": "Malware payload", "value": "ec19ad9a4a6aa0503a3d230f67f9399fdfbdc57e644937d30648d8fd67cf9be4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179245, "uuid": "357ce8a1-68d7-4ab0-b6aa-3e66ae5b45c5", "comment": "Malware payload", "value": "080302f86d05d1732edf59b525c4800305c32329", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781179245, "uuid": "2e9d2801-9b8c-4ed2-a512-3ae369e8e41b", "comment": "Malware payload", "value": "57c5b857a4cd3a4bf2cdcbf47a20b8a228332d88456356f97294b53cdee1872dd555b23d6327275f0a9e0bbdc2f705ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179245, "uuid": "aa8f7fe2-99fd-4c97-a9b3-3607619aeea5", "value": "T150B38D1030C1C432E567217588BAC7B58A6DFC710F756ADBBFC406AE4F266D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179245, "uuid": "91761567-ef1a-46c0-bb61-a98f055de26f", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179245, "uuid": "03ed3ebe-0581-4fea-82ca-bf5f12c95608", "value": "1536:kvQFS6jum8d78qt2xjmEGur+GLpmc8K/THUBZT/3d5Fb26E8Jr:IQFSAumAg3GuqGLQc0XT/3d5Fbuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781179245, "uuid": "51571f2a-c724-4be2-b0a5-6f6091f131dd", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781179245, "uuid": "993109d0-49e1-4460-a614-e47c00eb6a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781179245, "uuid": "e8c35112-23ab-41d6-b2d9-38e7c6ace8ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482f2d5a-65a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781189598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189598, "uuid": "d2a05c9c-a864-4aaa-a25c-9983daf993f3", "comment": "Malware payload (Mirai)", "value": "bd0612bda0e994f1b78e4ba9633c5b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189598, "uuid": "b9849627-0202-4e23-8b1f-b1461f8160db", "comment": "Malware payload (Mirai)", "value": "ecf2e168a9d78097050a3ed8b93ef7077a9baa3a8d0b796bcc521472901338b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189598, "uuid": "6eda2e2a-66c4-4808-b93f-6540b0a0941a", "comment": "Malware payload (Mirai)", "value": "e97d1e986b2e987d55c71d8078541c64b797418d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189598, "uuid": "af0f68cc-658b-4a12-bb67-cb2efdab599a", "comment": "Malware payload (Mirai)", "value": "9e84d3d04a6eba1df60f811ecb65d8d6b7160fc27a6695a5fb4a1a0ccc0bb008bf11228e9c718454ee0480fb5e83ca46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189598, "uuid": "b9ffd292-3be4-4084-b86d-e0b82db28ebc", "value": "T16DE3D606AF109EF7C81FDD3301F98B0224CCB46725A5376B7670DA5DBA5A58B09E3DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189598, "uuid": "73e6f613-9770-4cb4-af8e-bc3e5c5f7c5e", "value": "1536:Vc15hFmME/fPJIr0g1UZbzyNeoH/CUrZ9ctSbuDVwuxwkqWvMr5hjApomvb:iYpznoqUr8KuqWC5hjApom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189598, "uuid": "bfb0f205-e20d-4d40-8a11-cbf587bdc908", "value": 149356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189598, "uuid": "6bf887f5-121f-42df-a693-24062dcbc4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189598, "uuid": "0b3f0c5a-8fc9-4aee-b9df-7c5385368759", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c45d3a-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781189130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189130, "uuid": "feb5712e-1bc8-4778-9fe2-2b1a3083d6e9", "comment": "Malware payload", "value": "5fd87aa3ef451f3f1af08fb7de7e02d8", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189130, "uuid": "d1b4b3bc-48a3-4eec-aaca-e31c0ec3e8d3", "comment": "Malware payload", "value": "edf97760bc43d62e562e178487c5b53d211bc94181b83d2399f43dd3082ba22d", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189130, "uuid": "84de51a9-7c94-4987-8150-368c1a9517a0", "comment": "Malware payload", "value": "6a0cde694e7413a1729808edc2428009a10fd198", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189130, "uuid": "3201fb16-f518-4e86-9b88-baa00ae42e62", "comment": "Malware payload", "value": "294715806dc37e5c9c63ded5f26acf12ed5977fcc54720b0a02f85e181594ea7da8aab66f214255b7db126540b24b9e0", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189130, "uuid": "dc914e51-95c2-4f99-85b2-35b5f3a70f9d", "value": "T178F6335497804967F8CA693D9E73C665E2F4B92017A3CDEF079113653FBBA40083DBA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189130, "uuid": "1379ed62-eff8-4571-a6c6-766db04806fc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189130, "uuid": "c5238d6e-be92-47c5-893d-df37ca39eb4d", "value": "393216:xRLKlPmwrYtZq5X/4yUJZiFHsxtEDweFJGdalMkcL0ZEN/:3cbrYtZq5v4yUQwt7evqXkpZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189130, "uuid": "727267ef-08d7-42cd-8d53-e27a3ee4a025", "value": 16517214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189130, "uuid": "01360db5-2c78-4202-ae98-6bb6e8505cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189130, "uuid": "b2618aea-6874-4440-8816-e44f10e4b53b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5b6c09-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180961, "uuid": "0fc6eb4f-2523-4c94-8dee-09107fb4cfc6", "comment": "Malware payload (Mirai)", "value": "0e96e4685e04897c661a9df424887bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180961, "uuid": "cf9bd242-e9b3-4e69-b4ec-062251e5e15e", "comment": "Malware payload (Mirai)", "value": "ef0ebfef48902f00e7138b0fe78816208a8da50bc27fd6b5189279d19fbb270c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180961, "uuid": "0f19ac0f-3846-43a4-af03-7b3422b160c1", "comment": "Malware payload (Mirai)", "value": "88081f6a6a5024132b5ad322bdc9c5a95670717d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180961, "uuid": "f046369d-0f61-4039-9fbc-2926307268ca", "comment": "Malware payload (Mirai)", "value": "58e9f0db1ac8e9ca86d16e17584ff20e3eeaca1f73cf44d9ac69881437052264ac742329e9e1687b9c08dcfb0d90be89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180961, "uuid": "a8330e49-f7cc-404a-9c14-5edba08681de", "value": "T130C3F706EF614EF7ECAFCD374AED0B0528CC651A21A97B357974D928F14A24B0AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180961, "uuid": "840b9e50-1378-4cb1-8782-f064607b0b9b", "value": "1536:kAAc7pFW0I/n11dLGbLXYJn5TIanz1AsPjdCAiGG/iHDSoU+bRyZc4GaqnUTyntm:tAc7pFWPKLXYJnZQ0DSofyPT8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180961, "uuid": "a920f09e-a3b9-4fb9-a9ce-d8eccafdf268", "value": 126764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180961, "uuid": "b1e8b906-0243-4f82-83a2-6f30675c41e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180961, "uuid": "ac305fa6-d1f2-46c5-8ac4-bd0b37027375", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e7b708-657d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172676, "uuid": "97563e76-07ad-409a-ba59-bf30ae7c8a82", "comment": "Malware payload", "value": "8645f9b8f561f77c99c30d6115aedbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172676, "uuid": "822f4e51-eb64-41b3-874b-b84dbd6bb35a", "comment": "Malware payload", "value": "ef5c543584d54f71d0caee63b03a7b0fa9a0343bc2d51fa991c4a7bec13ef965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172676, "uuid": "f3b48dc5-bdc5-4412-904d-651b1fa95a02", "comment": "Malware payload", "value": "aa0d61443d344ae376460dd4ef75f2754e6a255c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172676, "uuid": "dfdb8f2e-14b8-4626-9223-235758e75548", "comment": "Malware payload", "value": "fec69d4e1928c928c7dc263021baa16ed3058bb05dc8059337487c25165b2b51d936893382c5b878d86d8802c75110d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172676, "uuid": "a08ae46b-10ba-4995-b6ab-35b93ae0a503", "value": "T1FC12D704ABE98229D4BF8B384C7383152233FA019A33DB9DAD9811DE5D72345CD92BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172676, "uuid": "2f337681-4a1a-4238-ad78-3d58a0aeb659", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172676, "uuid": "396d63c4-0a08-4e1f-8607-5046c2f4a392", "value": "192:anHjW4QSz57szTIJlhOtLYZw66aOaC9UJKhEAgy2c:EXza0KsZwTaOaC9UQhXgyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172676, "uuid": "2aa03d9b-b65e-4ca4-83d4-dd09747c11c1", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172676, "uuid": "87b4c06b-976c-45ce-9480-f9ad36cfdfa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172676, "uuid": "6c84a604-df38-4cac-92a8-9cb0e90c2774", "value": "rCarolinaEmillyStefanySilveira.