{ "Event": { "published": true, "date": "2026-08-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-24", "timestamp": 1787616182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a5af5493-e4df-4440-a71c-47b0e338b68c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fae9bc3-9f58-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787533626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787533626, "uuid": "afc3386a-586a-4ecd-a5be-d8baaa40c96f", "comment": "Malware payload", "value": "8d7d6396ba6bcaf4bc717994af4f6e3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787533626, "uuid": "42d96628-d6eb-41d5-9143-38bcd083148f", "comment": "Malware payload", "value": "010384fe2d669417d4ea35467f4a990a59a1a921124fd7ec734373c7b4c714b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787533626, "uuid": "60b3f195-7618-4c25-9442-983f75565b6d", "comment": "Malware payload", "value": "711c7c93ac4f63647ac58b845b12bfc62fcd95fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787533626, "uuid": "9cf3d7b6-de8d-40d1-bb25-7f00821ec5e3", "comment": "Malware payload", "value": "4f928a810e55f9cae27b9b8b2c92c2201e907077879317c569ae59ccc2b75f8ccb437946adaf9ea2615c27dbe2ea8d03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787533626, "uuid": "7cd92b3d-f6c5-494d-9348-9d963a14e1f8", "value": "T15AC27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787533626, "uuid": "4aabf184-c847-4736-8f14-0c716d476f63", "value": "768:p8vCB+25j6es8Rr9FYpMSUpi+20qUpi+20YQX:p8l25J9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787533626, "uuid": "d706e681-aca7-4130-9c23-d73f7b142580", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787533626, "uuid": "7915d920-707c-43f9-858a-6e45c4a1c430", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787533626, "uuid": "623fa054-553b-4e9f-99a7-8b2878723686", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778fc0e8-9fb9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787575434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575434, "uuid": "68ec3e5e-48f8-49b3-8497-9b44045a942f", "comment": "Malware payload", "value": "ab231fb5eb8ec8e3d243a2937d2c8882", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575434, "uuid": "386d4d18-0e01-4f6f-99a7-ab0546090c6b", "comment": "Malware payload", "value": "0191133b622f9729ebd313976e44e311a9c17e5fd9f8600ba3c9dea0f649a809", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575434, "uuid": "6a75260a-e3f5-4ad5-960b-f1433ba14081", "comment": "Malware payload", "value": "54f2621991bd8b67596c577d9c80623702b275da", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575434, "uuid": "220d7479-429f-4a90-8d66-c0e761002100", "comment": "Malware payload", "value": "fdeb956b742ad7ee234a5310be9ee11271e5ce8d979a06c8a11892a77d8391372b2a921719a9df57f38c0b69ae6a2a70", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575434, "uuid": "97adb074-0ff9-490a-b21a-7c73e57a4121", "value": "T16D95124FEA5906F6D53AD0B884066602FEA1BC1607209EEF27516E760DA3FED5F38740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575434, "uuid": "2e0b3867-9e83-4683-9fd8-028eb40a6d4a", "value": "2ec3493fee0a968668bc5969e1a514cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575434, "uuid": "00970a52-f61d-4582-a550-212b88b7b478", "value": "24576:yJW0hJdR4CT9G2Rpo8atIDk65FvOeKT1DcM2Kc3gpsGvXg0jP6WlafcbXyLfq6xk:f6atIHFvOtTpofUhP9PTqfrxNRDky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575434, "uuid": "fa44685b-e5d5-4ade-a8b0-7f09bcb799ca", "value": 2021888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575434, "uuid": "e08b88d8-a669-4168-987a-782ad294d695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575434, "uuid": "b84c29e3-e9a5-4001-8834-3fc9a907d760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4df8d3c-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576826, "uuid": "9b099f76-ff7b-4674-9b72-d1f0018a0360", "comment": "Malware payload", "value": "1483d198fafb041deecf6a7f4d77ada1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576826, "uuid": "5d2800aa-2fa2-400f-9cc4-28d5d950168e", "comment": "Malware payload", "value": "01c3daedcdbf64fa9f1b11da9ca0403018aafed602c0be0cbcce0b149807d2f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576826, "uuid": "9e80238f-4858-42cd-a869-cc212afbc780", "comment": "Malware payload", "value": "504918b4fedffad54efdb9ece3bec24498930fcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576826, "uuid": "05cf12ed-e903-4be1-94bd-986d0955f6ef", "comment": "Malware payload", "value": "28cc91133ff6b3254cd937f7a9a1cd34da700a3a48e0643112f7a36ff2ec42327ca00d8cd06dc7a19d0c74abcfb43207", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576826, "uuid": "83af80fb-a000-45b9-8cc4-fc46aa203f91", "value": "T17E235A11BC419512C85C06799BAF93D93703F7B0D2DDBA02EC02BB2D29EE6C50F2BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576826, "uuid": "e8005295-fc46-4e9f-aeab-7bbcde8caf3c", "value": "768:ABamXNt542HAcv6MtWBOL/X7AT2t/bmk+zQvj83/HnlG+hi5innDD4FIg:XmdA23WYicbLQtG+QIn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576826, "uuid": "5b318d1f-3af6-4882-a217-1842ebf770cd", "value": 45804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576826, "uuid": "8a342b05-9e51-4686-af3c-b5a0feabe1e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576826, "uuid": "1adfd35b-4425-4070-8322-e1097dbd88ba", "value": "01c3daedcdbf64fa9f1b11da9ca0403018aafed602c0be0cbcce0b149807d2f2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88676c7-9f95-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787560135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560135, "uuid": "f6958115-700c-4859-a1a8-cee83c07a3fe", "comment": "Malware payload", "value": "b6445abdc7b00355a6a17179416049b1", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560135, "uuid": "4e3b191a-3a5f-4812-b83c-ce507d3b785a", "comment": "Malware payload", "value": "02ea4d5a432cca5ffa916cfbd9c942fb9f65b5bf6615cbf847d2e8ec9b3505b7", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560135, "uuid": "02fff445-25ae-4441-8a1a-106481412d26", "comment": "Malware payload", "value": "0d03c9613ae039b2cfde1b35957b5b4356691a20", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560135, "uuid": "bd2da7b5-bae0-4968-9d41-ea973057b83c", "comment": "Malware payload", "value": "3f125afb65392854500ff78eb2c4bfce16dd2c0093ebbb69f9b416762db9b17106dbd72874a6b3b6274e1e0c8c959ae1", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560135, "uuid": "a016e575-676f-4222-b189-16f82aba8fde", "value": "T108A30807F6C6A1FCD426C2798759A133E672B4554B2177EF03508A352EB4FE06B3AB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560135, "uuid": "15c9f505-3510-4833-827f-25640c172b6c", "value": "2ccd3ebc3011fda923fb69188fa69af7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560135, "uuid": "6d78fad0-3b59-4150-855f-2ca74c3aeef1", "value": "3072:eOkmfXIt39pUYQ3NfuiLj8dATmM4vIoV:t7fXCtpk2iLj8KTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787560135, "uuid": "30cc5b37-3cc7-473e-acf1-117319cf4f82", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787560135, "uuid": "da168d63-2bb8-4417-9974-2574880a1a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560135, "uuid": "7fdbc094-6c7c-4b35-a9ec-c8faf7d90be0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9689619f-9f61-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537691, "uuid": "45539825-edf4-4304-8431-250d909c74dd", "comment": "Malware payload (Mirai)", "value": "e7d717bde2b246e68fdf51a685788664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537691, "uuid": "8251010d-dbf2-427f-8813-f2fdcda43f97", "comment": "Malware payload (Mirai)", "value": "04f4e5f85150fed08b3311c793d0ab8838d1c55117086e6cd0290bb0b2554c93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537691, "uuid": "484fd971-f3f6-48ef-8579-413325779ebe", "comment": "Malware payload (Mirai)", "value": "13f2aed6324c504744ceb7066b9302705fd21acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537691, "uuid": "45fa5f8c-2ce3-4c49-906a-aa80a9844636", "comment": "Malware payload (Mirai)", "value": "b2177c02748d311ea9fb154e246987832e38ff94df094fa174a69cb4ad688455cc7faece1d7ba300c32043203502c2ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537691, "uuid": "52a796b6-7ca4-4cb7-bfc5-369dfa80f5b2", "value": "T1EE830223090E7071D8B03C39B67695117C06C6A3A67C7D55F04AEAAA53D02BD9CF8FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537691, "uuid": "a4b03d51-4413-4e72-9672-8b5dd3654553", "value": "1536:kSb722VEtZcd+hzth1rRBa/YaXfp0tVhjw6PFAf5:kE722VEtioJhTo/YaXfcDjRSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537691, "uuid": "a866c8ef-340e-4b79-8dd8-e48be01300f2", "value": 88392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537691, "uuid": "d24022da-6222-4cb9-a3c7-b2b63584fbf9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537691, "uuid": "a116cd88-a9ed-4353-a51a-8cead2e67b38", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73426574-9f89-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787554811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554811, "uuid": "91fb9f70-27c4-4286-a81b-1de7438c3d40", "comment": "Malware payload (RemcosRAT)", "value": "c801d3d0fffcbad836c1ba6a81d32f5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554811, "uuid": "2a33547b-419e-46ef-bd3b-5ad446736e23", "comment": "Malware payload (RemcosRAT)", "value": "0510cea13d36b08922804e4cdecb799b72959a717cfcb9bdaf9b3a7b67604b2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554811, "uuid": "0d2ef071-5907-4a0b-85af-e2fe5ac92a53", "comment": "Malware payload (RemcosRAT)", "value": "3b7ff9c131ee191f1b382ea73fc422b9bdcaf5b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554811, "uuid": "0919f635-8e4a-4934-8e80-464cf660beaf", "comment": "Malware payload (RemcosRAT)", "value": "4e331d5c355c4ae74edb032d7445a258266d45ef122aeb3c8609c4f32ae83e90eee814f272735cfb6f4e55619ad5bd02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554811, "uuid": "ab80031f-1046-4e03-80a5-b37daf153b5e", "value": "T1B636C7853750E23277216BAC67369DB1B52A539318C5CF20306DD2297F2ED8B637CAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554811, "uuid": "f2bc65a7-abf8-46e8-a67f-0bd05dfe235b", "value": "98304:3g83G0hdvUQNRYbl+qqM6GNSup/81mOkalHMCo1nHAU5hedAEihbD8yvlznzbk3d:3g83G0h1PNRazukLOkYQAU4AEUbD8yvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787554811, "uuid": "31cc8db3-249e-4366-b9bf-d328b5f7fbd7", "value": 5169155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787554811, "uuid": "b6378015-c0bb-48bd-a271-2373323339f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554811, "uuid": "aeeaab70-2914-4bbf-a2ba-0b035e20e8fb", "value": "ALMAHALMOHIT MHA0709706602 11-15 SEPT 2026.JS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f39877-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787598804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598804, "uuid": "b74fcbc8-3f7f-4b05-be8d-45f731749d9f", "comment": "Malware payload (Mirai)", "value": "046241c30c2b7c189dcdf919ea26a271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598804, "uuid": "aa057e47-6b5f-464b-a395-771012005516", "comment": "Malware payload (Mirai)", "value": "057d3ea58a5f5bc53d47386869544f8fd692403bc029a24db9ed26c587366b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598804, "uuid": "37fa5fd0-e448-4caf-81e3-f32a6df1b91c", "comment": "Malware payload (Mirai)", "value": "d8a882abe7e3b92c05966fe8e3d06ecb8417bb6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598804, "uuid": "a418fca9-584c-4fdd-a36d-da1c2e5abe04", "comment": "Malware payload (Mirai)", "value": "0bb2ced1f127d83376676d3028c971302a2dffbfff552b411c8db151f8a5e786ee57daaadea250d8af0ab3600fa860dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598804, "uuid": "2dbc5944-1442-4b1e-8237-4badbb60d4cb", "value": "T1E5733B56FC814A23C6C1127BF76E468D3B2653E8E2DA72039E259F3133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598804, "uuid": "28b7e781-7540-4bf5-a7ed-30253137dd5e", "value": "1536:uB/VU93ilj19ZBpCO72Rbu1U+qhxp8f8vNT:uB/VBBpCO72RDRZNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598804, "uuid": "f4fd0f58-ba16-4346-812e-9ebd17287d1e", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598804, "uuid": "68bc5cf2-58da-4a52-a9d2-4578d437d952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598804, "uuid": "9c2b7f24-851d-4f63-92d5-27ac20ee9a12", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f3eae1-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579317, "uuid": "dc261a06-621c-4267-9c13-d130653996b6", "comment": "Malware payload (Mirai)", "value": "5aad226f9fca1187374bb8f4e53b99a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579317, "uuid": "556a815b-7f20-4ced-a3ef-ea7dfa330f34", "comment": "Malware payload (Mirai)", "value": "06c0d953a56629d869230c7962836b020e0977e8086c1fbfb7e6470a6047dbc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579317, "uuid": "018eee2a-8287-479a-85df-31ea9e55bf64", "comment": "Malware payload (Mirai)", "value": "d9a2469f6e69361beb5b88cf31ff086ee1edaaf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579317, "uuid": "3f630b22-7c2d-4bf8-ac2b-258b903863d2", "comment": "Malware payload (Mirai)", "value": "0122ca010cdb95bbcaab57b37d6759f9ad6d52b53664b37dc07c4c399cb2d8650589af83fb8d85ceeec1d07d0f064883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579317, "uuid": "233fbd14-57e8-42f1-abd3-25bb9b4e62fd", "value": "T139430205CB33A470D191D531FE570A63E7EF2EA489DA70CC0DB48F0D8FA269891E6889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579317, "uuid": "67c3a645-a425-4b07-8415-8b31e52b3d20", "value": "1536:dfYo8m3wN0aTa8B8+yUuCx0qX5ay508tKOAL+6:RYbNb8+yLCx0o5JtnAL+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579317, "uuid": "0dffba70-5a3c-441e-8960-1b07931a62ee", "value": 55772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579317, "uuid": "d04e9c82-0ac1-4786-b0fb-1ef694ec780a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579317, "uuid": "bbe534f6-29fa-46f0-b146-32b3321ba4e8", "value": "daredevil.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed59d83-9fd0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585298, "uuid": "dfc8c9ca-4d64-4297-897f-b8a4038b188c", "comment": "Malware payload (Mirai)", "value": "4e535a6731f039cee8857d5c79e45740", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585298, "uuid": "18e89f86-97b1-4a5c-b127-9403b2b70935", "comment": "Malware payload (Mirai)", "value": "07a947fb7c053feb7f1acdc48f4802c5d8578434afab3251c05c9812d32beefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585298, "uuid": "80543254-d46a-4444-a9b4-df5b6cbdb83b", "comment": "Malware payload (Mirai)", "value": "2eeb2530b2442114d138b606e7b175d0a57a1558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585298, "uuid": "be07fdf0-51a0-4852-8286-4bce5ba999ea", "comment": "Malware payload (Mirai)", "value": "cfad898e0331ca5b34a5c9071413fc3eb7ef1325f369e28c831b252c703bd11a3a42474b42afceb78c1fcce843514e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585298, "uuid": "13bdd483-3509-47ea-97fb-82b108cdc833", "value": "T1E6545A5B3B10CF65E229C53149B38E5663F5266227E2C549F21CDE18BE6038D682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585298, "uuid": "d50c457b-6746-41bb-bbf3-04d2f450f2aa", "value": "6144:XkZ+COPwn2sPf9/kqKJzeut5GmWw/V6hkNA:XkZLIyGeuqw/TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585298, "uuid": "e4372ec8-e75f-4d34-85e7-aebcce7a6504", "value": 287384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585298, "uuid": "6220d962-c9ee-4b74-b22b-d64014094330", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585298, "uuid": "8d056729-954d-46ec-922f-7923e497e6da", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12006dec-9f5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787535750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535750, "uuid": "1eb12eaf-aab1-4992-9ff9-a44a0a5d5dcb", "comment": "Malware payload (Mirai)", "value": "568c41d403bfe132bf852cd72e048784", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535750, "uuid": "08f3519b-523d-42b6-93e4-9a4e2c2b5b41", "comment": "Malware payload (Mirai)", "value": "07ecd27fdb601292e1ebd8ff88f4c5360bc8c9f3bc1a5ad7d389efa865e58d44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535750, "uuid": "9a16df62-1345-48c5-a1a9-41531f88842e", "comment": "Malware payload (Mirai)", "value": "c1d37fb21e6cf0de6760eb39c2a5f994e35a97d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535750, "uuid": "ea19532c-eedd-480f-8ace-dd969326210d", "comment": "Malware payload (Mirai)", "value": "aa7da479d159a81d3140cd8e0b504b6ca10352dc2f1cd2ae69849267ae1a3edc90b2d8b37acd7f7615c82cd7d48e51af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535750, "uuid": "5a19feb4-cc33-4c56-9475-694e01779ecd", "value": "T14724AEC1721C7EDFE1832D7D860955235C0CAE12E8039B9261FD6A47DA7BAE30FB9941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535750, "uuid": "e854fb67-c39f-43d9-a579-fa5cfdd1ea82", "value": "6144:uCWEBesWl+cJvAC3uVfAlVZ/kYVdaBCUvFFlJXsPH:qSeLAemYPlajFGPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787535750, "uuid": "c518f9b2-ea29-41cf-be2c-559a970e7827", "value": 216236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787535750, "uuid": "115059b7-0b4f-4f99-9aa2-e1bd152ad592", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535750, "uuid": "90572a6a-e3b9-477a-8cb6-574637416a73", "value": "07ecd27fdb601292e1ebd8ff88f4c5360bc8c9f3bc1a5ad7d389efa865e58d44.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58413a4-a016-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787615535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615535, "uuid": "d9ee30e2-14ed-4804-8349-e557efb505c5", "comment": "Malware payload", "value": "a569d38fa137ce89f70831b0473fe5ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615535, "uuid": "a67094a6-7d27-4f66-9661-37a3d1084539", "comment": "Malware payload", "value": "091f4580316498af0b96de415bc0f418e61f31e6defb57a54e4084382e51de63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615535, "uuid": "d9757fe3-8dc8-49e4-aadd-ed583518517d", "comment": "Malware payload", "value": "717f39a49c05716190c6cdc8a38ed623e55c3086", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615535, "uuid": "d7720866-f64e-41d6-8da3-744d5c5a4519", "comment": "Malware payload", "value": "a233ad25d45fe729873b1397ed735e38b2dc1b9abb768233574284a51e4f0f4c90896b542ccbe0ca1028567cbecbd7c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615535, "uuid": "1066af4c-6eeb-41fb-88de-71ec23b4eae5", "value": "T12C029E6AF21CFDCDCC39C9F664F39F4E725AEA4EB1DBA285800094A9C85724274713D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615535, "uuid": "53320e40-eb80-42ba-a149-bbdd10239518", "value": "192:kR9/5NlBRDGHeYT4jZKCK6MfRZX6YdHuLk74o4y31i:6Jn6v4jZKCXGTX2jyFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787615535, "uuid": "a0ff55b2-f56c-41f1-9a26-a505a3e9e1ac", "value": 8433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787615535, "uuid": "6e39c387-13a5-4bf5-a7c8-5f0284587e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615535, "uuid": "23d9b747-6a74-4f78-8730-42f1c6ec49af", "value": "SecuriteInfo.com.ELF.Svirtu-AA.71646998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582400bc-9fa5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787566792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566792, "uuid": "33e98e7b-3994-4f50-84da-5e1d007b9a0b", "comment": "Malware payload", "value": "67868e2d3d38ef58e81df82a6b52cf38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566792, "uuid": "e707fa1b-8567-44b8-a318-e4c7d479434b", "comment": "Malware payload", "value": "0a859a5a3e06a22b7f907c13e94fbc030be76d307a1178c2870426ea10dff26a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566792, "uuid": "a0b47bc1-dee6-493b-8f48-1fecfb273b45", "comment": "Malware payload", "value": "a32ffe264878747fe5d87e4ae224ea0bdc8f6ab2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566792, "uuid": "0cdc2100-7c75-42f0-814e-60c05eb57415", "comment": "Malware payload", "value": "901f965302b8fdceb5ef930e940d4b29e8de842a7163eb7537efc24e7b7d44ca50c3ef64d5fb381876fcc50e793aaf68", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566792, "uuid": "b22d9129-acd9-4d5f-a007-ab1f95b95244", "value": "T1D2C27D966A867C44BDC94A3E4CBD2B1D6DF5C3E1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566792, "uuid": "ca23988c-3f31-4d9f-9770-c65a473bdce6", "value": "768:TMT8vCB+25j6es8Rzq9FYpMSUpi+20qUpi+20YQX:wT8l25J4d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787566792, "uuid": "a8c7a7d8-bf66-434c-99df-09b878539435", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787566792, "uuid": "9498aee6-3749-443b-9db5-d17b906fe574", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566792, "uuid": "26d47f54-533f-488d-850f-70ee7ec7f100", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4b2ff8-9f61-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537840, "uuid": "5c167d79-5484-4b86-a5ad-ca515df68593", "comment": "Malware payload (Mirai)", "value": "e71ebb69861cd0de1951ab211a1d2080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537840, "uuid": "47ccde91-2aa5-454d-a8c7-4cdac26f1ca7", "comment": "Malware payload (Mirai)", "value": "0ac4152a60a7a373d0816fda27a5a522c18e5c972f180a0bdeab4bd9449e318f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537840, "uuid": "e9c12bac-dd20-4612-82c4-98c48771bd66", "comment": "Malware payload (Mirai)", "value": "65cb2fce5e14f2b27d7643a1acc0948c83ea5200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537840, "uuid": "549efcd3-f8b8-499e-b7d4-0645678c382c", "comment": "Malware payload (Mirai)", "value": "16295b4f79d737394e32064808295727a0901c3f47e780c4190cc28a8981263740245ec0abca8c121a71f71b128947a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537840, "uuid": "043f92a7-c2b5-4b71-b301-ce333e0655fd", "value": "T1CC347D49FE47D0F0EA9309F0211AE76FBA356A325136F5E2FF893A22F4B1701594925C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537840, "uuid": "6979fccc-2d57-4af6-93d5-2b59836790ba", "value": "6144:uCg3QiOqF4Snyg+ZTD3LsE8oWXCg+ei4ddtkcus:uCg3QiOq+SNGnz8Xh5i4dlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537840, "uuid": "e1609796-df64-4088-9680-5f5088ad7457", "value": 243352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537840, "uuid": "cfc3a715-95c7-48cb-913a-2475b993f271", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537840, "uuid": "f2bd5ead-1482-49c2-873b-7b07ef86f214", "value": "e2c334f483fc20d52e55da2f613d9103fa02a6751f33922e54cf504785f904d8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a400b84-9f65-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787539254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539254, "uuid": "f8549f25-f41d-41ff-aeb2-459206d67b78", "comment": "Malware payload", "value": "a537c7db62f90dd6a6cb60f6ef93d7dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539254, "uuid": "2553242b-2a76-418b-a813-54fbea8905d8", "comment": "Malware payload", "value": "0d13d3665a7b952d21184d806ad8e0f8b173dd4d5102a1dff1a62f24f7bf5c05", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539254, "uuid": "5d3ddc4b-7b5d-441c-93f7-1c8271df46bb", "comment": "Malware payload", "value": "5aed599fc56caa435d9d54a2ed1a0f7d444a82cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539254, "uuid": "382b7203-b6af-4969-9fe8-acbbf26f1e06", "comment": "Malware payload", "value": "0c60175d2db20db4c276059032f3e6e3abb655bde3cf6ab85a5cee972c22ecffb31dab7bdc0b08c6830541949253f04d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539254, "uuid": "1174eca6-2c57-4a96-9a6b-63a7dae39146", "value": "T189236C6516857C14AE99C8375C7E2F0CB9AD43E6314492EE7FCE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539254, "uuid": "bee4d1cf-c805-4ef8-b259-8b38c38d921f", "value": "768:lr9NyXsZztCe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZOcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787539254, "uuid": "8aef9633-ff2d-498f-9ff1-2690fe63e62e", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787539254, "uuid": "8f9ea676-c20c-48bd-a7d0-3ad7078e4e94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539254, "uuid": "dff5f2b7-e3b7-4bca-b84e-1e1b5883e2a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d6e395-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787584154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584154, "uuid": "744e55f7-c62f-44bc-89f0-a76e74c79129", "comment": "Malware payload", "value": "b6a96554a9371b76b37c08b0ac23f8e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584154, "uuid": "3f8a9e2b-beda-46fd-b98c-2cf495561968", "comment": "Malware payload", "value": "0d5ea419dd72597e49b79e254582c97c0a122f7c326d32593958134d969fa4cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584154, "uuid": "13e91c88-2c4a-4766-b992-62a5a1366aae", "comment": "Malware payload", "value": "d18638789c6797a4a3d90984ae9f816e4d287f52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584154, "uuid": "598229e9-aac0-4e01-a53e-465a143e127b", "comment": "Malware payload", "value": "20c8ccc52c302cdfcd6ea5555f8e0cc688292f493865c92b0b007258e2cd9e3db9b19ebf4bd6d56897f6d742c6cba3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584154, "uuid": "9d2a5f33-2f63-4c8c-b36a-4c4a33b149df", "value": "T17423E781F287D933C40B593627BACB65B74378E31E76C2008916EACDFB675D069B0867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584154, "uuid": "e49966a7-9fb1-42e3-b807-323406c75365", "value": "768:jrqh+/5gsQSo+14S0v659NF+/uASat+H/hlEIr7DDQ1BxfDlQXTRxuGxebShUax0:jQc4t+fv+Bxf4zuPjaxm9JW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584154, "uuid": "215aad00-3efa-49ac-98d8-d687343fb94b", "value": 46248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584154, "uuid": "8f32cb1a-d7e0-43f6-9d61-9946bce01eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584154, "uuid": "7f017170-8869-4589-85e5-33f126f209cd", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3553246-9f94-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787559670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559670, "uuid": "bff2acb8-f6ba-4ad5-ab57-6d3eb149c771", "comment": "Malware payload (Mirai)", "value": "64554ad62025301c46cbcef677c81509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559670, "uuid": "e7bc6a1a-c2f5-47de-92c7-7cada4b1496d", "comment": "Malware payload (Mirai)", "value": "0dd39fd5a0b389fc05abe442df584bf14a80bc6c52d8e27312c4237f120fd4f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559670, "uuid": "2abe0402-180e-4298-aab2-ed9a0cc1c569", "comment": "Malware payload (Mirai)", "value": "b4f3ace3cd8b4999db39e55cc60bc9848936abec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559670, "uuid": "f8d7982e-35e0-46e8-94c1-5dd7e0328ac3", "comment": "Malware payload (Mirai)", "value": "9edbe7643613618d471be2c49184e29f3d6ef7e4684cd540d9aa445db6d4c6f4b7fbbb2afe7bea49d144053ed52c287d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559670, "uuid": "f8a0f6a8-f998-42af-ba6b-5e46901b489d", "value": "T140C3B61E6E21CFBDF768873547B78A21A39C33C622E1C645E16CD6015E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559670, "uuid": "d26e3c37-58cd-409e-a17a-7f3f6a22062b", "value": "1536:xOhpcrKVYB/bCceyHZTheY+QY+N6frP0zmTQBT/i0sXemPvPjvC1E0:G2WVG/Wcffp+46frOmTQQtJvwE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787559670, "uuid": "55574914-7ffe-4ee1-a696-41a9cdcccb0b", "value": 127576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787559670, "uuid": "e9998c31-49bd-4797-8bbd-794d7b52bd55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559670, "uuid": "19893dab-13db-44ae-a717-0628a2a5d5e8", "value": "qtm.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb3480f-9fb3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1787572762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572762, "uuid": "54a27188-f231-48ff-ac0b-3eafc7370a40", "comment": "Malware payload (Stealc)", "value": "caf6ccdae819b91fa4c9c17c14a161f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "svhost-update-service-casa", "colour": "#01972D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572762, "uuid": "ddf4c41d-0453-4074-be4d-6a7bdc3e704d", "comment": "Malware payload (Stealc)", "value": "0f5e6fbd1e12c2653146c7c18cb55c7e4f9d7e241f299d323a3caf12c13c7727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "svhost-update-service-casa", "colour": "#01972D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572762, "uuid": "f0a3e0d8-5664-4333-b4d5-a6849ad4e0be", "comment": "Malware payload (Stealc)", "value": "23f333ad78abbfb012040430cb7cb57e877be650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "svhost-update-service-casa", "colour": "#01972D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572762, "uuid": "e52c3c41-8912-402a-bc19-80b14decd367", "comment": "Malware payload (Stealc)", "value": "99d940f3999a0b2a72a181f69463d537526eac8898a781c7c7a6785a531f3ffffe7b9775992d4db27915ceac895ab8a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "svhost-update-service-casa", "colour": "#01972D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572762, "uuid": "529d09b8-cb2c-4d29-a9c7-4e7648643807", "value": "T1BA75121C5107D902D2965F740DF1E3B426B48F84A902C747DEEEBEEBF57A3992E41282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572762, "uuid": "69776959-39d5-495e-89ec-4a475c0084aa", "value": "49152:9fb/2oSqoxtJmAFLV67iuAVwXgNjqmDb76la1Yvhdl:9fbuoefHLU7iuAWAqmDyAUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787572762, "uuid": "2b230336-f378-4910-aa16-3100f7ccfc6b", "value": 1700352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787572762, "uuid": "1214c8af-9fb0-4cf6-85f0-ceac1be7031b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572762, "uuid": "4c1fdfa4-55d9-4c8e-a63a-4b775e22387c", "value": "FLStudio2025_v131_Win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bacf52-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787598778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "8d5cf3ae-2899-4c92-93a1-4d3ef38dbe3a", "comment": "Malware payload (Mirai)", "value": "87e936e45862b3025c7d0b9059beb6e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "0313a37c-fa64-4871-a8e9-e3e98585351c", "comment": "Malware payload (Mirai)", "value": "0fcb8cddfed9c70b99e202646ca6dc82745685c5ab12db933a93f17ac6471a5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "410d41a7-4dc9-4144-bc4e-95b321fe5dd6", "comment": "Malware payload (Mirai)", "value": "4684bf196eef91778e9e8430cd70f6fd6620007a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "106ed23e-9ef8-48e9-bd5c-c2be1c6fd7d1", "comment": "Malware payload (Mirai)", "value": "617c54c2369736cbe8f992f9471c19aa16fb078f81d261009bc5db305a7686ae8b78a49d8ef18939cff4ba92c8e3748d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "4a7f2783-ba7c-4129-ab77-c60c3815ad7f", "value": "T134F2E1603709BCB6CD6095B2EEF1CF46F36A93B9D1FA312915000A54ECE661298F53CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "f9c0f3ad-2cfd-452b-8d4f-74b5e1fb7e24", "value": "768:6JTKmOVP3WWkPgb7lPBIqxwQEECBah3zGK0weMs3Uoz9:6AmO4POPN5Evo3F0XJz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598778, "uuid": "2448c25f-7c65-46b5-a7bf-664166941c42", "value": 36832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598778, "uuid": "40a995de-fa28-4b53-a41a-e5984935ee97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "1664bf95-ddd0-4dc1-a732-53372fb735b0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37e5060-9fc1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579051, "uuid": "4a6ed8b8-bc57-408d-b985-59d00d5a4b82", "comment": "Malware payload (Mirai)", "value": "bc29e8d954184b9b22bd64d64321acd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579051, "uuid": "527d88ba-0410-48e9-b548-12a82635f3e8", "comment": "Malware payload (Mirai)", "value": "115a0417eb49822f8fade16ff1c76bf0b913104b178f69c5102e3f20feb10140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579051, "uuid": "343ed4f0-df26-49f2-85b1-a310ef066eb4", "comment": "Malware payload (Mirai)", "value": "5bbacd120e15efe569eab36d9ee67b831e8b7ca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579051, "uuid": "e693d768-5c67-4d87-bc04-01386da94b0f", "comment": "Malware payload (Mirai)", "value": "f4bf499dca78fb34f11cab8eaf785d96c1825951851547bade26b461109ec6c5d7c4958bf4c1a4e5cf59e159721a3fd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579051, "uuid": "a7f3d713-3a53-482a-bf37-583ecdab8242", "value": "T177F36CA28CB36E10C6578479B2668A3D1B13E423424B6E64B47FC2B45F43C9DF2A57F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579051, "uuid": "ff5bd570-30f8-4ad5-95c5-32d0cb714aba", "value": "3072:rxv5CwOPC1nalWe9128/t0py55WeE6JCARu1EssMZc/T03ImIys61X1h5o7:rxTO+Fe9128lv5ketJCAaEssMOgh5o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579051, "uuid": "458d444d-751e-4f6b-822e-19c4ff7d8fd7", "value": 170864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579051, "uuid": "37603aa9-8db5-4ae5-a285-0660241dfcc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579051, "uuid": "15250194-d6aa-4b48-8169-54537a47adfa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7a9f57-9f6b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Aisuru)", "timestamp": 1787541885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787541885, "uuid": "334af824-bcc9-49f1-aa7d-7ee612878c01", "comment": "Malware payload (Aisuru)", "value": "f4bb6e7e923f2ff5193147bc0a4a3495", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787541885, "uuid": "20d8e3cb-0066-46c0-b0e0-50312bd370e7", "comment": "Malware payload (Aisuru)", "value": "118be4b076806c3d426507fa11cc0fffc40c62be51343aef8e82cc04d91330b6", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787541885, "uuid": "981e1060-727f-4598-b10d-f8ddb64acec1", "comment": "Malware payload (Aisuru)", "value": "49e1c1270fc00bbe1cc1d5bd2ecfffa5b82f81e1", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787541885, "uuid": "d778b2a9-ca33-4c2a-9ccb-66bc23c71508", "comment": "Malware payload (Aisuru)", "value": "beb078c2da086aa7335b8fc1e2c07127fd1b1acdf3458186a512afde51122e25e16f0f69050fd6c39148806efe29ad77", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787541885, "uuid": "57045b19-6b8a-403a-9850-cf6a9e15bf9c", "value": "T1FC85AF0BBBA179A9C416C531DBEF83652333F07126222D3F268876703D9BDE46E16716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787541885, "uuid": "62b3d7a7-ce23-4f73-b0d3-2f8ef99a54c2", "value": "24576:6uD54NgXqHDH+VXdcPTbhufVozOYnTgoQXSM81FNg:DD54NgXqHKVX28fu5HQQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787541885, "uuid": "83ec1591-9b9b-43e6-9fbf-e6a0c8c07d84", "value": 1822880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787541885, "uuid": "f4ef7b84-d113-4fbe-b5d0-6002fbd1e800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787541885, "uuid": "375f783a-56e1-4ab8-9821-6d24b649398a", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dfc63b-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585599, "uuid": "35b67846-e393-47f4-8e95-5f73ab1efd64", "comment": "Malware payload (Mirai)", "value": "0b2ba46afccaa061822913813be116d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585599, "uuid": "64ba98ae-78ab-42bd-9292-f79c8b42b038", "comment": "Malware payload (Mirai)", "value": "13967a1f8467a05a8a162856547c123359029fccf00c8c2bb1988daa1a451d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585599, "uuid": "bd6c7052-ea5c-4ec3-866f-aabf485e3ed6", "comment": "Malware payload (Mirai)", "value": "1872b08139c6e0ed1d64380b04b6ff729224272f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585599, "uuid": "b8b2d5a6-48ba-47bd-b6ec-e3e8b387885e", "comment": "Malware payload (Mirai)", "value": "1029ab0af3f76ab21637cfd5507606de5b080609f4c8c1da1bdbb2e2b244c0badb26ca7abda64dc22bb613ed8015d94f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585599, "uuid": "942eef16-0a24-49d6-a142-fc2f54d76363", "value": "T180347D49FE47D0F0EA9309F0211AE76FBA356A325136F5E2FF893A22F4B1701594925C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585599, "uuid": "8975768b-74dd-47c2-aff9-e4b3b99a17de", "value": "6144:uCg31iOqF4Snyg+ZTD3LsE8oWXCg+ei4ddtkcus:uCg31iOq+SNGnz8Xh5i4dlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585599, "uuid": "f0fed7b6-142f-4a9a-b80e-6c8617265736", "value": 243352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585599, "uuid": "fe61ae4d-eaef-47b3-addc-34e03d97bd1c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585599, "uuid": "1e17a307-2ddc-4500-8a6e-768f8ac279f1", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f96dba-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579358, "uuid": "c6eb057e-12c5-4101-a425-bba9a6e8158c", "comment": "Malware payload (Mirai)", "value": "4dd2025452b190bf93b77dccfe75c534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579358, "uuid": "e1415846-bd80-440a-8211-57a2ea39cc3f", "comment": "Malware payload (Mirai)", "value": "13f8ed3c1d7a6c8a5f86d67c8e4da54453ec52fcf6e19bba70bcf7890fab2290", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579358, "uuid": "841964e2-b2ad-427c-aea1-4903b1a6c8fa", "comment": "Malware payload (Mirai)", "value": "9c74207d602c779519b4d99861d20ba048871c04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579358, "uuid": "1e5ab593-9f5d-454c-ab74-9c65d5d7e686", "comment": "Malware payload (Mirai)", "value": "85858baccb648db584bc6d06ddb15a753e6af628707a62ebca669896598ee3e2a7bb15ae5f651ade3f74db275debda0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579358, "uuid": "2af49941-3521-4825-aadd-76d8b497fdce", "value": "T157D3F989FC808B12C6E151B7FB4E428D3B2A47E8D3EA71039D296F25375B8570E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579358, "uuid": "2356fc9f-8b59-4515-bbdb-c377d5d017b1", "value": "1536:WcwznTS5iEm/lGgk4fB+ClF4B2g2FDd4VG3BTjyL/ZxXWScqmyVLoJTGlG8wywli:oTJEm/lIyN4Byd4YB/yL/PXpkOLk0CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579358, "uuid": "7ea3b024-1bdb-4381-a579-2a78f43e04bc", "value": 137792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579358, "uuid": "e06b7a03-86b8-442d-bb41-a65c6eb614cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579358, "uuid": "0b94d5dc-fc25-4773-b832-e96477ce6cb4", "value": "daredevil.