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d8731c-6597-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781183559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183559, "uuid": "c9d4d66f-60e2-49ba-a566-7bf5c057bc56", "comment": "Malware payload (Formbook)", "value": "ed95203a39817a9499d506c0c867257e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183559, "uuid": "70da89e9-494e-4183-97c5-c944e69cd5a2", "comment": "Malware payload (Formbook)", "value": "ef6e6eeefd2da3e97e1c302f04eb3fbc38eb140c6bd1c3bd95b4f922b2012a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183559, "uuid": "69fea810-3151-4fa5-8ffa-3008af2eadcc", "comment": "Malware payload (Formbook)", "value": "b40c617f93bf3a2b2db7016ba583fc61d573c134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781183559, "uuid": "c67b6103-b5ed-40ec-bd5a-5255df07335a", "comment": "Malware payload (Formbook)", "value": "bf0485132fabcb8f2dd2f4118e25f747f51040b749cbfdd52c3f0e6e7e8a21f846fb5e4e3a9679d0f92148fc198316be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183559, "uuid": "1e0993a5-58c5-4574-9b09-ff9afea11389", "value": "T1F945E0011E4366C4CDB66774CA632ED81BF0E413C397E74BAAFC10B95A22BDAD54F612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183559, "uuid": "60f6fd6c-e2e6-4ad5-b335-9fef7069d1b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183559, "uuid": "962b3582-883a-4b97-b0ba-a1d2f6558ebe", "value": "24576:50t0UkVOWnlRLsebAI57hBE4uROmOYWH+rpE:xVVOOlpdkI5LGWH+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781183559, "uuid": "76772835-46f0-46be-86fa-b43e2308ac2d", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781183559, "uuid": "896f6c93-e3a0-4282-bd1e-693e0b2e7d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781183559, "uuid": "e42e4cb2-5b3e-4b1c-bf08-aac08bc5d96c", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75474b77-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166910, "uuid": "1f1186f4-17a1-4634-90e9-89e35601b118", "comment": "Malware payload (Mirai)", "value": "4f54912e452e32b76b491c25c7d4275e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166910, "uuid": "61d31229-0985-40c8-b766-59d95afdaa30", "comment": "Malware payload (Mirai)", "value": "f01a9008afb2fba0d41ba90f72cd220e43b04b2763b3a42c95d99b6937449b8d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166910, "uuid": "ead3d15a-7a79-4a91-b3f3-c7988bc7b307", "comment": "Malware payload (Mirai)", "value": "c353abdabf34c231183906a8a9ae21e21d19a1a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166910, "uuid": "d760da7b-0b71-4ec3-9087-5df98ec09b2e", "comment": "Malware payload (Mirai)", "value": "86db9a15faa4bd55d413ce92b63df5f916d71a21061ad20d29441ba75ddca9fa42cd70e2a350444053ceac3bcb618e77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166910, "uuid": "be7bc638-76d7-41ea-9dbe-bbcebdac6221", "value": "T1D03182C114C16F7ECC9899653762A03E50296CCA2FAA5FD8D9DE1CE8BB44B92B510F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166910, "uuid": "8057a56f-1e66-4e96-bb28-4ee6dd0f426d", "value": "24:SEBvi1yeBFBvK9hS4TtqBvTm7TV1BvWPOBt7EByTvDp8NrQtqBVSjRnBjtpBBVBC:Sovi7B7v8h1cvIxLvAuO07p446Inj7rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166910, "uuid": "b7c02b08-f0f1-4bc2-b779-db1a6f2bf67f", "value": 1498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166910, "uuid": "85756d47-6984-4f31-a512-7816b582bfcd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166910, "uuid": "e1b5b58d-a4e1-42f0-be20-beb4a0cdf2a3", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6eaf9b-65e5-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781217089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781217089, "uuid": "cf6aea60-2087-40b2-8ed2-3f1d80387656", "comment": "Malware payload (CoinMiner)", "value": "1f8b721815bfd4f57aa377369fa5f2ed", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781217089, "uuid": "a36a799d-487a-43e7-afa1-8413820cd59b", "comment": "Malware payload (CoinMiner)", "value": "f0ff7f1e0e1544828984d40247d38e38cb4b5d528665098c058e41b24db1d56f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781217089, "uuid": "015abaf7-26c1-4953-ac6c-dcbd0fe7365c", "comment": "Malware payload (CoinMiner)", "value": "059182cc6f9d9a6ae2aced1075e5ab3f4e081d55", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781217089, "uuid": "5a999e56-edab-417c-8910-812343ed01c3", "comment": "Malware payload (CoinMiner)", "value": "730deaebea4cf33ba4790415f176b1a4e02fd4f6c95915e6e34962ffa16c6d0a34a424391aab6430821e35af88e1ba79", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781217089, "uuid": "044c0b19-cbdd-42d4-9961-9a4bc236d8e9", "value": "T1C9322B2A7E550232E3A049B45175874F553C1533A3D7B3EBF373965A4B962848440EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781217089, "uuid": "3efdfbf0-4437-464e-8f54-a3fc9322dfb0", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781217089, "uuid": "36d64650-17a4-464c-98e1-fcddf62edb81", "value": "192:3ZojW0EaBlx+eGlLUN9PFJxTEZmFhSuc:3ZoxEOwt6fPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781217089, "uuid": "92b0f220-6784-4e77-a046-ba8fa41c4361", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781217089, "uuid": "d0fde5b2-d6b6-41d4-b79f-e481a21c44b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781217089, "uuid": "c4374645-e2c4-4a68-9584-7f1c2d990f3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d340ec-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186319, "uuid": "70c9e9d0-dadf-487f-8136-ef5345011890", "comment": "Malware payload", "value": "c81a721ebfdac71ab510b0bd14f29e1c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186319, "uuid": "1654ca19-9ca2-4221-82fd-24356ac1082f", "comment": "Malware payload", "value": "f1238d3d93e1e8be799b16049e8e8bbd3fcb9b46a94aa42524c9e0604232b750", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186319, "uuid": "f8e15a23-ae8e-418c-9fee-0a6e94bb3bd3", "comment": "Malware payload", "value": "dd347dbb0b958b5c9d409adf9d52d214aad6b441", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186319, "uuid": "2585ae4a-4d75-4115-a2e6-7cb3490fc150", "comment": "Malware