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23dfb08-9fb2-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787572580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572580, "uuid": "9803d878-672c-4213-9fb7-3d2b85433d7b", "comment": "Malware payload (RemusStealer)", "value": "c00880b7aff4947e2b9243a6f80da2df", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4311", "colour": "#E3B7CF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572580, "uuid": "781768c3-d57a-4f48-9539-a3bca3a15e15", "comment": "Malware payload (RemusStealer)", "value": "14aae0eb8a697939b529ac081835cc8d10623a2d8cacb127df44f13f1bad563c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4311", "colour": "#E3B7CF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572580, "uuid": "e6cc33a3-e3c9-4335-a2a1-eb5b0f262754", "comment": "Malware payload (RemusStealer)", "value": "f82c86a8876c8a2a7dcda2fc92378b43f5093328", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4311", "colour": "#E3B7CF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572580, "uuid": "e1c59549-8a0f-42ff-a5fe-f8f901befa6b", "comment": "Malware payload (RemusStealer)", "value": "3dc82f4f9439a751f04c2f990f3e5bd6947fc1905ad7444944790980bafd3f6eb3fc4d12c1e4267a48368efe80cfe95a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4311", "colour": "#E3B7CF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572580, "uuid": "523a9e13-85b2-43e3-a7c7-fb0b4f59fbc5", "value": "T1BE07332B2E8A22AFB7A674BA045CBFB19BF85C72268311448C5B7D95A4035454FF1CE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572580, "uuid": "5198d0e1-4334-4327-8afe-09ee967e8f17", "value": "393216:boxWeTLOWPMWYor1vCCACApZKFaws2Reb5UzvXaPA8+dzGPW:skeTLOWrCCTa+edESkdKPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787572580, "uuid": "c29d90f7-44ef-4197-a55c-2ae9f91ce3de", "value": 18359283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787572580, "uuid": "4d3a9d23-9080-496a-a5ab-fb6e579ce86e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572580, "uuid": "be9880b8-be1a-406e-bf42-efb68c575fc8", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846b8861-9fcc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787583616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583616, "uuid": "e3261bde-ba62-40ab-8f0b-a431e7281c17", "comment": "Malware payload", "value": "20cda16f2bd2eb346e5071a15847f621", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583616, "uuid": "c46e51d8-e089-423e-9805-94eb94f3c890", "comment": "Malware payload", "value": "1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583616, "uuid": "b45e50e0-64c2-4e65-b79e-6a0a94482667", "comment": "Malware payload", "value": "edc6788d681d16f495c9b23c6a2e8ea5a86dac06", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583616, "uuid": "9baed9e3-313b-4950-93ba-8848f059d0b6", "comment": "Malware payload", "value": "7afbb7e5e1176cf1fa8abfbcaf37f57ef7fea452467e3839f52edc8db1f2256c1d3371c14bf6b576ec11496320c6fa1c", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583616, "uuid": "5e137ebe-2e2d-472e-96c9-db967d4d40be", "value": "T1F031A4DA10101A716112CE4EB3623548B68D99E7299FDBD0CD990EE842CA7CCF662B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583616, "uuid": "27182481-649a-46ad-818a-6add7e3d832d", "value": "12:UNE6NOi6S6oLnGi6nGaihXYNA69b/yZ6LE/AjFq6F5MXs5B6a6TpuNtDi6tDaYzq:iqyLArssL+puPTaYWXKW7Mr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583616, "uuid": "9d4dd400-33aa-4c2f-b52e-25f6bbc120e2", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583616, "uuid": "4eeb8101-ee64-4348-b131-861e1551a63c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583616, "uuid": "e7a0b922-5d51-4ce9-b933-4404ef8d8bb3", "value": "1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42374d40-9fa5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787566755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566755, "uuid": "f3696a2b-e58f-4f03-8cb7-2e07b82a22c0", "comment": "Malware payload", "value": "c67a23760b5e4acbe13de9802aae5bf0", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566755, "uuid": "a0710b51-8d66-4fb9-a044-d6c97ea3e95f", "comment": "Malware payload", "value": "171e534cf5acfa8cda1d6f31268a757ba767686f218ac4649bfddef55b68e8c0", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566755, "uuid": "72edc585-f676-4118-b535-8cf5dc8550cb", "comment": "Malware payload", "value": "06f9efd726663e4a8190b4bef2930054359b20e3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566755, "uuid": "e4ac02e6-73e6-4ea9-a20b-255f5fdc2914", "comment": "Malware payload", "value": "758c7bb034f940887b9d9ed591b2fb144a093aa2bea297ef962ed0e0c1affd7d93601394fdd8228ab88f20f647148604", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566755, "uuid": "fccc62d5-95c8-44d0-85af-0acb3095e488", "value": "T1FCB66C15B66E00EDD8EAC4B8D38755238A3074DB1BB1B9EF468096752F67AF41F3A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566755, "uuid": "bc9937a7-390d-4c63-ba73-86a835beb8b0", "value": "e6c6caae8f9e8e8c2dfe127c94f478e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566755, "uuid": "59fb059c-591a-4a9d-bea4-fdfb17062954", "value": "98304:doSL9DbnKHuljf8AXKsMD/hxmW+78VaZ5cAVnL5JJiujt+Zn5E5i5D:bJ32w78VawyL5JJiUC5Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787566755, "uuid": "a3247211-a935-4c77-907c-9f7b9835e3d0", "value": 10872832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787566755, "uuid": "5871ec90-e3a4-4b9f-b7f9-43840ff53db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566755, "uuid": "874e8ae7-5f01-48a1-a2b2-6ced8d21f34e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dab241b-9fc5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787580438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580438, "uuid": "13da5314-25b9-4a96-afb5-f84755f50de9", "comment": "Malware payload (Mirai)", "value": "a50ddba8c18650ca7da13546fe0440a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580438, "uuid": "9b60a14d-47dd-4f43-94ed-9504432a4446", "comment": "Malware payload (Mirai)", "value": "18c1502de9ebf3b8fb22c4fb532ae2887a18b3694e0107ef5a042f6055e2d0c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580438, "uuid": "b1a21501-98dd-4ba7-8115-ddecaa19b689", "comment": "Malware payload (Mirai)", "value": "d15d6cb667bfeccaabaaec595ee05bfffd8a05e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580438, "uuid": "9d663047-e148-4072-87bd-980d6292aee0", "comment": "Malware payload (Mirai)", "value": "e9ee1210015edae2138e81f6d5f04be6294b8e1f0120c391c1292ff8cac0ccfda505f757bb06eb126cd80ed940b309ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580438, "uuid": "2a33e015-e016-4d51-915e-2a6fe077926e", "value": "T1ED13D716EE791B2BC1D0733718D78921E9B253E526A8964F7FB31C599E44220323FE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580438, "uuid": "5abc4467-bf8f-4e73-b0da-3d0aee346309", "value": "768:8Q+I8O7s6tH2V3OU0LnEV6JnxYyzNabHTPtW1eEK:8QB89+2UU0LE8JnewabHTP41eEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580438, "uuid": "3fdcfd6a-a846-42c0-b8db-794a77ec229a", "value": 44384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580438, "uuid": "b84e4f79-17fd-4400-8372-a23caf538d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580438, "uuid": "4b25148b-f6f7-488f-9467-791a0b28f3d4", "value": "daredevil.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280cdee7-9ffa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787603218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603218, "uuid": "193bda35-7aad-446a-876d-2f2fbddc4743", "comment": "Malware payload", "value": "b68cffbba31b52267f154004ec2f080a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603218, "uuid": "2b3b660a-4712-48e4-9831-542ecc48af5b", "comment": "Malware payload", "value": "19646fbbd930cecd76c64022dccf8b2a6c3c0d76d577d4ff00f92fa215113ad4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603218, "uuid": "f9e8a17f-c8d8-4bd9-82ce-69aa2a3f10ab", "comment": "Malware payload", "value": "574985d0d743f1171c2b2b8d5d5aff8ba89d82cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603218, "uuid": "7c511469-7743-47ce-ad2f-793755249a75", "comment": "Malware payload", "value": "c3fa3fcbb19f6147ebdd26f1cdb4155abdeef52e3481e864df659040df80124a54a21ddbaa547fe794b572131da04ce1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603218, "uuid": "1c666526-e37f-4ff0-a96e-b929c87e8df7", "value": "T171235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603218, "uuid": "e6a6a8f1-38e2-4a1d-ba61-a3ed4c67dc1a", "value": "768:5JFWzZx5F9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:DkzIcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603218, "uuid": "a559d011-0733-448c-b79c-1d5c270fafc1", "value": 50079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603218, "uuid": "6f1f2e3a-63c2-4e72-b899-f4e34139e592", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603218, "uuid": "2769abb7-b9c3-4e54-8b10-1aa3afc4ab35", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41343db8-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1787577491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577491, "uuid": "b8381471-c79b-476b-813d-d390be1773d3", "comment": "Malware payload (SilentNet)", "value": "8ee60c351b5731390e8f63ab1c51d9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577491, "uuid": "1fe93cb2-2631-4802-8764-b61da0ea59c1", "comment": "Malware payload (SilentNet)", "value": "199535206fa0f9d8f2af53440d9c7d3051d1227236a53fba46a5391f7f732134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577491, "uuid": "53ef4b00-9496-4594-b4b9-ac96bed73756", "comment": "Malware payload (SilentNet)", "value": "2e708c20c356146667b71f7625bd637508db0853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577491, "uuid": "4eb32073-6477-42da-8afc-850a121d2b75", "comment": "Malware payload (SilentNet)", "value": "b5e4f6d1cfda68ff90eac71817739d9abff7d41d734065ef594d196b9991b14208c988472370a84d35fe0dc4f91a7ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577491, "uuid": "541f7ea5-230c-4e04-9712-1b525555728b", "value": "T11D357B83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577491, "uuid": "628fba6a-2d92-4c98-9b22-8fee1f388bd4", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577491, "uuid": "bd0d557c-c275-42ab-96f8-77383ffd1a8d", "value": "12288:Hbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDqvfqItNqdg:HbOVE5ifGPRZwOvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577491, "uuid": "1cbe79f3-3849-4546-b469-05f6be6edffc", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577491, "uuid": "42ba3148-11c4-4d11-8094-d627401787e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577491, "uuid": "1f07be5a-2e3a-46e3-85fb-f621e41b7275", "value": "arcane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3fcc69-9fb9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787575526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575526, "uuid": "3a201a67-e2ec-4af5-a6f1-7496bf076dec", "comment": "Malware payload (RemusStealer)", "value": "ed993235ccd693f593999fc5c3804be0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575526, "uuid": "123544c7-1b4c-48ed-8c71-99250e2cbbc1", "comment": "Malware payload (RemusStealer)", "value": "1a44bfbdd9f4bbca790207cdd75e4b263922178077d616e1905ae84d55815ea0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575526, "uuid": "a380250c-f477-47bb-8fe2-9c5e7e2ecc81", "comment": "Malware payload (RemusStealer)", "value": "5c9241563a5d9f7b49cfd27a69ff512eeab7439b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575526, "uuid": "95d0ad71-55be-4907-a1ef-fa137da2160f", "comment": "Malware payload (RemusStealer)", "value": "f6ee0102dd5afe0ef1d05f641fc90d77bb989dc0adaa58f0666da9ee07f8b942060e4a16468792c07142aa56bafae3bd", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575526, "uuid": "0a94ea06-e572-4262-9e9a-2bd96df5482a", "value": "T1E4364A037A5661A4D1855F35C16B4612B734BC98C33573AB2E94FAB02F323C36EB6B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575526, "uuid": "6ac4a1f1-00d3-4516-9a54-4ae4024223ef", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575526, "uuid": "71212ba5-6c17-4e41-ae7f-0ffb5b7d8884", "value": "49152:GHEKjFBvqnWnSEJoY1SihIqLs+GkjeW9GLutiHBKt59cJe9nSgiebDiuwJ+D1Ut/:yvqnW823IqLj4LCScJcJ4k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575526, "uuid": "a28167b2-1152-4e2b-9d89-7b48224cdf9f", "value": 4941824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575526, "uuid": "8358b274-1273-4216-b522-696a698f2ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575526, "uuid": "0b1fbc5f-2bae-49df-9c34-54e50ac9c5eb", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf6df3-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585835, "uuid": "22c73fbd-5aff-450e-9366-0c056bb3229c", "comment": "Malware payload", "value": "bc87fd641dbf28d96c3981c3d7d40ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585835, "uuid": "bc3f66c8-000c-4c5b-bcc1-8fc26fc988de", "comment": "Malware payload", "value": "1a4d9b7355fc76aa8eaf91c67b9ace2cc3fbf70b13d88d4ce565ed9aa15f0b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585835, "uuid": "ca7dd8ef-9b04-4e0c-9642-039bed80de79", "comment": "Malware payload", "value": "09b8584dc861457398235e916769adc0f07d3f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585835, "uuid": "1ab47484-e14b-4e28-be40-1319404d4310", "comment": "Malware payload", "value": "3a3ef136fd96664e963968061e0671840d35352e6c0837ee1ce3f0664ebc21f256d266dd2b634add45c5742b4c45d89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585835, "uuid": "b8fbd006-1f77-4a35-9bd6-6cf5f2085c44", "value": "T1F4A36C4B760B2880F82102F0A7DE93E03F1551DBAF361EB7586A62F76F7319D1D06662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585835, "uuid": "cde2f0eb-8a7a-4d6b-baf7-bdeca4e8e25c", "value": "1536:+LUGHVr6HCyno/ZdJROL+Tanf50Qcr+J34jgLZCUn5p5M/LW:gHB6HCynibROLjcXgUhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585835, "uuid": "756e7a97-2d0b-4779-acf4-077eb4ef6308", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585835, "uuid": "e47b4dfa-2246-4a6d-88c2-f214c5e14404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585835, "uuid": "48beec28-b569-4e16-97d4-8a69fdcfe9d0", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a06d9b-9f98-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1787561199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561199, "uuid": "0946d3ab-e747-4d85-b8e3-b9e5e5a12f22", "comment": "Malware payload (XWorm)", "value": "f711903bef753f80287f7645d730ded0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561199, "uuid": "551a3b4c-f5fc-44bf-b7ff-c184a4cd331a", "comment": "Malware payload (XWorm)", "value": "1b8c8ea5208de30f140f12976469d64ba668d411d45808e5514bce1c6832969d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561199, "uuid": "1e195121-4fe7-4d92-a669-da614fedd31e", "comment": "Malware payload (XWorm)", "value": "286d6a8db845ba11a384c36bc0b0a2079a28bd6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561199, "uuid": "17563a2c-681e-4171-9442-267cb76346b5", "comment": "Malware payload (XWorm)", "value": "79f530fee36107ff89ed4eb869f5ea7c773033848c93f7ebdb752f61f53a0efa787c97df846ce08313609c344eb20a6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561199, "uuid": "8c31d587-442c-48f0-83ef-79098cdb486d", "value": "T144E5A3446786E5347A6C2B2CF6325431A619A3E794C8EB3E307CC108B77FA97136C9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561199, "uuid": "2d59c9ea-8aa5-47d0-a685-a7ba2f29bf7b", "value": "49152:GTviwGkWDjwQVbUB0sqtImK4JguSDetN2V14rAlAIzkgnaDIyA55q4xL21SR37G9:WiTkWDjwQVbUB0sqtImbgXe32V1ZlE6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787561199, "uuid": "e9d84d03-b098-4ce9-8e4b-23dc7e6bcd5a", "value": 3094429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787561199, "uuid": "399a2601-5208-48e5-8eee-7e73a2acb8b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561199, "uuid": "98a6da5a-292e-4dd9-bd4a-3f873f0190d1", "value": "Scan_0001.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e338463-9ffb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603819, "uuid": "28e8e724-e4dd-48d5-8c79-4cff4a2118de", "comment": "Malware payload (Mirai)", "value": "0368c69db18cc4bc37485f4b839f85c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603819, "uuid": "54d4e845-cd70-49a3-864a-ee40e74db472", "comment": "Malware payload (Mirai)", "value": "1c31596586ddf65d16aec86ddf43df1ca67cfaa43815b9170f031a9efcb0e8dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603819, "uuid": "4a42dbfe-9159-4689-b4e1-dea23859e400", "comment": "Malware payload (Mirai)", "value": "1e589e260cd9a95ee8765958f6dfdb931ea7486b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603819, "uuid": "a26904ed-ce29-4113-881f-a958cf787215", "comment": "Malware payload (Mirai)", "value": "a2e41fbaacd4142748ebf011c8c08bd71fd7590688db3d057783e5cc52bb7e93b583ba99ffb9d57937b726e4c50dfeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603819, "uuid": "1c16869d-c611-4cb9-9532-16ec0a68a307", "value": "T166934B2129F3A112D6D3A43F879F121AF16279070188C61BBD3E9D6E7F4229077B76E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603819, "uuid": "d6676a5d-559d-4c46-b807-0f2f6b68adca", "value": "1536:MmvvlvH7qN8lGtRrdRJuMA+mdrYQFId9Tu1EssMZcywT03ImIys61XKNAh5ot:MGlyrDJDm7IdBu1EssMZc/T03ImIys6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603819, "uuid": "98ef6560-29f3-473e-8beb-e2bd2cd8a7dd", "value": 92584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603819, "uuid": "3bb33799-705c-4391-95b0-c467e7043cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603819, "uuid": "da2e548b-c388-444f-a074-a6d6fff3ce02", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e3ffe2-a003-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787607407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607407, "uuid": "9fcf02d7-3dc5-4ca8-908e-76dd2940cc0d", "comment": "Malware payload (Mirai)", "value": "00a731db18285a8191edabef63504dba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607407, "uuid": "790c6984-a339-4dc6-86eb-2c43bd763667", "comment": "Malware payload (Mirai)", "value": "1e4e68d5e61e9c3159621f6e7dfe07d2cb7a42d5d60e5b0949d9a257f4cd9fc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607407, "uuid": "854da465-34fb-4a94-a0cf-547b8830b0e9", "comment": "Malware payload (Mirai)", "value": "92108da12e227d0f3adb91d41acd99694575315d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607407, "uuid": "d09eb96c-a89a-415b-b4c7-10620d4a415a", "comment": "Malware payload (Mirai)", "value": "1a81be821b223827415463e4e40f861d876f142b4ad788e06e0e6892999bdf02158e8d4b6e58e4c9c8e80b0933c95e22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607407, "uuid": "7d7a7e03-bd72-47b4-bfee-115515feebf2", "value": "T195145AD3BC12D9BAF84BE73B89470405B130B66310815A33721F747BAF7A0A556B7E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607407, "uuid": "c2d924d6-4043-4fa9-b18d-29a811749350", "value": "3072:x+RuBteH31wEjVM4t1qwBAHSGHVzjbieLx+IycIfgSu1EssMZc/T03ImIys61X1L:x+FjC4twwqSGPLxycEgfEssMOgh5ojE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787607407, "uuid": "c47ebb89-80d5-494f-aa71-85523416f8ce", "value": 203788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787607407, "uuid": "f6cfa859-fb68-40f5-b750-90486da77ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607407, "uuid": "a7ed71c7-d13e-4c07-8dda-57948b6676b8", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942fd345-9f95-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787560021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560021, "uuid": "b67f4bc8-c37f-488c-a7ae-4c25098d1fca", "comment": "Malware payload", "value": "dfa954c171c459c12bc5d6207aa3c0c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560021, "uuid": "3ba6bfd3-1f70-4ed9-93d4-b007007699e6", "comment": "Malware payload", "value": "1e809b5361699f505e401acf98f79034fc89c4e95c9a99aabf88628da836ce3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560021, "uuid": "01941c09-6f77-4484-81a8-66c25acbe9f1", "comment": "Malware payload", "value": "7eca9c165f477e31da1ca97f7b2e6e942d5555ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560021, "uuid": "471e3223-b3d4-4352-b1b3-57943a8e5fc4", "comment": "Malware payload", "value": "e4e80943cba00e7f2b5e0fb6a3650890cad3d0c634cbe41f040782338d56b936d140eaa3bf8e8193776fc83ac86c5680", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560021, "uuid": "02208d20-84ef-4f37-a96d-f97b6981e035", "value": "T1F8C27D966A867C44BEC94A3E4CBD2B1D6DF4C3D1224942AC3D8B3C71DC15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560021, "uuid": "104cbff2-107e-4c96-8687-0b4405c5dbcd", "value": "768:28vCB+25j6es8Rf9FYpMSUpi+20qUpi+20YQX:28l25Jpd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787560021, "uuid": "df063f72-fc1b-4113-9097-5a4b5491b838", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787560021, "uuid": "41b0b795-c978-4354-a1b4-0cd92ff07c1f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560021, "uuid": "8d7c29ae-dbc0-4c7e-b4c5-f6909c1d2b5d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e994f39-9f55-11f1-bd95-42010a9c0009", "comment": "Malware payload (SystemBC)", "timestamp": 1787532309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787532309, "uuid": "599c3d71-a6f3-486a-8e52-9de57986e7ec", "comment": "Malware payload (SystemBC)", "value": "1f4d12ddad20dd3b74bbd9579f0c57b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787532309, "uuid": "314c9a6e-d7e7-4669-b993-72cfee538f8e", "comment": "Malware payload (SystemBC)", "value": "1eb027a9844495e9a3c64bc0c7ea645058933a9b18cc98ff3f42a7b1a9142753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787532309, "uuid": "1c817770-a74c-4764-93f9-5d43c86ce072", "comment": "Malware payload (SystemBC)", "value": "756283303a89e2fc22efd7168e505404fb1358dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787532309, "uuid": "66a40a3b-4841-4393-8f32-17810eb6709b", "comment": "Malware payload (SystemBC)", "value": "8515861d3dd9ca8bf0a90c46578a282dd7d0962cbe6b09b6ffc2c68c1581cb31d695c57f7763994295228b41b2214347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787532309, "uuid": "85a9d19d-f80f-453b-a824-a80b0de3affd", "value": "T1A703F52A745092B1D5918AF03F9EA390C5BE78374269E449EFE0AF0476B1AD7E706207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787532309, "uuid": "1fcb6504-b04f-4227-8d28-dd179f28ff11", "value": "6cf9e3e4ea52048ec6ef92a1a0d9abd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787532309, "uuid": "4ac31d2a-a372-425c-9218-748b64a9ca24", "value": "768:q/c4qHYi1qqdZeG299DUi3LXMEW9o+3goDoJM773R:qUYi1qqdZeGM9DRbUwoDom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787532309, "uuid": "3847ed07-3995-4d62-a86e-11405c265ecf", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787532309, "uuid": "48002266-347a-4d0d-b370-2c2394d55b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787532309, "uuid": "e9eb1b1a-1902-4286-a40d-36c734ac302a", "value": "1f4d12ddad20dd3b74bbd9579f0c57b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee2055c-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576655, "uuid": "3e6a8bab-24d5-40a2-b9af-92f736712786", "comment": "Malware payload (Mirai)", "value": "62f1f60ff0726faa96325abf61980fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576655, "uuid": "f2313a4f-8396-4f26-ad00-3b0fb5fd8c27", "comment": "Malware payload (Mirai)", "value": "1fda08c75ae792e0c5dd76761a07c3e8e939dc29ee05c72327fb8f9a26ab2b08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576655, "uuid": "d194bce8-e13e-44c1-8023-1a5b81b8d206", "comment": "Malware payload (Mirai)", "value": "d2211a7c67a56ec9f346692f39aac4c5bb2c9c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576655, "uuid": "0bfdc7e2-da5d-4e24-8f97-03702ce83bba", "comment": "Malware payload (Mirai)", "value": "e19f50d763593992d0a79b20160d5083983f870523c1fde88926e45d29e19fc6b9d8be16304959b048f853d27628479c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576655, "uuid": "bd92abf9-8712-42de-a0fe-8982d0861d3c", "value": "T1D5C2F7FDF502A9ADF84EFB3EC401410D7A70A72550411A7537AAA937DC333A8193AE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576655, "uuid": "d8f3d3cb-4fcb-4e9a-a913-2afaa6fab325", "value": "384:KPda6gfFNg0fPL7WAlJFLMhOmJpcFuSZ8HAp3KV7Khb26oNuIkfabiQcMs:KVavfFfLW8FuA8E3Kkx26kuIkf+idMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576655, "uuid": "cec5135e-7b83-4b52-8ffc-75f551812084", "value": 26456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576655, "uuid": "ef843acf-8a62-4a09-b831-a691ea6553fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576655, "uuid": "82ed26f5-f9a4-4765-979e-308f8f98626e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bfa61a-9fd2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787586332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586332, "uuid": "e7fa7743-7e6b-4800-b17e-606e540f3dec", "comment": "Malware payload (Mirai)", "value": "cff650168c633999c80884d2bf5e069d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586332, "uuid": "01666417-e1af-4c96-89ac-2d7b4b892b42", "comment": "Malware payload (Mirai)", "value": "202c64b8adf002065f9f272d9ee2949bc1b71411ab0f332ca3daf1d36cfbcd7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586332, "uuid": "d23b5bbd-3d7d-4700-9594-3daad3ad899d", "comment": "Malware payload (Mirai)", "value": "07f603e79bcf904d4558f13b61c0c9630e3a5bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586332, "uuid": "7867038c-4533-444e-b5e2-d0ef69dad2e8", "comment": "Malware payload (Mirai)", "value": "79c76f2f313c61afc6eae9212a4cbe4e1edcea034392aa11c8ca747a8f5ce93416fa33e3cdb5034f09431a375f16ebf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586332, "uuid": "064da765-bf50-4ab6-bb9c-68739d154dde", "value": "T199144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586332, "uuid": "e6aff049-923c-465d-b90d-6d0f870453bb", "value": "6144:roAr/Tah1if9UVcYEEUYDckzjR482pwzihN2B6OTEkm:7rGhsfucYEEUSnR48Bc2gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586332, "uuid": "9d21eb95-56f8-4df9-b432-a887c0c67a6c", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586332, "uuid": "d16d3ac7-3be8-490b-8dc8-c885e0bdfc92", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586332, "uuid": "cade5d85-e343-457b-9f24-34ee08158860", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932b8ada-9f5e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536397, "uuid": "dde00d63-03b2-4ec4-a37a-109571d762ca", "comment": "Malware payload (Mirai)", "value": "f32bfdb5c98f92d79c984759ddbe124b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536397, "uuid": "c3750a88-c370-4976-bb2b-11a6e6cdf8be", "comment": "Malware payload (Mirai)", "value": "20b7849f1b98ff63fc9ae31d2da8a8145e496815bcd5a228f01061063f46216c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536397, "uuid": "c9c61322-8f77-4155-9523-ffc3d10b69fe", "comment": "Malware payload (Mirai)", "value": "8d58af9737cf4ddbb736e24c6c4a009fb71d1794", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536397, "uuid": "96be3044-2eb9-4620-8be7-69e4d016bce2", "comment": "Malware payload (Mirai)", "value": "855efe4ae8f235bbbd4db63d3e77a03ba93aca4040b2f3659c7d54cb24dc7cec68d43318276b6e393fa9b9169e8bb2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536397, "uuid": "218a519c-c3e3-4f92-aba5-18c2f439a852", "value": "T117545B5F7B10CF61E229C53149B38B5667E5266327E2C559E21CEE087E6038C682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536397, "uuid": "4eefd3f6-1e55-444f-9ae6-215b2e9255ba", "value": "6144:gM5XK4YODabLHG4kq79xu6h+l2rVXxEeJDh:r5XZXWzUR2rVbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536397, "uuid": "d8a6deef-544f-4eaa-bc0b-8df617d9d4ba", "value": 287352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536397, "uuid": "6d22c035-2831-4f45-8697-17eb23d0455b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536397, "uuid": "7e521ff0-4547-44dd-80be-47483bd34ce8", "value": "8e43add0886d834e856cdbda15be486bfbb368359d21cf8d3550bc854978878a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fd49cd-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576749, "uuid": "955c080f-ca20-4835-bd6e-7a55a508471a", "comment": "Malware payload", "value": "ab5c81020a09a6751ecae6d02bddd871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576749, "uuid": "b0920a38-289f-45bb-8650-8ba05505a775", "comment": "Malware payload", "value": "2169a8b6e41aefbf0e5f709c4ac0170a258c027aeb3869d5740844bbf06c1f0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576749, "uuid": "23203bc6-aec4-40bf-8e53-94fc75c634c4", "comment": "Malware payload", "value": "342827977102b7e6ed28f6100f74919b6e052e0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576749, "uuid": "b88c6450-d1ac-4a4f-a328-7ecb3bcad0d4", "comment": "Malware payload", "value": "7b82a179c528108b27471d7a51343a0b8da782d544c9b15a6428744e3aaa822829b1c28b1a89ed0f31340f9b2a845ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576749, "uuid": "c1dfbbb8-852c-4779-a09f-d9c687c52fa0", "value": "T1CDB2090677580E5BD1AFBAB03A3F1BD493EBFF5122A4D681160EA7CAC1B5E371141C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576749, "uuid": "1d480986-ed68-45d7-bb43-f2e5fd5c2119", "value": "384:rRT9osofADj7cIxakDJTDx/7NwgAVjTdAkA/bttVLV3OZH:rbom7cIB1VzAZAp/5tr3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576749, "uuid": "6b0cb49f-fdbf-44e6-9f43-e930822c2c11", "value": 24016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576749, "uuid": "8c5551fb-a407-4929-a922-f3bb16304983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576749, "uuid": "8514ae7b-35f8-400a-a570-eb486556595b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c123fe17-9fe9-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1787596174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596174, "uuid": "c5b33ceb-a905-4d63-b6c5-eb9fd78bccba", "comment": "Malware payload (CoinMiner)", "value": "93f21ed26c833208d70dc98b33918bf6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596174, "uuid": "e55e1b3d-c902-43f7-92fe-a24bf65356b2", "comment": "Malware payload (CoinMiner)", "value": "2199808b5669b6d4d316ad5f0f2ec8a29c796f178ee43ce2c1166d2d468cecea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596174, "uuid": "2988b301-7806-4055-a256-49fa53ffbf16", "comment": "Malware payload (CoinMiner)", "value": "169efd994b894301bfa003cd782dd2af8bff305e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596174, "uuid": "3535eb47-93c6-4a95-8997-337c653c2d68", "comment": "Malware payload (CoinMiner)", "value": "831e9d8a6f1a11ef7b98b48ccf004a17251e2f635042983499c496312abe6afdf261a3fa898b79a1c16a77a65147cbef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596174, "uuid": "45732e46-ca44-4ebb-8e10-c25f0fc98aec", "value": "T10E22D51E2E860331EE6008B0E675864A113D5EE37386FBEBE733D6870AD5D4584C06AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596174, "uuid": "a28d486b-a200-41c8-aa54-a4599699e441", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596174, "uuid": "dd872ba0-bacd-4087-8ef8-77e4b7c44b2d", "value": "192:bcolWLwziNBQ5tsxeugRPFJxTEZmFhEorccGFGp:4oBiHAvPFwZsMFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787596174, "uuid": "2fdb119c-9ce7-4f7a-86b7-5d14930d9034", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787596174, "uuid": "c024c066-2063-4125-a05a-ce01f786ff25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596174, "uuid": "ada8fd57-44f8-4800-bf9d-14746bb1d9d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51484786-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "ce225263-5304-4b80-a5b0-c384ba33364d", "comment": "Malware payload (Mirai)", "value": "018c21a952fcaaeb90ed5aea53585553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "1dd5df9a-dbec-449c-a029-20e1237b4c23", "comment": "Malware payload (Mirai)", "value": "21ba21ea41967d3f8d9c3e08bbc2dd5d865c2ac12afda9854b7531ec01f06bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "8cb270a6-eb9d-47ea-990d-d281a05049c1", "comment": "Malware payload (Mirai)", "value": "bdfab22c160cef998fe26d8c14052e60e75c27c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "4161b7d1-f381-4863-89da-28134f7cbc2e", "comment": "Malware payload (Mirai)", "value": "257fb7f6b3728c28082955539ddaf5a9bdd30f5b583a333dc83d089e05c9b05bf781d9c76860f921a9d140ca4755febc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "b3f6d4e9-7716-42cb-b9ca-72414d24fb2c", "value": "T13DB24C86FD814917CED11137FA2E828C37664BB4E2EF3307AB265F642746A1B0F3A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "5ef00db1-cf04-4e93-b251-f45a786c6f52", "value": "384:Zi1e4fKN9F32SkSb1TGdAy31pBGST5efRBjMeY/Fx4e:ZaePt32SVNGWi1jdQjMex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576659, "uuid": "892544b3-2ccd-4ad9-b02b-b1578866c5bf", "value": 24600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576659, "uuid": "c0076cb4-ad84-483f-9ff6-20f56982a75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "9ebd2fd7-acd5-4ee6-b2f7-50093fbadaaa", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76052a4d-a007-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787608933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608933, "uuid": "8d03d2a3-d438-46d6-8eff-1cd76ffd8742", "comment": "Malware payload", "value": "71d75b8cd84cb874b92ed8cc0efa8042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608933, "uuid": "25a06ac8-3739-4cb2-bb83-ecf4b7353637", "comment": "Malware payload", "value": "23b3344bfa7fab78adec1754aba67f57b468a3ea052d56522770ef99497e499b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608933, "uuid": "8a216798-83d6-4201-940c-22ff109f4bed", "comment": "Malware payload", "value": "017e9abda7a2c6412f824782dba680400860d07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608933, "uuid": "765943b5-76e4-42fd-96ee-3e78dbfd919d", "comment": "Malware payload", "value": "6342f74940bacefdefce152a3ddfe0846f975bb04c22a495ab3df2f38e3894ecf75030788e06e81be10c0398fc0c3c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608933, "uuid": "df720d02-fce5-42fc-add8-7f69328b2413", "value": "T12F74234662D7678CDCDE9834039931C3AE0F777CB985E77A90BED9AE33609348E45848", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608933, "uuid": "b319265b-9ae8-416e-953c-f07ff2edbc19", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608933, "uuid": "9f01a598-e386-4d87-aff9-48674083b31e", "value": "6144:6i17fe5lQvi+WglLT7SfvujsJOYasCbKY0qEluDeVplyomdL0L09yXRy3oy2UVIv:6m7fekvi+WgLT7Sej6OYHCbK3qguU+dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787608933, "uuid": "4e7a3929-0c70-4268-81dc-03cdc2ad36be", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787608933, "uuid": "e316b193-3035-49ba-b6e5-ba986e60f731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608933, "uuid": "37158e13-6da9-413e-abd3-8432fa838fd1", "value": "23b3344bfa7fab78adec1754aba67f57b468a3ea052d56522770ef99497e499b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa4ed05-9f53-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787531577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531577, "uuid": "81a0fb98-5055-4b92-8091-708bd5148614", "comment": "Malware payload", "value": "f8d7fb65d4864427178d1d9241f04b6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531577, "uuid": "0bde2d0e-887a-4ff3-9d13-7ce319d01113", "comment": "Malware payload", "value": "2445e07bc216418817a5e2dd276e0a8426157557b5f4c6e977d8db9c761ed224", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531577, "uuid": "aa45e7b5-82a0-4345-af76-97229bfa77ef", "comment": "Malware payload", "value": "b0d27650ac5e6e0d50bdff4015ef04eb138c1c9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531577, "uuid": "fa016a2b-dbab-4b80-8de6-2d5a8f847045", "comment": "Malware payload", "value": "849e5ab086dc92cca270da6e2a75d420ef6140617fe52d9234dfdce20eeb640b23c5fe404f3e46eebd48a9ce3729e42b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531577, "uuid": "36cbd66b-4e8b-4797-ba28-c36183a02368", "value": "T15D236C6516857C14AA99C4375C7F2F0CBDAD43E6314492EE7FCA3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531577, "uuid": "f5d00aa3-8f9e-4963-8b92-a4edd424f8af", "value": "768:399NyXsZztCm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:tHusZ+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787531577, "uuid": "666276bd-3c41-4dc4-8ec1-f8c55cbddbfc", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787531577, "uuid": "08370bc3-39c8-48c3-81ca-047218723bd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531577, "uuid": "52a2e29f-3a61-4877-a7f3-f7faeb9db018", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa62d48-9fc7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1787581488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581488, "uuid": "c233a3fe-57c0-4313-bcd0-7f6a01cf9e7f", "comment": "Malware payload (Phorphiex)", "value": "a3496c7444db218caa294632b658931d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581488, "uuid": "d0a5f525-49fb-4660-9b42-a368f6e709b6", "comment": "Malware payload (Phorphiex)", "value": "250b1960593c2f18862ab5579c4830c26edec0a7b3238cf76db83337723cc431", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581488, "uuid": "a4e58640-8336-43f0-8695-9636ab924600", "comment": "Malware payload (Phorphiex)", "value": "5ac2ac8f5d6003a2b046aac26265379d0247d211", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581488, "uuid": "21b13cd3-be4b-40fa-a38e-7a45a2127bec", "comment": "Malware payload (Phorphiex)", "value": "959d218660ad6fb8ba5ced7a3670b5096689063510f3f3aafcf917d88fe2cf1c514abca41547c223f96b16f784de1e44", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581488, "uuid": "92ac74f1-9775-4c9e-95cb-a784c840d7fe", "value": "T15E824B0FB9424326D0E11070A676867BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581488, "uuid": "38315864-7737-4fb5-a4c6-cdd32af5717d", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581488, "uuid": "3bd35f73-7ddc-4c7f-8f19-5173cb414404", "value": "384:X26I8vVaF6OeYUQQlmLu94gXTczlmxav8U9cEl:X2PvUQQt9U8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581488, "uuid": "c507037c-4cad-404a-ba97-dd63a3feed40", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581488, "uuid": "5789901c-783a-4c8e-ac6d-621ed4a5f88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581488, "uuid": "6eb1b5f8-741e-4890-a349-89504b9f4869", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e75c98f-9f61-11f1-bd95-42010a9c0009", "comment": "Malware payload (RevengeRAT)", "timestamp": 1787537704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537704, "uuid": "70f9105d-7e36-4b4b-8a58-925abc43df87", "comment": "Malware payload (RevengeRAT)", "value": "25e1a98bf6b4ac5596ee8c805f80aea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537704, "uuid": "4d28a9d1-e672-498f-b30f-3619189bf6e1", "comment": "Malware payload (RevengeRAT)", "value": "255c08bad1b9fb0092be6870923e7918cdd11b07fde4657875df8363af9b8843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537704, "uuid": "aa588792-2e1d-4a17-9ca0-4f55581911fe", "comment": "Malware payload (RevengeRAT)", "value": "2dd5b7bee66dcd5090b0c2a8f8765dd9f886495b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537704, "uuid": "17b805a1-192d-4c8a-a242-bc91b24815dd", "comment": "Malware payload (RevengeRAT)", "value": "ab665e9d59edec9a1c1f5bffe476a0278a3b256b38daaa5247273ed3dda0461604cecb5f6abb725242c9e0a0c578a609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537704, "uuid": "60865b66-01cb-40ff-b5bf-8da2956348da", "value": "T1A883F802F7879762D56C017500DB21A013F1AFDB5E73D51B3D88339DAA337929E89B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537704, "uuid": "af4b8a91-96f2-41cd-a660-43fbd29d8a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537704, "uuid": "88a1532a-d2d8-450a-a291-0fb8de1c3e40", "value": "1536:r0zrrtiJbi2Xj5XqnYFx+tqOW/AwSlWbYTjipvF2a:r0EB+IOWY2bYvQd2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537704, "uuid": "89bb4720-f727-49fa-9f13-5c52cbc86bd3", "value": 86350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537704, "uuid": "925bf014-58d8-4c24-bf70-adf4e950e08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537704, "uuid": "eb247817-b4aa-4807-b6db-4ac34800f529", "value": "25e1a98bf6b4ac5596ee8c805f80aea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20167268-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (HypeAgent)", "timestamp": 1787577865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577865, "uuid": "c841cf04-c4d0-430f-8bc2-09d8e96defc5", "comment": "Malware payload (HypeAgent)", "value": "58371eec5593257a4362ef5a8ff15473", "object_relation": "md5", "Tag": [ { "name": "HypeAgent", "colour": "#21DECA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577865, "uuid": "32f50a12-887d-458f-a2a5-99e7139df4f5", "comment": "Malware payload (HypeAgent)", "value": "26efd5bad5abe4fb1087b4c7d545c40e0e3c8f4c65703d91a67909587b66b13d", "object_relation": "sha256", "Tag": [ { "name": "HypeAgent", "colour": "#21DECA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577865, "uuid": "29a8085d-627f-4a43-ba27-0119fe22a091", "comment": "Malware payload (HypeAgent)", "value": "02168ea78b1096e465c9569ec1ba503777298daa", "object_relation": "sha1", "Tag": [ { "name": "HypeAgent", "colour": "#21DECA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577865, "uuid": "019fe8b2-19d4-484d-9c74-bc61491c12d2", "comment": "Malware payload (HypeAgent)", "value": "9ddd57ec9cd7569540b6ec6d01ff8e7b306e609cb73b947afab3af038c5523f214978dec1565dd708b407056a0ae06eb", "object_relation": "sha3-384", "Tag": [ { "name": "HypeAgent", "colour": "#21DECA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577865, "uuid": "4e5c4363-faba-4b89-aba6-254472c18533", "value": "T1E0A5B939AF46467E2F72EE12C9C52036F15473632A9F6CAB40C79E8F4A62644D3C744E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577865, "uuid": "ba21bcc5-b18a-4a11-8782-89d45adb1096", "value": "6144:Lgd70BQcU3RWEabsKBDI8V/q7TfksCI4yDaHqnjm:0d7PcUwEabvBHVWTcsCI4jHqnjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577865, "uuid": "0385e780-6d1c-44b3-8243-08b441467ddf", "value": 2112160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577865, "uuid": "6c3df818-3994-4d12-b6bb-a1e01fc90f8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577865, "uuid": "b1e6843a-a486-487d-881b-5f17f4fee2b0", "value": "PI_93842_Remitance.