payload", "value": "f2726780da4426fcf0cbe50be48e1158bd09f7f0a4d0831c80f693ca90cdb2d2c078ebae9becd26c51ae5cd185c85990", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186319, "uuid": "814dbdf0-0eed-45b5-8d42-5c2e2c9da958", "value": "T1AEB33906B551D62BCF546A314CC7DBFAB6B07C08DD46822B3149B72E3E3BA50CB62791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186319, "uuid": "0405b946-ec60-46f9-bbe2-f12e433458cc", "value": "3072:YYOouWFT3GeLlWVbrzoO7ITkDFKE2JtXwx5kqWp:V9N3uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186319, "uuid": "5fa77139-a8b8-40e1-8576-38d228b33e28", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186319, "uuid": "8c708e38-f511-4c60-9034-258df3799da4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186319, "uuid": "f00e9759-0cbc-4915-9827-c78ce2c5b3aa", "value": "SecuriteInfo.com.W97M.Keylog.1.16354.11350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e9aea9-6549-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781150238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150238, "uuid": "b2c6c4bf-1517-4c97-896b-956d8361e5e1", "comment": "Malware payload", "value": "715464f846af2b1f5921e7c911395235", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150238, "uuid": "e1e8ea66-6eba-4485-aec2-f5ff361f23da", "comment": "Malware payload", "value": "f25603c901a57609859e2f2ac6bbe9c1ca0774cf3f9f5dd48ac6699f4239f6fd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150238, "uuid": "891a89d0-a83f-4750-a68a-84ddfcdbe4b4", "comment": "Malware payload", "value": "d9fb43a836a8704c33deb4e21623536efb1f8372", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150238, "uuid": "891e1ba8-8059-42e6-8a6f-326558b99132", "comment": "Malware payload", "value": "50d38ddc6945f237e57170c2785963df2eefcc32ef6c1ef929fa1ee4bf9ee58cf1100c9d9757f7c8696f0eeae252f1e9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150238, "uuid": "3e44dac6-4aac-42eb-a0c4-04f07053b070", "value": "T16596F65B93D403EE11B2B106E84D3969FA12C4BC6B3293652D58793D33B6638873E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150238, "uuid": "b9b24ef5-b0b9-4f1f-a6d5-635f8f8a5311", "value": "49152:S5Ae+fkoZ1XgZWfgGjGTOYpmy21yZmBCO3Wycxb/brALNIfeWcv+QB8B183v+puK:Gr7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781150238, "uuid": "3a020772-bb6c-4a4d-8877-a917c9be4846", "value": 8935748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781150238, "uuid": "a183ef12-01bf-4d40-b6c1-09b1520eba4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150238, "uuid": "1644ccfa-a975-4bc3-a1c0-6a15cbed3ed1", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e59bf4-659d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781186430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186430, "uuid": "3d5a0e49-a87e-483f-9b97-f08ae3244240", "comment": "Malware payload", "value": "c1cb9c27ff543f22bf1f17476eddc5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186430, "uuid": "6a681ede-7132-4f11-8260-1cae4f888f5e", "comment": "Malware payload", "value": "f2819c7d26c22df67bba07641ae018a852244c786e0530ef8651c4c9f012be40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186430, "uuid": "9c6b5504-b95d-4d16-9646-75cf191ceb3f", "comment": "Malware payload", "value": "f760f52f05c1b317ce1c565767200c5ebf13da99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781186430, "uuid": "6e58dbd9-7000-4774-adfc-815e12472804", "comment": "Malware payload", "value": "310c408b9f0bc8e0fc2d488a39bc7da0d0a5741222e03dfbd7728a20c5d7fb10ac5dc5c147dde8a9f01e4ae0281fdab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186430, "uuid": "2e3e3fcd-a6c0-4ac3-89cd-d7689e638168", "value": "T14922C505BBD88236D9BE8B7C0DB383111672FA029923CF9EACDC519E5C626548D91FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186430, "uuid": "07b89ed6-188c-41ea-bc24-a9ca1b0a0b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186430, "uuid": "5be8ae0e-2786-4676-9a92-296af2231eb3", "value": "192:Y+Qhjr4Udvs660QtZyyLYZw6LpDaOaC9OdE0y2A:4cWs6ZgyysZwYDaOaC9OS0yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781186430, "uuid": "f2aff5f1-c775-46a1-bd2c-cc381a9be351", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781186430, "uuid": "7cb7b291-2dd8-4126-88a9-fb8b75444835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781186430, "uuid": "dbbff037-d5b6-4b9e-966b-7d6ad85ac83a", "value": "rThiagoLucasBenjaminPinto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec0646a-6535-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781141451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141451, "uuid": "c319135f-bd14-471c-a030-ce5ff7088141", "comment": "Malware payload", "value": "84fc09447eafc26a07aa556bcf9c261a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141451, "uuid": "77beb440-15de-4c88-96cf-3c9250a4803c", "comment": "Malware payload", "value": "f2ca2b2051c2a98e23b80aab601369474006f6a6dd1dfb8f212f51a726b23dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141451, "uuid": "86d48be8-c9f6-428e-a3c4-78b44d381079", "comment": "Malware payload", "value": "bb153788e329d900d1ee5cd27844d0e8ee94480e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781141451, "uuid": "f0132c47-a890-4288-a540-ae727d72c1ca", "comment": "Malware payload", "value": "46e0b8126cb0092928ef39e48e946e51c6d18cfdcd1b000ef74527f6e385cbcb4793a6c65eb5c805c48c0c17f6e0dbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141451, "uuid": "bd5f659d-729f-4cf6-8b16-7b52e90863c9", "value": "T1AEC5338B11A61D62A97E343D3A2F6F4142CAB398D5910C7644B81318FBFBAD3D75248F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141451, "uuid": "fa8ed1b3-678a-43cf-9c7a-9390ef720ba6", "value": "49152:R/PNlh2OBDLCbuiZdu5qEffi6rnR/mM5bBO+/RAd2m43eKuTk:tPNlhXDLau+EfqGnR/mmbgd2PubTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781141451, "uuid": "dcd4abd9-1743-4c11-8f9a-6586b45c4ca2", "value": 2595448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781141451, "uuid": "0cb31bb1-81c9-4869-b000-bd5f37e992ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781141451, "uuid": "d02c4065-a4e8-401c-a3bf-6d9ee7b71c2a", "value": "f2ca2b2051c2a98e23b80aab601369474006f6a6dd1dfb8f212f51a726b23dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2564b5-65d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781210675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210675, "uuid": "a4541131-e293-4413-9644-071394e70953", "comment": "Malware payload (Mirai)", "value": "ed1cb683931ce3b2263c011f9d6d7075", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210675, "uuid": "13cda0ed-1eaf-455e-9c74-2ef3d25d6f12", "comment": "Malware payload (Mirai)", "value": "f348830b9b665a12a71acfad834e6fcffbea961764c92916b7b1e2ed8e74797a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210675, "uuid": "3d61c1af-6eab-4538-8cae-9ca981b31491", "comment": "Malware payload (Mirai)", "value": "af7dbd53d978840a49f98ddcf18c57e35b910486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781210675, "uuid": "5c01f5a4-e223-47df-b7da-cef0ed0e1229", "comment": "Malware payload (Mirai)", "value": "6116a7839dd89b424040e744f7fec9ec4a44b6cf842420480cfe3b0924627fa9f47873547ee9db749b5e94a83a18c7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210675, "uuid": "c05b0f30-04aa-4d5f-aa24-57553f12c150", "value": "T18B148E84F683E8F1E9930879202BDB321F33E97F5136DA46D3AC5932AC55601D91B6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210675, "uuid": "6dbc1b78-4a35-494e-a4cc-e4206d774dcb", "value": "6144:23XNnMi5y5c1uwQU3xo3ac3pH+Jm9GnS:2dnMi5ym1uU3pm+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781210675, "uuid": "a300c528-8f53-4b93-adf4-b24d10230162", "value": 