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41101f20-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585651, "uuid": "53aa40f5-0e97-45f4-9a2f-ca28459d5379", "comment": "Malware payload", "value": "1f0b251cf7d41f433d99da067dc27058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585651, "uuid": "35a59894-8b20-43b0-9b79-079d50b3a1cc", "comment": "Malware payload", "value": "2847a02ead80a60c25245bca169655b89fb2c724cb7bd7ec184860d94336b9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585651, "uuid": "d6681299-39e7-4f28-aca7-eaa295d6b9d9", "comment": "Malware payload", "value": "017ec058de8f55b34d3bfb6826c5f88a1703efe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585651, "uuid": "5963c270-ed8b-4acc-8761-efacab66b157", "comment": "Malware payload", "value": "dc645474e89d33a07f0489e46d7b3b00141e1a5ac893ca26d1425cbd031291c36a11e216eefe2cf997cd1fc71d58b800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585651, "uuid": "d8582c4a-a744-434a-aa69-3b0c8b0c611c", "value": "T1B1656C17E3A345ECC56FC13483579776BA70B8290634792E1A94DB322F21E909F6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585651, "uuid": "91cd5243-c599-47d7-9ee2-543a0c1c8b4c", "value": "d3a615b1875384c0ec55dd8588433cef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585651, "uuid": "21c87f6e-b512-4f84-abb6-2996f5166f25", "value": "24576:fRRrN/cdW0DUX4Pt+ZbdQJslUJ9zif9PEuBgfb9/zJhVxfcjUq:7rN/cdW0DUX4V+ZblUJ9ziPRBgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585651, "uuid": "cf599d6d-2392-4887-92e2-6643db8db374", "value": 1453568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585651, "uuid": "8b4c7b7d-c07a-4b28-bc47-3bd58c5dd01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585651, "uuid": "f69cb92f-9f1b-43b5-a156-a616ca3d8530", "value": "stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66113e4e-9fc6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787580988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580988, "uuid": "d3455df5-880b-48df-8d04-7b13a2255ef8", "comment": "Malware payload (Mirai)", "value": "0e2248425277899c2db00859f46ab5b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580988, "uuid": "78f73d87-5919-46df-9bc5-54caf84aa7ca", "comment": "Malware payload (Mirai)", "value": "29fb2896608e2b8250ae782a68c1c10e0fc02b2e312da5a603cd8d491f4d0f89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580988, "uuid": "a1824951-584c-427f-aea1-c8378a4ec5d3", "comment": "Malware payload (Mirai)", "value": "db343c14ae86b6271be4193d199be2ab8ac7914e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580988, "uuid": "d234c901-e0aa-4383-a391-6976f716a0a6", "comment": "Malware payload (Mirai)", "value": "dc8fbafc0fd191e13f7da68eb2634e7262f31ebe564458ac722f54beaa21fa17175606ff515fd6b7b7580a40dd9fdfdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580988, "uuid": "002516c6-38c5-440e-88c0-da8577624f3a", "value": "T17603F164AB66CD56E2D13A72A9761DC63DF325B4C39F70631198CD8CA0A6FF0382D183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580988, "uuid": "f106be32-b562-4764-81ae-eaf6bbc0f2d4", "value": "768:wuDagzEQ8rpQIT/qvsPUnUBkdEGXL2DDWsRIc4bkT7kD6bIl9q3UELd:lDagGmQSwUU+WGiDDWmIk7k+bI4Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580988, "uuid": "4a9248d2-6606-4576-96da-4d1cf7cfe03e", "value": 40372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580988, "uuid": "f19a2db4-17f8-4659-ada5-6a02e1204b31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580988, "uuid": "a33da374-314a-4ef1-afad-3305fc13218d", "value": "daredevil.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5483ea79-9fd0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585254, "uuid": "7bfcb5f6-dfe3-409a-ae5a-0695a45f1c59", "comment": "Malware payload (Mirai)", "value": "4407bfea25ab93b6dadf72d0f791dd09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585254, "uuid": "ff099fcd-2187-4490-80db-4996e63a5f5a", "comment": "Malware payload (Mirai)", "value": "2a54c2000244c2f1c1cbc15597c7bdf1faa4592a0b15f5954150616e5f0b8b09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585254, "uuid": "4cb3c634-1fb5-40d9-8450-ef40cd7e95df", "comment": "Malware payload (Mirai)", "value": "b6031a44c53a092fa4d7a7a619c4e0cdca04ec6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585254, "uuid": "8a3b281d-6e54-45b9-93db-85a43e1c17ee", "comment": "Malware payload (Mirai)", "value": "22836a7ccffe96bcf95f2f04060ce1a7de2d3d309ba98f8cc13b110e1313f7eb682c24593a018a7f16c67b48dd32e688", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585254, "uuid": "bb3b0fdd-f6af-4493-b786-2ae62dfad672", "value": "T13CD3127D2B5BDAE6C0878A7FCD29CE67B4E02E593C0D8FFCF69402194596A25052073B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585254, "uuid": "c626242c-01e2-4172-98ab-5e510b06e0b8", "value": "3072:8NwRzIOrjSf2aljNPEAnJCoVGw4Z6r8SMK3DILp6EIU:8a5IOrjSOalBHnJCWD0ulMK3tEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585254, "uuid": "60464e80-fdd1-4c16-8f7c-f4bb6e3cf0f2", "value": 140060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585254, "uuid": "ed6aec88-3e07-4846-a2f5-155fa1c99912", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585254, "uuid": "e7dc5eaf-c04a-401a-a948-c768aad0b205", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295423f1-9f89-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1787554687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554687, "uuid": "1c525c26-e664-443d-b0bb-fef27fc98901", "comment": "Malware payload (AgentTesla)", "value": "495ea9f9bd52e4282ac6732abd43e2c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554687, "uuid": "caf2c53d-0109-4083-a817-55031222717c", "comment": "Malware payload (AgentTesla)", "value": "2acc3c29b9551744095a0c597af172ad168589e95fd3521cd795f31651cc7a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554687, "uuid": "3962a2f4-92ca-4afa-a890-c8dc2ab6d660", "comment": "Malware payload (AgentTesla)", "value": "2714ffd5a5b8aaefd67c25ea1a790f20ee10890f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554687, "uuid": "7a21d228-ac15-4cda-ad07-d3f6463bb89a", "comment": "Malware payload (AgentTesla)", "value": "4219d37fd8145f75ec3643204e09d2c728bcd365b2d5e90f2594e045070126a6f0c186380c64af248dc389c3f24905f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554687, "uuid": "5e51be7d-0ed0-4b69-a6a0-b8b006c587a4", "value": "T1BCB42387B368D077CA705233D06F5DF629779F2099A8AA2727005F5ABC717E88C1F524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554687, "uuid": "fab78a0e-8fa6-48ab-8445-eb5dc568f006", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554687, "uuid": "62cb8ba9-9369-484b-b565-acede3e47959", "value": "12288:uXolILUscaTCy2t09lHTQsOk8TWJVhLPxpJnh/mO:uXolILUS2idssO1W5VpJntP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787554687, "uuid": "0f57a3fc-36ac-4e03-85db-e93809dd9d73", "value": 523340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787554687, "uuid": "b4d5ff21-ff0a-4a36-9b4f-a3bc5539befb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554687, "uuid": "1c133a1b-8b6f-416b-9bc1-3534da8e6cf1", "value": "ORDER_10.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a153d-9f98-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787561221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561221, "uuid": "a83983c4-e9dc-4b0a-959e-6ba9cef11c52", "comment": "Malware payload (Mirai)", "value": "0f629bd86750803514e74d331e8f12bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561221, "uuid": "b83402ee-f95d-480f-bdd6-d52b3ef0f204", "comment": "Malware payload (Mirai)", "value": "2c6e71bd8e001c18d1e934e6b1debad563ac87a122ccc44ad50b4b848f3e708e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561221, "uuid": "79efeb16-fd2b-4603-9002-d40140fbd57f", "comment": "Malware payload (Mirai)", "value": "7d2b192eb2b279709bb3f1a1a32baa92edd38743", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561221, "uuid": "c17c759f-95eb-4bd9-8804-73b8912c9765", "comment": "Malware payload (Mirai)", "value": "aa870040ab38cc83c35027c541cbf1202b0509b8b3e08b6010fca069684d00b42a0cb4bafcf25c39654fd0fd3f1c1014", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561221, "uuid": "5b8054f9-14e4-4c02-a636-0ff846909a5d", "value": "T1503132DA18202A310102CE5DB7A6345CB28F96F72DAFC7A49C4A4DA9954839CF263F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561221, "uuid": "a7567030-80e7-44d2-a14b-2d108e76769c", "value": "24:HMAbeF3beFlyF2IFJ+yxg3Mexsva63ZUNXIcYT:HMwUARybveLYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787561221, "uuid": "234e98ff-d770-4985-84f5-a75b9d7a2e48", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787561221, "uuid": "c9e13a9a-2781-4df6-95c1-4cf2f145d7ad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561221, "uuid": "1b084e9e-6adc-4712-a8d8-f51d27565f1f", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e197637-9fc9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787582237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582237, "uuid": "ef237b40-a695-4b46-878c-b707cdd9ae95", "comment": "Malware payload", "value": "85789a29ecc015d73e25c031f5074938", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582237, "uuid": "0283905a-1485-4219-acfd-a8097fcc68b2", "comment": "Malware payload", "value": "2c87f833e38c2c3988aa02d7e3e442c7ec0ae6029e68e72f6948613f22b341ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582237, "uuid": "d19729a7-f413-4da0-b96e-6b143128145a", "comment": "Malware payload", "value": "a3c7daa86ca4851a2141c3cadad5d46584da796e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582237, "uuid": "6b207ac2-606a-427b-a455-aafbaffde60b", "comment": "Malware payload", "value": "f5efe6a6a3d5f6077f118be1c0b9d6d9677b166a2896a9eeffdbced8a551d6ae2794febfe0e19a626013d4f64a72bc32", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582237, "uuid": "544a88e6-355a-415d-9297-03cb9fdfa25e", "value": "T1FF236C6516857C14AE98C4365D7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582237, "uuid": "17d4bdd3-742f-45db-9193-45fb569c0115", "value": "768:yr9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:cHusZpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582237, "uuid": "f38c5aca-1bc4-42c5-a104-dd46e614a2c5", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582237, "uuid": "d8ca2456-ffe0-4d48-805f-fb354567d905", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582237, "uuid": "2a577adf-4660-490d-a59e-8f182e596652", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eefb1e7-9ffb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787603820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603820, "uuid": "6080641f-fa84-4a30-82a6-76fa645eb886", "comment": "Malware payload", "value": "e78d104a52b103650df89351edd09729", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603820, "uuid": "bb0f3f8e-7e9b-4922-b0f8-c0b2efe67f8f", "comment": "Malware payload", "value": "2cfab543fa110359af5b5b1c525091c0dffd77dee1be7b034c3e9194be675a6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603820, "uuid": "5d664362-79b5-4472-b562-e0090c952c81", "comment": "Malware payload", "value": "60b0526295e7bdda6c12fcf3d4d547733a10b2f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603820, "uuid": "8bc19f10-ebc0-4313-8e82-2b16a73923f4", "comment": "Malware payload", "value": "92ae7687b2ac6ad9783e8c3af0aa38f3b407195debe4ea3853193ebfeb9339328b680b48e782cd37c77aa829b4ebcb91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603820, "uuid": "d2b83998-84e7-48d8-bb81-c18e6df977fa", "value": "T1DEC28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603820, "uuid": "33bd8401-7f17-459b-8623-c81a5ff8fb5a", "value": "768:88vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:88l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603820, "uuid": "d78bc421-af47-4219-ab51-d379adbc0c04", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603820, "uuid": "0928bbb4-7304-400f-8284-813112b42eb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603820, "uuid": "c4760b2b-a087-4968-b997-d33f1482fbc1", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2533fc-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536920, "uuid": "6afcd258-87ca-487e-a577-c73e8df3bf72", "comment": "Malware payload (Mirai)", "value": "db10f2d9a9f84a7330bf5344d4d83bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536920, "uuid": "30e02566-676a-40a2-a685-7bb6d86fe7bd", "comment": "Malware payload (Mirai)", "value": "2d35e56e6696dc96cdefe099424ef6432a145f8f7add13ddc0b866c5d8243efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536920, "uuid": "b590c0f5-b4c0-4743-81c1-c591cd18968e", "comment": "Malware payload (Mirai)", "value": "51ef9d1a1b946f8303a22ad149d758ed4cb10b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536920, "uuid": "d2e738ef-3032-4272-8b2e-dc9b0d915434", "comment": "Malware payload (Mirai)", "value": "47c2b66c86e19ac6e4880316a637f1a587fce19fd181980e7e78a92f2d3978cdc680fd960a26a04ea56b2304973c6cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536920, "uuid": "a398779a-f1f5-4949-b505-eba6211dfbf2", "value": "T1AB830223150E7161E8F11C39F229D1157C1AC161E7683996F04AEAB953D02FCA8F9FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536920, "uuid": "a44aa0c6-cbbb-4101-b6aa-09fe5ef26fad", "value": "1536:kSb722VEtZcd+hzth1rRBa/YaXfp0tVhjw6PFUPbyyL8jf0:kE722VEtioJhTo/YaXfcDjRmbyyL8jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536920, "uuid": "b6a2375c-886c-4672-8289-e7f2fc77313d", "value": 88392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536920, "uuid": "1830f730-ca4f-4c6b-97ec-6f1b4d80a971", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536920, "uuid": "54bcdc0e-6791-40e4-8d1a-af40d672c465", "value": "2d35e56e6696dc96cdefe099424ef6432a145f8f7add13ddc0b866c5d8243efb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19c19ef-9f93-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1787559318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559318, "uuid": "90289ee6-8047-4dc3-aa33-a89368d1c9fb", "comment": "Malware payload (WannaCry)", "value": "e256669e66df22bb97c0a7ca417f4928", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559318, "uuid": "a0203a40-7472-4de7-8b9b-8f816dc55989", "comment": "Malware payload (WannaCry)", "value": "2d658d64d9f8d49cd52f7e249ab58759113a64f2906f0035bcef8440f0abb239", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559318, "uuid": "090d9179-256a-4069-8d9b-52abae760efe", "comment": "Malware payload (WannaCry)", "value": "726bb87e197c72e83f4e32b3fd94dcb499596cda", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559318, "uuid": "d974b866-a438-4e66-9082-2913814c40e6", "comment": "Malware payload (WannaCry)", "value": "8968da66465e8d583f65724c3cfc63a9575a3d05344ba0965783db72726996cb71ff41d8b280883d014aa1cf5a649609", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559318, "uuid": "9903a377-9277-405a-8579-db5d806375ed", "value": "T10E36225631A840F4D1076234E8B75F11F2B7BC6A227A560FEB508B362D13B92F728763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559318, "uuid": "c5209fe8-f741-4c01-bc25-5cbe60139c8d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559318, "uuid": "7e51fd3b-9953-4a67-8bde-1b82a01b1b0c", "value": "24576:jbLgBbLguriBJMSirYbcMNgef0QeQjG/D8kI:jnsnGMSPbcBVQej/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787559318, "uuid": "04a3f31c-a4a9-4f4b-9095-94f9c74957a3", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787559318, "uuid": "737f4315-feb6-4eb4-ae74-aac7a2212fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559318, "uuid": "8ff17fa3-8674-4e8d-8d0c-bd9db1079d6a", "value": "2d658d64d9f8d49cd52f7e249ab58759113a64f2906f0035bcef8440f0abb239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fb489a-9f98-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1787561225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561225, "uuid": "892ecb63-edbb-4fb6-84cd-502a101e974f", "comment": "Malware payload (Formbook)", "value": "b20aff73cdcda7ee29b0e3f28c85d796", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561225, "uuid": "0298b2f5-2e76-4895-a28f-de3c5e3033bf", "comment": "Malware payload (Formbook)", "value": "2da298f74981ccb598542ebd7141e419ee1d3c5b3bbb7ee66657cba543c1d1e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561225, "uuid": "a8acda28-75c6-457d-b137-7cabad7d1992", "comment": "Malware payload (Formbook)", "value": "ab9dc6cc0f78d677fea76f51b59b58edb6efee71", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561225, "uuid": "11b8999a-3322-4cd8-a055-cb548f6d465e", "comment": "Malware payload (Formbook)", "value": "6748f46c569ce6b218f7a2fa757fa93417de54d2c619c9280084cb5f6eb55553c62648672521038428a057d0b54cbd09", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561225, "uuid": "0efd26a3-06f2-4acd-ba9b-58aa905d6eff", "value": "T195639EA21E28C0E32D5DB45460C5DFEE867A7127ADB94E0717248BA2CFBD1C73E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561225, "uuid": "5c82c9b8-c458-41c4-80a9-810862a72cb8", "value": "768:MBD2RXab/eJBhSsFo3kTTl77sZAk76vqq5O2JtyTQ/ee9EkVBGJVDCCZyaBxsNZu:peyxkuJA2psU14n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787561225, "uuid": "4a42ad49-eb14-43ce-a9b6-cf1b76dbba02", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787561225, "uuid": "5c311f1e-46d0-43c5-a4db-ba21627130fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561225, "uuid": "3b83eb4d-17e9-4b9b-9cba-742ca78e5212", "value": "RFP-000000189836 (AA-26125-MLNG)_ 24082026_ 11.59PM.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff4c2e-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787584996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584996, "uuid": "6ad6d274-83fd-4039-a5e6-6239d6b5576f", "comment": "Malware payload", "value": "d0ae890a904e2a3c53437cca746ace56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584996, "uuid": "934d69b1-caa3-4fd5-bc15-f4a769557f8f", "comment": "Malware payload", "value": "2dad0277fc973f027d20bf4cf1faa34420c8aa7bc48760a30a760f3d5cad66f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584996, "uuid": "a4b4968b-4602-4677-8377-ce6315057ec5", "comment": "Malware payload", "value": "683c3aac5fcc2b505312edb6b9dd1c3957a1194b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584996, "uuid": "4949cee1-8128-42e5-869d-be382aa95668", "comment": "Malware payload", "value": "980867b1e7ccaf364669fade508220a6777e9f985606f9a63b4f5936a3f170be442a31a853b8ec5983c9f4246640b32b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584996, "uuid": "f342c975-d812-489f-9abc-bd6b8bffe0b5", "value": "T184A33A4B660775C4F17001F4A7CE4BD13F2360DB2B3A5DB6AC6912F3ABB319A181DA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584996, "uuid": "570398c9-fceb-4804-8cc8-d0d6dbdbfa52", "value": "1536:OKUe48jrpaUkCiALb5VdtzpVzRc3mBlE4RGE9gneUn5p5M/LWz:OKUe3jrBkCT3DdtzjzRcW799gehqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584996, "uuid": "86057d09-969a-4976-9ab0-466f73884079", "value": 99808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584996, "uuid": "edfdb402-b242-437f-96ec-b5fc5f1f027f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584996, "uuid": "ba31a4e3-1495-4660-8863-bb38b4d578f4", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a51c76b-9fdb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787590096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590096, "uuid": "92c97d2f-7d22-41a1-9357-fd95f1eb35b3", "comment": "Malware payload", "value": "bb06a8f0af94c96f430132a02e8f4910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590096, "uuid": "ae0b1c26-8c78-4e88-8c1d-1820fade7fdb", "comment": "Malware payload", "value": "2df2599e1f1e5555723ebf783deed130702a1f3484f82d7fa2a4963507b57382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590096, "uuid": "e81bcf70-8aba-479d-8808-38dd82eb7281", "comment": "Malware payload", "value": "f4d2d04ca3b422f10806cd83ce0ebc27ae0e80c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590096, "uuid": "c02e2295-e028-4d8a-8f6c-b63d35dae70d", "comment": "Malware payload", "value": "b6bd49167ef5b136fec2f36f04bdfd6b88196f87a5b584b7028163af53de3a91d78f930d53aa761552afacdff82370e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590096, "uuid": "709ee6ef-cdbd-44fb-b930-ab8503ff9fe4", "value": "T1CC283303B99441A4D4669B31C5BA9353BB35B88E9B3673C33F44A2381F367D06EB9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590096, "uuid": "955cad8e-4010-4d0f-aaf4-91430f3a2400", "value": "1c1ad2adeb06878a984583db245d2aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590096, "uuid": "d860ce62-f51d-40af-a124-2cdf7ce5db6e", "value": "1572864:wxkUCeVV5U2nMJtbNf6pSNIeQfcLU4SevDjoHqiVLgYqqqkTEYWZ74:/9Qg2Mb5SsL3N/baVLgYqqqoXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787590096, "uuid": "fa6f7c02-3268-4183-9a28-4c1d8be25569", "value": 96314480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787590096, "uuid": "11697349-906b-488f-a402-599a318da489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590096, "uuid": "08cd09c0-49a1-4c06-a9ce-38aa3659a713", "value": "2df2599e1f1e5555723ebf783deed130702a1f3484f82d7fa2a4963507b57382.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa66332e-9fc8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787581962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581962, "uuid": "798ea160-85d6-41ad-87bf-c7343eb54823", "comment": "Malware payload (Mirai)", "value": "e75d713458a4eab3c9b2336b825c37ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581962, "uuid": "d8bc74ca-ba84-4a24-9ac0-fddcfa05edf5", "comment": "Malware payload (Mirai)", "value": "2fa86f74d22e3a1cd5db46b8528030b5660f3386f0ae9807a921273092db3ace", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581962, "uuid": "9bf73180-06a6-4aae-945d-42ac8c02942c", "comment": "Malware payload (Mirai)", "value": "899b04be1f5bc5b99b629e57cd7443513e026ddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581962, "uuid": "1909c0e0-f231-4710-b6fc-b48ee9efa00b", "comment": "Malware payload (Mirai)", "value": "5f26ade6578c43b768d3c361e10f13c0d0301f57d44267f0e2cfc77c8cc67c7db9039229e372e3b8d9c8584f34b8e7ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581962, "uuid": "6e5089a0-0f68-4bb8-a93d-4b5db875ed03", "value": "T129B39C9BF24745A0C88246F047DB9F9E3E2363C05F4B98FB3D2D4A3999710DB4A15BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581962, "uuid": "8fbb226a-bd0d-485f-8937-70186dc5e581", "value": "1536:SdQHDSXnP4qBuQTHDyhjUo/Q6NQAgdT/LWW:aeOXQouQTjgjZQ6GAgJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581962, "uuid": "071e83c7-1708-4d79-bef3-12c6d812608b", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581962, "uuid": "45f1ce5f-fdd0-4a56-b590-8dc5be8b3d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581962, "uuid": "f7fc2a23-f91d-4ae0-8b78-e485e20fc8f3", "value": "daredevil.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da33f51-9f98-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1787561298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561298, "uuid": "44235f1d-753d-4adb-b85a-c327f96bf274", "comment": "Malware payload (AgentTesla)", "value": "a30cf1a5150faccb43f242380c78ca00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561298, "uuid": "aaa88bfe-8d47-4644-aabf-fb6e8db48d4e", "comment": "Malware payload (AgentTesla)", "value": "30972f27d7a7608a7d6beef2f0107ce84b7710664449eee913081a52531006c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561298, "uuid": "dd644e5a-bf5d-4e61-a71f-883028a4e463", "comment": "Malware payload (AgentTesla)", "value": "d64988895e0069c9275c14353a8c1cbb8202604b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787561298, "uuid": "7d074bcd-dbde-4642-9b01-18734e8aa65c", "comment": "Malware payload (AgentTesla)", "value": "a5df0d9d4f9af1399646bb5e98dd5e5515735f8eba6347d131bc20e5b80eb590e596a9884b459212aa1e54eeca492a32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561298, "uuid": "cfcacef8-5abf-4b47-85fd-591c4d852b49", "value": "T12C351BAF6324613870850A2BDDFB0DF29D6149FFEB948934E840B77D1B2894518EDBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561298, "uuid": "1b3d9f22-335f-4316-ae71-124c1fb69d5d", "value": "12288:+uJUJUcwSzkPmODU74UpIHL7UUOvIJe+3p7pDrFUve3n3o++4WU3nkDpiAd8ODU7:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787561298, "uuid": "e1b53b16-5743-472c-aa05-a4c12aef8a59", "value": 1101292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787561298, "uuid": "5be67fd7-951b-49e8-b378-a17415b89cfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787561298, "uuid": "c47a1d5f-31c8-4e94-86d5-d365cb748ee6", "value": "Productlijst SAFAGA PORT DI - 60181207.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9505c1a7-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543701, "uuid": "490194ba-94a2-4201-b192-a30c7ab8fc9d", "comment": "Malware payload (Mirai)", "value": "23c86005938a365aa13f47c757508f83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543701, "uuid": "17cad2ff-0be7-48b1-abf7-04510bd3aaff", "comment": "Malware payload (Mirai)", "value": "30d0f4479b7223afa3e6679b6261e68685f25ef5127e00f596b946fc9518bc78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543701, "uuid": "82d7e7bf-c5fe-443c-863c-09f63ed31913", "comment": "Malware payload (Mirai)", "value": "a9c5f0ad4c68fb785f6936f2b2223ae88c9c1b6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543701, "uuid": "c302e659-1c6c-4694-9692-1c7cf195d10a", "comment": "Malware payload (Mirai)", "value": "2082c1ad6141c1ccd36af0da1163bd9637ddc1877a8e4bde89726f41c153c1cc8a4876759f78b6edb109f880cfa3f264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543701, "uuid": "8b744086-9f07-4d52-b811-4e0a71db3223", "value": "T1B8C32B46BD81DF02C1D625B6FA9E548D33136FF8D3FA3015CC216FA0678698B0E7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543701, "uuid": "be04440d-ab7b-4ba6-9406-3797a9bdb38a", "value": "3072:LDpGyGD7lHLbdRkRc2h8kRRUoooLMIi/1CtPyL0YDIL6a9/:Lc8Rclk7UoooLHitYPyL0Y8L6K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543701, "uuid": "63c0fbfb-dbb3-466f-a6c2-7962ad66a3fc", "value": 121456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543701, "uuid": "ec7b371d-f3e5-40a7-9222-25b6f4cd038c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543701, "uuid": "9731e3e0-ede9-48f4-841f-e43d85116f4a", "value": "raul.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5ac6cf-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576652, "uuid": "7af3ddb7-ede4-4e54-9cdc-87c2820b8806", "comment": "Malware payload (Mirai)", "value": "cb393f4b7a54ac63f57ea68102fdb3c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576652, "uuid": "f4e7eb01-c2ed-40bf-8f71-ee5277302736", "comment": "Malware payload (Mirai)", "value": "315b7d57c8ebcc6fb29aca562ce7c5ea7d0565556f84d35454e65a84bbe50ace", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576652, "uuid": "8372402e-4a0d-4e4d-b73c-18af1219c0f0", "comment": "Malware payload (Mirai)", "value": "19abdefd68ad496848fdd2e4d9baa10a2bec1852", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576652, "uuid": "95f47536-2ebd-48b2-9ca5-83ea5aa1f24a", "comment": "Malware payload (Mirai)", "value": "c62684750ea11d35c04162e67fd87b1c4065ba49b3a8735de3275522c8edeab97f8f7696422c7400b5024b8bec907372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576652, "uuid": "fb1a8f70-5a09-40d4-8d7f-eca87087e79c", "value": "T111B26CE18F3A1F94E26443B4642187385B53E42AB74F0EBE162FA3618453D8DF1967F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576652, "uuid": "6ab7e841-3912-4db9-a924-c16ae4ecbc7e", "value": "384:KG1lMaIPgfe4QFlCgg+Xzf38FmfIfRXomENGNXevVLZhdr75zoZ/ynTqBg7xpx:KG1KaIWe4QbCT+emfI5XV2LDoJuvzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576652, "uuid": "a2e73984-59d0-4452-a71a-3cbc0558970c", "value": 24544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576652, "uuid": "472b40c3-6541-42a0-9ede-907a89eed001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576652, "uuid": "417e4f99-d9e9-4833-ae97-e085db3c7f5f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6175e560-9f64-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787538890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538890, "uuid": "58b68e34-b844-4eea-97ff-daa8816294b3", "comment": "Malware payload", "value": "6ed6763f5a99f24d0a8e51d4cc1de092", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538890, "uuid": "2efb737e-4c26-4146-b4c0-249666602fb8", "comment": "Malware payload", "value": "32954f6ff197f408b847d358030506ea1e9b8f955fe1ac16eabd3ea7313cfcf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538890, "uuid": "c7896779-c8b2-4495-99f8-aa4a957df56d", "comment": "Malware payload", "value": "9496d44609bb71f01a76f5747d098e7d195afdb0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538890, "uuid": "a9fef93a-e4b0-44b9-a987-3b22949625d9", "comment": "Malware payload", "value": "759789e9be765cee1ba2c96ac4904f8bf72d1c3b0482a091da4d9f37ec252def6cdc774afcd33df8a130b7e7a96b4c93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538890, "uuid": "5b96aa04-6870-42c2-bb27-620d550e3abf", "value": "T19FC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538890, "uuid": "8214b625-5018-4beb-9f57-639239aa4094", "value": "768:M8vCB+25j6es8Rx9FYpMSUpi+20qUpi+20YQX:M8l25Jnd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787538890, "uuid": "f31fe2c4-5c51-4d89-914e-c6e99ae59089", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787538890, "uuid": "d8ff3a26-3c7c-4e5e-b88b-e5eb6a4cd0bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538890, "uuid": "068930d5-77c4-4f53-ae29-bcd1e2477396", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3333a3d4-9fce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584339, "uuid": "c9aded3f-d25e-4e77-8e99-f9bd30e9bee7", "comment": "Malware payload (Mirai)", "value": "ec876b431925f8bda79a3985b3d3f514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584339, "uuid": "2cb50229-0513-42a0-8925-0f3ec09e7713", "comment": "Malware payload (Mirai)", "value": "3347e8464e66db963347176e516120c35388a339175a2234c6730e5576f4dd3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584339, "uuid": "4aa2dd13-4c3c-49d3-a4c3-e8587e1769fe", "comment": "Malware payload (Mirai)", "value": "5c2f1144c6073a80dabf4ed3b74d82e7fae98ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584339, "uuid": "36232619-88aa-4628-b423-a3f55047f01d", "comment": "Malware payload (Mirai)", "value": "31344e58cd6e5eb5862b46aa03fc405402d05e5afe951469865cd8ebd640909831fe9c8cefe534cbb30c5c1491906804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584339, "uuid": "ca3eba1d-f9c2-45b6-a2f4-87b586c5e36b", "value": "T1E2144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584339, "uuid": "87220f9c-e8a4-4d49-8a06-bb4db6ee51b4", "value": "6144:roAr/Tah1if9UVcYEEUYDckzjR482pwzihN2B6OT+km:7rGhsfucYEEUSnR48Bc2gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584339, "uuid": "9ac8bcd0-1080-491c-a75a-648a91d5da05", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584339, "uuid": "33b74c08-7bc7-442a-950b-40dd85530902", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584339, "uuid": "4c67ec5d-8c24-4bae-a131-52a734d5502f", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d28a8f2-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543688, "uuid": "be2af19c-ff75-4fb2-8f56-82faa7830e60", "comment": "Malware payload", "value": "ca562521cef8572f2550908cb03b5961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543688, "uuid": "5e92bf8c-28d1-40b8-857a-d8accdf8b8e7", "comment": "Malware payload", "value": "336656fc6a31de7dda597b739354db26beea2315edc0628232d3972a8d65f98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543688, "uuid": "f4534e5e-cdb8-4b8a-8b72-647280abc633", "comment": "Malware payload", "value": "05d13911c12b120457b8bc7a956ae663ca534087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543688, "uuid": "674cb2a0-90cf-458f-8f66-7aed58ded58b", "comment": "Malware payload", "value": "773468fcbe241316480723c4dedd670282887320bb3645494900f5f923d798411a43787422ca97daa42539dac516945d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543688, "uuid": "0af76b08-4a94-4b58-b044-c5ef9732535d", "value": "T18CA329737A338E07C0C5B5B241F34625B4E6AA6E18788D4DFEA25EC8EB117D03216776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543688, "uuid": "0923bcb7-4312-4880-ae49-115d99508994", "value": "1536:5/zKsafODM7fR4jeaKfgqOeb7NF9MJiGt3o+D6E:naQ+CqaAb7YToe6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543688, "uuid": "07aa0078-cc2e-44e3-9101-20ddcc05c414", "value": 105060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543688, "uuid": "fbeae5a7-15e3-4707-9ef7-bf8e56d2b009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543688, "uuid": "dcd67af1-9c55-4b75-a944-962cd08a778e", "value": "raul.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8331a52a-9ff3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787600365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600365, "uuid": "a30d4f08-e88c-478a-bbbf-2f4188f2e13e", "comment": "Malware payload", "value": "cfbfc61595a3b2eae1d9601cefb24da5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600365, "uuid": "aa0e06d0-44e1-4c6b-83dd-7a57ecaa98e2", "comment": "Malware payload", "value": "3426e4a772946d9aa423cc2332a28ea755e91c8b445c50e29c465c72562d9c30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600365, "uuid": "314df68e-275b-4109-8531-4778f16fdef6", "comment": "Malware payload", "value": "3166a5aa98591576193fcb06b2dc6ac0663b4df3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600365, "uuid": "e3a21659-08d9-4203-8e0c-85c3524fa34c", "comment": "Malware payload", "value": "86b05465bc9b0aea3afc86d20d38dc64519953de8560ec7b168f76e5125ca8329c62e0bc17899781cf3615facac014f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600365, "uuid": "730addd8-30b6-4321-9b20-5c5531d51f2f", "value": "T18641FBFD7052B703DFB68E05F260E674B21BE1D571CF268CF88C6853CC4694076AAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600365, "uuid": "a7dbee64-94a2-4559-98f3-45c5d555d9e5", "value": "48:4CCpOCmhpi0p2BpaUGzp2V22G9TezXqD90ooWt0ui0I0rH000zH0a0M0F0I0Q0kp:yQFcAf3uu/JrUNzUXFmJx9SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787600365, "uuid": "28382ade-2a09-4c84-86d0-890f8338bca9", "value": 2093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787600365, "uuid": "3666c05e-d468-4dc4-b50e-58345587677d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600365, "uuid": "1f560b6e-2c5a-42ef-9771-a6472cb084dc", "value": "tplinkrouter.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33288bbf-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579185, "uuid": "cf83cffa-617b-4611-b0eb-2132b5787860", "comment": "Malware payload (Mirai)", "value": "411bb01032ea9ef27d8312c2599eaf0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579185, "uuid": "07b0dc26-d40a-49ae-8889-d9950815de04", "comment": "Malware payload (Mirai)", "value": "360d3d35c8d098c9798b1563e98d83e4c5da4fc55e50b11a156ff6b2cc3e7b97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579185, "uuid": "094e1ba8-3113-48b2-98c7-beba050cfdb6", "comment": "Malware payload (Mirai)", "value": "28397e3bdd55b2ec4f8eddc33a7e6e887fd4bebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579185, "uuid": "370ccd83-5630-4b39-a217-68106e94c7a2", "comment": "Malware payload (Mirai)", "value": "fd50fdbf9e522c51bb96c3d4160fd15adc7d552e4fa9f448cd5afe070035a2a282515d727245418603ccf00a27618d3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579185, "uuid": "7ab4ae0d-25fc-4ef1-993a-e42d5b30acee", "value": "T174E2E1BDDBE54A08E5BE81795EAFBD06C490E10B9571C77183D8B133588371A0A28D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579185, "uuid": "fbf4df91-51a4-4bef-adec-1df8400ce3d2", "value": "768:zeS29fQYea6VzykApEA9lh8A/H0gnbcuyD7UkWykkAJk:YSYVG2RiATt0gnouy8kzkkWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579185, "uuid": "419ab559-df01-4cbd-9a9b-eef9e5177244", "value": 33020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579185, "uuid": "bf60e00c-c514-4e99-b3ba-4dcc2db0f36a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579185, "uuid": "c97d60a8-aad8-4a2b-967b-0f7ea0be1716", "value": "daredevil.