205008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781210675, "uuid": "d693fc97-f059-4206-a0da-665fa24d4efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781210675, "uuid": "dddb5cb0-d47b-4dc6-9f97-6b92c89b5482", "value": "0331d7d75ddba0a3462a7274d95f574cf59abceb601192784cc1f2d454676bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f8f28b-6540-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781146153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146153, "uuid": "a6d94633-ad9f-4073-a5d0-053cccf24c39", "comment": "Malware payload (Gafgyt)", "value": "885e00c31af8eb531e0195685ccfe2f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146153, "uuid": "43f93ad8-71ed-42fa-a64b-981d80d013ab", "comment": "Malware payload (Gafgyt)", "value": "f398e8417f7f1d5fde48772b954abf2c13c186ebf315f44627b9a9f804613191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146153, "uuid": "49a49f2a-7d03-41e5-88d6-5ee764bc323a", "comment": "Malware payload (Gafgyt)", "value": "c2b5e0a07e846cef68931d668a439c036eba85d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781146153, "uuid": "650060c6-c579-4276-ae27-307b797877f5", "comment": "Malware payload (Gafgyt)", "value": "fda7f39e4521258e77f807d67567d2de4d14f873384ab4ed29e9a19261efba2ab737215cbcc23c164c08a27bd8cbb974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146153, "uuid": "ffddfdd0-e162-4afe-985a-5cae72d0167c", "value": "T15FB33A56BD018F53C2C315B3FB9F47887B1667F8D2EF3203D925AF61278A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146153, "uuid": "a7c50739-363a-4ae6-9c39-51ed7e0488ac", "value": "1536:tFLUYuqwW9MgwsG84b47XGF2rwGDcCa6rwO0923qVbvR0hrh9Fvo5hJppvq:tFYkT9qt+GQcGK6/U7qHro5hJppvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781146153, "uuid": "351e644e-1c0f-4122-b008-f48eb5dff297", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781146153, "uuid": "1aef0742-e166-449d-8998-d2e57de95cbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781146153, "uuid": "985510bb-e0bd-40e3-bb1e-722c5ad3bbb2", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95527edd-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781189297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189297, "uuid": "49591eca-43da-4418-b123-5c1d5cfb5d8d", "comment": "Malware payload (Mirai)", "value": "e8a5535891169cbcba78b62a4d071d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189297, "uuid": "5a1ec926-bdb6-4c56-abd0-1de1bc3c14fd", "comment": "Malware payload (Mirai)", "value": "f39f997e165331677a7138d0e83db7e48694918801e6c2c6cf8dcef742911cd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189297, "uuid": "3394a894-d6cd-43ea-9b3e-c5826e10c108", "comment": "Malware payload (Mirai)", "value": "bfeb3f4f7fad9d56f046bfb9ef44d2834d828783", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189297, "uuid": "5365f6c9-7ddf-4724-99bd-5e54eb8aaf89", "comment": "Malware payload (Mirai)", "value": "554d2aebd33f61973c6d388601a807355b1d412d281e973f244ee49b3c7e968010759acabf1bb912aada457f55e6e86e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189297, "uuid": "94d5afab-e7e8-4949-aaad-1b3eeba9114c", "value": "T11AA33A16BD418F03C2C625F7BB9E438837266779E6EF3202ED25AF6137864D70E2A550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189297, "uuid": "22606aad-9762-4898-a837-f845d3aa9dd5", "value": "1536:qPuk3gPhUbUl2PgSiFJcwPktjCTiOUOgoOjxHPUTXvHdDo2Rr5hj2ppJu:qxmjN39kiiRxHczv9kG5hj2ppJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189297, "uuid": "9d77f9d3-6c85-4b45-8f6a-d233fcbf86e7", "value": 103716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189297, "uuid": "550132db-bed8-417f-bf48-80fd091bcc4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189297, "uuid": "76f8e835-6c16-4e52-89bc-f3e52ee3acf1", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fa38b1-65a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781189599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189599, "uuid": "706ffea8-90bc-44ca-85dd-3e59c8f8d941", "comment": "Malware payload (Mirai)", "value": "e2f0c66121f9bcc6034e374eb54ba6ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189599, "uuid": "c49842fb-4cae-4600-b0bb-785c6a55649c", "comment": "Malware payload (Mirai)", "value": "f4209978cb066865c6350041f646a54771b2dc69c6969994c73149603719fd79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189599, "uuid": "25a7e750-d1b7-4d57-aa03-cdbfe4a86519", "comment": "Malware payload (Mirai)", "value": "19d445ab5c782bc1c83b71186b3ec1d591c419ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189599, "uuid": "5b121d5e-0949-47e9-a1b7-4e60371b5a6f", "comment": "Malware payload (Mirai)", "value": "50157642649be7c37f0ea65c6d98138c9ef361cf8d77b66c2dd31dc385a0cb0f39ec04f3e833edc02a129d95badbe372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189599, "uuid": "2c0da5eb-1805-4ca8-b50a-d37bd37ee6d2", "value": "T15FA36C0376D189FEC087E1F057EF9561DA23B87E153671AB6790BE802F4DDD02B19AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189599, "uuid": "3eb8f0a5-6c47-40b4-9d3c-81886ed7261f", "value": "1536:bn4zWwdEMJ57FRNSwT3AWPDQT5ZX+ENT12kpPFUpXJ0vpojzEp3oYJ3r7ZaUuKhL:bn4zW6FT3NPDQNZHT2kptUpWxojIZJJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189599, "uuid": "6a4d914b-a83d-435d-9ca0-0d9327f6a9de", "value": 98240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189599, "uuid": "1371a2a1-1a0d-4c08-a452-00659b7e785c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189599, "uuid": "6329107e-e972-45d8-9dbb-2111411f2849", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0246bac5-65cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781207519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207519, "uuid": "4bb1b54e-c081-48c0-8ad1-0d25b7650f00", "comment": "Malware payload", "value": "ae504425187e1183e5428bf336d4c04e", "object_relation": "md5", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207519, "uuid": "f595f298-f26e-42f3-a13d-071fb560bd9f", "comment": "Malware payload", "value": "f47b2f5beb33105542ba80729434368d9de42b8357657fff122484cc779a2e70", "object_relation": "sha256", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207519, "uuid": "50614e1d-2535-416e-97e1-b3dc3e58f950", "comment": "Malware payload", "value": "c16df113377eb2c54069ba229fec60a89e494e4c", "object_relation": "sha1", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781207519, "uuid": "eeb2e0a5-f3fd-4226-b8a0-436080c487d6", "comment": "Malware payload", "value": "d7120855533d6bc1f026a911ecddc9ab81edb0a73a5605d677b8dc4b160b5cd64e54778bead62d29c7d9fcd152ad8cfd", "object_relation": "sha3-384", "Tag": [ { "name": "161-248-87-10", "colour": "#12E19B", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207519, "uuid": "d27da421-6c4b-459e-813d-97bd6feb1c82", "value": "T103E028220A0307DECF94BAE43255BB4C4140533F251F24351DEC7852411D63B0F113D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207519, "uuid": "2659785e-4261-4b94-85b3-bed0920eaa8a", "value": "6:u02F57YN3EuW3ABsu2xKWg1L3ppNaaiAPhscCIXcEoQhYT3SNbARcw3XBJmdI:uzzsNu3AH2vgd3pjZikVH9/Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781207519, "uuid": "a214b09d-bc22-417c-85e1-344b4586484d", "value": 342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781207519, "uuid": "e656485c-f262-4513-8220-a6719d825157", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781207519, "uuid": "34346a7e-e84c-47ca-bf0c-ccfe79b83360", "value": "runpotato.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef395ec-6570-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781166899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166899, "uuid": "2bafd39e-a0ef-444d-8e81-514307fe4b2a", "comment": "Malware payload (Mirai)", "value": "54373ef412cf6e6f8c55c135bd10c134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166899, "uuid": "e4018734-3a2a-42eb-a44f-b3a95e0a8212", "comment": "Malware payload (Mirai)", "value": "f51e2baafc56fc354d48e6b47369b9a0c7b88587bcdc5408abccc0705ad91610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166899, "uuid": "6a5b6d80-2cb9-4610-b26f-88d7b2493ca6", "comment": "Malware payload (Mirai)", "value": "ae02dd4bfad917ac7c4f76b27b6d91c459b20c3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781166899, "uuid": "e8f8509e-1aa1-4857-acc0-9fe2bc345dd7", "comment": "Malware payload (Mirai)", "value": "50af385a782e150fc957380d57e84508a18b32a6c3e909492dd40a578359971be7f3e81c32e3d62d08b46ba0bc36a557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166899, "uuid": "12d39038-c613-46d5-bb56-335ed09ef10e", "value": "T112B3C60F6E629F6CF36C82344BB78B2A975527D233A1C585D2ACE9005E6034D587FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166899, "uuid": "19638d71-2b89-4e7d-9fbb-fa6bd2a8b11c", "value": "1536:nPCpNa3/9KlDyERWSxWSRySgM4sO0+mci/pbWP9yZWiwEApI/kffgdc:n6c/9TEPC0+wpb+Qreq/kfY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781166899, "uuid": "132ac075-5e11-49e4-af96-116760328f2f", "value": 118088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781166899, "uuid": "f045fc3e-c942-42e4-9a42-3eecf0a89b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781166899, "uuid": "6fc7f3b1-aee0-417e-9705-805ee6f421ea", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25e6e81-6576-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781169670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169670, "uuid": "701eeb6b-02f7-47a4-89b5-2c81e190ff72", "comment": "Malware payload (Mirai)", "value": "2fada1b72932697f1e781a5a931c1a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169670, "uuid": "9d37f68a-3fad-41a1-b189-860843358571", "comment": "Malware payload (Mirai)", "value": "f56900632e6c4281d78f818d1940ccb5ffad766e46a7299c01d7803317c10d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169670, "uuid": "8d0bb4dd-1d17-4ce0-a1a5-908785171bb4", "comment": "Malware payload (Mirai)", "value": "683a2eeaa749db658b10ceb715da94c085bceec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781169670, "uuid": "8ecb4c26-b451-4008-844f-e8e1452f18f4", "comment": "Malware payload (Mirai)", "value": "35041f42bc793b727226e69d5b3d1cc14df3fec065dac3370b3f2bd48b9de0997c982680797f03e76b45ed23a0f0a894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169670, "uuid": "da6f7fbf-f934-4095-92b6-e5a796e03588", "value": "T17AE3080ABD519F12D4D325FAFB9E818933136FB8E3E93102DD206F54278A99B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169670, "uuid": "22ba8ba2-9846-4ab5-9ca9-3831c0d5df71", "value": "3072:YiKhcGcxrsxgbEfCGbg1pd0Mzaza35KLoJxjRC5/h9USZeam3:Yf8BsxgbEg1Iyaza35KLoJpRCL9tYam3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781169670, "uuid": "e65388b3-20b2-47a8-a92d-ebcab7f0cdaa", "value": 145672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781169670, "uuid": "91f2c8cc-8ace-4f7a-b894-5be15c2f1729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781169670, "uuid": "4a202883-8d28-4451-aad1-dbabbe8dcfc5", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986d3700-6598-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781184149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184149, "uuid": "59e98c87-b8f9-4528-9b7e-488642c88919", "comment": "Malware payload (Mirai)", "value": "67dca18529e7dd3daf8af1ee1e7d9baa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184149, "uuid": "c4b05c75-a89b-4204-ab71-5e00a88b648a", "comment": "Malware payload (Mirai)", "value": "f6e8607015b661dfb727a238eaeb4a8cd4b2716757904991cbe425bbb9aa3c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184149, "uuid": "650dff7a-49af-4161-9972-073c4cd8a1a3", "comment": "Malware payload (Mirai)", "value": "83bae8d1241e70b050db7e91cbd0741c3d788fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781184149, "uuid": "512dddb3-9c3d-44f3-8c2c-9a9597775526", "comment": "Malware payload (Mirai)", "value": "8d178a1457fbed3ea558f3dd5e40e39f18fb5943fbe5ae416367b74eab289725995b7c498d2a1aac563b1bb477793f7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184149, "uuid": "20003f2c-53a7-4f2e-bd3f-cd176b0d3682", "value": "T14373022D3401E836D4A2B531164C97713F9E8FA4EE80880727A9EECB8C2557F7CC65CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184149, "uuid": "2539cc45-e4f3-4a67-9cee-6e21da0833aa", "value": "1536:z+Pu5aS2xdTaABs0PrHZfPgvFV3NTqLV5ZqlV8V:6PZSGPHPDZfYTk5EVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781184149, "uuid": "8f0f91c3-8792-49b0-8300-2044a651cf01", "value": 76960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781184149, "uuid": "8a517145-efee-4c01-b5aa-57106a381b08", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781184149, "uuid": "d707c90b-3742-46e2-83d2-15c3601ee349", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f9b54d-659f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187144, "uuid": "2c6ae6c5-ad37-4ee7-8fb0-3b6d961a9ed3", "comment": "Malware payload (Mirai)", "value": "a9af7a3e3e0fe4100c2bce1ce734de7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187144, "uuid": "791c931d-3a7e-4442-b538-7b55f5f10f4c", "comment": "Malware payload (Mirai)", "value": "f70403b02e6eec711b8867a463ae58e07e4b114e543d483e87b7e4d484d4e624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187144, "uuid": "ee30b424-bb9b-406c-a943-57c4c5886ff5", "comment": "Malware payload (Mirai)", "value": "e4bb309937159ed342624c236472414d100f79b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187144, "uuid": "54c38aee-f6e8-484c-a953-42ecd949b814", "comment": "Malware payload (Mirai)", "value": "b38a70732ac260982a8f57c09d327fdca61be42f603e83177248fa10ad7862295a048a3bdd562b234731ce1707601558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187144, "uuid": "3264e50b-3ab0-4e26-80ef-431639c4daa5", "value": "T1E1935A239E165F0AD106A9F071F19F390F22FCBA8C631AD6E462DEE49543DC9B105BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187144, "uuid": "408fb3aa-23e7-4a40-a653-35855941ef58", "value": "1536:I6+P4eNskt4KZhwoJ5dxpWCjCrC1bbeZcw5hjOppK:QP4eN7/ZxjpWCjJJ0l5hjOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187144, "uuid": "b9709b1c-4fe5-4aca-8779-c881660ef350", "value": 92628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187144, "uuid": "0b0b029e-6026-4beb-9abb-6cacb77c29d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187144, "uuid": "4de9de2c-eac4-4196-8c7e-782889b153d2", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe23b29-65bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781200804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200804, "uuid": "e95563fb-2b77-4ba2-a594-9ad3a41217f1", "comment": "Malware payload", "value": "f7a917914a16cd6bc5b12dcb7f622d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200804, "uuid": "a28b0614-3eb4-472d-9c72-aaeacf88ca93", "comment": "Malware payload", "value": "f724a5e685d03cc16ee098098f465ac940074cc4a15a5f854282c54a6b2a776b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200804, "uuid": "ee37bb0d-cce7-4187-8e0b-1fb82a36a62a", "comment": "Malware payload", "value": "10ee6184a861de86f932dc0740b5c4b6618f0011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781200804, "uuid": "bee06886-149f-4405-b4a6-50274bc9e030", "comment": "Malware