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9c83aa-9fea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787596547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596547, "uuid": "647e72bf-a1cb-4343-b45c-31cb49ca4145", "comment": "Malware payload", "value": "0f05c749e517bbfa9c76647f94d93ee4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596547, "uuid": "31451ad3-520a-4597-91ee-04f3c178b108", "comment": "Malware payload", "value": "3675be6c9d4f5be9d5404784c438b75baac1b4dda9886fa88ea5459b97ee4b7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596547, "uuid": "907f70a2-98e4-4d36-ba68-c136b655e6b8", "comment": "Malware payload", "value": "1cbfdbd5e48eb008bd3a179d123cfd5423734250", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596547, "uuid": "64996185-59be-4c7d-aebe-c2057f5b9e0f", "comment": "Malware payload", "value": "22f581fd2ba3df7a43d4decf39483e6c0d919c3f97302cb35565efd8bdea3bb31cf09b6875fa1b8e09299d27b39d2957", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596547, "uuid": "f231a88b-bcf3-485a-8489-d17f76d8c400", "value": "T14C774B43E8E61A94C4EAC1B0D166815BBBB23C5D1B7823EB1B90F3701F36BD05AB6751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596547, "uuid": "cf41c3cb-2d92-4d42-8d6f-cef7fa8d5d34", "value": "196608:1KVBkorBGqtl8EEgcb/xxq/n+R6Pup/FIjrnoLccqRUjrwWDFMFb7els:1Ksolb8EwZ4Q+rnGtqRMwWpMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787596547, "uuid": "2c726742-8c8c-4ee3-b88b-87732f1b35e9", "value": 33960084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787596547, "uuid": "17e96d52-b088-44c7-bdbd-ab2db141c81b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596547, "uuid": "b58ec448-1785-4cff-b35d-45550e2967a5", "value": "kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5207db4b-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576660, "uuid": "22538ff7-2a41-4a69-9f09-2ab13b054b24", "comment": "Malware payload (Mirai)", "value": "49987846e8484eea91209ddfb4576cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576660, "uuid": "a6e7d2e1-3692-485f-bd82-bd87bf397590", "comment": "Malware payload (Mirai)", "value": "3716b6d1d428dfc45655a8bfa6bcc5141ece16cf63663f12996d5678eaf13a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576660, "uuid": "a0d72f08-305e-43b8-a845-189c15022a25", "comment": "Malware payload (Mirai)", "value": "5d4660233d8833ed1892cae8c5f34d4983451959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576660, "uuid": "8980ef0e-2fb4-40d1-a6a9-79b65630a00c", "comment": "Malware payload (Mirai)", "value": "8b7e0c7778ddbabb62f7bea9b8d5a3dc550fc39482eeee6f337d768e82a467adc9efa8dd9af7d65f40b975545934bed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576660, "uuid": "6bac917c-8558-4056-bbeb-9db0dd019e18", "value": "T10EB25B86BD814517CEE51176FA2E928D37665BB4E2FF3303AA261F642742A1F0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576660, "uuid": "d0605c67-9a36-429d-b864-0b2453447ceb", "value": "384:dG2m2FfIQp9Mgj6JwqQ87+2eZvaBcjQOF9hM4tXV5aceBy6jdmFx4e5:dfyRVg87+zvaOPFLM6qy6jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576660, "uuid": "cbf8bb51-30de-4789-bf2a-b655e6232733", "value": 24504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576660, "uuid": "013c76c2-f124-42db-9b71-20738513c609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576660, "uuid": "55121adb-fcc8-407a-8de0-b23b2d572a4e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4691897-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787577738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577738, "uuid": "a17ebcc8-c866-454c-9c7a-be96e8b04f11", "comment": "Malware payload (Mirai)", "value": "df0fecf5c11e8d81a1e825e369265312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577738, "uuid": "7b69e2ca-4840-4ee2-bfae-a2ad87ce2804", "comment": "Malware payload (Mirai)", "value": "3922cdf20694b7e2ee02eec17fa0c6f47688f8ac7a5ecfdd594f3461688ff847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577738, "uuid": "f8adc72b-5946-49a9-b90b-20493ba14e5d", "comment": "Malware payload (Mirai)", "value": "f31d671438c768e5b2afde5f43d9e80a112b9081", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577738, "uuid": "ac2f85ec-8ed3-4ff1-92a1-f36e5989a6f3", "comment": "Malware payload (Mirai)", "value": "1527b53abbf2844274f34db7ffa52c264d39d9886965e85536f52895d95547b9525e00021738b49d641afabaf68d9d27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577738, "uuid": "a105ac24-e1e2-410a-b005-85e838eb34f0", "value": "T174140852ACD29B12C6C2457EFF0E514E33136B6AD2CE7212BD1C6B703F8A47B0A7A455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577738, "uuid": "3cbdc819-6e49-47d0-89ec-fc1ee98ba3df", "value": "6144:+30ZopTvSeXg550rRmTXXjYs1aDf64slZDTEssMOgh5oC:tZopTvSeXgb0rRgXjV1aDi4gEssMOghR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577738, "uuid": "1cfe6a20-e574-4c2e-ac77-c488ecccbe20", "value": 203696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577738, "uuid": "fd38a3b6-ab71-447f-96c2-ce40b50d15e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577738, "uuid": "730edabf-d549-4b8f-bc91-ff7bdb6d4a16", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d2aafb-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1787577572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577572, "uuid": "b2fb956e-fbc6-4097-9e27-1f86e3259c07", "comment": "Malware payload (SilentNet)", "value": "fea18c468601b346ac285fdb9e3f90bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577572, "uuid": "5a29024f-a87d-4f68-a123-4fc127e1b8e0", "comment": "Malware payload (SilentNet)", "value": "3b2e435dc9bea6c2123f9c725543a6140cef01884c9c11ad76a0c2581ee8684d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577572, "uuid": "4c7d909d-61ed-42c9-931d-ceb68788f831", "comment": "Malware payload (SilentNet)", "value": "d00119e19a6da649ec1175a2a5e3bb29a5232f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577572, "uuid": "a93ce252-bd4d-47e1-bea9-47a07459eca4", "comment": "Malware payload (SilentNet)", "value": "09f8ef795ab53db200957a6b5411db578b4346f41064c0eb1fd007e4af169fc3e1d1fd27c3d105233bc7227bded295e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577572, "uuid": "e4112a9c-a830-4296-879a-be34cc9d86a1", "value": "T1FC357B83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577572, "uuid": "c6612d3b-a1dc-42eb-b598-78cd09e9c50b", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577572, "uuid": "644aabde-e459-47b1-8e06-d25a1843928a", "value": "12288:Pbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD/vfqItNqdg:PbOVE5ifGPRZwLvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577572, "uuid": "b81bc8fb-0c4d-410c-bae0-1901ad4e42a7", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577572, "uuid": "1d531969-b74a-4967-a8d5-c526f1926cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577572, "uuid": "0acbd130-106f-4993-a1d4-2d6b64337b0a", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd47924-9f60-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537243, "uuid": "fada1200-d92c-4d0e-8dc1-e9fb687a40b8", "comment": "Malware payload (Mirai)", "value": "fcf073cf76795d6c782868c26b3849c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537243, "uuid": "482d00d5-1a0d-47d6-b2d0-c5ff4590cc32", "comment": "Malware payload (Mirai)", "value": "3b42c78b7127376f57bdc15655c71beb4c57966b110da3445a1b666550a2fcf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537243, "uuid": "d05e8bbd-46aa-49d7-a85b-5b1f37b88bbc", "comment": "Malware payload (Mirai)", "value": "c41c6f91c44318d121629e89df2d23bf9bae3acd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537243, "uuid": "8ba3d3b6-a81c-4c9f-9a5c-82222c94f881", "comment": "Malware payload (Mirai)", "value": "3490e9bb1821f54e31b76e88fec930d4a9beba637d40295ecf1095bb99af3c072c5c43320fa20defb4848878aa6bfd2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537243, "uuid": "478af55a-5bb3-4e48-a4b8-1cc45b06d114", "value": "T131449E01FB180A13C1931DB40E7F07B7D36D89922CF9E11D6A0EBB564731ABA96877C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537243, "uuid": "fcab2a11-b2ad-46e7-b0b0-f8b8bf6f9685", "value": "6144:uxsE+Go1HJ/5H1jLhsY0vMF/39qKw6twPmRpAfAaD8JoOPbndDhD6e:MvQHnHT2MF/g4zJge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537243, "uuid": "4c8015df-7277-4edd-86b3-bc37d4e5b68f", "value": 263788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537243, "uuid": "24e91499-b543-4193-9d5b-a3b88beaa22c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537243, "uuid": "2259d1a9-856c-451c-a479-5bb2b18f037d", "value": "ccdc4a015bb2a334f7ed236b6b8ba4f40eaf66208e62d09b20a73f99fab1df41.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9f300d-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576656, "uuid": "204db37c-c11d-4f4e-8ce0-71319a6fef20", "comment": "Malware payload (Mirai)", "value": "abc1dd9047771baab8fef7db89f11cc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576656, "uuid": "9091b8df-88da-45ca-babf-6bcc50a6b14e", "comment": "Malware payload (Mirai)", "value": "3c97579c6efeebf9516c882f8634a498573c8871eb6fa29cf8b2e5ff7f42bff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576656, "uuid": "c4529df6-7980-4277-82e3-17f3d96132be", "comment": "Malware payload (Mirai)", "value": "38b730c56e910ba3f3a7888bc44d25ccb68139de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576656, "uuid": "c1341b62-8b35-4b0f-a9ad-d243b6a5dddc", "comment": "Malware payload (Mirai)", "value": "6db87970a2ca3e07773cfc8161e0fb759a89f3a6847f658215f3636cbabd220721318133436a10d16d2464f5c2592303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576656, "uuid": "03a381d0-86e9-4a3d-aaac-72d9f73c2af7", "value": "T181B2C15146808A6391E60C3BF977D302D3941BB549F7793932744E2CA3DA6DA27B83C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576656, "uuid": "cd4241fa-9d52-4f9e-8e50-e496584f13e1", "value": "384:xag3WjvMR52Ys5Mf7lyRONcru9kGFrv+bFJ6Dzt+Kr1K7omdGU55YMowf2E:L3WjvMRsMxKOD9dvW2zRE03U03wfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576656, "uuid": "f669510c-0a25-4314-acdb-8d0999c3a379", "value": 25312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576656, "uuid": "f988f617-40bb-4023-b3d3-6465a376d35c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576656, "uuid": "47c141e4-c21a-4318-b27e-8a855d1dde22", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cc7577-9fc1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1787578941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578941, "uuid": "f0e98e6b-35a9-4048-bee3-b9e57b5e75c7", "comment": "Malware payload (Amadey)", "value": "fe415557ba8004349316645525c793a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578941, "uuid": "1d13a67b-a087-4467-b414-b5776d618496", "comment": "Malware payload (Amadey)", "value": "3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578941, "uuid": "d367b9f5-7f47-4ef0-b42a-7ac2da4a56d9", "comment": "Malware payload (Amadey)", "value": "e8b27a9b284b6d5d7a792692d01c8b70ea8cafb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578941, "uuid": "efc62067-01ef-4634-90d7-d57c4af92881", "comment": "Malware payload (Amadey)", "value": "43f303ee63a1513f990c173be2973af8b5b5bccc75b38785e3c36397e231b3e1ab9e1689de7d6ae02699d6fe96fdd589", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578941, "uuid": "e1203668-4f9d-43e2-a9f4-0d152fc54795", "value": "T1C204024363FC4238F0B56978A5BB9901BA76FFD0AC7DC45DA099700D49B7A74C5B2321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578941, "uuid": "01541a57-ad50-4715-bd70-cd20c5a96fdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578941, "uuid": "1827e91b-1612-4b6c-a1a8-1244bfc20b83", "value": "3072:R8btTfnelD+aL26Ogi52ztMX/kipPTq/jLfuDX+gUy1i4woUDQut/T0j8z4OFOto:R8b++arOgi5Q6X/u/nfuDX+Uo4woUDQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578941, "uuid": "41ff3198-2324-467a-90c8-904cf4670816", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578941, "uuid": "b173a2f3-ff65-422c-bf42-8a1ea999f983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578941, "uuid": "59f4f741-a249-4597-aac0-6b190a3828ec", "value": "3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53922265-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576662, "uuid": "a35bf61d-e39a-4d65-a0b9-4e4be53c91d7", "comment": "Malware payload", "value": "e11bbc99045129c4cd35163e2dc5da15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576662, "uuid": "b8655a5f-c07e-417f-afc3-7b25038d058b", "comment": "Malware payload", "value": "3f35f7f9d37d8bfb2f861c9d61a6696553189897acdecb6fef5dfa95fe88470c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576662, "uuid": "0badc11e-f986-4122-8a8a-de3480a32c9e", "comment": "Malware payload", "value": "70aded3c7aac9fc0d35be80da277d20448bfde0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576662, "uuid": "5700dc0a-42b2-4347-b9fe-76ab85ed0439", "comment": "Malware payload", "value": "171abd85a3560a7c60f723421d5fdbeab726600024ddbc9c16e1159a95b0e47a5e3487d53fc82e1d72fcf78bddd3a15c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576662, "uuid": "2a93397c-33a4-4cea-a485-9f7ae11647ee", "value": "T14482BFF7E3AEF7B8CD3FA9B2891452C4FF203C14B013979A0975A27E98FA9042411752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576662, "uuid": "8316bcb1-35f2-4583-8464-93cbfb72657a", "value": "384:Av0tltUYGrkN3tkuNZz58OA3FQjPxJoBV2F6Ufk+nUxaVXALppkXP+GxL:E0tl6YGrI3tZz58B1yxsVOfPdNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576662, "uuid": "4365a8be-ac03-4394-8d56-b41259072988", "value": 18656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576662, "uuid": "08d292a3-0544-4d87-bbfb-7f17437d2ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576662, "uuid": "bc56a318-82f7-4008-ab5c-4d40c5b955bb", "value": "musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae9bc4c-9f5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787535416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535416, "uuid": "0b05c8d4-a51d-4a01-8911-c0a8505d22dc", "comment": "Malware payload (Mirai)", "value": "0e390c0672ab53e60e9637af6873da80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535416, "uuid": "58125b2a-76f3-49d6-8da2-eb9400981e8b", "comment": "Malware payload (Mirai)", "value": "415c91ff2b7098268f56db653448aa5a5ac7db9692e58b997b721a83bc3b8e6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535416, "uuid": "57dc1cc0-1358-4200-b182-280972614852", "comment": "Malware payload (Mirai)", "value": "34e93681d961a37c7c22bdac81827bdbc75e4971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535416, "uuid": "7163d741-d63f-45a6-9967-6dc5bf6f8ea9", "comment": "Malware payload (Mirai)", "value": "1063e88388dd7732f9006c7bb49834c70bddf0a3f0ff91b260791694ac037eececc7cf0452ad03f401517fca51a2b056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535416, "uuid": "a078a124-7544-4727-be61-990e76c9be69", "value": "T154D312DC7A4192DCF0E382292D8085A52D87CA7E5EB527F27B44E54818C7873E56E0EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535416, "uuid": "669a16a8-256a-4c01-b298-99cc56a496e1", "value": "3072:8HawO8VWmSa2yags5Z1aph2ENhOdqKjwjeuIX8/oEOEnz4Z9h0A:8q4zJ0gs5ZI8MEjwjeuIXQoE9niB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787535416, "uuid": "b6da2ec1-ad10-49c6-af8d-8f88be48d3e2", "value": 140004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787535416, "uuid": "ee600a87-a9e9-4df1-9914-e963c1a07437", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535416, "uuid": "2576d82a-b2df-4b1e-bbcd-be49820ebe1c", "value": "415c91ff2b7098268f56db653448aa5a5ac7db9692e58b997b721a83bc3b8e6f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7465b1c1-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584878, "uuid": "4cda27b9-2554-4659-9a47-3ef108d4ddb9", "comment": "Malware payload (Mirai)", "value": "c10c16fa2bdffad69c10b04e7c5d9bb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584878, "uuid": "a6265987-d556-45b0-b966-3b8c479250ab", "comment": "Malware payload (Mirai)", "value": "41ceaf7915fb607afcc0d34043817aab3c81b41b81731901c43e87d93729d600", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584878, "uuid": "35927cfa-e28e-4079-996a-e43c39950c75", "comment": "Malware payload (Mirai)", "value": "20700d79187210747832b31cf2be0c653b5e1d5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584878, "uuid": "0ff5f06e-a504-42de-adad-a6b0b3e8a803", "comment": "Malware payload (Mirai)", "value": "d2a246dec5418069010284daf8f0fc0081f868d2bf7f75d0dcac4dfcef519bc85fbe231a7d168c1623cf0a649a64b98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584878, "uuid": "56d0779c-1222-41de-b74e-f698e9ddea5d", "value": "T15E547C45AF646EFBC41ECE310A2EC30621DD588BA2F9B73AB678CD4CB55A30915F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584878, "uuid": "4fc77146-66f3-4d79-9277-2409858f8720", "value": "6144:YfXTvXkWuAk4XlTmu532/ote4CMSGXtAc1RCdNQLcA8xbLtLLBP9wB:Y/Tx9ldQsCMSG6YxQtLF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584878, "uuid": "002285e6-a6fb-4b51-95cc-32a0bf3043e4", "value": 287384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584878, "uuid": "f2ec0486-20be-44ee-8396-d7026286a211", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584878, "uuid": "b406543b-bd68-4097-9db3-5bd9d1fde7e9", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb33ec9b-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584218, "uuid": "eb6af452-25ab-4561-be82-084b58b125dc", "comment": "Malware payload (Mirai)", "value": "04eb6b352d3dcc7a6cd20986cbb92879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584218, "uuid": "db05cb08-fbc1-46db-a768-8bb5eb94dd86", "comment": "Malware payload (Mirai)", "value": "41e30a20f3fa511ea839f533ab5bdd4f9b621eb4edb657fa5fffe96e5f6f6b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584218, "uuid": "7564077a-ea60-4600-9922-83c854b01ef7", "comment": "Malware payload (Mirai)", "value": "29c991475d4eea4b3942bd3e02222f80d84b5197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584218, "uuid": "b402a0f8-6132-4b3c-a480-941f2611d759", "comment": "Malware payload (Mirai)", "value": "c7f47883393084c1b771b6950d71c06274d97685448dda83f49cea9562e1cf8dbc7b4202e23f4417b91a481ca57b8466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584218, "uuid": "56e13522-a04f-42c8-b2de-a5070f3798eb", "value": "T195449E01FB180A13C1931DB40E7F07B7D36D89922CF9E11D6A0EBB564731ABA96877C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584218, "uuid": "2a623261-2b5e-4833-9c82-36d27ed523e9", "value": "6144:uxsE+Ro1HJ/5H1jLhsY0vMF/39qKw6twPmRpAfAaD8JoOPbndDhD6e:MEQHnHT2MF/g4zJge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584218, "uuid": "fd24e579-94a6-4251-9762-eeb207293b74", "value": 263788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584218, "uuid": "4f501eea-5912-4bad-8139-74224fd7fc92", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584218, "uuid": "42d79208-865c-4084-b022-d598c62eda99", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c546fe7-9fd3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787586556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586556, "uuid": "34de98b4-a37c-45d2-8314-4f043dc25f3f", "comment": "Malware payload", "value": "d1625c5a83a58c8426a9a57f59177795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586556, "uuid": "9efde94e-f519-4825-bf5e-9d0f9822f11d", "comment": "Malware payload", "value": "435ba2f17112114a9a0b3356b4657e5fbd35c7cf311f143d2fb939a1d8a8fc2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586556, "uuid": "79d09f02-db5c-4fe4-b565-0ddaf50007ef", "comment": "Malware payload", "value": "cf18f7f1a2495778d9045dfae4cb5312a4fe0861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586556, "uuid": "2b9e1639-34ee-4158-bc48-c40f8fcf5b5c", "comment": "Malware payload", "value": "8d33226ec32e57db64637f189972f89bd0820f8f8af71318df277a7cd138a39af7c21bb7a1fbb5c146ec34d4fcc3d10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586556, "uuid": "855e5513-7f55-445d-8278-c5b0b68ee42a", "value": "T1C725AE523BF61461D64046358FE2D321720ADBE874D54A8B9F908EEFDF032651E82CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586556, "uuid": "0e20181e-eb05-4901-b840-fd729cb30257", "value": "12288:oAhx87OJdu5Ch+Lwtejq05oSY1o4mra5dCYy79:dx3dYABSYRvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586556, "uuid": "a9a86005-0da3-49be-99f0-71a85bb78094", "value": 1057088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586556, "uuid": "9423d4f3-134f-4d76-8dab-a5de986703d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586556, "uuid": "96b9a837-8d85-4271-bc4d-0af7c8a29a06", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a087325-9ffe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787604886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604886, "uuid": "f1495d6c-1b28-4387-93bd-8d6f367b0249", "comment": "Malware payload (Mirai)", "value": "90637eaa50cc04552dc4126298869f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604886, "uuid": "0e8c47a7-d2b7-4241-82dd-5b45840366e2", "comment": "Malware payload (Mirai)", "value": "4379770bf5e7d2ab7ff966e7d8cd4a59a3182bac56e1b76bec3255d5278ea703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604886, "uuid": "39c2c9a6-af45-4f0f-b5d5-777a6ef6c1ea", "comment": "Malware payload (Mirai)", "value": "b64428eec6616ff93b18c5115937db297f5f428e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604886, "uuid": "06a3eb69-ad98-4a38-baa3-d4211952a9e7", "comment": "Malware payload (Mirai)", "value": "07820cca2e42591b09f56a7eab7795557ebb805de290833f384731fe3fb12a08f39ee627f5613ce1814aba0a269e36d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604886, "uuid": "4ffdb8f2-f7d6-4207-b75f-cbb6b654fc62", "value": "T1CB047DA38CB36D54D2568479F2268A3D1B13E413424B5E64B8BFC2B40F43D99F2667F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604886, "uuid": "bef5b125-1521-4d6b-8d52-f01ece6bc78c", "value": "3072:oZKr1U4dttPwtygvdp/Er+34DE+N5YCjWWA6ZR/wu1EssMZc/T03ImIys61X1h5z:oZKr1U4x4tyg/sr+3kE+9yW5ZR/REssW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787604886, "uuid": "50870929-ce8e-4aad-9745-23df1fd48d20", "value": 174832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787604886, "uuid": "2da5220f-946f-452a-899f-beecdea89c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604886, "uuid": "f1aafdac-562a-42a1-a65e-af674bf2f73a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95390b47-9f9b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787562599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562599, "uuid": "e41d49d2-3525-43fb-952b-87a38c6715d7", "comment": "Malware payload", "value": "675891aecf855a3b4df401be996253fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562599, "uuid": "927407cf-9f1c-4fae-8a00-83e5976acaad", "comment": "Malware payload", "value": "441c962281eb649eb01f1e7a8b1af5bbd85ffa8aca325a3cc378529d9c99d4f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562599, "uuid": "fd1f2e6d-863a-4e97-9fd4-1e5752b3ed24", "comment": "Malware payload", "value": "ccf731ff1f3f0d6f8015a45b993fc7de2ddcdf0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562599, "uuid": "d391119b-ee71-4da2-bde8-d5ae4624c4b8", "comment": "Malware payload", "value": "0c257e5dfc7f9544efaec38b9d18ec62704fa7943706e52c13f61f7a555aa78c42c0cbb1bc6620f4aa60e3f0834b645f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562599, "uuid": "e3a49524-09e4-4aab-aa69-adcfb11c519b", "value": "T16B236C6516857C14AA98C4375C7E2F0CBDAD43E6324492EE7FCB3CF28C4AA9D920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562599, "uuid": "b10e10a0-2184-4d70-bf46-cd492fc8e020", "value": "768:p9NyXsZztCX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:pHusZ5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787562599, "uuid": "6610b002-556e-4a4c-996f-9dd0e4baf63b", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787562599, "uuid": "50b7d2aa-4b99-44b5-a3a1-6e421502f060", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562599, "uuid": "92c39681-5915-430f-95f1-188a59e9e97e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb538d31-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787578152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578152, "uuid": "5f709a22-51ad-4b59-b133-6fb4bdb9594f", "comment": "Malware payload (Mirai)", "value": "694c27d8cb0101887d2e2d01b328e69c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578152, "uuid": "3e8b9c56-ae22-440b-81db-9f52462e444c", "comment": "Malware payload (Mirai)", "value": "45c4d75c175a8e82f68901cb2846ab9efa8ea270739dd58534e25b3cc474251b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578152, "uuid": "1fb01e9a-8179-4fae-a1d1-0444d4eb9ce5", "comment": "Malware payload (Mirai)", "value": "cbc62b56353a3e9112484b941577f42736bfe269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578152, "uuid": "caceb0d3-79ec-42b4-8785-15d068eea2b1", "comment": "Malware payload (Mirai)", "value": "2ba7eb708e76e2a51612c5ff57de772c3232eff3a67534a6a1364dda87bd0aa240596a8cfcdbdc148a2943f07ae17222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578152, "uuid": "fda4a5e3-2ef5-4432-b338-8e531ff97980", "value": "T10733022232133C5381E3A03AFA705F8734149A7AD137C57A8B54D3B423D66A9DAF25DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578152, "uuid": "713dc663-aec5-40bc-8a2c-8a95360e4603", "value": "768:tRdAqXV4BrB8nmzBIalTWVnPeiaSH3aaD0qQmuhlmBwWaC7T2Mr0eBRmts3UozC:V5l0B9zax9PeOHK42muTmBwVP20eCwzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578152, "uuid": "9860f0ef-77d1-4459-b329-049f4e221c22", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578152, "uuid": "6be31a31-9a27-4d0a-a443-008e1a52f829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578152, "uuid": "2344f2d4-a641-4306-b040-6b5e5892991d", "value": "daredevil.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c49c9c-9f9c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787563196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563196, "uuid": "24e68921-9398-4612-8cdc-0b86dc706155", "comment": "Malware payload", "value": "802e6fcf9416fbafff40324e4d832ba1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563196, "uuid": "1610eedf-9687-4c49-8f92-dc5bce40d276", "comment": "Malware payload", "value": "45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563196, "uuid": "031b3bc9-66da-4db3-bef9-f28a2fda0ba0", "comment": "Malware payload", "value": "dc405d56f408305ee6fc987620d51a2541c14b3a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563196, "uuid": "cd97a1dc-6feb-4c1b-bae8-2223556f3184", "comment": "Malware payload", "value": "88ab84c1b535c80a9fd221c04153b3d5e65eac24e9aa6d5619badce33ab5ec3d06ee9a75667f9aef82b9a7dd345bd1a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563196, "uuid": "4493362f-eefd-44f5-bcfb-7c4eacbac864", "value": "T1C731679F02241A326002ED4E7363354876CDA5EB2D6FD7D589480FA9824D7CCF252F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563196, "uuid": "f53afe5e-6797-44eb-811e-2bff4072ce01", "value": "24:r27miL4Dcuzpk/hmoIt1O6ZFzuLuL2iyIx/m:K7JL4WIfO67zuLZQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787563196, "uuid": "c95bcda0-2658-4555-a16c-4ecf2a597e75", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787563196, "uuid": "0fe2e366-647f-4d27-ac34-bc6557773760", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563196, "uuid": "bd49e7fa-a487-4c9a-a374-74c695d04ca5", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221e5c4d-9fb3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787572714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572714, "uuid": "802c6a16-714f-457c-8e50-709703450976", "comment": "Malware payload (RemusStealer)", "value": "46fc3c9a5e9d0a08b58e99c317a593ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572714, "uuid": "1d7da5db-8b74-42a9-8ee1-0ca96d85eff9", "comment": "Malware payload (RemusStealer)", "value": "482fa07dd6635918997e856854b64285e1a631f873cee83b9c7f92c78cb4caca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572714, "uuid": "d865f268-4195-4413-b4b8-a467caa18fe4", "comment": "Malware payload (RemusStealer)", "value": "6cf24b0aa267631b8c85c193ad0fde5ff051bf19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787572714, "uuid": "66fdcb26-7fea-4823-ae1a-9679ffea7183", "comment": "Malware payload (RemusStealer)", "value": "4de471ab3cf9bfa950f2a31efd9aa555a1c4931d8b648aa47b2859ce990c4850f59a5bb7ea935a532b7b10d7b1084d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572714, "uuid": "8f29c27c-4192-4384-8dc2-8d3902df3a60", "value": "T10EF56D077CA082B4C05A6B7E4176A213A725BC48C739B3EB2E51EB702F613D26DB5F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572714, "uuid": "277d0e2d-7710-40ec-acf4-0569878dd4a3", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572714, "uuid": "729ae3f2-8353-4adf-b30b-241416fb9e91", "value": "24576:yxbZBD6Cx+ABE5J8AMY9BmRj4VeHKoVkl5FFoCyqr25Z/fLm7Wky+YovUbmLhW2E:eBDDRE5/iR08HU5F2CyM2aioqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787572714, "uuid": "9fbe5d05-02fd-4582-8e83-d325a0548eb0", "value": 3390328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787572714, "uuid": "f21747fe-ca6b-48ab-92a5-1f36c9fd06f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787572714, "uuid": "ff9b7144-66bd-4b1d-b90f-f6c612c5780d", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfcb698-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1787551148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551148, "uuid": "51ff1ca5-2880-48a1-ab47-8d27f8b63840", "comment": "Malware payload (Formbook)", "value": "ba425803971bbd612fab8d127f940623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551148, "uuid": "4d45aeeb-f2e5-465c-9b8c-c5303288fece", "comment": "Malware payload (Formbook)", "value": "4878f4605acdf2ba1cd57072d13d1b19712e914799df5132f5397a550dca3427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551148, "uuid": "0c8da163-c11b-4141-a5ba-964e0d9cd2d7", "comment": "Malware payload (Formbook)", "value": "c641df031f54df0ef3625219aca86b0c3972d546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551148, "uuid": "522ff794-367a-43d1-ad5c-3afcf5d39dd1", "comment": "Malware payload (Formbook)", "value": "f299d90057178f5abc473ee74c482e43f12383d41ce7e4e5b8648eb989d20ee9bc519b6fb41bea6f23c78646529003f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551148, "uuid": "e6aa1821-8ae0-4d0d-9d0e-a91a20badde1", "value": "T10E4502086357DD02D2C60FB05DA1E3B45AB48F849912C7039EEE3DEBB97B3562E442D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551148, "uuid": "1e167f86-5b55-40a9-ab0b-9c0503601166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551148, "uuid": "d4c0126a-23f9-428a-a323-35f2045ebb91", "value": "24576:5u1jP/2oSdvpiUdvYfxwOGKHVk9f77F5QCAhODJ/kCtR5P0rJNcl+:5u1b/2oSZg6OGK1C7R5QCIr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787551148, "uuid": "4875ee39-a7e1-4f42-8655-299d0175e2e3", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787551148, "uuid": "b086d794-83c7-4e7a-b9d5-55e6d9d0b67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551148, "uuid": "76ea8c47-3a90-4e9d-86ab-c9945d9200e8", "value": "Purchasing Order Required Specification QEWQZfTDiYZ8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d94222-9fdd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787590952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590952, "uuid": "c9649cf6-4b70-4134-9862-bc1b55c44663", "comment": "Malware payload", "value": "5341495aa3c5d1b56ade1ef353ab28a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590952, "uuid": "e5f7e013-96fc-42d7-bfea-42cd91ef50bd", "comment": "Malware payload", "value": "4980c099052a595c008011d0f5a7983d86650a77519f15dc72f21b3b40a021b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590952, "uuid": "b55191c6-31cc-4d42-923a-8d8f14b167a1", "comment": "Malware payload", "value": "e1e8eed4824cf6d56771b6b040aba0beb53d1167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590952, "uuid": "2a5bc9c4-9430-4727-b424-c60f52645ee3", "comment": "Malware payload", "value": "fc1dde0fb147e87b4cb53d0bf4fbb189dc99e7c9b4dee0993c7494b89281e1b9c89c9fa7f9c3c4a9d718d109be8c73fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590952, "uuid": "91abba7e-e86d-4c7b-94e2-2e5ca1770eb1", "value": "T138283307F98580E5C45A9B31C6BAC613BB32BC8D573673D72E10B6382E7A7D069B5306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590952, "uuid": "8ece77e4-2caa-43a7-ad21-bd3b4ae0f380", "value": "1c1ad2adeb06878a984583db245d2aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590952, "uuid": "3853cad1-2342-4c92-991c-cca1772e777e", "value": "1572864:uA+wv83pf4VcPJK+nN6DqJpEtFkot1O/UdRObYzUSLcT8CMgtiBQpgpNOjin:CFOOJFnNKqJStV1O/UdQkgd4yg3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787590952, "uuid": "d2f965c4-8657-4c58-8ee1-7b5eb13d7087", "value": 95234672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787590952, "uuid": "443e6920-f5b7-4cf6-8123-457a130eb76a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590952, "uuid": "5db9761c-5b7b-4fc5-8248-7f6d81d0c57f", "value": "4980c099052a595c008011d0f5a7983d86650a77519f15dc72f21b3b40a021b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742826cc-9fe9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787596045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596045, "uuid": "51a09064-7a44-45f0-a838-272208dbaddd", "comment": "Malware payload", "value": "4e5f0065da7d4a6403dd07c7d93d20c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596045, "uuid": "a489fd55-14be-4372-8802-19b5900b6903", "comment": "Malware payload", "value": "49b40f07663805daa576a72d301b7670972430af82c92145b9702feab1bb1c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596045, "uuid": "7438a251-c26f-47b6-93f6-cfe2e5199075", "comment": "Malware payload", "value": "544765739aaf40e8f0900666555c38581f3ea854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596045, "uuid": "f97b1d79-23f1-49ac-9676-df16fe499709", "comment": "Malware payload", "value": "94a9776c3c4e0fa5c8e496e5eb68af7134efa19227a11fe641b9f5035de8f2ba978bd0ca090dfb6fbfcefaf0448228d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596045, "uuid": "8681a11b-1165-43a7-adf3-321b4870d83d", "value": "T1F6E523E4BED23976F426CBB76793B8BE71293B4189608C0D36CD1B052D215187DBB389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596045, "uuid": "908165d0-53ae-4805-ba81-b3d5e13718d2", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596045, "uuid": "f4b0c7b7-4506-4e63-97ff-6965519b8583", "value": "49152:ycrobH5TWOEE22KrQtoADzs9wSDjeKKvwA80AA84thHBn14K2GLdcfG:JS5TWFprADzs9Lf/KvwAHThthH114K7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787596045, "uuid": "43ddd7e8-5eee-4ba5-ad69-b73497383686", "value": 3080192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787596045, "uuid": "7e3e3a28-1b0c-4228-b006-db593c5cdb51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596045, "uuid": "b0e3cb9d-9e61-4f55-920d-cdc837d86458", "value": "49b40f07663805daa576a72d301b7670972430af82c92145b9702feab1bb1c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abe4917-a006-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787608484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608484, "uuid": "66769727-c50f-41e3-bcb6-de4d89e47142", "comment": "Malware payload (Mirai)", "value": "9e527da4b713ccebdfb8b46fe17b67e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608484, "uuid": "8f5ed718-33a7-4593-86ed-578bb22c3496", "comment": "Malware payload (Mirai)", "value": "49f6d68d8020ab4b83e52ccc80a6fb53605097c264ef46a3de694a48ad520f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608484, "uuid": "06eba998-1c26-42d9-80e0-07705ba45d9e", "comment": "Malware payload (Mirai)", "value": "326aa56468c5ff775f622cebc99deef8a33cfef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608484, "uuid": "dbf047ea-bbf4-4376-b837-9ecb8d5a260b", "comment": "Malware payload (Mirai)", "value": "e325ed2e877b2b08748bf34fcfdf67a1500d2d05d15d66d76524a7e8f580684cab8b79072aed264fabdd2d52d820d459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608484, "uuid": "41472f01-b740-41b6-b396-dd018aec1e48", "value": "T18E34D75E2E628F3EF269873487B74E25975862C722D1D640F16CD1102F2029EA56FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608484, "uuid": "7a804097-9ff3-4b00-a084-8fc3d2a5392c", "value": "6144:wH6jum7s0+1bx9KeepotZFGj8FLKEssMOgh5oHd+M:mxoCgEssMOgh5oHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787608484, "uuid": "24816583-8385-4b6c-8b8e-5bd110151878", "value": 247716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787608484, "uuid": "6597ae3c-9ebc-4748-91f8-930e35f9ad66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608484, "uuid": "f0b4350f-2008-4da3-bb4e-ef0b95147c9e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96eacd63-9ffb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603834, "uuid": "89609507-55b0-4974-8839-5388d5d8ee47", "comment": "Malware payload (Mirai)", "value": "9361ae6fd746ffa3863cd7f686286a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603834, "uuid": "02e288b9-b2b7-43ad-8c14-ca74a0cbd9c3", "comment": "Malware payload (Mirai)", "value": "4ac8325d485cdd1b00d808223b9e60a6bc7dd62fe409703f3112009f6d737139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603834, "uuid": "04b072aa-cc44-4ee0-b0b2-e7336adf7450", "comment": "Malware payload (Mirai)", "value": "a19374ef1d57f5de3bd58d2b12dcb91fa0001ed5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603834, "uuid": "3bb67cfc-f01d-44c8-aaa4-37e3035157c5", "comment": "Malware payload (Mirai)", "value": "fe77da1862ef1bd4b44b5ae4de37e658e911fc1091bf9953f665d6d5d2e6b93f8f01af31a7113042add74baae6a17c5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603834, "uuid": "b4e527f2-3690-4d51-b60c-08a64d71cb23", "value": "T154C35B82E6A2D0F1E68701B00557E3E68935EA305416CEC6FFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603834, "uuid": "1510a96f-f441-4bf3-aa39-28ca40b36cf2", "value": "3072:X6tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNio9w:1oRNjmj1VGc3rRioi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603834, "uuid": "190bccb5-f49b-4249-af37-3ede38136358", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603834, "uuid": "541f3c04-297a-44c4-85e6-2c788a26f72c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603834, "uuid": "6de09170-4aa6-4448-a830-dbad5b13da6b", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a943208-9f60-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537214, "uuid": "9df26e69-f6d6-411f-ae41-df88594ff8ac", "comment": "Malware payload (Mirai)", "value": "85847bcab089a278bb5b34dede451c5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537214, "uuid": "d3cbea31-a4ac-4d92-b73b-5f0792871156", "comment": "Malware payload (Mirai)", "value": "4bb8b380fa4377b7baddc6fee6ed312e2e3c1489825aad487f5b9c3a11919e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537214, "uuid": "9c19b69d-bd5b-43de-b30a-fb3f3dd9fd99", "comment": "Malware payload (Mirai)", "value": "04b981b12ac1f9e568f1aa11dc1243b251a2c120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537214, "uuid": "d68e5876-fcf6-4683-9e53-55cc0b18a50d", "comment": "Malware payload (Mirai)", "value": "24d6372b268e89ba6191ef29a649614ee64a3bb29928bf8c565f1403e9079a0fd451eb709b79d0b2acc09ce653eba3ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537214, "uuid": "2358c848-7cea-4512-a563-0f87c9f757e1", "value": "T1CD8302225C0E7171D8F12C31B2269211780AC672E76C38597446EA9753E12FDACFCBAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537214, "uuid": "14fd0da4-f359-44ac-bac4-b3b750731c9d", "value": "1536:kSb722VEtZcd+hzth1rRBa/YaXfp0tVhjw6PFn0Fjanfb:kE722VEtioJhTo/YaXfcDjRt0FUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537214, "uuid": "328abc21-1b95-4d9e-8207-d824ab218ffc", "value": 88392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537214, "uuid": "3495bfa3-76e2-4376-bb57-7b8c6a305e0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537214, "uuid": "dabbe3ad-202e-453f-adca-d335fe95d15f", "value": "4bb8b380fa4377b7baddc6fee6ed312e2e3c1489825aad487f5b9c3a11919e78.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf0da08-9fd2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787586263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586263, "uuid": "d28ed2d5-3a14-4dfa-8a75-05b44cf9f5eb", "comment": "Malware payload (Mirai)", "value": "00766876dbc4efb14549f722a68794c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586263, "uuid": "8f09520d-fc1f-4804-a272-9c6c95a43c1c", "comment": "Malware payload (Mirai)", "value": "4ea8e41bc05d6f5a11aec94578a2af51a0cf5f25040890a2a714fa6bc46fa965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586263, "uuid": "e6992a60-27b9-4839-86b2-9176bd2b7e9f", "comment": "Malware payload (Mirai)", "value": "423e18e2f29bbe0b55aea61fc4a1cc976c3c6c43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586263, "uuid": "6bdfc863-9781-457f-a66c-ea5bfbcae9cf", "comment": "Malware payload (Mirai)", "value": "a08fa152a17affce0e1efb5232b3315643e1b523f5906c6549870e100f16052bcdb5c8a70efb7b4751bb0c64f6844273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586263, "uuid": "bd96245f-83e8-4bb5-b822-374387feadd5", "value": "T16F830260D8AE73CDC5259838C40AD622BDA1E850B6F6F34670892725EDF12CB1F7D34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586263, "uuid": "6f8555db-0db3-4f3e-8205-b0ac2a5514a0", "value": "1536:0Sb722VO7LBcrtiZcubVMou336LyfjkhFIWbtv7fUKlsafF:0E722VsButiZFUjLkhaWb5lsat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586263, "uuid": "aab47ebe-8330-4f99-a96e-ab7e0cabe967", "value": 88400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586263, "uuid": "841390fb-1761-49f1-8c24-22ce76edac48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586263, "uuid": "9d569c38-0106-4f63-8a48-fd98da4fa27a", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f500fd9-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787577917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577917, "uuid": "7e831f16-3016-40b1-941d-430edd445190", "comment": "Malware payload (RemusStealer)", "value": "577c6df943f057215b1f81fd0d8b44e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577917, "uuid": "9da869b2-a049-4c7b-aa55-eec92587ed5b", "comment": "Malware payload (RemusStealer)", "value": "4ff863b60d5d5d4fb86764e6b6bb25677d2a3086c33fccc3f09e707937b8d4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577917, "uuid": "5cb722c2-9dea-42e6-9951-76b4cb218c1d", "comment": "Malware payload (RemusStealer)", "value": "0b7d0f8a2b4e6c1d7952e24f1c6b8b597ffcb8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577917, "uuid": "24e4176e-7e2e-45c5-b01f-93968383293f", "comment": "Malware payload (RemusStealer)", "value": "c8ef9da77e87a4c424c2f12f74d9332b643350105460e17274113d97946ffec20737775aac9873d6b9aa4a8638ad97a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577917, "uuid": "ef81a829-96ae-4d87-a088-30a19187a677", "value": "T1B7C58D077D9542B5C49AAF3189729292B671FC0CC73233E32E90AA782F757D15D7AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577917, "uuid": "f92111cf-e9ac-41e3-b2f2-75ee1bd72286", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577917, "uuid": "697a3d26-cdee-44f3-aaae-85130e3f6979", "value": "49152:VDIP0ZHjNZeHGbTOVslFSHnF+NSJTBqBS+yf8OuTEkmEcifQ7dUkoBZoXDLw2+/Z:pfHjRWVslFSHnF+NSJTBqBSff8OuTEkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577917, "uuid": "626f1652-b94c-4a3f-bb0f-5b2fbf8e17b0", "value": 2560424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577917, "uuid": "e6bc7a0e-5e36-417c-93b3-054de22675c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577917, "uuid": "c887ebf8-8f9f-4ef1-8a3d-21e5c6b723e4", "value": "4ff863b60d5d5d4fb86764e6b6bb25677d2a3086c33fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822eec61-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576741, "uuid": "8451e2c8-dc50-4e7e-8632-0e71a0803b93", "comment": "Malware payload", "value": "c7083eced47fb877ae870e7d87a5f85f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576741, "uuid": "9bbc6266-cc09-4449-88a0-bce883dc5ecd", "comment": "Malware payload", "value": "501c727b0bbe4dbf748acd5c732d796317d02cec49647255b3a3783e30c75b2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576741, "uuid": "9b1cfbe5-7f72-4bc0-b86e-2e51f3746ac1", "comment": "Malware payload", "value": "c32bd7d2c9af6cb7b54bbdb7d51dbe0ddf74be95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576741, "uuid": "e6538c18-5927-4c90-8df4-1037a40b82c4", "comment": "Malware payload", "value": "ccbb28b2025cb8132b9bd93e9f2491571493b581e5c74a0699d412d051dc2c239a74dc7dc582eff1390d63968ac1c058", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576741, "uuid": "8150fd08-60fc-44ce-b558-cd6b847ec059", "value": "T1BBC20853A9C7F0FDC86982794187B034A273B039127ABD463BE5E72F6E7AE124F49401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576741, "uuid": "5640ca0e-5ed2-436e-9eac-c0afb6e2bebb", "value": "384:DGBwSak2nTZD+zagYIpTtr5WXv+zXiL3zh8YyMm:DmU1DEYsIHzzhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576741, "uuid": "b76ef2e1-31b1-4930-ba0f-ed58befc4644", "value": 26288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576741, "uuid": "8472c1e5-9691-455f-98c5-6adcf92d72d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576741, "uuid": "160eecd8-0853-4bde-8f3f-c4ec7b625b64", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf4ae1-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1787583991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583991, "uuid": "4167c4a9-d07c-4c1c-bbf8-3b7044a47e60", "comment": "Malware payload (AsyncRAT)", "value": "62ffc1a570060d76d010afee054d0d95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583991, "uuid": "b333e80e-5aab-44c3-9ff4-fa7d8eb65fcd", "comment": "Malware payload (AsyncRAT)", "value": "50d45ea5f67cd018b72fbcced629ce9159a7b914750adc78f6e4f29c866db426", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583991, "uuid": "1665c1d6-138d-41f0-88cd-6606c1399bc6", "comment": "Malware payload (AsyncRAT)", "value": "76f342f88d9be605f58b3428328e97b41144b5a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583991, "uuid": "f8d021a5-a60c-4394-b894-d536e6f2420b", "comment": "Malware payload (AsyncRAT)", "value": "e3f0019c5f2c9ff273a89fab38fd449dbc25ae61e343747987cb7f80969aef812bc5da0513d45eee2f16e06a5d79a70e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583991, "uuid": "11da2066-5b6a-4307-9024-1279846c74d6", "value": "T1A2258C983250EC5EC0D28971C9A4EDFAA5702CA7D606E20395E73D9FB93D586EF101E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583991, "uuid": "40e88c11-a8af-49ec-81e7-47e81fbc7666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583991, "uuid": "59c028bb-600a-4766-9b99-a1eaa24c6b2a", "value": "24576:1ggyeySlKIdXWqLhVXHBWO6vWSIdzjP/2oSdvqfx:1TnmIdxXkTvWJzb/2oSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583991, "uuid": "d00105c0-dc17-4c3d-ae39-9cfc3567c8b0", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583991, "uuid": "24a4ddb9-5895-4f02-9d18-abed89ea3426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583991, "uuid": "d31b012b-ab3b-4fdd-bc21-2e90e58f52a8", "value": "doc 20260824_9000001rfq001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bd7837-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787582837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582837, "uuid": "365ee987-6341-4702-9371-e0e089c71842", "comment": "Malware payload (Mirai)", "value": "a044bc712df14502ffa528f574cf109e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582837, "uuid": "d4aac945-2741-47e5-b0c5-55695a4edbaf", "comment": "Malware payload (Mirai)", "value": "516849e917a7bc109c362afcf2d35963aaecfc5648529d7f3b0869bf0ecd0da2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582837, "uuid": "1de287e2-fc70-4580-80cf-0168c50fa5e2", "comment": "Malware payload (Mirai)", "value": "5a552b06d7a1a6b5f217675328c804049eb09bb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582837, "uuid": "688c8fd6-0e52-4e31-9d70-861a7ba37ade", "comment": "Malware payload (Mirai)", "value": "7a39d7d55914f183e142b41d8f0dc7194fc4434de118ed2dfc0fc848eb8d1e3148bd2afe9ea104e575c8cdb7756f9a09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582837, "uuid": "93f28612-f848-432a-abfc-2b3a7372d756", "value": "T1BA04C71AAFA20FBBD8BFDD3306A90B0539CC554722A43B753674D528F50A94F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582837, "uuid": "dfd288fa-1c21-4355-9dd8-859be8017e63", "value": "3072:juMkL6NAQmYdeeu9aRGAKC3kJSD/6TsxiMG:juMkL6NAQmYdUalKC0J46IxiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582837, "uuid": "1cb766b2-6d8d-4a2d-a2f6-ea3920bf2e62", "value": 185608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582837, "uuid": "e2186ec3-5d4f-41c4-aef5-d11f82f9185a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582837, "uuid": "cad2c6ef-6c3b-481b-94f6-3e32883fe8ec", "value": "daredevil.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160e200e-9fc6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787580854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580854, "uuid": "3032f3df-f202-405a-ab83-2c444b67962d", "comment": "Malware payload (Mirai)", "value": "c052f989ae5f727428840690e64b28c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580854, "uuid": "4e864488-2e4f-4405-a55c-bfb670895984", "comment": "Malware payload (Mirai)", "value": "5288325864a0e7e0f95a8448cace4128a3b480b331838ff0e1c88f404a2fc425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580854, "uuid": "c41b5a62-d21e-4c93-a2d3-14f7eef99294", "comment": "Malware payload (Mirai)", "value": "db6b6164aa8c056a13f4c30362c0bd199ed8b16e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580854, "uuid": "90fdd818-aede-443e-8b0f-97e60de4fcf1", "comment": "Malware payload (Mirai)", "value": "fa07166613f9b0b2f5679234dd3d7b8991758a20479278cf43d6dd36c13dc1726b4852032cdd17f65e4b4498f9a2e7b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580854, "uuid": "d8996922-98e6-4ec2-9220-878ec4b9493c", "value": "T159144A02776D0403D3632DB43B3B17D1939FE49321A4F604790FAA999FB2932A696DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580854, "uuid": "8af9ffcb-0e88-403a-912b-cc92876fcc74", "value": "3072:H3yrJxcAH1QNTxudVyMnVTh61s7u1EssMZc/T03ImIys61X1h5oN7:HirLJH1QJxIVlnVFSsAEssMOgh5oN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580854, "uuid": "11ff6a60-a794-4ad3-968f-51b2ad6004a7", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580854, "uuid": "8eaeec0b-7ce1-436f-b91f-8a3abb96bccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580854, "uuid": "d033e1ea-7576-4516-9584-6163c94fa2a0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea7c0ed-a011-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787613135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613135, "uuid": "18dc2528-850d-4b4c-b6c4-790868c01097", "comment": "Malware payload", "value": "c34229a38381e4ef1cdac65d57509247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613135, "uuid": "3f141e35-2336-4dcc-9694-434619f5f04a", "comment": "Malware payload", "value": "53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613135, "uuid": "b974ad78-8172-4ae0-b24d-5b595b955c18", "comment": "Malware payload", "value": "c3035ff9ee3fb9d222f7725fed7f7825adefc32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613135, "uuid": "8a0f9231-fe6d-4e7e-876e-c7386b8dc77d", "comment": "Malware payload", "value": "796679ebcdccf9ca83106835211c400b0d4d1eaaf24f83fc4310b0a8704808afd137df89c54c07194cf8b7bcf235bfe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613135, "uuid": "47a2e3b9-d16f-47c4-8332-3b7a39b7c80b", "value": "T157D52359AAF20474D437C7B18F92E07DB06A37858BA08E5BB39C3E105C635996D3B3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613135, "uuid": "477dee11-f4d8-44fc-8b56-8cdff2b6cbdd", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613135, "uuid": "303dbb06-0004-4fa8-a28f-73b22e77f831", "value": "49152:Qp7/1Zpv+vI4xt097SgWDiZA6Jc3yXgJxHRvyBiFJ+oWBRIRczI+OSiE5JXGHlq:QpL1ZgRxt05SEt6CXqxHEzIlQGHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787613135, "uuid": "479a78ef-2e78-4a34-99d0-71a713b571b3", "value": 2937856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787613135, "uuid": "ead74183-679f-42e9-a8b1-dc2ecbe45d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613135, "uuid": "e997b2b8-0203-4f27-9ea5-9c5fa2c55f8e", "value": "53160a2c0530340faa7d622f4e145ea8bba75af2f50e5d85eff8393a3bf34d88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ba2c01-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787577879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577879, "uuid": "d9164b56-4d13-4891-b32b-9b00f8697c7d", "comment": "Malware payload", "value": "23998b32f159d15458af831402a6df47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577879, "uuid": "9f2721d4-7197-4102-aa39-973d7fa5f2d7", "comment": "Malware payload", "value": "551c920f4e51f0b8f0af4212465feeecda249061ad107ccfc53ca532c09d138f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577879, "uuid": "618e57bd-6792-4055-8aca-257a60ca44fc", "comment": "Malware payload", "value": "4b9ebedd0d45942c76c8314e0c63e4ffc5c3f8dc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577879, "uuid": "63d47e67-1d17-441d-b689-06e634fd3b65", "comment": "Malware payload", "value": "a4887899b6bd655b68354035207150bf41ca250a3785b204eb77c60a8da2b63e144c9f29534c2e769397b8a3e3573d0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577879, "uuid": "c9a8cc2f-365c-4a05-bfcc-9ee6645e5194", "value": "T1BA235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6AD9109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577879, "uuid": "f5a066ae-15ed-44b7-a920-b0cefd6013c3", "value": "768:u+h9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:u+Kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577879, "uuid": "225f80e1-5727-43c4-ab5e-fcc58327d28a", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577879, "uuid": "bb1c4507-5bbc-443c-bcfc-910f0a47ed59", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577879, "uuid": "cfd67b7d-8876-402e-b416-9747596f5f35", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87502071-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543678, "uuid": "397c97bc-3b9e-40ad-aee6-50907e8ea562", "comment": "Malware payload", "value": "60399d5026c7a01a9bbe17a4038928e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543678, "uuid": "fbf2f945-a9c8-43c2-9fdd-2e248c9ab122", "comment": "Malware payload", "value": "554206748472a39920ad95a26b6c217ce65439fd58d755a0f05457b3cbfbb57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543678, "uuid": "19519a48-9211-4132-bfcb-58a8093062b4", "comment": "Malware payload", "value": "ddcfb37605342328c60975478631a8d39814f395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543678, "uuid": "6459430f-d8c1-40d6-a74d-398d26c09b5b", "comment": "Malware payload", "value": "ae3b09a4d5b91ef232d3629ddf30a9e67f53a748a014371036ca5dd4cc6bae084b92da35d33364f256c06e926e1eb209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543678, "uuid": "85ddb3c0-8301-4e35-89d0-b971e96ee5ce", "value": "T134065C09FF65691ACD29C672EC7F13AA3330F54D22175B2B664EBA3078A31F55E42720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543678, "uuid": "d3821b29-ab40-4922-bf8a-aa2c5eacf4ac", "value": "24576:74VJv02iibCyYwo2vo55/Z43h6fHyJqOcBrexHhdgBgZ/KPdlQEl2c+jMxBze:cVZ02dg2vo55+wHynHhdvyKqVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543678, "uuid": "8f55ff56-7971-4655-be64-93e2ad9f93f6", "value": 3714848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543678, "uuid": "a7b6b42b-0f8b-4f43-ac26-4ad8e4df23d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543678, "uuid": "a72b733d-b3b0-4bf0-8c2f-7b3ae3d21025", "value": "_sodium.abi3.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855476de-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576746, "uuid": "d2fddea3-b460-4b6e-aaa5-9f6228734627", "comment": "Malware payload (Mirai)", "value": "99896c31ab0209ed63378b2ee70f26cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576746, "uuid": "e9a5971e-1b8e-4c79-805c-a34f124e4f42", "comment": "Malware payload (Mirai)", "value": "5562f19e546bd12951fa2fe9420b5edfaf1c942da758ba5697e13ec4b4dd4f5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576746, "uuid": "d4c8b62a-cdf2-4b2e-a744-44864cbbc0ba", "comment": "Malware payload (Mirai)", "value": "f03920f1c416aec655176f262e32f006bcad0b2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576746, "uuid": "d47384dc-f3fe-475a-9d14-24243fd94f29", "comment": "Malware payload (Mirai)", "value": "4fcd00eb9dcb4fa56616777942d46cf4ab97b5f7fd04e7f9c14d4076d339c35c73f8a45f2c908c1309bbc67de4afc34e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576746, "uuid": "f47b4dfc-38e4-44af-ad78-1dd6f2bd4ffe", "value": "T17103094AF9818B12C5E115BAFE2E524D3313077CE3EF7326AE106A34679757B0B3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576746, "uuid": "a88c8c37-e2f6-4a09-acd7-016107d270fd", "value": "768:ttnvcGn539x6CfbVUjanfnrhpgD5mkcIYGWi0HGBFDKAM:ttnfn53mCvnfnr4g3ImiuGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576746, "uuid": "3a85084c-56af-4269-ba67-4e02d5693beb", "value": 38088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576746, "uuid": "74772a9e-e4ac-448e-960b-c64b1a3fd04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576746, "uuid": "76a32e3e-3e16-402f-a05a-a20e99912505", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e73624-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585719, "uuid": "d8e079ba-ed4c-4ef9-8c72-0580d1b40556", "comment": "Malware payload (Mirai)", "value": "c7f2b92638f02873880f9783157ac98a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585719, "uuid": "67db5879-3e51-4457-9d92-2b35be18f40d", "comment": "Malware payload (Mirai)", "value": "55e231d9583fbd2e372ac0f8ef6f5fa97cee1ecd30a934c8d8811328f3601585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585719, "uuid": "d9ba23fd-56ae-4751-925a-b8f181d89e76", "comment": "Malware payload (Mirai)", "value": "d90b0965a0af34afd1eb30db9b6d9d8053b0bca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585719, "uuid": "18180a6b-4d84-4c27-887c-2667901d627b", "comment": "Malware payload (Mirai)", "value": "80d958aab24f32b8ff5398a07b75b854557ebb4f24fc9e9aef262c4e7432dc49521fc671b37cef4717f637cdb9adf890", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585719, "uuid": "7977a251-e6c3-4c54-8b62-fc0573a82727", "value": "T18A545B5F7B10CF61E229C53149B38B5667E5266327E2C559E21CEE087E6038C682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585719, "uuid": "c39f7f78-1519-409b-a0e4-9599ef134e9e", "value": "6144:gM5XD4YODabLHG4kq79xu6h+l2rVXxEeJDh:r5XUXWzUR2rVbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585719, "uuid": "d76d5a0b-980f-4b1f-912f-7cf937c20401", "value": 287352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585719, "uuid": "e5f194df-d401-42ef-a730-880fc88fcd23", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585719, "uuid": "2ee2827d-2cec-462b-8a1c-0bf18a3c9e38", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3af38a-9f61-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537725, "uuid": "0b7381d1-ef5e-4612-a7a3-f253cbb770eb", "comment": "Malware payload (Mirai)", "value": "fd489eb0b2765a176ab63325ca05c6c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537725, "uuid": "f8519a34-00c7-4adb-99fc-c33d58f68b54", "comment": "Malware payload (Mirai)", "value": "5646884c460c159a9f189c9ecb9ca9c350f8cace278e95aa05e1e7ad2d98471c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537725, "uuid": "63529c8e-9bb7-4157-8683-f2be538ccbc7", "comment": "Malware payload (Mirai)", "value": "2df0d26edd04cb2a129846312c7618606db8e84e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537725, "uuid": "980085f3-03bf-4810-821c-a1e263f528ab", "comment": "Malware payload (Mirai)", "value": "bb7d912b13f7d0ea44feb9e15dc7d274675abb04e8f92fa0e960787f73cd169be7ee6ae712f7876caaf88f729a006b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537725, "uuid": "b118873d-69df-4105-b9e5-3134aa6eb5d2", "value": "T16C144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537725, "uuid": "15737ca6-4ab9-430e-a021-8daaaa578680", "value": "6144:roArJTah1if9UVcYEEUYDckzjR482pwzihN2B6OTEkm:7rwhsfucYEEUSnR48Bc2gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537725, "uuid": "ca138472-15d6-49f4-9864-a7e15a2a9742", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537725, "uuid": "f5569d71-62e3-41dc-a0fd-c8f455a57064", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537725, "uuid": "08dbac9f-fc10-4b71-b0ca-6dff86fc9355", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1402bc1-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787582913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582913, "uuid": "0584524b-5590-4bc4-a420-e8b97e6a9b91", "comment": "Malware payload (Mirai)", "value": "29e995e1a99a814a11e803218cf11459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582913, "uuid": "3d1601c5-24ce-422c-840b-64b5276d21ae", "comment": "Malware payload (Mirai)", "value": "576b03f431de4fa667b4276d95c95de2ad99d544433d8fc3aefc22dda735ff98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582913, "uuid": "84329d66-cd99-480d-8344-b7e38748d60f", "comment": "Malware payload (Mirai)", "value": "905949692979e44f4e6c4a22923ca43c291977b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582913, "uuid": "de6fb60d-2a9b-4688-a6f6-a8d3d334804c", "comment": "Malware payload (Mirai)", "value": "70b02d6aae84f4f3f084461fda5400bec76b4eb2b487c73d06f31484d5fd7b43cf7480bc1c0c0759dd03c0c6f1ff9fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582913, "uuid": "3056e54b-ad76-4edb-b99b-55fd70dcf805", "value": "T16934D8096FB20EFBD86BDD3B06E91A06248C641722957B35763CD528BF0A54F4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582913, "uuid": "f0c3d3dd-e954-4192-9111-134481b46b09", "value": "3072:eDM4HYHWgRqJ5gk6K8u34232HexNCsHFJOdH3n8LBu1EssMZc/T03ImIys61X1hc:ku0j8u34ESkhHSJ8LKEssMOgh5oOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582913, "uuid": "44d70921-5799-46b5-8bd1-30137c6f1def", "value": 251812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582913, "uuid": "9727d084-2e8a-4ef5-90fb-74ff6743a008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582913, "uuid": "10f07df1-53b1-442a-987c-7cef9227c6ee", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bfc3ae-9fee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787598307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598307, "uuid": "428f73d3-53ae-4245-9654-077aab9a0b41", "comment": "Malware payload", "value": "0aa3079bd91ef7080e5340584995f705", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598307, "uuid": "29e80e93-9dcd-43a8-9652-dd8786a74bcd", "comment": "Malware payload", "value": "582988ffe1334f235fc20667fe67538e50f2a918994126c0fa284bfa45e62c44", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598307, "uuid": "3e7a82ae-8773-4a07-ae0c-2952675df9a1", "comment": "Malware payload", "value": "bf5526aaa0ac3e7a9bb21633f5050fb129d4b0e3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598307, "uuid": "e05cc7a3-12b1-40e6-87f5-cce537a58c4c", "comment": "Malware payload", "value": "7d2b2a3d700e6c85e7a6ad45800417a0b14953f0455d9a99bd5ba2e889ccb789b3469d8f61c00d58e80e285a51449a69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598307, "uuid": "1858e7ec-d4c4-4ab0-9116-9b61c9f5e052", "value": "T140C44A55F880DFA1C6C129B6F64D86AC33174779D2E772068A258B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598307, "uuid": "49b55a94-41c0-4bfe-808b-2a1629f97cb1", "value": "12288:GLmSyud7z3GZdqEvee14fX7coB6r+Ar6pO/cg:pHGXWJv714fX7cr+Ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598307, "uuid": "aef6dc4f-3eb3-4074-b277-20e86545f332", "value": 595120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598307, "uuid": "7fa83e31-1ece-487a-b953-f41e82b07bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598307, "uuid": "57847abf-0968-4a55-9cc3-0817c850592f", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdfc8f8-9f92-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787558827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558827, "uuid": "1321959d-00a2-44e0-beaf-854a4ca1d59f", "comment": "Malware payload", "value": "be421b7b3e38313e738010c1d4fe6335", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558827, "uuid": "619d332a-30fd-4e86-860d-27d62faac2c5", "comment": "Malware payload", "value": "587b0fe097b5be07f9711b41cdd20cb7732d744abd37b86f229ed2200238272e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558827, "uuid": "c3863484-7d2c-4db8-a1a9-25d06126f71d", "comment": "Malware payload", "value": "dd25271b955450c565cdbf4de90bcc1ca7f981ed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558827, "uuid": "4a0531f3-d647-41fb-982a-8354b1b55efd", "comment": "Malware payload", "value": "3d5c083e8ca49cbe3e9ecb400a9525a2ba3345ab2cbcf38a6586f45509af8b5bcf8848ae24dc99e217866d87ea47a971", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558827, "uuid": "5caebf93-b3d4-489e-8e44-0e91027f6da3", "value": "T1DA236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCB3CF28C4AAAD920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558827, "uuid": "348eea30-30c9-4feb-9575-3cf890d9a37c", "value": "768:u9NyXsZztC+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:uHusZ2cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787558827, "uuid": "6f533384-9122-48b5-a2ea-ccb104a581e1", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787558827, "uuid": "020a38d8-20e5-48d8-bd49-d8f376305ef9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558827, "uuid": "cd24a251-7d39-4083-9499-a35e442861f0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802a3ea8-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787578026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578026, "uuid": "33f66afa-a52a-47b8-a6cb-e7632eea60c7", "comment": "Malware payload", "value": "2e7a95b6e3de92926e5c3c5db59b213d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578026, "uuid": "6c358cc6-c8e2-44c6-aff3-1609bf02973f", "comment": "Malware payload", "value": "588197157412404247076382b843d6b37162a37ee47ae42405c2e6c31c99fe24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578026, "uuid": "8e0e36e4-94dd-45e1-a327-c74ff2b24de8", "comment": "Malware payload", "value": "38539649ca20008d675dc1a0ddb1cc80567d722e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578026, "uuid": "6bab583d-e827-414a-913d-d2b0d0ab3563", "comment": "Malware payload", "value": "0fcf2338c8f02df35e89b939a31bd9c7bd9bc0a67edc7106f098bca7d90dead9e314427edcad3711e8676e07ab658aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578026, "uuid": "dfb7ef37-fa8e-43c4-a2f9-54bcaad7d45d", "value": "T152F37B0A72E510FDE1779239CD951A05F372782607209BDF03A0077AAF276E16D3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578026, "uuid": "88702fa6-d7d7-480c-863f-83a236bb9f26", "value": "0e59af4335b2d7add8de171bd85959b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578026, "uuid": "1ef42169-c8b6-4ce4-bcaa-5c68b0de135a", "value": "3072:id/0IJTBhDJkGOZAVBpJn151QUCAfhTKnE/vOr9WGydaB:i6IJXqGT91IUCASZaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578026, "uuid": "f99da973-7660-46e2-9fc9-3741167764d7", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578026, "uuid": "8d1d3e4a-133b-4fc5-abe6-511a97a3284e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578026, "uuid": "d14ff72a-7101-4f1c-b7c3-da150a5675e9", "value": "588197157412404247076382b843d6b37162a37ee47ae42405c2e6c31c99fe24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96e1371-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584994, "uuid": "8ef31a90-d567-478a-a479-45277bb0396e", "comment": "Malware payload (Mirai)", "value": "f76eee42abae57d03c92a51b3118fddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584994, "uuid": "67f050a0-7506-432e-a1a0-23929ab829a6", "comment": "Malware payload (Mirai)", "value": "5a059ee0af217e3afdd1e6666e5f77d0f7e843e5c2581db86417a70a7e6c2b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584994, "uuid": "d81ec545-16a6-4661-b8e6-dd122c7f8fd4", "comment": "Malware payload (Mirai)", "value": "eb3dc436045619c2680ff5fc34c9d0ea26ea6cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584994, "uuid": "e35701ea-769f-4a79-a934-dd4b0bb9e551", "comment": "Malware payload (Mirai)", "value": "d5bc1f222d5c48103acefbbfb95368c196fcb1154ad9b3df2a8ec32aa207cb1cc38624572a624fb668bfdfb1aa8a4954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584994, "uuid": "0be77294-ea16-4d4a-8090-a65749581fcd", "value": "T150830194D4A973D9C52098B8C40FD501BD62A428F7B6F64324882729FEF27D61B7E34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584994, "uuid": "121fe809-2e7b-41c6-9488-f66b0732dd02", "value": "1536:0Sb722VO7LBcrtiZcubVMou336LyfjkhFIWbtv7FoYk3fR:0E722VsButiZFUjLkhaWbTs3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584994, "uuid": "1f7bd85b-3a81-40ee-8c52-2cd8748864f3", "value": 88400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584994, "uuid": "4ba08987-4232-4314-a261-78db8cf8910f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584994, "uuid": "aaf36d5e-ce60-46d2-9a07-b547e9235e9d", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2491ad0-9feb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787596981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596981, "uuid": "8906f053-8ace-44f6-ae01-470228e63a6c", "comment": "Malware payload", "value": "2645519c94b369f0a36c7fbda5adac54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596981, "uuid": "a885ac13-f4c7-4e3d-bc24-88df5d9035df", "comment": "Malware payload", "value": "5bb97826cac1543d4699ef3448b66bc9a8b0675d0a71de7626dc7e82b33b5135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596981, "uuid": "357b8b82-d9a6-48f4-8875-ee5f57ce5d42", "comment": "Malware payload", "value": "f1c434bd1c556e5f10d047704a597719817b0643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596981, "uuid": "8bb02a5e-9de2-40e3-9d01-ae9773b1ffeb", "comment": "Malware payload", "value": "43edcc656e665284ecf732a7f188e7860c7f2cf3975f46cea5d12ac682decbb543bd9c58dea438c739ad958fbb81af5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596981, "uuid": "9470c060-7b9c-4bc9-ae9b-deb6f8a851da", "value": "T1CCD52299B8BA15B9E432C3F18FD2F0BDF0693B824EB18D5B7ACC5A004D125552C7A376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596981, "uuid": "107c223a-f365-4f2c-8b1c-937e2989bc54", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596981, "uuid": "0c050232-76c7-444e-8390-db80f08d3b5d", "value": "49152:nMyl82KFZn1LN0WCE5yM+X2QEODikv1rxomDVXfuhmvHMDy38sOItEG/mBh+gg5r:nV4n1J0EI2OD91xloeHDnmb+gen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787596981, "uuid": "211ad559-4140-4cbf-ac22-15e592d840c9", "value": 2953728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787596981, "uuid": "93cd25fb-e962-4441-9e7b-aa68631d9a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596981, "uuid": "bf404375-c21e-4eeb-936d-5581680043cd", "value": "5bb97826cac1543d4699ef3448b66bc9a8b0675d0a71de7626dc7e82b33b5135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96eaf0ac-9f76-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1787546711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787546711, "uuid": "6df79fe6-f97f-4d1d-8a0b-463ca6aa476b", "comment": "Malware payload (ValleyRAT)", "value": "9c747cb42f715dd307c10585ac8c2a7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787546711, "uuid": "43cca104-9df9-43fd-a297-564e707555dc", "comment": "Malware payload (ValleyRAT)", "value": "5c55c757b15a73014794636af7761f62e69e379d7aa402969f107f4c9d7da9da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787546711, "uuid": "e4bbdf6b-e5ff-44bf-90ed-4d45cf454d84", "comment": "Malware payload (ValleyRAT)", "value": "bc7c54f5d185eb8c3d55a04c604c61ba7c647447", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787546711, "uuid": "49af658f-0faf-4b59-b2dc-66afa5673c83", "comment": "Malware payload (ValleyRAT)", "value": "dfeed344c3ce608826837a8fb726de7ea80c6158b5d5004c4bc12770faf8fc482e7bad36013e1a93e7e476f7cef0a7f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787546711, "uuid": "f30205a2-cd21-4473-b589-c9246d2df634", "value": "T1C8847E01B5818131E9AE0934B835DBA75A7DB8714BE0D4DFA3C44DAE9E207D1EB3871B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787546711, "uuid": "9d3e021d-fcc6-4e20-a126-ec75504495ac", "value": "ed719d06b435e943e2137e8d090ae910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787546711, "uuid": "8d754d19-010c-48e8-b6e4-78a59c538ddd", "value": "6144:2cZZ+x7m+cWCDq7ZNIFTRhUE1Tk6++a3/z3mDAa/SnkuVNhEAYEQHQpo:vQc8nIFTRp1TkhhGWVL0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787546711, "uuid": "0e4bcf49-27e4-4a4a-a039-e967d374003c", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787546711, "uuid": "ded90631-f252-4a8a-a96c-22c08517d427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787546711, "uuid": "4ef0b42a-121c-4f8b-a6b1-e320b111b789", "value": "9C747CB42F715DD307C10585AC8C2A7C.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9beb9f25-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1787577643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577643, "uuid": "9e2d22f2-1af6-4974-8ddd-fb67caef299e", "comment": "Malware payload (RustyStealer)", "value": "d1336fe4db7f56d197047043bc1a8c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577643, "uuid": "a24a2c2a-8375-4235-9ca1-9330583f7a01", "comment": "Malware payload (RustyStealer)", "value": "5c8e45cbc43e5e7b15d41c0e4bf245e9b904b4d316db90448ecf10e6eb080ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577643, "uuid": "a3eb46bc-f0d9-47c1-85f2-0da8fd6cae8e", "comment": "Malware payload (RustyStealer)", "value": "a67217f713cee6b314440820b714a760e394e77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577643, "uuid": "66cc3189-8f1e-4f11-a4c4-35d2f2f691c2", "comment": "Malware payload (RustyStealer)", "value": "26b5bc26c65965ff9ffc256a418d0b6f459c552b6a6ccb52ed4d601efb30dda3c9addc9c7c5b5d71a1cdbacd8ed51375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577643, "uuid": "032d76b9-667c-4efa-aa3a-9a859b508aaa", "value": "T12C064A02BE8659E9C1DDC870C3478B634A2274CB1A36F6AF42E501253F6EBB55F2C359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577643, "uuid": "cddbd63c-ebc5-49d0-be2b-c7f3712a00c3", "value": "28625d255b1bd061bcd7099c9c54bdd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577643, "uuid": "6626e9cc-333d-402c-bcdf-2fc3a2ecfa83", "value": "49152:tGZhgzYjzsolLD5j9WuI9NuHzDUcJ2TTQYq6Flx2WF0gXI0C0dgSOIU6ipS:6tAz981Gx2aPlmS5+pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577643, "uuid": "02ee3ade-64f8-4f80-b49e-6060fd201881", "value": 3924992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577643, "uuid": "d8956273-60a6-41b8-b746-c1223b6379ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577643, "uuid": "fb898248-52db-46a2-ada1-31d83b9d6db9", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65c4965-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787584157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584157, "uuid": "dfb2633e-6611-46c5-9cd6-7c2c21e21151", "comment": "Malware payload", "value": "b454a04b6054b05f2426bfd6d323bca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584157, "uuid": "2b2b3645-088f-4066-8c9b-995af58f1c27", "comment": "Malware payload", "value": "5d72c446d7e021e3ad4a6e6c852775b86f20bb1f0c114b8ea1546a9d775eb6cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584157, "uuid": "3d808ec1-e6ae-404a-b9bc-7cc4160dfb15", "comment": "Malware payload", "value": "7731076dc691bc5aa76927e473565d221a9634ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584157, "uuid": "57ccca2e-ca83-4b5f-97a1-0764223b1189", "comment": "Malware payload", "value": "6fe3e2c11e9cc9d7c88aab5e4fd1e380d55346f7f8d931c64f7fdb183ca238094c1fb02e1434cb0c10b46ef5444b9ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584157, "uuid": "3b4ff8bb-2869-4650-b5fd-25c5b1d9af39", "value": "T1A0D34B17FB0C4562D8C32DB80E7F0BE68324AD5220FED515250D7E9A1B33E719A87B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584157, "uuid": "0132bea4-773f-4a79-abba-e85b9b6003ac", "value": "3072:cITjMNB2qhEm1lx1yl1IJAABTQNTFgXHMacU8UcV:cITjM/zhdlx1yl1IJA7kXHp85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584157, "uuid": "248c1d86-488b-4051-abd9-945f29a60070", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584157, "uuid": "eefa166a-fa03-4ebb-b190-847df4ba9fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584157, "uuid": "02d26cde-5e3c-45e4-9a9b-563e90f178f2", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d522f9b0-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787577739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577739, "uuid": "c101c930-a8df-4f6a-9cab-300737dec41c", "comment": "Malware payload", "value": "4f99142412c02cfc8a7a24089e7f533e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577739, "uuid": "6c4b5a3b-fa00-4bdd-8c90-b5616e11d2d9", "comment": "Malware payload", "value": "5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577739, "uuid": "7cf0c746-69ff-4dc0-a778-eca03252d162", "comment": "Malware payload", "value": "a6607da1ca6791cddfb3e4db45a943bbc5e56061", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577739, "uuid": "2d8652ea-ea3b-4c43-a708-7e28d2c2b9e5", "comment": "Malware payload", "value": "9ba9404ad315e0a41e29a0bc6771c534aee9918ce65c2a7d2fddb5795e3ac0f9d4222d522b12dde69512c8f7be37b312", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577739, "uuid": "a270e1f6-73fd-4f83-b05a-dab141c12760", "value": "T1D53152EF610819321142DE4E72B2358D768E91EB289FD7F4D8180DA9824C7C8F261F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577739, "uuid": "fe6e2e4c-233c-4380-b869-9c68bd8996b5", "value": "12:UBJr6BRVlTDHyoSwU605dCENG3ROx6NG3RO85iy6OaH6aPzWueh76WueDa+L5L3z:+2lnyV5aqgjSUdGp5D8V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577739, "uuid": "9da945ee-977d-4323-bca2-df44da47ef0e", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577739, "uuid": "c0a69532-8ac4-4ba1-8f78-0f7a29abc67d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577739, "uuid": "7dcc93c6-fd77-4aeb-9796-8312a12298fb", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4c4aca-9fad-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787570236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570236, "uuid": "943423d4-42ce-4810-8267-276a8130031c", "comment": "Malware payload (RemusStealer)", "value": "48ead24f6f60cc63d70b1f636499672a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570236, "uuid": "c1c75dd1-a652-4eef-b294-eb0a55869db0", "comment": "Malware payload (RemusStealer)", "value": "5e12c7f4822f67723eaed1c3ded4fc8e94e576fed316a2b24b56e003bccb44e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570236, "uuid": "19308537-64b5-4acb-a2d2-ec6a719ce7db", "comment": "Malware payload (RemusStealer)", "value": "83ff35e3378b860d9a10819cddf3aa231e50cabd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570236, "uuid": "799d7a58-3ab8-4304-be8f-cb08414bf3d2", "comment": "Malware payload (RemusStealer)", "value": "83cbab8aaa09b2d26780bc1c9ad34e159444503d90a0a4415b614bf2cc11e25452e0f6bcdd9b1e7a60e1366b2177b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570236, "uuid": "4b5bd176-6b4c-46b7-bbf9-1514a0c87c05", "value": "T1DB26BE03BCD481F4C4569635C5BA9263BA31B84E8B3673C72E50BA382F7A7D03AB5715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570236, "uuid": "58f556c8-4fb1-4a1e-a893-e9164ed4aea2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570236, "uuid": "ba5b771b-2217-43d5-bd7b-d3b621bb0888", "value": "49152:VCwNfiO25sifI9lY6J8Y48DUabi5Yqlceu4Wlab5negc518wfvugnAeDOFXEL:oNBilpq5nu4MQe/YwfvDfDOSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787570236, "uuid": "6cd7bc93-8dc9-4811-ae5f-a2cb5ab82a3e", "value": 4554168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787570236, "uuid": "e27cf43c-6c0d-43e5-b9bf-f6c7f91319c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570236, "uuid": "25aa1eb5-6384-42fb-bd71-e2114fe5d468", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f066f8-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576796, "uuid": "3619f08e-c7ee-4e7f-981b-b43d1ff53167", "comment": "Malware payload", "value": "d02619ad03113eeb5c338faa227c5391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576796, "uuid": "c1d25c3a-8e06-4199-b5d0-55bb2d57e6d3", "comment": "Malware payload", "value": "5e4d0a9c09b59bb57071802371386c670fd1b18cbb5140be6f1715bd1309efa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576796, "uuid": "6a4d226f-3253-43f9-ab15-93dc3d6c7a91", "comment": "Malware payload", "value": "b3c25a787c5e39f6f3bfb70fc2e543094248cfc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576796, "uuid": "cc2d1952-e2af-4487-aa24-6549342db3a3", "comment": "Malware payload", "value": "ad213f1703dfa368008698b6a32759c0e252c54cd80ef7d64337ddcfd4f9c9cef3057f3c733d2086f6c8412271137069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576796, "uuid": "aaf6bf45-e2c8-4715-8c6a-51d884fe1af7", "value": "T1B472B0AD5B0521E3D837547213A803801C390FFADD03DC6A6699EAD3DD09CE5A1E77E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576796, "uuid": "38455cbc-265b-4c77-9a20-7182b46f3222", "value": "384:anxMbDo/EqEFZTOkQyT5lNJgGlzDpHyKbP1dCRMZ:Wxg8vEFZ60bNJgGlzDpjc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576796, "uuid": "1d388030-72a3-456f-9cb8-2c21d8544a04", "value": 15972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576796, "uuid": "26ef5173-439c-48d4-a9e9-efd39252497d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576796, "uuid": "77fcd1f0-c25a-47e6-9265-a64f37bad022", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480bf527-9fdf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1787591676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787591676, "uuid": "a48e7d68-13c4-4593-a93d-b179645fd2fb", "comment": "Malware payload (Phorphiex)", "value": "ed7f7dbeed08ef3446c29432ee50861a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787591676, "uuid": "34175a4f-0d16-45e5-98cd-b5f1e7365e55", "comment": "Malware payload (Phorphiex)", "value": "5e6d5240402036291aff059a205ae94c60b72e45b6faae2f3567d7e7368f5d16", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787591676, "uuid": "dabb6450-f776-4c2f-92b1-9270d60bfac7", "comment": "Malware payload (Phorphiex)", "value": "20676bec6038ab33b21d264864f4854d6022044a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787591676, "uuid": "eb65d06e-ab22-47f8-a25e-4f496a9baf50", "comment": "Malware payload (Phorphiex)", "value": "ee254aa3a3e8be2695ed407cb60a05086c2b804b89c5c53cd1307fd18ff6b0d96b206ad3445749442a920b4b83daf658", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787591676, "uuid": "dadf39a6-f7cd-4217-877f-2da59abb5987", "value": "T1CD824B0FB9424326D0E11070A676867BDA79A8B633C414DBF7E48AED0A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787591676, "uuid": "5c09b80c-cfbf-408c-8140-57388c45fd37", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787591676, "uuid": "45616991-699c-4b71-9ce6-a7ff81abf58c", "value": "384:ak6I8vVaF6OSYUQQlmLu94gXTczlmxav8U9crl:akPTUQQt9U8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787591676, "uuid": "4b64880d-7cc2-440f-8e24-87d947c8f6c0", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787591676, "uuid": "9f7a5e64-512d-4b90-87ce-80858731bd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787591676, "uuid": "fca89cc5-275d-403d-9a62-15f3a6b46925", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07e99d2-9fb9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787575557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575557, "uuid": "39d1cf2a-b28d-4496-b582-abafd5af3c63", "comment": "Malware payload (RemusStealer)", "value": "b3ab783af9bde54b3c481fd2bf15665c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575557, "uuid": "258b994d-49ce-4f1f-8f84-bc29bcbd1e4d", "comment": "Malware payload (RemusStealer)", "value": "5f0a835ea6284558f514d95a8c6be7b691f3a2de6d057ba139d16d5dd511102b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575557, "uuid": "b8d68176-57aa-4dad-8a03-40796da2fb1d", "comment": "Malware payload (RemusStealer)", "value": "337193b3d37dd173110899076b1766985d3788b7", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575557, "uuid": "a018df1b-1a54-4bd8-8ce9-76a71490dca3", "comment": "Malware payload (RemusStealer)", "value": "08e17883733aba32fabe44e00fcc1766e47ff719618fa9144985d6ce391a08eaee0ca70dd5f4fc0eb665b9ec57c9a7b3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575557, "uuid": "3a96eba2-e0e7-418a-a5fe-5f8efb8ecfc8", "value": "T160C549137A98A1B5D4E6E23596665250F730BC4C8B3133D72EA2AEB81F333C16E78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575557, "uuid": "8cd5699c-ff2c-4451-80b5-9decd9f4be1a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575557, "uuid": "5ea1a938-1d8a-4f3f-ba7f-3436cbccba20", "value": "49152:/LIXm9xYZFuf+QHHr2dDYwtuWwQSg2+bLYD18:tYZF8Edk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575557, "uuid": "b5e0536d-2eb3-4c6b-882c-03dbe2fe694b", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575557, "uuid": "e0a63c84-2421-4a80-84e8-138211fa64a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575557, "uuid": "685823a6-e0e4-45ff-98ff-98c791059e26", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0386db50-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585548, "uuid": "2e4add47-3b87-4e0e-bbee-8b0d7b422ba6", "comment": "Malware payload (Mirai)", "value": "4ad8cdeb3640f79e61fb9adf02fe474b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585548, "uuid": "e0e62007-0999-46ed-8a76-4a82cc3e5632", "comment": "Malware payload (Mirai)", "value": "5fd33f140fd5693ca292aa8c934722b08de01b3bafd4904579a2cb0deedac8d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585548, "uuid": "7cb19cde-d776-4ebe-818a-17a19e7765d5", "comment": "Malware payload (Mirai)", "value": "252582d010847e2ffdee8556332363b8b3038b05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585548, "uuid": "e6addf1d-97d4-4376-8c7b-463eab7d4d5f", "comment": "Malware payload (Mirai)", "value": "edb09f967e7496cfc14f04212a69ce9fafc438395ac8034b5511dc4b8fd768626f1cfc3988752b63e678fb59825b087e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585548, "uuid": "679493ab-beeb-4385-81b6-03731d26783c", "value": "T187931205ADF7F449D79E383B1C97BD2058C8DF4147AA7BB2272980B6D09C7AD811DD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585548, "uuid": "bcba7be1-c7ca-475e-9ed9-305b30cdeadb", "value": "1536:DoPhAoPCPNIJAj94Qc3U5tVUQMXcdP3ltdjylhkJLhpIm7oD3PqjLAa3t98tKY+A:DuAo0NATUzVUQeGPTFylhm/7cM0Pt7NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585548, "uuid": "ebda5b00-87a9-4d7f-a4c5-bc27745eafed", "value": 97292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585548, "uuid": "93021e27-3875-4bd8-9b2c-6b8989985a66", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585548, "uuid": "ee96428c-62b5-4512-87fc-77b736255707", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dd7fc9-9fc7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787581639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581639, "uuid": "4c5cbd97-2f6a-471d-b2c5-a7f839d452f2", "comment": "Malware payload (Mirai)", "value": "6c040be99f818d0d88aff439767ea8ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581639, "uuid": "8c958ac6-0de4-47e6-9182-f6ae227a8d12", "comment": "Malware payload (Mirai)", "value": "5fd50bfea00c7e9791c450a1f53ae11db6997d3e986e08f4ea9e4d1e985786cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581639, "uuid": "87de3554-abd7-4482-8df1-15921ceed21c", "comment": "Malware payload (Mirai)", "value": "88d1586d5be9b9aacfbee4b0c350d4e3324177b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581639, "uuid": "8945fcf5-26bd-456e-9027-f02401fd21bc", "comment": "Malware payload (Mirai)", "value": "5519722a0b5c2c7f54cdaf881a9da5604491d3b4545279ada3d185bac9c7eb612745c4a2db01b29810158297d222dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581639, "uuid": "267f5dd6-c3e6-4db3-b795-ba6a63d8a573", "value": "T12704A85E6E129F7DF67887304BB34E25A76923D627E0D684D2ACC1101F6029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581639, "uuid": "b75257b6-1558-46a8-a2c8-4feb60568e29", "value": "3072:ASDgGBh9ckdpqV1rMJw/yvLgisougDYM1:5DPB4ypeQeKvtsovDV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581639, "uuid": "727d1e2d-7a7e-4687-a342-41cb75211db8", "value": 182248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581639, "uuid": "8a895da9-efe0-499a-b69a-b12de173b31b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581639, "uuid": "2fcc72dd-de6a-4206-9bda-91bec0a1983f", "value": "daredevil.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92144f87-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543696, "uuid": "5576cd8a-4cc3-4742-87a8-f3fd554d9b49", "comment": "Malware payload (Mirai)", "value": "797125981c82b7a0a3333651cd742c7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543696, "uuid": "2b0a06df-9dca-4d58-a503-d4f0e2c86534", "comment": "Malware payload (Mirai)", "value": "60b59195ee6260aca64bf6f704d52b064cfff2533692eb70f006c564a8dddfb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543696, "uuid": "3159e4f4-6cf6-44e8-96d3-95dbb5371294", "comment": "Malware payload (Mirai)", "value": "b06cd4feee882cf85c735c8902c47aec56855d26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543696, "uuid": "1f95c4ac-ca4a-460e-8469-fa89ef322b36", "comment": "Malware payload (Mirai)", "value": "97c8f8d8cbdafd9d54d597a9b7d874c3e883be67370e6775b13c6d41abfbfb8dd0e6db2441ed6e921c62a82631e4cea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543696, "uuid": "45edda8f-afba-4a33-9a1c-66b589cd9d3c", "value": "T1E1A31A067D42DF03C5E522B6BAAE45CC33126BF8D6EA3142ED266FE137864DA0D36750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543696, "uuid": "7b6cc81a-1f75-45f7-9f22-43bec0ac9b17", "value": "1536:pETde7An5IjskVFXfXENMd9k8KQBPHDpwhncksDGpm1Wm2JdRezfLX7:yx1IjNnXfXSIk8KQlHDp2ckstYJufX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543696, "uuid": "b7b591a2-1108-40eb-93ae-c2c94354cee5", "value": 98960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543696, "uuid": "8e886b46-6ae9-4e5f-a7f1-a7b181cab84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543696, "uuid": "f197c0e9-13ea-4fc4-8dae-36ba338ed4ba", "value": "raul.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78ee871-9f51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787530847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530847, "uuid": "14b2a448-9fc2-4040-b6e4-9f77d4ed72ab", "comment": "Malware payload", "value": "0004f67b7d98c6e30d6c16f8802f76dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530847, "uuid": "d322eb42-d22f-4213-9ad2-b5de2a2b51e7", "comment": "Malware payload", "value": "6112186bff6395832fb6efe21d3e5d285f959f50299d0570dfab7ed412be82c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530847, "uuid": "cbfde9a9-ef99-4293-ae74-160de491a565", "comment": "Malware payload", "value": "c62db65ad00bd05e9a37492b3af551445ba51fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530847, "uuid": "5a89fd07-ceec-45fd-81be-0161f078e10e", "comment": "Malware payload", "value": "5e10da1d0a27229b8b75cf0c90b0eab281ec5b07944ced10182d29c17fc0cc8e6dc16d381a627ca4c51242837131895d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phantom", "colour": "#241AB6", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530847, "uuid": "377c6cba-e927-4f60-85e0-7db945058d21", "value": "T16E73D649D783A1F8C82B4CB02E97E3FF0E62363259908DF4E78ADD45B533B516698702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530847, "uuid": "1dbcd5ab-ac9b-4c4b-b45e-d4a436302007", "value": "3c52d12edfba816c6953dd595276f9c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530847, "uuid": "c36351c7-0a21-4926-ae56-ceb1c449b532", "value": "1536:p/KS0GhdufPn+OHcTtBSn/AU4n4E+og4n4Hc:tKa/un+7UPNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787530847, "uuid": "0f782006-646e-4d9b-80f9-464bfc1caa57", "value": 74271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787530847, "uuid": "89fcb737-9756-4baa-8c6a-1da0401a056e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530847, "uuid": "094ca279-7118-4e72-987c-ae0ecb22c4af", "value": "stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9826289c-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543706, "uuid": "86d0b565-954b-44ef-8063-4dbe1ce792ad", "comment": "Malware payload (Mirai)", "value": "0b8dea53f9800d90a6554ec430734920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543706, "uuid": "1bfacb21-a061-421f-b47d-7fe4716125b6", "comment": "Malware payload (Mirai)", "value": "613ec570594be2691ce18fe8aa51aa4716584c0e586ec97dd790c4b9757b5a83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543706, "uuid": "8f6df057-d4a4-4baa-acc7-870e794f4ed5", "comment": "Malware payload (Mirai)", "value": "8e69107499c474c2676c551edede77daed4fc32d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543706, "uuid": "5ea2a5ad-9ff0-4ac7-83a5-a4f77a73a86f", "comment": "Malware payload (Mirai)", "value": "54391dadb88c3b9c23c7b71c81fc507e7697b2456b3e74bba8971ba1219927df30e73506bd1f4e722d383ab138854acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543706, "uuid": "1b06291b-5d30-405d-ab1d-ac17d92430d4", "value": "T197E66C16FA6250AECAB9C87082AA5537A730B409435179AB6FC49F702F51FD04F3DBD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543706, "uuid": "2352068c-3197-4b1c-a4b1-ca4d581c39d9", "value": "196608:U09lFnclNKZYkwz3yVagbMt3uHJsFvCPwPDO:U09lWNMNwz+asMt3uHJsFvCPwPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543706, "uuid": "c9ee6c61-0b87-4e40-93a6-f51a5faea26b", "value": 14357504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543706, "uuid": "96d7c587-ea29-4ec1-b833-c1d037b1ead2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543706, "uuid": "013b1b6f-f5c6-43a5-9c0c-b526bf90cf6e", "value": "_rust.abi3.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba31fad-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1787551067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551067, "uuid": "d611ea51-9292-48f5-b17e-8252d4bc60fd", "comment": "Malware payload (Formbook)", "value": "1f97d1336a3c8c4f4ae6fa1cb8183b66", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551067, "uuid": "c48af1f6-d776-47e0-a1b0-521c0190a0d9", "comment": "Malware payload (Formbook)", "value": "6165f9419e34957b3fcaee0e0add451ed30f929c42151f078d5eed18b3641704", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551067, "uuid": "107d812e-a6ab-4fc8-9042-220df0f8310b", "comment": "Malware payload (Formbook)", "value": "1ccff61aa0c85063696fbb3e773a1b680375a02f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551067, "uuid": "7df2aaa2-12bd-4eab-a68c-f00a20e4dc27", "comment": "Malware payload (Formbook)", "value": "f9368af666238fa007f0871bd34946b5c2b35695df87e6c070e22783d9898863e33ee57ac1d93aa34e2fa1f44e6088a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551067, "uuid": "0f10dab0-823a-4022-83e1-5c114c35d59f", "value": "T16B06A3441B48F7327B60A74CABB69C30B41A538324D5CB21306ECA59773ED97636CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551067, "uuid": "aa83c89a-cc94-42e6-a1ac-9b3cd311d451", "value": "98304:KOLXXpJCYnHYyeoOxieF+0Xle0E5gIF8iUfxE45YYqlGLRrlDsP+dOO7PhPAeZpm:KODXpJp4HPFZXIpF8iuP5KlGDsPYdAeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787551067, "uuid": "7d9d3130-ab66-4352-b3db-4dd4bace27eb", "value": 3811461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787551067, "uuid": "afafe576-cdf7-4c6d-b89a-2106b181b54a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551067, "uuid": "86f05c1d-2f79-42f5-9a67-c6da1490a929", "value": "RFQ_Order Specification_Quatity_N1HSBDGH_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ea68f2-9f93-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787559223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559223, "uuid": "4d705158-c5c3-41a6-a49c-1a2e3971a75d", "comment": "Malware payload", "value": "a1ac933607bf2c6e8bc39a38a2223eca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559223, "uuid": "2598ea1f-2b1d-4d1b-adbd-da161d99c1cf", "comment": "Malware payload", "value": "617f96a9d0fda0cae4f0119fc6a2cea5f5ac8baa789e7932dad8ed86e219a440", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559223, "uuid": "6afc0c34-db77-4f34-91ed-4549e3604f89", "comment": "Malware payload", "value": "35f4cad54e35d8fe1edadfa228391fd995fdbe3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559223, "uuid": "128f5ae7-6459-4072-b370-c585b347e544", "comment": "Malware payload", "value": "8f6993f725c2b691c8dbc9d6edc94a74d656ef7878e42715bbd247cdf3bb466bc2ecbf5354186c7644207747cf2911fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559223, "uuid": "4797a1bb-d4d7-4c2c-a871-021954fff791", "value": "T1DAD4F1285988C671821FA78ADB772D4855BC59CA98DDFC8E8F346AF4232D3212CDCD71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559223, "uuid": "cd797ecd-c830-4a4b-84f3-12867e01fb1b", "value": "12288:g9etKMHceuslg5221SbHOhoyWogG2I8T/uNTAUrcd+lnJRhK1FbaIVZ6:Tvcrwu2I8kYd+lHh33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787559223, "uuid": "7c8de60f-1aa5-4cb2-8ab3-354334b6eaf4", "value": 635740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787559223, "uuid": "49265a5f-8b30-44c3-a9d6-f83a19559bf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559223, "uuid": "8815300f-76e6-4a14-b5b4-4963ecdfaf66", "value": "Vertrags\u00e4nderung __ FN 002485118477.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e272743b-9f7f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787550703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550703, "uuid": "4fb2018e-c4e5-4628-a7dd-b4c6086b2a95", "comment": "Malware payload", "value": "d4f138ee979e3f5a2c6d0cd71a50eb69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550703, "uuid": "6e24fd1d-6f34-480a-9a68-d58f488e5729", "comment": "Malware payload", "value": "619ce341c1d9eca1e42264025a7ca75c827b9afe218311b5e82797e176b3c623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550703, "uuid": "b7db966e-408d-4ac1-93bd-8c2014d5ba78", "comment": "Malware payload", "value": "da370879549ef00f7376a6d64c6df9164f2d1369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550703, "uuid": "6e4254ae-5c5e-4d37-b0fb-1b30459a67a4", "comment": "Malware payload", "value": "98340635cbe1f30731aaf06bd94f115d474f70cfcab115611092fa21f9b89ce7e88e874d0523588f6db0a9751fbcdb59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550703, "uuid": "ab3df72e-dbe3-48eb-bdf4-5a32940f4d02", "value": "T1E5076B0BFB5099EAC459823548AA83917B70FC855F22A7D33A4CB62D2F737C45EB8714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550703, "uuid": "a8f64431-f546-4fa4-990d-b78ede9b7b7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550703, "uuid": "dd20e825-bc4e-43f7-b1e2-5bb92a694175", "value": "98304:FKhlJvEyhPAC2M2paA7tgb0CDTxcUFy0y50U7To0ssjPrpVIpwRAaER0iozy8ZKn:FWvEePA9MqjpCDDgjPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787550703, "uuid": "f0ee1eea-515b-4669-8844-6f2c73a02b1b", "value": 17988608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787550703, "uuid": "81c7917b-f059-4e21-99ae-4de3d0c95cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550703, "uuid": "4c9f9136-fa52-4497-bc6b-33f2ccf8ca0d", "value": "sbx-telemetry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915fc435-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787582779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582779, "uuid": "ba6511eb-c2dc-4f59-b4a1-c3854a3a1393", "comment": "Malware payload (Mirai)", "value": "09c9ba08d8640c026d76bf6ca0968411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582779, "uuid": "6a5ae460-2583-421c-b1eb-f26c607acb1d", "comment": "Malware payload (Mirai)", "value": "6210a1c6ff3c633555c8578b34caf5df58462fdfc65226b75ac2a0773e682a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582779, "uuid": "594a33ee-1f2b-45e5-92c9-777ff7691c7f", "comment": "Malware payload (Mirai)", "value": "0f36f470f7f3669107502e2e16dd84a5496c70cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582779, "uuid": "3eb1b628-36da-4a3a-bd15-399b521a4375", "comment": "Malware payload (Mirai)", "value": "c14bdc0b4d94d6885c18cf5b7cfd4a74011a428809567b6cdf584fd4bf018741db0515ab333ad188522e3dda14c8dfb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582779, "uuid": "16c02e76-5c2a-40ca-9cc4-e43fd6aba180", "value": "T133430224F0B55A9BC9BD043C939D6B72C50870C833DFBF9C62714F886B38496749A5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582779, "uuid": "b51324ed-f124-4b6c-8e00-92c734782806", "value": "1536:UEiMsmKiIlLUX3Flnw5ATv4bTlKQnnho4xGxZ:UEiYjmUXVlnw5ovupKQnnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582779, "uuid": "a637b261-c6f2-474d-8acf-3830d57dfdc6", "value": 57456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582779, "uuid": "17ef9b01-3ed7-451c-bef4-3899e5cdef31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582779, "uuid": "0e8f8be0-e2f6-4ca3-b2f4-8bfc04921886", "value": "daredevil.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3042bcc1-a006-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787608386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608386, "uuid": "c027f12c-6ae9-4397-b8dc-d271ccd501e8", "comment": "Malware payload (Mirai)", "value": "8f2efd82c43f00c4400aad0f22f9cfb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608386, "uuid": "b2f4484f-8ee0-485b-91d6-be383ede10e7", "comment": "Malware payload (Mirai)", "value": "62868f70c9145d6b67edd9d595fbf10d05d51442c3b7e2d4e459e7da1df1e8e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608386, "uuid": "50302440-c979-4a2c-aae8-9798d1fe8681", "comment": "Malware payload (Mirai)", "value": "0b925ff390792ef9344437c04b37d61d1c021655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608386, "uuid": "b85b1ef7-c3e5-45df-aece-492a5e0ac9bc", "comment": "Malware payload (Mirai)", "value": "ad6dddf5c15c861a2a6610f034270f5ef86ca4c1eecf83d5daaab1ad29de862e73bde8c2fd568c97eeaaaff53d976a13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608386, "uuid": "7bca5d5a-30b8-46de-92cb-4a8786e5aeaa", "value": "T1ACD36CC56DE3E0F1E953857A4A6F931A4B36E4370119D911FB2E28386F42110E7BB7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608386, "uuid": "25145516-d893-4049-9cef-312e8764e558", "value": "3072:UCaVHDLv6BLSXBgv3c6ebYPzMUPMhK2iu1EssMZc/T03ImIys61X1h5oV:gHfv6BKB+wrTK2vEssMOgh5oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787608386, "uuid": "fb9ba2ba-de35-4d2e-b7cc-ad274d63841f", "value": 140872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787608386, "uuid": "3e84f927-877c-4ecb-b8d5-3591be5b205a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608386, "uuid": "5426eec1-a957-4360-9702-3eb8f5128e18", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca3f53f-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576651, "uuid": "b7f65718-0a8a-46d1-ad08-8d2f2099b9b4", "comment": "Malware payload (Mirai)", "value": "b6b58884d1ba135bd1712992cb69ffd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576651, "uuid": "94f91c74-f43f-494c-848d-57411817a4f4", "comment": "Malware payload (Mirai)", "value": "64f287ae4e695ac0adfadcf516773d8ad7a60bc7174005903cb443ec86d3066a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576651, "uuid": "6d142417-cfcc-4288-81d5-4468e9fb0daa", "comment": "Malware payload (Mirai)", "value": "cad98fa51562b88d4bf400695ea5b1111686eed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576651, "uuid": "581c6d86-ef6e-418e-9e0c-f1f806ef29bf", "comment": "Malware payload (Mirai)", "value": "b79638c6d6594f458a0353c1c31fa96be44d29d3d100e3a68cdd4b9e7eecf924d1cebd740dcda79b77cf215685864a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576651, "uuid": "4b368914-c9ef-43cf-965a-c142d61e54eb", "value": "T14E145BD3FC12D9BAF84BE73B89470409B130B65301815A33721F747BAF6A09556B7E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576651, "uuid": "54956e16-51ea-43d4-9dea-1deca53c1492", "value": "3072:kIYziQxkT1jEZQMJe3+wpn/Ku/VzjbiGLTKby0ZqWDu1EssMZc/T03ImIys61X1T:kIGaMJeOwFKuvLsy0oWIEssMOgh5oD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576651, "uuid": "4621f75a-8fb0-483e-a2db-efac2a5b6891", "value": 203756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576651, "uuid": "0b08756c-d030-4170-ae64-b7593575be49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576651, "uuid": "97ae07a3-a449-4b61-a586-9c426302ae03", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269173cf-9f62-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787537932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537932, "uuid": "ffdf7418-45c4-4169-a305-07802b6cc9e2", "comment": "Malware payload", "value": "90b383a42d7af8c472bf5ac90c857376", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537932, "uuid": "fcc53b34-193d-4bf8-a40d-b009f53f6bca", "comment": "Malware payload", "value": "6559e5bbe140cacfb5e71d11d0357ce09a6c806f568ec50bae3c955f84ee86fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537932, "uuid": "8242550c-703f-4cf8-aa02-d26a6a185b3f", "comment": "Malware payload", "value": "984c94b34cf83d08c76cb7caf99207ef070064f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537932, "uuid": "bb36ea4e-8fb3-4d52-b47e-2a065c1d2376", "comment": "Malware payload", "value": "bb3fc1e39d2deee97b8fa1c01fed3df90da350de4754abb593bb44f9ed876a3846fe837de6c5bff4c064ea2dc1735b05", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537932, "uuid": "148f37ff-41aa-4354-88da-1962d155a58f", "value": "T137236D6516857C14AE98C4375C7E2F0CB9AD43E6314492DE7FCE3CF28C4A6ACA208B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537932, "uuid": "d5b5d5dd-7859-4118-9814-3104f1f49516", "value": "768:R99NyXsZztCL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:vHusZlcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537932, "uuid": "09df1e0d-6044-4165-99d2-f33ace1d059a", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537932, "uuid": "5eb33b30-4c8a-44f8-ae2b-d754f5ba958c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537932, "uuid": "48c280c8-8d7e-44ff-8a15-bd1748a9decb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a4fc89-9fb6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787574166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574166, "uuid": "5b6a6cea-5939-4d70-9382-3ea015212746", "comment": "Malware payload (RemusStealer)", "value": "259e79145b060c001ae95b20f6228e25", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9926", "colour": "#B49DCE", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574166, "uuid": "9384c101-4623-40a9-8cd3-45510bb43c1f", "comment": "Malware payload (RemusStealer)", "value": "657b8d5a4111a13aa2797fe24bf0eeb38db22c76fb54901637e720b8109bc52c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9926", "colour": "#B49DCE", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574166, "uuid": "4149ee39-7318-4db8-b5d2-e52bf8d14c95", "comment": "Malware payload (RemusStealer)", "value": "c3beab78fc4cf0612d6f9ce4c714b3444d956227", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9926", "colour": "#B49DCE", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574166, "uuid": "6f5050d1-1ba0-4978-a11e-e9d9cf5869b0", "comment": "Malware payload (RemusStealer)", "value": "32eb5dcf84de65e251ca49392ea5f32cd04fedec2d7b8934431272a069600ca05c556a99783af19b03e43421380a1e5f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9926", "colour": "#B49DCE", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574166, "uuid": "768244d4-2beb-407a-bc2f-94ca317408b6", "value": "T1481633B21E1D44B7FDE9EFC783706BAA1F9C887621A28D203476F042D664DC7E159836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574166, "uuid": "7bdcb8f2-c63c-40fd-b9d8-e4ee62a7bab9", "value": "98304:o/kNQlRd7dSsX57AIV5MFdJ1P18wdhq1ITJmb9gcTTU5KqE/MwBod:cR7wg0mSdldhrmb9gMfq+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574166, "uuid": "0459ab7b-60ff-4d2e-be11-548397bcc6ed", "value": 4267395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574166, "uuid": "6a6e82bd-765b-42cc-8906-44a19a11e7c9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574166, "uuid": "b71dd768-c6a5-416d-8c7e-da3a408916b2", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88038730-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543679, "uuid": "e5d68d58-2ff2-4b2e-9340-4b26567b80a6", "comment": "Malware payload", "value": "ac3a671d81f0b319172c16ea5bdb6795", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543679, "uuid": "72e9e191-d55a-402a-8c4a-c28f07587cab", "comment": "Malware payload", "value": "65999cd4c92e97ae82d464366918a70a4d3dcf00fd69a1c56f90fa37b9c24782", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543679, "uuid": "2340bcc0-b5dc-4b46-b902-e33fd977ef3c", "comment": "Malware payload", "value": "5ed5159213c7f52053d969c66c2aea4a141268c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543679, "uuid": "18d5ba82-0b2c-4dca-8794-516ef64da8ab", "comment": "Malware payload", "value": "25a3117034322abccb175c32a79e31138531c44e9d742c2f4844d698708f5ac8d81633748be09f78b7b57b2e969f79e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543679, "uuid": "cde42842-f068-49b0-bec7-334291fa19b7", "value": "T1DBC27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC12FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543679, "uuid": "a46d0b0f-4bd9-456e-846e-26c4f804c50c", "value": "768:28vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:28l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543679, "uuid": "a9f8717f-8e79-4ddd-aeae-cced277526b0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543679, "uuid": "0e39cce3-b049-4df0-a870-9db6da254468", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543679, "uuid": "daa71971-ea7c-43b9-b4f8-6254df058d11", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19fce38-9fdd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787590967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590967, "uuid": "88de05be-8be8-44d2-bb46-7bdf3f3237fa", "comment": "Malware payload (Vidar)", "value": "1d1082265e6707d1cfebff97cc9764a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590967, "uuid": "67a61747-9769-40fe-a8fb-4d7f0bf061d2", "comment": "Malware payload (Vidar)", "value": "670b6d281f3918638255fd6592f80bfa9d77fcbd78f62071e237978fa329cd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590967, "uuid": "3cc99851-49b5-493a-8aaf-04267fe65bea", "comment": "Malware payload (Vidar)", "value": "949c39d12430a13f1029226b5459724a8b43308e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590967, "uuid": "2dd7e371-c9cd-4b62-8174-a9cda35db51a", "comment": "Malware payload (Vidar)", "value": "a40bf445640ee31ae2197a8d9a2fa492f00cde5c3e4fd3cbf051b596d2759e7918b725c710b9ac1c8490a1fc8ff8ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590967, "uuid": "a626d1e5-ebdd-4b0b-bfe5-1ded147b842e", "value": "T16E183303FA9440A5D45A8B3695BA8213FB35BC8D973A33D72E54B6382E7A3D03E75305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590967, "uuid": "e66e8ef3-db14-4f0e-9124-f3effb5d897d", "value": "1c1ad2adeb06878a984583db245d2aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590967, "uuid": "5aba6100-249e-4d40-9060-d34f59aea4fb", "value": "1572864:uUAmSmr7imhgSjla2u6fa8Z847Ff73ygKTSpdWzYvA1PM2aRn3ZvOMi:PtS22KtQ25i8X7J3PYSpEzj1PM2kvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787590967, "uuid": "a03aeea3-5ff7-4c55-80bc-ef6b035f8c28", "value": 92088944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787590967, "uuid": "f2141b90-ec75-459e-bcf2-b42b731485e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590967, "uuid": "af259700-8dfe-46b4-a917-ec23ee3c0d4c", "value": "670b6d281f3918638255fd6592f80bfa9d77fcbd78f62071e237978fa329cd2c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6c9f6f-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787578238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578238, "uuid": "401e6631-2810-4f3b-be2c-97125cd86672", "comment": "Malware payload (Mirai)", "value": "cba8e525d8d087763426b87c3d54c6fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578238, "uuid": "ad3254b3-63d4-46fb-9ba3-41db71581e7b", "comment": "Malware payload (Mirai)", "value": "6852d14ddab95ad43b8122b6752371c59b4a46c88c9a5885108acefbee23662f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578238, "uuid": "7574944f-0000-4a2d-81ea-8d4ff4c2cbf7", "comment": "Malware payload (Mirai)", "value": "9b1b8ee4d61125e2c8b05a94abf04e2a09cc5168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578238, "uuid": "ad11c26d-f97a-4c05-9608-3e0b55fb1dca", "comment": "Malware payload (Mirai)", "value": "c0b8479e2444d22c0b3e6a841cdb7fccd8e77e08d7bb7d40e903fd4a67e4c8bc57d92668db79d11b24891f570d6c5b6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578238, "uuid": "8bb802b6-5480-45d4-82d7-8aa4659a1892", "value": "T160D3F946FC418B13C6E161B7FB4E428D3B2B07A8E3EA71039D296B25379B4570E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578238, "uuid": "ec7d9baa-45b4-4b0f-bb88-30421dbfc9f1", "value": "1536:UA6DFJ1/hxgFxLInugEIjZT9mG2DkuY4VOZ2RTFs7xj1UWN6YYVQUflv7wyw7xRU:C/RqxLInwOhmGb4C4ps7x+fFO/fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578238, "uuid": "74b641fa-3af9-49e8-8cb3-6e14e2bd78ba", "value": 141888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578238, "uuid": "b998b7c9-f431-4d18-889c-ec2ce966f89d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578238, "uuid": "a32e233d-8f68-437d-a07b-7c563207fd4f", "value": "daredevil.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dd8d2a-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787574891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574891, "uuid": "6bc1950e-12d0-49d8-bb32-92c096009f4e", "comment": "Malware payload (RemusStealer)", "value": "c313b12260b8dd8dc574850524d9251c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574891, "uuid": "0a2daa03-2035-4b11-8ef4-a43fd6d9d9b8", "comment": "Malware payload (RemusStealer)", "value": "6958097575474cb21149aa5e9c9dd80ed6b49c8588d963ec786caff6fac7087a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574891, "uuid": "8e375714-cad4-4d8b-9771-4c8551751233", "comment": "Malware payload (RemusStealer)", "value": "460b259affd10c94bac0bd90c6bfac5857c295f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574891, "uuid": "62661920-77d5-4153-ae9f-60a50a3fa98b", "comment": "Malware payload (RemusStealer)", "value": "e9d94e19cf680f1c0ab70f3ea4b298a0728b3452fc8eea17db476bf97f329cfa8d5df4c777d591b3fa6034b9cf4b42f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574891, "uuid": "92660dbf-96e1-4471-bf5a-1e195a1bc61d", "value": "T104C55A03BC9481F5C4669731C6BB9663BA31B84A8B3633D32F50B6382F7A3D029B5755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574891, "uuid": "f5a8a38e-e968-4e05-b4e6-4961ccb0cb42", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574891, "uuid": "3e6401e8-c629-4016-8f1e-f557410e5233", "value": "24576:CFILj1A60tJbpruaJcCzA8lBkdO9K/hSKAjCXO7my+XyKFFlaZWAA:gAj16ruaJ7odkKwK0X4Fog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574891, "uuid": "16d67ea5-f942-4405-95b1-e39feb8699e2", "value": 2696120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574891, "uuid": "feae5b39-6732-40d6-ac77-0ac8c607ec2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574891, "uuid": "5ee71be2-615c-4e5c-b2ed-55ba9ca4b32a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a8f080-9fa3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787565841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565841, "uuid": "0a0f60fa-b52d-4c35-8c76-b8c4de10e24e", "comment": "Malware payload", "value": "4e845bdcaf64f132330f7d65ef66f570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565841, "uuid": "409a78e0-256a-4649-a482-f476f7f15b58", "comment": "Malware payload", "value": "699f584975b1ef4b4708f0580a63c53d798bd44226f755242a50672142878af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565841, "uuid": "189a7e3d-eb07-4e4a-9582-ae520c8f6fa9", "comment": "Malware payload", "value": "30d86ad4b9890eadb408ba8d17e02eebda2782c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565841, "uuid": "b7da2589-4ff5-41dd-9ad4-90d109309c14", "comment": "Malware payload", "value": "fa8148f5a6d0f30811cff3d56aef0f1e854720db31c631e158c91397ebd32fe40f5009a067ac04d48e2fd04eb72dee90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565841, "uuid": "399364f1-147b-47a4-9135-13c3a878cbb8", "value": "T1691302938071D47BF64BF8E66480A9DBF275B5940FFDB9C021217C8B69351B806BC8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565841, "uuid": "a248ee2d-4939-4d21-b5b3-5f24f47ad23a", "value": "768:OIkvhd+xT8f2HeAr5+BrnMFLu/WoIvkCnutEJ2OKf8RE79A+tKjgVtCHmVXOx:XGy58ULujgutEqr7qljQtCHm5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787565841, "uuid": "9953a2f7-73ed-4938-95bd-35d3655f5f7b", "value": 44972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787565841, "uuid": "f7b2ef6c-600f-455e-a6a9-af2d2ee1d37f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565841, "uuid": "013a8838-7089-4efe-8f4d-869642b013f6", "value": "pty4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1baa28a3-9fe2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787592890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787592890, "uuid": "efb864e1-4549-4fb0-99d9-63702af3d175", "comment": "Malware payload (Vidar)", "value": "85c89eabf109e53c5fa5f7d9bb03f80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787592890, "uuid": "962bb64d-1719-462f-b30a-140afe46965d", "comment": "Malware payload (Vidar)", "value": "69daa1a225ee2c4680838016d6ad87e391834c441a9e96f56701e1722dbf7ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787592890, "uuid": "a7e3e34f-065e-417f-809a-7b0570baf528", "comment": "Malware payload (Vidar)", "value": "afc44263beaf8a5c391ca5e4592153c8cae012f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787592890, "uuid": "f9d26778-1d1b-4891-8994-bec008423657", "comment": "Malware payload (Vidar)", "value": "985a46f4ee22e97911d64d0921b20907f62c16b7c7bc511a623fe8e11b82dd65051ce0d08c29fbc503cdb4c59391dd18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787592890, "uuid": "ad97ede6-2976-4555-8635-5fccd7c56a71", "value": "T10C069C07FCE108A5D59CA3318AAA42427B7DBC851B3263E32E54B77A2FB7BD05935305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787592890, "uuid": "e82924fb-08e4-495d-a98b-fb7790ef264d", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787592890, "uuid": "d060afa4-8b0c-4b4c-85c1-510625b65a3e", "value": "49152:0PwPHwPDSU88IoyiW0QqqeitYnb1uxvDghFEWP1CU8v3CTxvj:0GRrKmtYnb1Wb6Efoxvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787592890, "uuid": "c80e0a0d-adcd-4801-80a8-56fbbac2f1b8", "value": 3851008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787592890, "uuid": "662e3bb5-cfd2-4058-8d9d-90d0237f5453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787592890, "uuid": "59abfc05-3848-41e1-b661-e3971678d75b", "value": "69daa1a225ee2c4680838016d6ad87e391834c441a9e96f56701e1722dbf7ab6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9f22d0-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585966, "uuid": "25acbc0e-24b8-42c0-8534-e7e087aa9973", "comment": "Malware payload", "value": "f5f5f906b21b4e3f8ed4ba1b1a37b28d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585966, "uuid": "ca20b9d9-8e81-4ae1-8857-1476cf4c7227", "comment": "Malware payload", "value": "6e134b0a2d2247cab988db2b0bfc7a511b1e7c79c0d3699536558352abb47b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585966, "uuid": "a93ad68c-96e5-43ed-a7da-00217f8d3132", "comment": "Malware payload", "value": "e1abe49a6ca79c4d1adeb91a237c8b9584338295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585966, "uuid": "3bd6cb70-cb6c-4930-94df-67bfacd83765", "comment": "Malware payload", "value": "c900b38983aba99a75d284fc8b5e52c79f6f0565981cec1538e93bd2660cd9e7c9e12419d75b0eda2d322a94ecd4a697", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585966, "uuid": "884222d9-48c9-41b3-802b-907a4b0cf9ca", "value": "T197D3E913EE807EB7C51ADC74426FC25214EB5CFAA2E5A33A71F8469DBE7C20611C7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585966, "uuid": "44f6f31a-b9cb-47be-aafc-5e04158f76fb", "value": "1536:zC7FdOBUZAT09VvoRs4O8f8ZjARSBPkD82xwMEr59a:u7FoBUZBjwRRO8f8ZzE8ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585966, "uuid": "88d1bee2-3afe-47b1-9d4d-ef3901b282ad", "value": 140252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585966, "uuid": "9ec0922a-5fe9-431e-8076-6aaa3111be46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585966, "uuid": "63384b4a-a5b1-4f6e-bcd7-5444c7046a63", "value": "main.mips32r6el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e152fb-9fc4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787580149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580149, "uuid": "c7f62aba-2e09-4a27-86b3-59dfff8fc503", "comment": "Malware payload", "value": "435fdd2af674145619a4b709f01a8037", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580149, "uuid": "82692d5c-1069-4f94-895f-5f2df6d147e9", "comment": "Malware payload", "value": "6e54d7092839436f3da754c81a2bc21e951576208ddea941cada6944f51fa679", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580149, "uuid": "da24607d-d61a-44f0-9af8-1f55c67b0457", "comment": "Malware payload", "value": "4c05b0ef5fe9bea612f26eec0e8e68164a9dfaa6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580149, "uuid": "11a9a3e4-a56d-425c-8db0-d214f86ceb88", "comment": "Malware payload", "value": "1ec1e6f116d63ef2b505bd785a9339210ba295b008d2689225a7bd4ac592c764ed00cc06a91f215342fadfaa4d083ecb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580149, "uuid": "a4f5b4d2-7487-4536-b35d-1f33a69c2cee", "value": "T1F9C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580149, "uuid": "7e1f6f6e-fe07-474d-a669-671b53bc98f0", "value": "768:k8vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:k8l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580149, "uuid": "411f03a9-c017-4598-8e36-e35a081b66cc", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580149, "uuid": "178341bc-3f4b-4048-8ff7-8e9b0e7072e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580149, "uuid": "4c5e362d-282e-4698-a1d0-5cbe0f3c6843", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd2d6cd-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787582612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "fd35c4be-a8d4-46a1-8a5f-99963fb2aff0", "comment": "Malware payload", "value": "9a271976e30454fced81c67048a06aa8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "f180a62e-afe4-438c-990b-a465e65166cb", "comment": "Malware payload", "value": "6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "1c60a2fa-cf6a-49cc-b6c9-2aca30bb8c36", "comment": "Malware payload", "value": "e79c7f7e808a3c281c086d6c23bb7ad2e9a2c26d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "bfb739ce-4131-4afb-996f-49ad0fe5b9f0", "comment": "Malware payload", "value": "c96d0adee370ef5124b746085cc807a9bd32517a6761462d8e8ff8bd50b221e863455765204bd5d01fc3fa54cf23304e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "194b42ab-3712-4860-94e1-474aca950489", "value": "T18B318A9A06501A315103CF9E7376354CB54EA5E7289FCBE0D84C0EE983487CCF662F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "f233e674-9917-4327-a99c-9c24c4c336c9", "value": "24:3ZotNtGQGNmJXxo34a2sCah1UP0+GDLxAf:PVl2sCah1UVGD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582612, "uuid": "e8f3a73f-10cc-4c3f-be18-9a659f551e58", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582612, "uuid": "e5add88c-4d8b-44e4-aeda-d1334449da3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "af6c99ce-6df5-4ff6-8da5-6314f729d7b3", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1966a83-9ff9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603100, "uuid": "d12351ce-0f18-480d-b130-d843cc9f95e3", "comment": "Malware payload (Mirai)", "value": "5b7673a4586fa65d2c12565a79e9e42c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603100, "uuid": "a9ed7dbe-f361-4d16-8c90-9b19751e3ec2", "comment": "Malware payload (Mirai)", "value": "6ff8c9cabc23696ba9120a1125520c8928cff24d687cf944b1c3bbe92a00b135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603100, "uuid": "26a1d7ca-da0f-4167-b312-aabd53c73a26", "comment": "Malware payload (Mirai)", "value": "9b25e2e51b195ab425a4ad700f6fe90516153266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603100, "uuid": "0b161d0d-3cbc-49d7-bef1-ea704ccdd6d3", "comment": "Malware payload (Mirai)", "value": "b6fbc77717e1cd215c4f899d12471e87e0866d9e3140f57daba829187e6601994b0233307c28b3058e07578ea9cc2813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603100, "uuid": "080d3302-665f-4a0f-9fc3-da8c99f49c56", "value": "T11AE36BC169A3E0B2EA53897A473B931A5B32D4370219DA11F72E68347F43151E7BB78C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603100, "uuid": "0facbc6d-2e2e-48e9-8cfd-22b41bdf38cf", "value": "3072:udKCJfxD7iWRlTw363hnSF7QVzbUjGsu1EssMZc/T03ImIys61X1h5om:1CJfR7r2iOjGVEssMOgh5om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603100, "uuid": "d6a14f20-0e00-42f0-9f0c-db1fae0e921a", "value": 148168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603100, "uuid": "12a3ae7d-6abb-4a79-8a17-50effe0776b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603100, "uuid": "4d95433c-c82f-4b60-b34d-bd8219d643d3", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b3e954-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576663, "uuid": "6f15beef-99be-46b2-bec6-7d4ce4a87977", "comment": "Malware payload", "value": "bcf15d70fb501bd9cc7da62ac4033657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576663, "uuid": "6e080143-5624-4511-90ee-a47055ce22e6", "comment": "Malware payload", "value": "711b8fe2d98adc4d3fa80b59c9eda88f3fcbfe35c5dae389cc0d1c2c133df259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576663, "uuid": "1d8fddfd-4c08-4b8b-9493-27fc0db881e7", "comment": "Malware payload", "value": "6aaa72c6105c71ec08436e9cdcb87bc0c2bbcc4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576663, "uuid": "ecb8d40a-29ea-49ed-a92d-525bc5d63a17", "comment": "Malware payload", "value": "51b2cf96a57da190f1113d331641e44b24d210edb82fbb70d3b88eec669d05715b683d34bbb609f4eaf3a01753b43c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576663, "uuid": "efebe449-6e68-4c2e-a351-6a997212e4f7", "value": "T1F6E2E815EF504EBBD8A7CD3344B84B4230CD6C2723F52B2B2D71E929B11A54A9BD39E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576663, "uuid": "b6417f4b-2cf9-4339-937e-3418de7f0883", "value": "768:LXnUWeCvISc5UBHlwef7eNusXOXiq6OeXEU:LkagDyBCu70W6OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576663, "uuid": "461ab2f2-6a96-42ca-bd5c-f9a321095bf0", "value": 32044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576663, "uuid": "65c5cd13-d916-4652-a61a-3d5186eeffdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576663, "uuid": "d7d1adb0-0ab0-43e3-94f3-c13732c9a0ad", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a123bc7-9fcb-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1787583008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583008, "uuid": "941ea26f-ada5-4309-b48a-5ac840035c59", "comment": "Malware payload (NanoCore)", "value": "051efd15a1c7d57e40e72e073898f0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583008, "uuid": "159f329b-4b00-42b2-a6d9-660f45c54712", "comment": "Malware payload (NanoCore)", "value": "7146aa6b97153b033def7ea490d8a5f24c1f0140855db29311b9e81ba132cb2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583008, "uuid": "5e430d23-2542-44d4-816b-26d9e4015bee", "comment": "Malware payload (NanoCore)", "value": "adae76131545cff4348f11066fea2eedef145cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583008, "uuid": "4e9a902f-45e8-41ed-a4d5-37673443a9e7", "comment": "Malware payload (NanoCore)", "value": "924aa5d3b9feacafb1414d8c6317f4ce4836ea57598699b2c84b4c187965e8fb8c4a7ee7010a7114547099ea9dcab727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583008, "uuid": "b7b187a5-c38c-454a-aaaf-2352dcd4373c", "value": "T1A9C4025A73E94A2FE2DE8A7AA0221502937CC1E398D3F3EE15C855B78F257E006471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583008, "uuid": "9d047ba6-a4ee-4ce5-9343-7c02a66caa4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583008, "uuid": "1cafd357-3c75-44fd-8759-5125c172840d", "value": "12288:JLV6BtpmkjMNl+Xzca9ymmOxGbo5YJAJg1pnjP1oEA/2Dq:xApfolSzpmIGU54119jWtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583008, "uuid": "4149c10e-c42e-40df-8d26-797e6785d3f4", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583008, "uuid": "6e552ad9-48fb-475d-a4fc-4f1516505a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583008, "uuid": "7f30962a-0aca-4af9-8946-390b63a32f73", "value": "051EFD15A1C7D57E40E72E073898F0C4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a1e0ae-9fc1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787578818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578818, "uuid": "f7170697-221f-466b-9ab6-86789d1e15dc", "comment": "Malware payload (RemusStealer)", "value": "89ec6ee7f5a321a3db10af39bdc0617d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578818, "uuid": "de92975c-d5f0-4fe1-8d6c-17049e27eae5", "comment": "Malware payload (RemusStealer)", "value": "7418da8244ca828455bf41fd20be45449600ee428e1b9926d17f8230cd759429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578818, "uuid": "45c023e3-2fb3-484c-a8be-6fdcbda7ac42", "comment": "Malware payload (RemusStealer)", "value": "c4c38380303cbdcdcb8bc59b8b42cffe8d42b38a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578818, "uuid": "97d2dd17-93c5-4411-b5cf-908156fd4e23", "comment": "Malware payload (RemusStealer)", "value": "cf8a5afa3cca0fd476b54805a290f37b50bb4b1155396152966f4e535872d1db9a0fbaa5effeabca4f0d2fd1e0b0afa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578818, "uuid": "e13a42ad-c6ed-459c-b4ba-106d274906f2", "value": "T194C57C076C9502B5C49AAF3588778292B671FC4CD73233E32E90AA782F357D15E76B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578818, "uuid": "c0183b34-41ba-48aa-859f-26d94b930cf8", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578818, "uuid": "73401329-9df8-41e5-b13a-ce274acc3cc9", "value": "49152:PfO4TMekMeRzpSFTUyeLhDs/T88ZywwGr2w6IiDeo5MlLYEQfFpyM4BJDjSXidXr:eskMg6khN8ZywwGr2w6IiDeo5MlLYEQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578818, "uuid": "33ab58b4-d818-4053-92eb-7ddfc7613492", "value": 2533288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578818, "uuid": "069d081c-8f38-4e26-b57f-a8603608e5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578818, "uuid": "2be8d732-6710-4f4a-989f-b6d75e2c2780", "value": "7418da8244ca828455bf41fd20be45449600ee428e1b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5c1d38-9ff4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787600940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600940, "uuid": "a51beb8f-1bc5-4fa2-96be-43720be12260", "comment": "Malware payload", "value": "16dc08fefecd9065e8cd1a010fcd7ed6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600940, "uuid": "4a20ba3f-76e3-46dd-9fc3-7f2af15f7aa7", "comment": "Malware payload", "value": "74f92110966d46b49dab95189364618795e12e8895f0246e37e7e7b8f67346cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600940, "uuid": "4111306b-b46c-4bfd-b8e3-bf92eba064d9", "comment": "Malware payload", "value": "ec700c7ccbadd4a19d1feff0450692a075123085", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600940, "uuid": "854f0168-3f19-463b-8671-5df30ed0d8a4", "comment": "Malware payload", "value": "2d451fbd4d20cd44ce80411764010d6ec99b0f36fd4160238208c669e5f6248d42bee5433bb15dbd966a603cb4f06476", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600940, "uuid": "1ff71449-e2dc-46ed-8e9e-d4ba0e592b71", "value": "T19D4733219F6AADBE4AAC933C30BF5F1D2BA00FC59458E5EB07D460C7025EF41456BC6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600940, "uuid": "d149e5b8-6055-4ca0-bd23-ffef0c7f2825", "value": "49152:v14dAhVqR14DQmXuiS5vp93QwGSLFohsuJ2d/NiR3Jl4tb0R3CeIgpzDN9ZaIJ+l:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787600940, "uuid": "f322d59a-e545-4374-813a-e88942becac3", "value": 25184935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787600940, "uuid": "d7913770-145c-4d04-ae9f-3f3a0605f91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600940, "uuid": "c969c266-1054-4f39-a076-72b74fefd64b", "value": "Invoice.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda0a162-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585967, "uuid": "c5c82842-aad7-45f2-af0a-515c486332f8", "comment": "Malware payload", "value": "d2eb34170f955e2cc7cde2c755ba702e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585967, "uuid": "c2ea0184-92d4-42e8-9883-29ac4a9ca4b2", "comment": "Malware payload", "value": "75b6135f464b51aa7d8d0547c979027c0bf3379ec00d6e334b4e5d0e15404a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585967, "uuid": "d175e16b-e72a-4507-a1d3-c98769570d4c", "comment": "Malware payload", "value": "85a3be59433758b2cca3a54fb9d119fe4b9ec8eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585967, "uuid": "c4c275b4-78e6-444f-af9c-91837050c596", "comment": "Malware payload", "value": "36770e988afe07936bc90ef96a2337b28f425ff07e3c7d9c3480e3bd73efeef5e6ad70772070d2a7727fb2f3c5bd950e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585967, "uuid": "9bc08997-34b0-4512-af01-6dbd78871d83", "value": "T1D4A3E60FBC5ADAB2C9929A34C27F00512315874158BBAF7369BBC21DD76213BD7279C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585967, "uuid": "234881ad-c4b6-4866-9c70-4993488314e4", "value": "3072:+cbDlsnn90xJXPcbUkG6kKdeAK657JYoXEo5AyWVXH:+ctsnuxJfcgkG6kKde2YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585967, "uuid": "b30afd38-855a-4014-964b-e945d56b9534", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585967, "uuid": "33a9eb75-d543-43ef-b69e-2e3fcb1ed252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585967, "uuid": "488283c6-37e0-4b47-95cb-ede8acbfcce4", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56df7c2-9fcc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787583672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583672, "uuid": "ea8b3df3-e1ad-4b6e-8ad6-ef10ceb13d40", "comment": "Malware payload", "value": "c7b8131b537f10035e073643c9713b0c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583672, "uuid": "4405a03a-8903-494a-ae51-fbed471d5aac", "comment": "Malware payload", "value": "76e3bf7f3aad7d1debc712e6b37fa0664fb323450dcebe1c3cfde792384e9eb7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583672, "uuid": "5844d8f4-f395-458f-b5bb-67367ab82b78", "comment": "Malware payload", "value": "cb9e98aa8cbf0e42354d841d178af4078c068e0e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583672, "uuid": "1e4c12e9-bee8-498a-b38e-3c9183b3b459", "comment": "Malware payload", "value": "a9975a75d2507432cd720718179c114cad936917fd8bbd4928b405b91e0c94107f891494dacef804ecc7fad1f59a67fe", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583672, "uuid": "7ee4015b-b298-4d70-8a67-a2c37d6f8e4b", "value": "T178A53350153ABE053509856B73B02E6E00DEF953F65093FEC99726C2B500BDAD8CE6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583672, "uuid": "ff36306f-1263-46fb-a227-e82fc649480a", "value": "49152:ydG1RnZrSwY6BzfxBSBRIWp+OfnHmTYMGhxN:ySRnZxtB1BkI++OhxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583672, "uuid": "0580d26d-b343-4422-9fc8-08ab22150792", "value": 2080664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583672, "uuid": "47468311-d45f-4189-98f5-5113cba9c3bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583672, "uuid": "365fe9ca-e764-4c7b-8644-eec4681f78eb", "value": "Purchase_Order_1117-P24010.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04726c9-9f5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787534835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534835, "uuid": "c7c307ca-0ab8-40bd-97ac-18c2aac73b01", "comment": "Malware payload (Mirai)", "value": "0dedfd761ef00180bdaa86fa9ba19bca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534835, "uuid": "83d47088-2e39-4e12-9b86-c632b0f4d07a", "comment": "Malware payload (Mirai)", "value": "78ef93e33f5c390dd4cbbd8098f34cf1a0d961fad2ec8854f8c05065c75a78ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534835, "uuid": "f8088274-377e-4d5c-93bd-0f0daaa2c753", "comment": "Malware payload (Mirai)", "value": "56d559f797d272026fc212128cf6176ed58d1127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534835, "uuid": "4ddc824e-5a0d-4a96-9f9e-547de7067e63", "comment": "Malware payload (Mirai)", "value": "643dba0ea64bbf936691fe13a6892c32afc92dbc31b5f6d34ef26aa04b80846b908fccb6fec1c07272ca8958edd7d74f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534835, "uuid": "da8cb4bb-c91f-4911-aa8c-8e6b1766452e", "value": "T1FB145C07B69144FCC19AC474876F9523F931B85D03243D7BABC0AA716E22F716B1DBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534835, "uuid": "b4606852-31b4-4cf8-b1ae-e7163ac67d40", "value": "3072:GabMqr36hG15AsAIFJRxsV/bXS3taAylwWm4wi7d74Hyj80d:Ga7qGPbQV/b8K9m/cdmyjZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787534835, "uuid": "5cce0bb1-64d4-4f90-a4d6-6989c6755d12", "value": 198912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787534835, "uuid": "40efb056-cca7-43db-94c0-c911a8591abf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534835, "uuid": "f869f325-2640-44a1-9688-adbb94fe16da", "value": "a2232cd0627028b5dceb4deb513f885d9dfef0fe5ef52ed9a006e9c69834031d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7750d9-9fa2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787565487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565487, "uuid": "a82894d8-f749-4686-b573-da08a00d2549", "comment": "Malware payload", "value": "b6824ae2e68edaa3e6ae926ab118b1b3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565487, "uuid": "bd05950d-1bc5-4f42-9f19-41e8c75ca99f", "comment": "Malware payload", "value": "795ffb72e55af55753090880ba6f1ba106d4e415c5223162b7e9e3d9d327092e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565487, "uuid": "de1ee845-36a2-467a-b655-067c0b87b06a", "comment": "Malware payload", "value": "a2b9ee979fddeec42a98c2ac2fc0fe815b4ff7b0", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565487, "uuid": "0fc1fd11-0539-4451-8c5e-6939b0d65b20", "comment": "Malware payload", "value": "02c5cb34f23d31e7d7d49f547964ba31bb448f2ed0c08c5c34f8cdc9d77cbb7d6152f698d4773242c7d9c56150e46b85", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565487, "uuid": "5fc54bec-9caa-4ffa-bd6d-94eae745d1bb", "value": "T1DB263379CB7134F4E12BC97969910E06E9A2FBD24B309DDF47248EDA0E276D05E3E610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565487, "uuid": "c63c4832-da4e-475d-8e90-535a9f68a5a4", "value": "d06838dc8f3e85f7c31a7b0360fc67c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565487, "uuid": "a8568601-f9d9-48ea-9ad5-17089fb6674c", "value": "98304:cJcU4JHP1rStWIYPb6hm8owtJP4c5DgVYJDhzLzlWlpHa/31gb1a9mPGB:ZtQWIQstJP4NVYnLzlGpHggb89m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787565487, "uuid": "fc00c953-54de-4ce9-aefe-8d664d070d61", "value": 4446928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787565487, "uuid": "ac741f31-ccb4-4c4d-9db0-1fc4ec0f781b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565487, "uuid": "93d7a310-0686-40ff-af24-b8018c296518", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59481231-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787574954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574954, "uuid": "d2c681e6-9da0-4843-9904-7421c6fffc10", "comment": "Malware payload (RemusStealer)", "value": "66a309931c5fef47531475364f3681ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574954, "uuid": "4a9199f7-e171-460a-996a-ff2fa940c124", "comment": "Malware payload (RemusStealer)", "value": "79a4f6619793991c126900993a4ab516983a61ca6dddeee9f8eb4bdd3a434c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574954, "uuid": "5840c49a-14af-4b74-b35f-2e1002b5093d", "comment": "Malware payload (RemusStealer)", "value": "243a5524762e9d776856efc1471f882f5b8e1073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574954, "uuid": "28380a48-357a-465c-9bc3-3a807dde5766", "comment": "Malware payload (RemusStealer)", "value": "35824a65166dd6061abfc7c643b4ea073f21330b0b24465d8fac8096f5b54bb24ab6c219ff8bf4663e6dd8456974d272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574954, "uuid": "185aad8c-d0f7-4889-9c90-5c121cf7600f", "value": "T122264A037E5665A4D0855F35846B4612B734BC88C335A3EB2E94DAB02F633C36EB6F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574954, "uuid": "ece665e3-1da3-4863-aa79-b8651a682775", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574954, "uuid": "6b046b2e-13fd-40ab-bcb1-d5f9811c88c8", "value": "49152:GYfeiYYW7JjyRZuwwCd4FDJ/QQkuK9YODE9dPnSgiebDQnFIeD1hv:CtjyRZuA4zCpDEjuFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574954, "uuid": "557a7aaa-bf17-4899-b103-ec3ae12104d9", "value": 4857256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574954, "uuid": "5a806ebc-0369-4ad7-9526-08c2d0584a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574954, "uuid": "f3ffc8fd-4d92-4e65-8766-56dfcc9ba414", "value": "\ud835\udde6\ud835\uddd8\ud835\udde7\ud835\udde8\ud835\udde3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6d9d6f-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787574956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574956, "uuid": "98d0cacb-bf8e-4b87-a25d-cab7d1d00125", "comment": "Malware payload (Mirai)", "value": "bdb83ef3d3cbec2f6305b3298e2c5615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574956, "uuid": "c51bde87-6321-4699-9d86-b706cb708027", "comment": "Malware payload (Mirai)", "value": "79c8c8f24ee8ed9fcfd100149a792db90e4c6d1cbaf40dcf095a478f1f3c483c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574956, "uuid": "e6032709-0fef-418e-ac1a-d3b1ed8cf45c", "comment": "Malware payload (Mirai)", "value": "15c7f6ef0ee5b239c7758e24bd35e8400b2a6222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574956, "uuid": "cb445886-d690-42b8-9d56-38591e0f2ea4", "comment": "Malware payload (Mirai)", "value": "96d65ad9d75c343e425e37cfee5ce70a28e43b1d7914ff06d748574757ab2c4ce413628a218e63b68d62e7a220ecfc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574956, "uuid": "8ce5bdd9-922f-4508-8f9f-648229d4a35d", "value": "T1B9D36BC469E3E0F2E953857A4B6F671A4B36D0370119DA11FB2E28386F46010E7BB79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574956, "uuid": "4a8bab7a-cf1e-430b-bcd8-0c84fdc82652", "value": "3072:LTSZ9DlYZsURKHhYZePcNY5NrJpnProl+X+u1EssMZc/T03ImIys61X1h5oV:LID2ZsUif5Xm+XDEssMOgh5oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574956, "uuid": "8fffacd0-e751-49fd-9ea6-57b95ca8bef4", "value": 140840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574956, "uuid": "1c252c92-d8c4-4f78-a4d1-193197231cbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574956, "uuid": "bbf7ee79-bacc-4c1e-839e-d6874ca05e97", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a0ccff-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576743, "uuid": "61bae6a9-3a38-4968-858e-80554e1869f2", "comment": "Malware payload", "value": "e990ca415dc7c82208df55b2e6ea177a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576743, "uuid": "72fea552-fc6f-48dc-bf84-9bfb334ce1af", "comment": "Malware payload", "value": "7ac26ff2824b9a67c18823400bc773aae66131a22e16e95114daae072a926b35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576743, "uuid": "d3cf7bf9-690e-4564-82aa-da1a74dd1238", "comment": "Malware payload", "value": "c0f56f026bb60791fb19d430c7b123197c60e831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576743, "uuid": "fa507b54-8ea1-4f8e-a8a5-7e67ed9ba7b9", "comment": "Malware payload", "value": "55bc5788dced6b5e7e4f14ed6caae707139ccb8949a6dbdf6113f999e79f1c169b30e0b4f1a78af36c8ce23c85700b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576743, "uuid": "495dbf26-3588-4cc7-9193-70b3e7b4a711", "value": "T143B23C91E7C3E0F7E88401FD1152D7516336F438216AFD4BEB2026BBB812921E757BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576743, "uuid": "4f1db00a-0c87-429b-b26c-555ad0bcca9a", "value": "384:fORoHGlOvCRVvpnzR3sGzBWl7uRI9BcwQZU8c1j9v4IFWkS+UGuy/:kYGlOvCRVvpnV3NAH9YU8cL4IFNStZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576743, "uuid": "45280669-ee12-457a-9069-e1e9c63cf94f", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576743, "uuid": "f99e55f0-7889-4d58-816c-7702f8b27ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576743, "uuid": "6bcf1980-977e-4f83-ae6f-5f613a0266d0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3f5bb0-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Aisuru)", "timestamp": 1787543683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543683, "uuid": "970c8662-e373-4667-9ed1-5888038b56a0", "comment": "Malware payload (Aisuru)", "value": "ae946a76020ed6d4911a152cd4c76e54", "object_relation": "md5", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543683, "uuid": "6a609e68-0c95-429e-9fb2-8565a224f629", "comment": "Malware payload (Aisuru)", "value": "7bc264b4a37d6ccac9176959cda22c0ea99a3a962849017e21dc8723a4e64fc9", "object_relation": "sha256", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543683, "uuid": "7be4175f-7964-4d71-92c9-786146fac521", "comment": "Malware payload (Aisuru)", "value": "49286f3bc816ff0679aacc493cc57bb31904b506", "object_relation": "sha1", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543683, "uuid": "3f7506ff-b002-4c5e-a41c-7d0afb8f9a56", "comment": "Malware payload (Aisuru)", "value": "f6bc34791ac27c303e03870a1322754c8094ca85f67fe0d542d606eab19ebe033a62e352d27ee9b6271c7625e6d9599b", "object_relation": "sha3-384", "Tag": [ { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543683, "uuid": "f676562d-97db-43ac-a1d8-21f6e72d62e3", "value": "T1CF830882E747DAF2E80311F592FBDB312A35FE3A0835DC8AD364EDB169126D2550A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543683, "uuid": "c1193b73-0b27-46ef-9e15-44ebcd4ee763", "value": "1536:HjY+hjEaGOu2uIVzmafYukUUu/WY53hGw1rq++dP+xogMSYri3ajcGZ16:HjY+hjE6nTVzmafYTZI3hGQW++y0yaHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543683, "uuid": "b9640b5c-d1e1-429e-89e9-5ba8d3cb2978", "value": 87664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543683, "uuid": "62bb4004-b12e-45ef-afa8-2023f965a09a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543683, "uuid": "2373f5c8-da32-4f33-a8b3-d5f76d74aa08", "value": "raul.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a76ed3-a002-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787606914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606914, "uuid": "d218e10b-00d1-49ce-b2a1-7903892f3919", "comment": "Malware payload", "value": "4b38a8990c0d4359973374c7c182da69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606914, "uuid": "737f9194-2afc-44bd-8c43-7c6538b7c9ab", "comment": "Malware payload", "value": "7c33aadf2aaf932241116217b5cc7a96575217a8f93ca131e4bf3def72b4b8db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606914, "uuid": "914912e4-7020-4a29-9564-711f29336f40", "comment": "Malware payload", "value": "25c9b8821a3f9dca0d58949af4aa91ef0a0a099e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606914, "uuid": "68bb4017-2f2e-49e4-a004-3930e743de3d", "comment": "Malware payload", "value": "780b2c8649bd1adaa33dfcf300720d5fdd476ebbcadeaddb4e338d37ca0b9e0b2ec9ddbb4bb476d126baee216adc8daa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606914, "uuid": "dfa62b84-0033-4fc0-9c58-48f2cb27273c", "value": "T19D143951BCA29A12C6C3467BFB4F418D372A635AD2DD7102FC1D6F603F8A46B4A7B181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606914, "uuid": "1b30f1f0-b0a5-4eb0-8ab2-1ffb5ae980cd", "value": "3072:LoWWVznh2W4dBf/4YHKeU5K4ALmhDyfEvxZWTySfu1EssMZc/T03ImIys61X1h52:LJcznh2W4dBfwY/aK4AyhDnATyS8EssH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787606914, "uuid": "5cdd6eff-fcd6-48c5-81ce-cff2fade8b7b", "value": 195276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787606914, "uuid": "94a62902-65bb-4ff6-85b3-7212fd16a526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606914, "uuid": "6dc46b9d-0771-4bce-a061-a96c5bfbce34", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5468419-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536937, "uuid": "51c3d6d5-4df2-4742-a76f-a87151793a00", "comment": "Malware payload (Mirai)", "value": "155d1d836fe64e45b201d0c2d9a8276a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536937, "uuid": "4e026816-adcf-4aa5-a4a5-6e1cf432595e", "comment": "Malware payload (Mirai)", "value": "7c7b9c33ece837a45ece5a982740b3b2d6cd44fe93664dd7fb68e97103359c43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536937, "uuid": "b2ad4c76-6aec-4ed1-9900-0b2ed3ff6e2e", "comment": "Malware payload (Mirai)", "value": "009e1530d69305490afe495caa1ba06a396d8603", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536937, "uuid": "98fb3356-9253-4ccb-a417-03e1248686f1", "comment": "Malware payload (Mirai)", "value": "dbfe0660cd3625c07b376cecb4bdd377ea03c9c8b934f46d577275fa70d8430361cad2148f272ddb92df47d898a5795d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536937, "uuid": "1faa8cf7-7524-4756-b5b7-8f85080cd981", "value": "T197545A5B3B10CF65E229C53149B38E5663F5266227E2C549F21CDE18BE6038D682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536937, "uuid": "2a4f6090-2fd0-40e4-80a0-7c5fb93ed39c", "value": "6144:XkZLCOPwn2sPf9/kqKJzeut5GmWw/V6hkNA:XkZWIyGeuqw/TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536937, "uuid": "0ba7b801-c262-4f2e-b1cd-f285b69ccdf0", "value": 287384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536937, "uuid": "ffe5f1e8-a954-4378-9264-d6fb6ce9a61a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536937, "uuid": "6f6650bb-12ee-48e5-a966-fd583239ee99", "value": "d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d475f-9f93-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787558942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558942, "uuid": "06f2ea05-90b2-4d1d-9631-48e3b986850d", "comment": "Malware payload (Mirai)", "value": "3da98e5fb66e9d1a0b2c01449889db29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558942, "uuid": "39deb341-2e02-4020-ae9c-48c81239064c", "comment": "Malware payload (Mirai)", "value": "7c82112529268649005f48216dc9f194ab3429329ee509d283a30e5576b9714c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558942, "uuid": "3c6d9041-2ea6-4017-bf9b-529bf680b0c5", "comment": "Malware payload (Mirai)", "value": "167dcfc6d830cc90c7a9ca8b0694be71abc63d4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558942, "uuid": "b007f06c-dabd-478a-a2e9-ee7801ac920f", "comment": "Malware payload (Mirai)", "value": "0b9365cda31974edca4a026c4cdf80cc48bff10548d395f18c22613e32228ed73df0605e55c6195d548f1fc9de6f88ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558942, "uuid": "332d298d-2690-4ea4-af7e-a6a2136ab773", "value": "T1B9A35B227D791E3BC4D4687B62F30721F2F2479A25BCC51E3D610E8EAF246503617AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558942, "uuid": "da38857b-3c87-4559-833d-c08b3d6c3809", "value": "1536:sXKlesSnFAnv81pLuhBez5zm3vErDlIybp7ijcAcGtlyQNWq5HtgmAl7tsKm9:PoXLSeFAkt7WXjTNlNu09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787558942, "uuid": "496b5b82-d7c7-4829-9501-62630ecb6b6a", "value": 105100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787558942, "uuid": "a24bf2ee-f3b0-4cce-89c4-41611c8e3969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558942, "uuid": "53dc67c7-df6a-484c-ad79-081eff6e82a2", "value": "qtm.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe8dd61-9fa9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787568711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568711, "uuid": "32e39d27-2baa-4cb7-9f4a-18f6363b6735", "comment": "Malware payload (Mirai)", "value": "35c7e30f385a2c90babf3042bef4f046", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568711, "uuid": "3fc5b533-2541-4991-ae62-c8d0d3669300", "comment": "Malware payload (Mirai)", "value": "7cc8125ddab8ac4154f876a3f114e8f65fa84824d577616875390d1c0d4408e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568711, "uuid": "c567a585-0ac1-462f-8d6c-0efac30237a6", "comment": "Malware payload (Mirai)", "value": "a7ec193994182e10da97178115ed08e601ed23e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568711, "uuid": "ffeeab25-6df8-4df1-bfad-2fd21241c495", "comment": "Malware payload (Mirai)", "value": "d3a64334f69bbe4ebdc9c62177fff4cef499dd388c9753b33f919ae3df81eafc0b5cf2aabb3ef4f39ca1b9622ff41e48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568711, "uuid": "b38d125c-8282-41af-afaa-c32399887a11", "value": "T1C53166DB00205A723403CE9F72663848638DA6FB1C5FD7D4C95A5EAA93483CCF255B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568711, "uuid": "d7323f1b-969c-4c27-9f73-75f23534549b", "value": "12:UmlL6ml178VioZGk6Ebj+6djFar662JMWjDtB6qKZe6uaogG1i61RDSpGcbp6Frv:HWZtJXZKroflCSKnzt9fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787568711, "uuid": "1081bdb8-eba3-47bc-aab3-a212e2442e4d", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787568711, "uuid": "2ccd889a-70f4-4c3f-b7a9-e11959dc86c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568711, "uuid": "0f824c19-cd12-4786-a4e5-f96a19b019be", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d7f01-9fb5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787573709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573709, "uuid": "72688238-cd56-4a0d-a3aa-8e308edaa33c", "comment": "Malware payload", "value": "0a2d7b56854ddcf6b5dd7bf949ae2847", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573709, "uuid": "991871a2-2e33-4512-8059-db8318fe5364", "comment": "Malware payload", "value": "7e17f7dd343cdea5796bc23e825feffd6871ca1b621ad3c4342eb0a875b426d8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573709, "uuid": "9a1bd6c4-4aa1-427a-afff-cc0e6e61ee79", "comment": "Malware payload", "value": "4e3155969c9ff5feea61db80ed5bd02f1eed866b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573709, "uuid": "ca040fbc-e52e-455f-a269-85a832cc1bfb", "comment": "Malware payload", "value": "b7ee7977eea2efbcdd4de77e1142d4ac98c748165e183b77b1a1fb6432a5aae1189ad75f0335d6fac8271ccd5e95de2b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573709, "uuid": "0cd1717f-f379-4fbe-b077-aae99f20b74f", "value": "T19BA6228EB27550E0D1E522F2C3D58339E8F879CE899016EA0EA51E36DC538B7DC5523E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573709, "uuid": "75780477-eef7-432c-8d34-b760f040214d", "value": "115458f119918dd7981d2fc446250721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573709, "uuid": "6639314a-467d-4d64-92c9-75b0b3b16cd6", "value": "196608:gjVfjHkcA1ulCyhlKVb4BvsBpGM5ZPji2C2ir9aW0B5cKtcmMlJeQEWJng3Rk1j:qtf0ulNmVb4BRmLiZoW00McmYYWJng3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787573709, "uuid": "1c9d76a5-23e1-43a4-a7f0-746a878dcf52", "value": 10360832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787573709, "uuid": "da5d867b-0e63-449c-8dd8-35515d83d90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573709, "uuid": "617ddcc6-a29d-463a-afbb-e313e4d32fdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62ca197-9fa9-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1787568721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568721, "uuid": "137ab519-6035-45a4-a6ed-a1d5074f408b", "comment": "Malware payload (CoinMiner)", "value": "baacdc3583ecaa4e7c614b8aa8acb274", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568721, "uuid": "a5dda79a-5ce3-44aa-9bcc-94864de09c67", "comment": "Malware payload (CoinMiner)", "value": "8049f126065d8f2c0235e0946389d6b0bc88bcd968f17e2d05bc4dd41e566a3c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568721, "uuid": "1a072924-9d06-4565-97bb-df7b62030c81", "comment": "Malware payload (CoinMiner)", "value": "37e57a7eae226b6b3518d496a754b2d2b96c9da7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787568721, "uuid": "cf7de4e8-3dc8-46f4-a1ff-b7488b044944", "comment": "Malware payload (CoinMiner)", "value": "d30e4be2d2da7b6a3ed471c384973e11e038d18cc3b673bf33437e5029591db91daf00f2cbc5ab75daccbe5633401246", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568721, "uuid": "6f749c2b-3d9c-425a-88ee-2ba78bf815b3", "value": "T109363398AC82D474E02BC3B8419638BEB27EBBE14912BC1776E41D184E1FF50597FB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568721, "uuid": "2fcb0e6c-8374-4b5b-879b-8ac96f5c5d9d", "value": "949ec789a5933fb6051c9013a550fb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568721, "uuid": "20359bd2-942a-4150-8b44-da2b2c8bad1d", "value": "98304:vOWBcekZcdLkg1o6ZkBqo1b6v8aMSj4gZCn1pxE/Yz8X+aSB3/X1u:vzOTg1o6ZWVWYUFcn178gmiB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787568721, "uuid": "5ac0ea10-696a-46cc-8cbd-7d8c1e2b04b9", "value": 5298688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787568721, "uuid": "16091342-d891-4090-8411-27acb42990fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787568721, "uuid": "01749c4a-e860-441a-9a16-a7e4de9b35b5", "value": "8049f126065d8f2c0235e0946389d6b0bc88bcd968f17e2d05bc4dd41e566a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b12851c-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576729, "uuid": "8def86f7-bda2-4f69-8cf8-128d5d52d908", "comment": "Malware payload (Mirai)", "value": "044e287cb77c66b7b4a7a12adf5012f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576729, "uuid": "be2ac47e-ff28-4ef0-aff5-5dd7fd188412", "comment": "Malware payload (Mirai)", "value": "80754daa5b0ecf0d12992a59e02f37fb7021734bcef4090d69093fab35ea374e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576729, "uuid": "22c662a1-8f9a-4677-b45b-9c627defe17b", "comment": "Malware payload (Mirai)", "value": "06694a98fc1db55fef6379d3fbb00f2d9004905b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576729, "uuid": "ab06f1e1-962e-4714-94ac-a8288b5e3686", "comment": "Malware payload (Mirai)", "value": "4333b51895e249a280e3bc8b429b45e922cc631eb5845d88552a0f242b3187ec2071c0fd4c4699d2db9ae68e0c225e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576729, "uuid": "7f2def24-ef76-40ca-be1d-dd86f3cfbe18", "value": "T11323074AFD805F00D9E525BAFE1E424D33934B7CE3FE7111AE215B2523C6A2B0B7A911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576729, "uuid": "13baf42b-aab6-46d0-9aae-0809ea4b31f3", "value": "1536:5lnESiKbuDyyyyyyyyoPo0/IOWNFXiK2lnkivAt+JHCzD:vikr/IOWNFA1At+Jif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576729, "uuid": "b73f72b4-add9-485e-a896-a759cd752702", "value": 49552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576729, "uuid": "c6142394-ee2e-4ddd-898f-759173999408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576729, "uuid": "78d410eb-8329-42ad-b58c-575e7a90dc72", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc2e5c9-a007-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787608998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608998, "uuid": "1e3f135a-e05f-4c88-84a2-f23e37d87a36", "comment": "Malware payload", "value": "b7e8f4b1136567a630d7e82465780042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608998, "uuid": "5a97100a-eac6-474c-919c-41800df82153", "comment": "Malware payload", "value": "82608a590fa29af44c5b77830074b7e0b9d27174d042c6a8ed6f7119b6d54bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608998, "uuid": "be01711f-0259-4413-92c1-61b381db3d0a", "comment": "Malware payload", "value": "e1b69a52333fbcd25335739d30378f15ef2a3341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608998, "uuid": "8145f29b-e0ed-417d-bc94-9cdcfdeb3d16", "comment": "Malware payload", "value": "288de9fcf10c56ab958b1b6e0642ac98e52891b39a4c11db7f766e1a4885798669c1fc4641370fd715790b7f6d52cdaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608998, "uuid": "68613beb-40cb-494f-adf7-d61a1d04a2f9", "value": "T1A4551E8ED8919BF8B3A6F773521AD6225CF6344780328631CF457E395F02F24A524EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608998, "uuid": "09a81b9b-46d3-4cd3-8f10-23bb8479eed1", "value": "12288:DKnr3gPi2qT/Q6hGT692vl9Iem6m9gEBi:DKr3gCTY6sUeBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787608998, "uuid": "0063852f-7b0b-4a5c-8e8b-00ed934ac97a", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787608998, "uuid": "ebd19ac8-a3a0-40e9-87af-fd7306f3a9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608998, "uuid": "7e423c72-5d39-4b65-af3b-02c5231e1364", "value": "23b3344bfa7fab78adec1754aba67f57b468a3ea052d56522770ef99497e499b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffbd741-9f52-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787531237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531237, "uuid": "d71593a0-a19d-4a82-a548-a55e269693ca", "comment": "Malware payload", "value": "b119bdbe19c91521fbba3f9ef251f673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531237, "uuid": "4c6d06af-538d-4323-80d5-e4afb8f9057e", "comment": "Malware payload", "value": "826ac95ac380c1566761674417bfe72cd4b771b09871b17a15ddeee265bf149e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531237, "uuid": "56971b77-b4d6-4d8c-a56f-a4a115cea401", "comment": "Malware payload", "value": "518cc8573a8ee5908b9aabdd5bc53e3b740552df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531237, "uuid": "f84fa81e-0212-45e3-bfac-60f98c664f94", "comment": "Malware payload", "value": "9dab0aba40437018b0a01c6b15b5fa80e286cd326eb1fcb75caf79fef77274de8df3892113f4f537a9608ca8cec42ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531237, "uuid": "ea779885-969d-491a-8c50-a220a67b143c", "value": "T112D5239EBA732574E837C7B18F12E43D707E3B844B618E4FFA9D29405E5264468323B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531237, "uuid": "901965f3-f694-44e2-bd83-3d0bfddd713a", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531237, "uuid": "741be5b6-5413-4c67-8f2e-81b03d3afdc6", "value": "49152:HoJcRt12rnqSIVUWT49ef48wonIFCZEh5tt+vjN4XHIuLFOmmrVuLHKYd1lu:JIpIVUWnnnbE5X+vjN4XoIFe6qM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787531237, "uuid": "a01ace90-e8a0-4b28-a504-811d8ebe469a", "value": 2912768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787531237, "uuid": "2885e1e9-94d2-4147-9cb6-2d36627b7fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531237, "uuid": "693c1f5c-e295-41a7-9034-3f5e0b064b6f", "value": "826ac95ac380c1566761674417bfe72cd4b771b09871b17a15ddeee265bf149e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd59207-9fe9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787596114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596114, "uuid": "b6418e15-ace1-4e38-8b63-4c76a4fb0101", "comment": "Malware payload", "value": "cf6067531d65ee6f95cfae3a5455f894", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596114, "uuid": "69d1f5ed-f0d4-43ed-942c-e146c1c0a916", "comment": "Malware payload", "value": "82a7c6208b7b98fda014dbe12d7afd6101941920b4ea87124e19eb6c9cb9f4b2", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596114, "uuid": "67f417e3-0803-4cc7-8a8c-f0df81e96ccf", "comment": "Malware payload", "value": "d4923e8a3a04c85448855b87d68d1605849feb43", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787596114, "uuid": "c5226b6f-b327-4469-851d-c8669e6d9056", "comment": "Malware payload", "value": "f497af205c345e3dc6d6e1572a1bc590caff2ff7a634191caba379bd7c346ef93e074a10c15089e64e6f2263d2648957", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596114, "uuid": "b233ccc4-3789-4c14-8f45-586dd1a28384", "value": "T102B62357E2A344F8C95BC1B497A7C772B930F8690234BD2E1E94D7212F26E604F1EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596114, "uuid": "c4162f9e-05e9-4048-9c00-f89dba140ef9", "value": "ab4deb034aa730f55aea72b8fd02202e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596114, "uuid": "45507dda-26a3-45c0-b2a0-e935b885ad27", "value": "196608:Kqr7mJGlZSlp7vaXFE045/ifTJYXoLViHqlCY9soAlHcR431du3PX:h/Sp7vACpIVyqA6HAIE18fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787596114, "uuid": "1e4c5248-adaa-49b3-bb43-8d139634a942", "value": 10654960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787596114, "uuid": "62e70837-c202-4fd5-a2eb-2ce08600b12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787596114, "uuid": "797a57b2-aadb-493e-91be-2498c4db2215", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fc607e-9fd3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787586740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586740, "uuid": "7e330da0-eb3b-4109-89e3-f1bb525130b0", "comment": "Malware payload (Mirai)", "value": "f463f69f6c375019af283bc28eb7c85a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586740, "uuid": "bcd07dff-356a-44ac-a007-6539e685c49a", "comment": "Malware payload (Mirai)", "value": "840d6303cf94d4dd8d2bc8d4718535efaee87be41a36b8278f4460efd0e4b912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586740, "uuid": "c97130a3-fd3a-4814-9b41-7d23251426e6", "comment": "Malware payload (Mirai)", "value": "667155b8b5f81b211ffec170e88f86c1dcdfa833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586740, "uuid": "b9131b87-e56d-44ea-9471-cd437231cc96", "comment": "Malware payload (Mirai)", "value": "1b790571f1a4ba56b99b1455b3101d4915377a2c1c0c6506634d8b777f7d4bf89ae1f87bd92865f401f11824fb5a3d51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586740, "uuid": "a059feba-01c0-4ce4-a467-e2a5c3fb76ee", "value": "T117143A95F890DE52C6D5267AF96E518C331313B8D2DAB106CD244F38B7EB85E0F3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586740, "uuid": "223ef4b8-1963-49e1-b2ec-b1ed0c63198f", "value": "6144:sRlx8s/kMmKTUQ4g8O592I0zMp0No9MpM1J5km:2lF/kMTTUQ4g8O78UNMi15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586740, "uuid": "0f1bc276-396d-47b4-a103-0ab4a55fcc82", "value": 198320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586740, "uuid": "5a746c4a-4330-4396-82d4-619e7453b01b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586740, "uuid": "2553bc12-609a-49dc-8a1e-50df4adcf8e4", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136b55e2-9fce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584286, "uuid": "ac908ad2-6caf-4299-9fbf-1d080aad5e4c", "comment": "Malware payload (Mirai)", "value": "40dfc14f402a06281e14c38fc927ff74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584286, "uuid": "3a5222f6-ea51-432c-aebb-6d5e5203007b", "comment": "Malware payload (Mirai)", "value": "8421a7f0fe6396845762246f5cc19a7c1a7124ff80d5aaeac69cd91b0fc815cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584286, "uuid": "02d56c96-0705-4b92-b845-64c386461a74", "comment": "Malware payload (Mirai)", "value": "c3cd36b10436c354a93a1e7356fbaf4541becf7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584286, "uuid": "f1503c74-a69e-45f6-b1d6-4818be2c8377", "comment": "Malware payload (Mirai)", "value": "2446cc06f8bde0fc69968f804c9eb713c8768ee0f058a4bad1146ba288219f07735d0ce013e5d9f8d2f3b9f512b810cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584286, "uuid": "084c9b59-9853-439f-a206-e01f8dadbba0", "value": "T16124AEC1721C7EDFE1832D7D860955235C0CAE12E8039B9261FD6A47DA7BAE30FB9941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584286, "uuid": "ae540978-37a7-45b6-bc34-e1508dd6a878", "value": "6144:uCWEwesWl+cJvAC3uVfAlVZ/kYVdaBCUvFFlJXsPH:qreLAemYPlajFGPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584286, "uuid": "cad260e9-ce44-43d8-a213-9d3f60f38651", "value": 216236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584286, "uuid": "4bce6e69-5753-4afd-8e1d-4037d366acbe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584286, "uuid": "d0455dfc-1ae9-4a71-8e11-66e5865c1a2e", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cece8d1c-9fbd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787577299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577299, "uuid": "93b595fd-2d52-4da3-b98a-6bc16f651d81", "comment": "Malware payload", "value": "00da62995f7a12b1370372ee60cedbc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577299, "uuid": "64266400-b011-4148-a0ec-9f88908432fc", "comment": "Malware payload", "value": "8489030a25de5eca642d8130c840af85cc258516b6454dafb68041915405947d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577299, "uuid": "76f25eda-6d18-4166-9ced-86513c32b5cd", "comment": "Malware payload", "value": "0497b738c1923c1acb3beaaf3db4b215c0fd93a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577299, "uuid": "48c822dc-a184-4c17-8167-77afedb61b21", "comment": "Malware payload", "value": "2c1b0365681f9dc2be100af0334db179d8d22f6f1d65893a320993b1bf4ebbad98036d56d5b769061defac1f7dc66393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577299, "uuid": "229d6eec-5921-4c94-a42f-34a292fa17c6", "value": "T1A3A722E3B28A653DE06E463559729310473B7E206C1F4D7A96E434ACCF352A03DFA6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577299, "uuid": "e9bcca9b-b152-473e-b094-203023ebb35d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577299, "uuid": "d6425b63-39b3-477c-8139-a24c008ad265", "value": "196608:h5Ii9bPwzAaYggn0yrPYULdNvYbJ5As8zTgB7910l3Bf/2Kz:hjCYgg0oP3LzwN78zTbdNeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577299, "uuid": "b3574d82-a8cd-4ef4-a04f-716e96c7e9e0", "value": 45594655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577299, "uuid": "31afe5c5-ffdf-492c-939f-30b68cc0cd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577299, "uuid": "b46e46df-0c7b-41da-9bb9-d2c7683a87d2", "value": "KMSManager_App_v24.8.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cd8064-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543697, "uuid": "f83e3c65-5237-4614-bc81-2d1d1289b26b", "comment": "Malware payload (Mirai)", "value": "2bdd89c6489756ee6e10ecb34501bbe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543697, "uuid": "3cc6170a-10f0-4700-a0cd-4a20c63bb3e9", "comment": "Malware payload (Mirai)", "value": "84ea062cf0ebbd2474f50dc74d36c6805814f6a0486bcdfa0c40273e01f749e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543697, "uuid": "bb190c1a-5175-4924-aa92-5a031c66906f", "comment": "Malware payload (Mirai)", "value": "98f584232d070807d8aefaefb8b305e86576a079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543697, "uuid": "efefcda6-5d6b-4366-93fe-e1617ff4e991", "comment": "Malware payload (Mirai)", "value": "2d40b7c5bb7cec073514a6ff9fa02bcde6514c8aba72c0849ee7c2bbfa7d80759eec5ff81b1b860743ca77a7f54d792e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543697, "uuid": "5247cf9a-6a49-449f-b653-b528291eb1e7", "value": "T197B33C46BD91CA02C1D225B6FAAE54CD33136FF8D7ED3115DC206FA067874DB0A7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543697, "uuid": "ac3f97dd-84d3-4556-95eb-ec01f912ab23", "value": "3072:jA5jkcg3gnMQ91Q0/OB1wVXGwGd+Ln0z+APX47H:jUtOB1oGwGd+La+AQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543697, "uuid": "17c25682-edde-4e7a-8391-1b6578c4d650", "value": 108040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543697, "uuid": "0c195f1a-253d-49a1-ac28-8b907ca0c3f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543697, "uuid": "5f185f49-fca6-4c67-88c2-a3f0d33902a0", "value": "raul.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8404c6b-a012-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787613876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613876, "uuid": "2f0625a9-e27f-4549-a398-998732c19eeb", "comment": "Malware payload (Mirai)", "value": "bcfd4b9b9bbf487f495a83769cc82f75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613876, "uuid": "d0be2fde-af03-49c6-b95e-38256d949e8b", "comment": "Malware payload (Mirai)", "value": "866f6652ceff521896811a1666fbe0fd17fd879e31953b47cb3cfab1619067eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613876, "uuid": "8c8e66e4-26f0-40e6-bfb4-7f2af514a226", "comment": "Malware payload (Mirai)", "value": "a2254c4ac1eab68eaf1090685dd603fba0c44b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787613876, "uuid": "c1ae05dd-0c0a-4775-845e-c0280502a819", "comment": "Malware payload (Mirai)", "value": "68e0412d4d18b3331f42f36dc15ded07915768f81382ccfd41b3f30cc141b566764c7c3285b44b371eefd6f4e788da2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613876, "uuid": "befbb5b6-d9de-49a4-979b-cef5132cf1a7", "value": "T143B3BF87B1907ABEF0A45E3FC4135E26E6259F705583173D71BDF9906E3A3903292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613876, "uuid": "01556d5b-54ce-49c7-9dac-679dfd613040", "value": "1536:NoOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkz+8rSx:N1xKlGWnqTUcXgZS5gZ7CSXhSLUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787613876, "uuid": "d1a31dbe-2dc5-4422-8885-30c82639dd9b", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787613876, "uuid": "8c479bdb-0e26-493f-9930-3a774851c201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787613876, "uuid": "99ee0b9e-8140-4063-b4d3-5038175f1896", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e93b39e-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576735, "uuid": "cee05a23-3ad5-453d-a326-fedfa6799d3b", "comment": "Malware payload", "value": "bdcf62901766276bdd7b5f08c784ccf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576735, "uuid": "2ca22bf2-9cb9-4dbe-9280-e35f6cd16ed2", "comment": "Malware payload", "value": "8712b26c192f287279be9d53a9d09cca7a150770ec4f47e9cdd7e0c2001f394c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576735, "uuid": "5a84e307-600a-49ff-a301-9ca3834e3243", "comment": "Malware payload", "value": "4807683b822a013bca7fbe044b89ef5dd60c8e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576735, "uuid": "426e61f3-f82f-4b83-af1f-c8699e0beb51", "comment": "Malware payload", "value": "1e301bb0958340b1ff8df666d8b3a604ec32f48e71cb45c2995b0501f4cc528a6ba566df97597ee5a980b1712b923acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576735, "uuid": "f738bf86-3fbf-45bf-b31b-4bdc8712b25a", "value": "T1A1B22B81E587E0F2E41B46B98092A77EDB30D61A2515D91BFF709BBDEE13911830F319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576735, "uuid": "b431ac06-3957-426e-b6df-4315f5d7a483", "value": "384:fCXJdg5g3tI4cjfaxWapnTUIsc83SFG1bhs7yURpOLja0pqKEtkzw:y7tIffgWkYIsnvdeGURpwa0pqK+Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576735, "uuid": "28470f66-5f9d-4b06-9e4b-63b3bf25577c", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576735, "uuid": "3ef4fc3f-11ea-4f95-af12-6b75cf1be488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576735, "uuid": "36d767a8-a9c0-425b-9982-01c5fcfbdbd2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b69f62-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787598777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598777, "uuid": "d5a17d40-20d1-40ba-873f-985b8acc3923", "comment": "Malware payload (Mirai)", "value": "c60fa779002232fde58108a99a918e6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598777, "uuid": "86470d8d-01b1-409a-9e17-b4deb91fd9a6", "comment": "Malware payload (Mirai)", "value": "880a9ea4c0bfcff656613559449a906f3da211c977fb8e29927b33322ccdd6dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598777, "uuid": "402968aa-5cee-4bc2-9c07-245eb83581c3", "comment": "Malware payload (Mirai)", "value": "5657b5726a71593deb1ac243ef625a98be33c26a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598777, "uuid": "044a4a9a-7526-4e8c-a7f1-4fa600a971d2", "comment": "Malware payload (Mirai)", "value": "a16587ee00bd8b3f29893053bc59402cc0804fb0fef71883dceb1f1388e6f9ee35c3dd1dc71c10b495175dcefffaf8a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598777, "uuid": "c7de0212-fb76-4e8b-8b35-bcdb1d8a4f91", "value": "T1C5B3AEEBF64715A2C85243F013C79F8E3E2323909E57A4E76D1E267B15760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598777, "uuid": "21f53798-1ab0-4dc5-86e0-dcfaef27f214", "value": "1536:pkA9afIgfNMW3zC8aRGGTtJM/qrlpmxJ6nDgJe/LWW:6fIw3e8ZE3MYlphDgJeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598777, "uuid": "efb55388-acdf-4261-aac9-1cfb4d06aab4", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598777, "uuid": "6197da84-1d03-41fc-b99c-11f80c94b634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598777, "uuid": "5ea2795c-e523-4273-bce1-bd86e4379cd7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1d259f-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787577432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577432, "uuid": "910e18aa-cefd-4051-b82c-5f647033f19a", "comment": "Malware payload (Mirai)", "value": "d9e1aa50098eb86621897f32d711fcb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577432, "uuid": "a896ddc3-683a-467e-a585-6e5990813358", "comment": "Malware payload (Mirai)", "value": "884d4aed509b9eba0c7b7cb4e0d98153707dcba323c95a28cbc38629e23d5de6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577432, "uuid": "52fc4d5c-340e-4701-97b8-5e7f2cd05182", "comment": "Malware payload (Mirai)", "value": "a79b9536847d8b37443fa82ce7dee7cfc475dbf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577432, "uuid": "82a69a51-a30d-4e46-98c6-5db1ec21c3a0", "comment": "Malware payload (Mirai)", "value": "834b744c761394fc4148dab9d33d7292ed021ce060586b66214dcd4e7b435be3a9422d330e55b7d89d0381e90940157b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577432, "uuid": "25492b55-18bf-4615-9622-cb539b44f5c6", "value": "T1B5C36B72CC252EA8C126E874B0788FBE1F639490558B5EBF2867C3714053D8DF91ABB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577432, "uuid": "d9e421a8-0206-4394-9510-13aecb509ceb", "value": "1536:p25c+IVYeuJyXFO5MUYawBCeUKe49JGkvV5DfPWdKIhqCAbym:p25cTVPuJyXErYaAzekvVVPWoIhmem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577432, "uuid": "192d546a-591f-49c4-a10f-43cfc6a6b893", "value": 129668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577432, "uuid": "cec440c1-eeed-4ec0-8007-aaf69efee9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577432, "uuid": "c2c540f9-143a-4edc-83bb-efd3079ddc6a", "value": "daredevil.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bf4ad5-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585679, "uuid": "7bf7307e-a1e6-44ee-adba-68d4f696fad9", "comment": "Malware payload", "value": "bba76f16dbb167a6d434b6617fa94683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585679, "uuid": "78c88c97-b879-4df0-845c-375db4183042", "comment": "Malware payload", "value": "89f87c3a7c6aaa5c2d9c9bfee5aa08cee02072776631d39be4b9f0207dcb3e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585679, "uuid": "90379cfc-6762-486f-8235-18019b1ab486", "comment": "Malware payload", "value": "2638d382933b574ec77bf3e899db6988b5300126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585679, "uuid": "b901eca0-3cb5-4513-8285-8f169bd1708e", "comment": "Malware payload", "value": "264b380e65b7eb732b30c3ced3f40a259f1e040f21108b25654c91ae3633c559717b508c36235cc741fd353950716eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585679, "uuid": "ff0bd7d6-441f-4249-9d17-4affd0463667", "value": "T14FD30A03ED816EF7C45EDD70852DC24A15DA5CBA92E9922F71F8C98CBBBD20546D38C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585679, "uuid": "81edbb7f-45a0-4e83-9d40-b984c0c70c14", "value": "1536:F7VYdcBu0hiPij2DFmXvSwE5sn33w09rxowsWwgpFDVCK7iGsEre:F7YcBuXPy2Zh5s33wgsWwgHoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585679, "uuid": "130d4bfb-5a3f-4219-a2ec-668cc96ca69d", "value": 140252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585679, "uuid": "248db587-b793-469e-9b88-f9e262f32b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585679, "uuid": "48925bf0-026c-480e-9dce-3beeaca54307", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb8484b-9f51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787530619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530619, "uuid": "442e7e31-805e-450c-952b-d1fee2c028d9", "comment": "Malware payload (Mirai)", "value": "8467c01db0c4e30bb9af3639ede48e81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530619, "uuid": "7e4f33bc-50ab-4601-8981-f38e2a26d04f", "comment": "Malware payload (Mirai)", "value": "8a640912022d829a62612042935a6ba20f13e0b95a535cb4866ae0b091c62d51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530619, "uuid": "c290c27c-547d-4729-b12b-24406601a53c", "comment": "Malware payload (Mirai)", "value": "18d0f7a0706271679c2f68b8b2a6bd25a2e3e01b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530619, "uuid": "2fefdab3-31b0-459e-b1a7-95a6ee129f57", "comment": "Malware payload (Mirai)", "value": "a78e37a5e0a7b6042a7d1d9deeed2846978a90ae244470728fcfb6f52b00dd4e83c696d77bd49a7f21ae910bcad55b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530619, "uuid": "04d0b88b-536d-4f4b-80f6-983ef50da4f8", "value": "T1C5B3E085B210AE56C02672FCB1870A80D3B16D7B4B9A150B44B3F5B46DBCCD47E1AEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530619, "uuid": "1ca38d05-e1c8-49ca-bc9b-32f921ec8b0a", "value": "3072:15Apzl9NOvXoVLAE375lhYy5SkOXNwu/:sevXCLr59hmNwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787530619, "uuid": "eb5f39fb-b73b-4df3-acbc-58a8f357a58b", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787530619, "uuid": "600e6164-3c76-4919-a248-a2e80bb9fcaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530619, "uuid": "2f5cb64d-9f64-46ca-8c97-83fd3ea898d6", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b0481e-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584833, "uuid": "939c94be-6b4d-4cf3-b8d2-63a819d8b2ad", "comment": "Malware payload (Mirai)", "value": "60f9effabcc1878d60f1cf28c410804b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584833, "uuid": "8b42ae57-0b7c-4fa2-af18-e7428d61400f", "comment": "Malware payload (Mirai)", "value": "8a8ec0af1638935637d17fdfc0d3ac48ab2cd59dbb385e24afc7e32e0fc49b0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584833, "uuid": "cf3c9604-63cb-4532-b406-7864b4af4c59", "comment": "Malware payload (Mirai)", "value": "3a62293eb83185f03fcbb90edc626c69a08add19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584833, "uuid": "a7f272e5-b6c3-431b-ba74-474e1c169991", "comment": "Malware payload (Mirai)", "value": "c370bdd05170ed289accb4b04e85e9a15ba4daf45e919afbe9a838b22c7da5b5e96b2e9f6cd8f0dcc512ab2de38bdcfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584833, "uuid": "198f553b-06ad-49b0-9830-46cc4e7e9a5c", "value": "T198D3121DFC7087BCF2725AB07B136A364033CB6E9EBA0F775A6457B85982495CD108AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584833, "uuid": "1bf03f73-d86b-48e9-bd2d-1e95a829aeb1", "value": "3072:8HawOSO2uMoKGNZcIGHtWZBfRENBxmls86IKEgy0RomNz0P:8qnVMothGODE4+2sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584833, "uuid": "99c23283-2a7f-47d6-bb2f-d095926ecce9", "value": 140004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584833, "uuid": "a4c62339-ef0b-4265-8f6e-45188211773d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584833, "uuid": "b297c991-13c2-4be6-b1a0-50bff344773c", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa895f0-9f60-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537241, "uuid": "664399f1-e373-44c7-87b9-b79fba7846a7", "comment": "Malware payload (Mirai)", "value": "a8e2163feb03080de683782beb6678d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537241, "uuid": "58859d48-bace-4f5a-86a3-78fa88884cfc", "comment": "Malware payload (Mirai)", "value": "8b37a21a6605af22f379b00103154532761f82d321980db441aa6ee88de5e529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537241, "uuid": "653afa7d-0ae6-49ae-934d-c0087a50c43d", "comment": "Malware payload (Mirai)", "value": "6469850d61c4c6f91b247d4a2644d7790e8087d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537241, "uuid": "7396010f-2de9-420f-9c19-e8bb6e9a9dbb", "comment": "Malware payload (Mirai)", "value": "77d6d5846da88798768f560ce7d99ca2c00250cf917337053cc23c369a311c5b763ecbbcbbae0a15aea0fc86273ca681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537241, "uuid": "21cc43d6-ca20-4261-9b80-640b438bd968", "value": "T1FF144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537241, "uuid": "f6d083d0-72fa-4aaa-a19e-c9ce208b47db", "value": "6144:roArJTah1if9UVcYEEUYDckzjR482pwzihN2B6OTnkm:7rwhsfucYEEUSnR48Bc2gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537241, "uuid": "234154e3-3440-42c9-9293-0c72596afc85", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537241, "uuid": "3d520c82-c1dd-48c1-82ab-6d80b0bda8d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537241, "uuid": "dbad5366-dae7-4c82-8ca0-69179dca317d", "value": "4bb8b380fa4377b7baddc6fee6ed312e2e3c1489825aad487f5b9c3a11919e78.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e8ed7b-9fa1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787564989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564989, "uuid": "fa923eb1-9361-4912-9b22-25220437a71e", "comment": "Malware payload", "value": "4a41f93a6adf437c9c37ae2b07672649", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564989, "uuid": "47d2af67-aff9-43be-8941-791b50097b3c", "comment": "Malware payload", "value": "8c78b18ca8e2c9a62e77fc7d5927fdcb0c1bc9128b131abd3238a9cfac4834ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564989, "uuid": "21c069a0-a21e-426a-8be4-b5a59ba083d7", "comment": "Malware payload", "value": "2565da419a298917d35bb61b587c4fe9baaac622", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564989, "uuid": "63eeec39-0a34-4b3e-8aeb-d544c2e36733", "comment": "Malware payload", "value": "6bbd46cf7a98e9d2626b6c801c0c487230e432edb5dc9e260b28b147ab570e5469a84443ffd747384eb71cebc970ce32", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564989, "uuid": "d8c607df-8d52-4785-973a-16c498b3bfa8", "value": "T13E236C6516857C14AE99C4375C7F2F0CB9AD43E6314492EE7ECE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564989, "uuid": "d0ff9f40-5fd3-46a2-be7b-f0d28dc4a1fa", "value": "768:Er9NyXsZztCM9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:iHusZUcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787564989, "uuid": "8c34c271-b043-4a69-a3eb-5155f7915324", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787564989, "uuid": "cbf71d6c-e0bc-41ad-b63b-a34c01bd94f1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564989, "uuid": "ce055632-5643-4585-a2a9-a3364280a561", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df695809-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585058, "uuid": "1e8181b4-bd3e-4530-b8fc-8c5292a76059", "comment": "Malware payload (Mirai)", "value": "41f143f1311c24e59c9a00dc74cf7743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585058, "uuid": "916d6262-b113-4b4a-8bb7-a2120e34c038", "comment": "Malware payload (Mirai)", "value": "8c96aa076d106444fdf6cda734598cfd294d7d0cc70463e6b5aa8573a85d5ec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585058, "uuid": "ddf24383-0811-4626-82d4-9445366af981", "comment": "Malware payload (Mirai)", "value": "c2218ec09e570408fc088cebe82f9a138ecca029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585058, "uuid": "c0e93500-a2d0-478c-9b16-d3c0692a6af1", "comment": "Malware payload (Mirai)", "value": "b1b9068b7da5506edf8f12dd9f242d135618c7f04a8adfe3fa8ae4291d60ac456a460ecc5dc7d93e54fefcf9a82e5253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585058, "uuid": "66ad6088-ec92-48ac-b94e-cb529e2100e4", "value": "T10F144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585058, "uuid": "5736e679-c830-4c14-ad64-c724270570b0", "value": "6144:roAr/Tah1if9UVcYEEUYDckzjR482pwzihN2B6OTnkm:7rGhsfucYEEUSnR48Bc2gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585058, "uuid": "32ae9970-5864-4fc1-9d0a-65079d4b9dc1", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585058, "uuid": "c380ce22-3bb5-4715-91a7-9ffd4f2ff95d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585058, "uuid": "308a2348-6892-4aad-93fd-88dc813c5b9c", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf566bed-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576843, "uuid": "a73e1807-547e-4ac8-bb54-710c620884d3", "comment": "Malware payload", "value": "8ac48af3a263bdbbb5cae5b31610f027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576843, "uuid": "49e2d8b0-2fe7-40ad-acd0-51e655c40b25", "comment": "Malware payload", "value": "8db31712e8e011070d03fcf5d7e3083286cc3977d7af2840a7c02230692d1183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576843, "uuid": "a66d4bdf-901e-4fd0-ba5b-ea12ed19b47f", "comment": "Malware payload", "value": "59a37f64fcbf24d7bcd1c2e916dc0dac00686651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576843, "uuid": "71aec222-ac48-4a6e-8c1f-365575b47fd0", "comment": "Malware payload", "value": "61e2da10d494fb1f8b18d8fc203a1c79afbfe9ccdb0f4c38b663598c564c3cd0808dd722110112c30b0c345e029706be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576843, "uuid": "c6eb3f1f-cb06-4aef-8abd-436a00652ea8", "value": "T1E8E2954F6E328FDDF669C7344AF34E30A799238226E1C686D36CD1501E6024E985FBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576843, "uuid": "01fb4adb-cf0a-4081-9a18-c84d19150c50", "value": "768:HFPuV73QkBfPgmj2/S3zLMiXoQ0eTK3yPn2:HVuVd8SDLLYIBn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576843, "uuid": "d74769a5-24dc-42e8-9a1c-4f039f421734", "value": 31724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576843, "uuid": "98f23923-1309-4b68-86ff-d9890f785ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576843, "uuid": "35374aaa-0a3d-45d3-9126-87e47d35bb12", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f8757d-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787578032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578032, "uuid": "fca5b999-3ce9-4b26-b247-3692afae7518", "comment": "Malware payload (Mirai)", "value": "8c3c5f11daef4e93358f02ba7220caea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578032, "uuid": "37a45356-c814-4218-9280-135e6ee3e564", "comment": "Malware payload (Mirai)", "value": "8dbfb51d784d840bfd4895610e203655b23a0d53ebfea2d8fc18025870c18551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578032, "uuid": "36b47b0d-e9e3-4a7c-a939-f6eb0f33b6a1", "comment": "Malware payload (Mirai)", "value": "743a3e61a0a507833c787b17cc5ef4555b55385b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578032, "uuid": "0441fb8f-0eef-4421-aa26-b0c0598161d9", "comment": "Malware payload (Mirai)", "value": "e71213c23951f0b956962dc81dfd1c8d7157516de205908acf703a69da75b07aaedcf3a9223805c8461789bd7099e515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578032, "uuid": "77e28e9a-884a-40c7-94dc-fb599a9b72a7", "value": "T1E733F1730AEFE671D68994B68D1145CEF02A884773C31B8701BD5EF918F78669AB0F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578032, "uuid": "5a90f98f-849b-4592-9d01-368e37d39757", "value": "768:ITwx6MTEcesecq9o/DN2QK2coGCxlDdqlm8ATdYMDC52B6cdNeiYDzXurp5l8Yh0:IWfO96goGCf5WApY2BVdNvmad5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578032, "uuid": "b7b5d60e-5775-4630-8ebb-27225a225fb6", "value": 54524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578032, "uuid": "572211dd-25a2-4b15-a0e7-0c7c933b9cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578032, "uuid": "02041671-24de-41e5-9a6e-b6396380b829", "value": "daredevil.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6c19a9-9f5e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536363, "uuid": "1a80d85f-834e-4484-9581-f75159a01cf1", "comment": "Malware payload (Mirai)", "value": "77d527197667f9ebffcaab86b23764a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536363, "uuid": "24d5c263-6dfe-4b59-bf52-231de2c462bb", "comment": "Malware payload (Mirai)", "value": "8e43add0886d834e856cdbda15be486bfbb368359d21cf8d3550bc854978878a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536363, "uuid": "b8a53a7d-e610-4377-90da-30285ac4defd", "comment": "Malware payload (Mirai)", "value": "7e4afb1e224c1dfee05a9cc3133ba3560c62fb71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536363, "uuid": "022cc300-fbba-4241-85cc-354aa106aec2", "comment": "Malware payload (Mirai)", "value": "6b688459b2aee81276594224e3f9b307d302bec0002c94eae95538fb2fd963e76531dfed88b85d3dd5621e8df02ba12b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536363, "uuid": "0a50c700-1d14-4d5b-8027-3467d4db5434", "value": "T183B31295280F84F2E46BA2795B1C0EC1CB63E6F21890B5437876DEC99C45ED030967FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536363, "uuid": "0ad830f2-004e-423f-b9bb-4815ef328e5a", "value": "3072:BE0Vn0kzmFunZwQRHkZM4cIGnPPCs9b+r/mcyYUCagV1sn:W0Vn0kiFuZKEPlxYTfam1sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536363, "uuid": "dd83e42a-5819-4d8f-80db-beaca457c73d", "value": 117404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536363, "uuid": "e28d2aa8-a0ae-48ea-8802-88aa8e7413a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536363, "uuid