payload", "value": "70c8a6421f7a51860b725531071089109a0bca2b309485ac092a6e9c5d05f8257f8ac50226fec64ccfe5708f970b353f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200804, "uuid": "be93efb9-0f43-467e-9bc6-a6c1616469ae", "value": "T10122E605ABE98636E4BF8BB809B383116277FA069522CF9D9CC8519F4C62740CD41BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200804, "uuid": "1f1cbf63-eda7-4bb9-8cce-b4b4b8ce974f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200804, "uuid": "3b456ae6-7d60-4336-b059-35734c3d5f1c", "value": "192:dUlVhJhdzfT8n31pAz45ALYZw6uaOaC9cNvtny24:OVHfAlE45AsZwlaOaC9u1nyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781200804, "uuid": "14366bd3-1418-496e-9841-c703f1978cc3", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781200804, "uuid": "96dc765c-1c45-45b1-a2f1-95f06bb96d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781200804, "uuid": "83894f65-a1d7-4fee-9b36-7b8c51cec0dd", "value": "rBiancaHelenaAliceGomes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8f1b48-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180960, "uuid": "a36a5d9f-008b-401f-8042-052c18d84361", "comment": "Malware payload (Mirai)", "value": "8de8d9945642bcb682c7f84bac940165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180960, "uuid": "0c267a42-f0df-496d-9ed4-e728bcae4148", "comment": "Malware payload (Mirai)", "value": "f90dc0095d30b8d70a308a5b662e269b2723258eb728a970abbfc13fe69277b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180960, "uuid": "ae7fc3f3-bb32-4a79-8f3e-79643a40f09a", "comment": "Malware payload (Mirai)", "value": "34820b9c3918ff6742b3fff23aad303f388f8fd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180960, "uuid": "d193895b-f9cb-4ef2-aceb-8c35eb9913fc", "comment": "Malware payload (Mirai)", "value": "42d22cb02e18ef9566130ba2be418aec07cfd35a5184d51dedce62914f0ebcbe4ee6d61505a0f049af1e5c1f2142f1e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180960, "uuid": "9a57d7ef-ea56-4de7-a32f-b49b40b511aa", "value": "T1BE933A9AFD528523CAC516B7FB1E4289376753A8E2DF33039D255F21338A82B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180960, "uuid": "6aca9a4d-2f3a-47c9-80ab-f7e89ff49617", "value": "1536:n7NrkOjcJgRBuqCvL/LCRCD4S6CwVqj9eH+GaIGZbO+YYXjmtqgta:nvjogRQqCD4Q4qj9e+GaRVzmtrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180960, "uuid": "1ed24956-e0aa-4b0d-af16-7709ed1cc515", "value": 95572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180960, "uuid": "d0ec766c-ab5c-4218-b634-ce7498563c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180960, "uuid": "1f421132-5423-42d8-a3a7-1e1c6566133d", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57c6c4a-65a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781187741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187741, "uuid": "5c0f62b5-d2fa-43fa-a6e5-c37034e4d804", "comment": "Malware payload (Mirai)", "value": "8307024a1a580fdad1dec074798eb214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187741, "uuid": "78017240-d663-46be-940d-563f64110b7c", "comment": "Malware payload (Mirai)", "value": "fb121e40b9ade664c0f43695396842fd574943fdd240a55540a2f8e7436f64ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187741, "uuid": "9856dbb1-2741-43cc-8ced-0e19e48b1df1", "comment": "Malware payload (Mirai)", "value": "76f5773d9c99f259783035048cc2ffc84601edea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187741, "uuid": "04c775ef-15fa-4e78-8e51-81df9d8544e1", "comment": "Malware payload (Mirai)", "value": "03b5fc2a7af827858c3a0a4ed2578c01163878580a61c42f5ff1072fcf781c42de3b5e43ce8b02307503adc3a3e8214a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187741, "uuid": "ff3b287d-7725-4093-88c9-fc52c45f1627", "value": "T13CB30A97F900DFBBF80BA67641930815B130BBB60E5316B2A2277C97AE761D42437F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187741, "uuid": "3939dfa9-29b7-49cc-9c9f-38ff1ba2bf9e", "value": "3072:30+B0agd5XylAhgdlYLmPquNaCwJ3RZHlI:308TgDylEgdlYKSywJ3jlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187741, "uuid": "5ab00a3d-4a3f-4863-9f33-800b42e9dc1b", "value": 114296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187741, "uuid": "48377a87-6936-461d-986a-3d90f2537db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187741, "uuid": "73539c88-6311-44d3-9d01-e5a2133973a4", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30393cb6-6591-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781180967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180967, "uuid": "0f5f4288-7497-4ca3-a799-62ffeb3e9326", "comment": "Malware payload (Mirai)", "value": "76e2318fcafed0ecef80e6b6ecd4fbae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180967, "uuid": "4ae8511e-f789-40a9-8cf4-01d16db2107e", "comment": "Malware payload (Mirai)", "value": "fb9dd2a09a9197f4661a10501c5e310b39c5ce6477582ddda56ed28f9fe9a797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180967, "uuid": "19097923-97d5-479a-94a7-88268cc4e611", "comment": "Malware payload (Mirai)", "value": "13d8f1f0a4ca06ff576160e8d90f8ca34b5237a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781180967, "uuid": "76948bcc-b429-4268-ba97-87dd37b6cef7", "comment": "Malware payload (Mirai)", "value": "c6458e603850a0209913c36fee637d56042af7bbf8ab75a84d29683edb807cf69525b814590c7d2d3fd06a319ca0e3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180967, "uuid": "9fae45d0-ab1c-4819-9e9e-dea9972209f5", "value": "T1BC836CCAA783D4F5ED12467171BBE7728AB3F03E1019E942C7A4AC72FC12642D61639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180967, "uuid": "f74fdf20-66ff-4d19-b084-34dda0e6d1ac", "value": "1536:vZDnWw3w6vRXwX8Ixx9Popm9NbmkaxspI1t07n/:vZ7vdRQL/9Pz9lmkHG2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781180967, "uuid": "a965e09e-b3a8-4854-8893-72d1276d71e7", "value": 85520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781180967, "uuid": "a6328913-2096-4efb-9479-b365953b8717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781180967, "uuid": "2992a8a4-5aac-4537-bd6b-52dde2522311", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de83341-659f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781187084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187084, "uuid": "ad33c3ab-aeff-42de-ad65-dbc214afc2a6", "comment": "Malware payload (Amadey)", "value": "8be3cd07b71a42de138232531975935f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187084, "uuid": "991171b1-0633-46ab-b9ee-50f518803a37", "comment": "Malware payload (Amadey)", "value": "fbb697f6ff25ac3ea01c7536945ec053406f2fdd30e802350a2c28fcb19672dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187084, "uuid": "33d3baec-8812-49f4-9560-f005c81c4f6f", "comment": "Malware payload (Amadey)", "value": "9d42bfd6862989d796ceb7512ef33bebe6706fba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781187084, "uuid": "e50d71cf-2375-4510-a1a5-9b0bbef76c7b", "comment": "Malware payload (Amadey)", "value": "0c1caef167a6d038c98df4e1a08d5878bf9c47fe75b85dd025b59230051d5aae6f9be33f943da4acfb6d3712e878a9aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e7b4fe", "colour": "#8BB2B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187084, "uuid": "062a8b73-85bf-418c-8886-be0dca9896b5", "value": "T1CB23024A148E8444EC60B77482F527647F2A1E336CEC3F56750728DF7EC5AF035A88AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187084, "uuid": "a74e4f9c-9084-4f89-a7c1-ecb8562b800e", "value": "768:+gh9gGYnm/nob3PEAr3LLM+Ri9tHnRmlxZ94LDfOjSfd/euxhVcRCjdXOmOpRB9U:+ghFmHzjr3LVND86SfUGbcRCO9xR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781187084, "uuid": "1d6c0835-8b2e-4370-ae51-a3e77948890d", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781187084, "uuid": "062d6ea4-ddab-4fb9-8541-a8b24a50b061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781187084, "uuid": "8b6a4391-2263-475b-80ab-1040fcbb511f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d322727-65a4-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781189096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189096, "uuid": "f749aeec-b9b6-4b05-8dd2-c9322dc900e2", "comment": "Malware payload (PhantomStealer)", "value": "a5b35f95d742d8b5f5459aa814b56614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189096, "uuid": "6a9a5fff-a751-45a7-adc8-d62247ddb6de", "comment": "Malware payload (PhantomStealer)", "value": "fc32b0350ebb6e5c0a57567bca7ad78e5f030629ffa514a4aef5e02b412edd0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189096, "uuid": "f07cdc20-c2dd-4d80-a3b0-868e14cda8f2", "comment": "Malware payload (PhantomStealer)", "value": "1be5a59b56a60581e6ee6546a5954f0520545761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781189096, "uuid": "f338b063-353a-42a8-9915-b009d0bfb465", "comment": "Malware payload (PhantomStealer)", "value": "f2260d2cb074c71520e16ffd88d65826e3c7bed1dee0d606f4c682425ac3823489d361a0f94ba3f3150867536df111a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189096, "uuid": "b9b0308d-a2da-43c3-8f92-a1ecfb3bfbac", "value": "T1D2A401712E1BE8E5C3E31EB10072A305E2F095791A554A93B7C8BF7DAF38DC26C49694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189096, "uuid": "9f50c217-41c2-432f-a9a5-d3071d0392c8", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189096, "uuid": "71383949-434a-4026-8403-0c10cebdbac6", "value": "6144:AtZVzFXh4c6gJe1Qsq4iXqeWjhqFdJLoWQBH63wGrf+vVsmOfyVB5ZZ47:CRxh3sYhdvQBZGCdA44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781189096, "uuid": "3cc37d57-b6e9-4466-8ec4-143a1a26a98f", "value": 451288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781189096, "uuid": "2929c482-9364-40ee-a6a6-af7ef9a4e548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781189096, "uuid": "60c041ae-cf3e-4331-a96a-dae0d1abbf4a", "value": "Request for Quotation \u2013 ABILL GROUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ef6586-65a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781188971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188971, "uuid": "4e4ef44a-ba16-4b1f-a943-33c00b32167a", "comment": "Malware payload (Mirai)", "value": "3351a3139e956221d31afe9a5f477748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188971, "uuid": "2a768a19-cbca-4fce-b7b5-9b1e698103d3", "comment": "Malware payload (Mirai)", "value": "fcaef1b71107e674191b9fbaf42edfb71c56c8155df6a6994c8f9355f2a0f985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188971, "uuid": "55965e3a-c89d-4350-92a9-d0a6e9a0da33", "comment": "Malware payload (Mirai)", "value": "472ad05d1068b88f273d98231d91febcc94b639f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781188971, "uuid": "730145c2-ac97-48ee-87bf-0176e615b9a9", "comment": "Malware payload (Mirai)", "value": "17f0416dfd6875311fd550759920fb3050eef35bb71ca0f55cd31c50f05d02a573d0bc00c0a1b1e0a16b9d79829d7d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188971, "uuid": "7ccc5f05-da70-4923-b78b-db863b4816a7", "value": "T15C14D70A6F610FFBDCABDD3706E90B0229CC645722A43B363674D928F54B64B59D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188971, "uuid": "619e6e71-8db2-44d0-bf7f-84ac782a7548", "value": "3072:v4kFjoJY5KDOn5Khs8TuE1FLR1f194hwTsz+rc8ItEh:v4kFjoJMuO5KuA3F11f19yVzH8iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781188971, "uuid": "207fdba1-ec90-472b-bb09-44846c2e4af1", "value": 190796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781188971, "uuid": "d2c5cf45-4304-44c5-b64d-4b4da19037b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781188971, "uuid": "f508fbac-f513-4af2-95a7-6de1f6d49c85", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c7edcb-6562-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781160770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "e8417390-5c82-4a5d-b5de-d48b1f8b2299", "comment": "Malware payload (ConnectWise)", "value": "a274343379087df9bbe339f32e265e86", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "6bf8a11c-b041-4f92-a7cd-b48c06b859af", "comment": "Malware payload (ConnectWise)", "value": "fcb1f3d5e4973d31df2e0d5a534b655c69147a7641e3d264aba996179ef228ac", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "f55d1db5-895a-4b69-8560-acf362c1a98c", "comment": "Malware payload (ConnectWise)", "value": "0c3cb2821c5246a0476d96f4b693aa8bf697487e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781160770, "uuid": "5720c0b8-fb44-4c13-9b25-7ea5b4900054", "comment": "Malware payload (ConnectWise)", "value": "ef13973c2e2075d14f38de9b05735c441193cae63216afb2de0c6cee37230d0f66aa2226dd1721a52201b4e4dc5605f2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "88b14e42-734b-481b-825b-5e47bef2b9ac", "value": "T1FD46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "ef8114ee-c119-4a62-aa33-bd66f06ba750", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "69257e48-edf9-4b10-ab07-2aa99665aa3a", "value": "98304:JzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:JhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781160770, "uuid": "2de30b75-7bd1-4bba-92a5-f9f988796a2d", "value": 5643312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781160770, "uuid": "03eacd3f-2ecc-4313-a09b-91736184ee8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781160770, "uuid": "bc16ac45-fa96-4542-8e5e-15cd558f3204", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68efa1e-6568-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781163637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163637, "uuid": "71fba555-9e83-4fe9-80c2-4f884b87f6d0", "comment": "Malware payload (Formbook)", "value": "c42d6b5aea1afbaff5d65379ae3d913f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163637, "uuid": "9d4275c6-44b7-4c17-82f9-7e91834858f0", "comment": "Malware payload (Formbook)", "value": "fcf77056fc4d3515d2582315aa7de5c427576a9450369a12a6234546acd6fc0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163637, "uuid": "39c9a706-213c-4ed3-ac5d-fde9700d1ec4", "comment": "Malware payload (Formbook)", "value": "7b33aefed19266a36cbd830326d9aedf55d0096a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781163637, "uuid": "1b4bec0c-73d1-4344-b4ea-d2e7bc3ea849", "comment": "Malware payload (Formbook)", "value": "5456887aeba2906af01cc495654ca413a9e886e46ed775ae44975cd27ab70f65a0a663da57b6b0c2878378ecf5c619f0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163637, "uuid": "aa380855-e7d3-4f47-91f0-24aefb9b3526", "value": "T1F7C296C637C2F4505716A87B392FB0DAF12E5C40BB584868E7A4B14DFDF8324D5E9A28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163637, "uuid": "b6227bc4-0842-4da2-a95d-3704b9ae9c62", "value": "384:8Hsv45+JCXF4kvDa2Xnrn/ozrGbN6w9ydHRPKcBe/itzMK/sh0dzB62XA4M8XfC:nc+8X2kvDa2TozIepyMAVGfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781163637, "uuid": "4c64fb91-07af-4164-9232-b72021018267", "value": 27868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781163637, "uuid": "e676dcb8-6177-41d2-88a9-447e2053ee3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781163637, "uuid": "f03e94bb-c4ad-459f-8f20-468801e29aa0", "value": "INQUIRY_FORMpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd983ee7-654a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781150710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150710, "uuid": "de8d6a6a-46df-4f6b-a011-f426c343c973", "comment": "Malware payload (ValleyRAT)", "value": "e2d2adebeabc58b42c56d76e3f5b18db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150710, "uuid": "dacf70b5-67d2-4ad9-8329-1644080945ea", "comment": "Malware payload (ValleyRAT)", "value": "fd42ddcc1b4107863ee362d48cf68262176995c88c65969c957f2a16fb7c22e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150710, "uuid": "7ea25e07-d4ba-4d26-8afe-b5f93acf5468", "comment": "Malware payload (ValleyRAT)", "value": "3e773669a151375e55b8eda1e4c1f3b3286496c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781150710, "uuid": "89aed049-db2c-46ae-860b-aad1b3cda579", "comment": "Malware payload (ValleyRAT)", "value": "8f9fb651c2da1885b1c15c45e5384928295efa7111bc733d2cea0404619ae18105e4262a2c7d3a7387b03c07569b1b60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150710, "uuid": "999d8b31-d97f-494f-adfb-65415411340c", "value": "T1DA446D407480C572D6AE197054BBDF764ABDB4701B28D9CFA3844EFE5E303C2A635A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150710, "uuid": "d1725506-0cde-46c4-91f2-c3c40edb3986", "value": "6541f72cbd1ad3f210a7c5376655dfb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150710, "uuid": "fa4de744-4dd7-4b04-b61f-b29ca1761882", "value": "6144:SGcm++4cwp7AJPEKlT+uIFQQqGd/Dn3lYwj:cJp7AnBGVxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781150710, "uuid": "1745c1ca-d575-4e86-ac00-9e3317367cb1", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781150710, "uuid": "b9ea0dd7-a1e4-41d0-962a-47bfafed1131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781150710, "uuid": "98bee2be-bad9-4a76-b0bb-3649155b2155", "value": "E2D2ADEBEABC58B42C56D76E3F5B18DB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba41fa17-65d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781211693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211693, "uuid": "44013aab-6466-4dc7-8d1b-13ba134d75f2", "comment": "Malware payload (Mirai)", "value": "9b517081d08ede3586f7d8aea03c0a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211693, "uuid": "951bcac0-278d-4da0-b5f5-8cc5627ca5fd", "comment": "Malware payload (Mirai)", "value": "fdb7e75e2fd8cbb8fde0bafa3a870005442e63143c3348fda5110ac6acfbe60d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211693, "uuid": "312c0915-3282-40a6-a857-949390e4e98c", "comment": "Malware payload (Mirai)", "value": "e100be6c1b38b4a931697bc4b5378f0adb6db045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781211693, "uuid": "e36eca25-917b-4510-ba2b-40bbdb2daaa1", "comment": "Malware payload (Mirai)", "value": "f743786828d6654e4e063ff4006279ff4ad9e0e5dbe6980dc6efe9dc329090f351dae0f220a826678ac7458ea622f6f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211693, "uuid": "66522598-da32-469d-b6ba-0b3474a79060", "value": "T1DEB36C85EA63E4F6F16300B5296BE7738A33D436502BD987E3692E30DC65650CB1A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211693, "uuid": "1260695d-acdf-4b19-aee8-cc60d6ca1cd7", "value": "1536:ErKBfM+ATU7jlUwj2ed+VXa4T9MxMVwU/WSfbV2HOHmfGqgQIh:lq+A47jlPO9+MVwWvTEHWxQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781211693, "uuid": "4a6042d3-215c-450c-8748-f0d8a2d21367", "value": 114464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781211693, "uuid": "e8a802a1-3126-443f-9b6d-ee0fb2770f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781211693, "uuid": "a72e78c4-f71d-470a-a86b-786486f46b81", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e6151a-657e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781172947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172947, "uuid": "7bd94bd2-576b-4235-b507-f767047c3ad1", "comment": "Malware payload", "value": "61504575067517938e30905b12318cc7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172947, "uuid": "76ad2a0e-1025-41da-aadb-9c595308140b", "comment": "Malware payload", "value": "fe326d057d8ffeae90a4a26eb8bdb590d6a54bc0b5e0baf19b10e4a2254cb311", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172947, "uuid": "ec6637e6-bab9-4a3b-9bd8-08b086a6fce1", "comment": "Malware payload", "value": "b9c986766e2a68e9315a61a3b4750b1d1a6c8815", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781172947, "uuid": "dfaebd43-8101-4fe3-a05c-92357d83773d", "comment": "Malware payload", "value": "accec72413dc8eb0bf4030efdac02f41bc819fb77ab245adac8887ba318ab4731e32c3a3df7d881c3a858bd321c9f0f6", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172947, "uuid": "ddf6ff6e-9b90-426b-b3fd-b521c662a82c", "value": "T17CA4F105B7E501FAD27B9638CD621902EE73FC4617609ADB47800BB61E37AE09F3A751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172947, "uuid": "38b33ae1-b780-4073-9d37-370313d5db2f", "value": "96d4046d27c7329387c73c37b5520a4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172947, "uuid": "9764bb7f-f4e4-4fcf-8b97-f308f0bb7f33", "value": "6144:Wv61lrtovLaFyRklOnyRJ/o3JESF0ANMQ/TgAPe8vavjqywiTnaAGccwn3:oKcv4yRknRJiJEwB+Q/TRGgQ9T3GhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781172947, "uuid": "81bceb12-30cf-4640-b26b-6f5659ba7ab3", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781172947, "uuid": "e0738fa7-5d42-4cc7-9404-3de1cd62366b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781172947, "uuid": "ff52cfa1-8e89-4b83-9470-6d28fcd6ba22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c9d1d4-65ee-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781221245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221245, "uuid": "76b02511-5d26-4f87-b1f1-6489a525b81f", "comment": "Malware payload (Mirai)", "value": "c1326d8708f9609860d652dbc6470858", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221245, "uuid": "e5461e2d-cc68-4bc1-a3bc-3671e68bb2f8", "comment": "Malware payload (Mirai)", "value": "ff9a5b94955c24804c45c1a13d23874663806bed01ea40af511808d6da078552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221245, "uuid": "14c90eca-41a6-4c44-8373-a53fc25bfa22", "comment": "Malware payload (Mirai)", "value": "7ed86ce2b8c1280d87b91c88aa6c0c7379ca682b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781221245, "uuid": "38f1a2a0-9755-434f-a080-4fb503dbf674", "comment": "Malware payload (Mirai)", "value": "9b661de97ffd7cb47a3fb2a703ec522b7df0923988620d05fe176eb9cde48f22449f70cb6049fefe37dbf177417f5c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221245, "uuid": "8aca450b-d5c6-435f-9623-cc2883f38d17", "value": "T1F7430946BD818A25C4D4137EF92D018E3313676CE2EFB2229D156F6037CB96B0E7B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221245, "uuid": "202d7418-00ea-4e0f-92b8-a7911eb7a044", "value": "1536:Pdn4bU77dbGHmaUi3MKS9bIHW7PlIlimnCIuPMP:mUFERCIuPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781221245, "uuid": "69bc27be-2214-4a1e-931f-75eeda6edf69", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781221245, "uuid": "81a0a619-2808-4b58-97d6-d268861f76ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781221245, "uuid": "88b8be3b-882e-4782-8962-b2d51b2d95e8", "value": "zoryn.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }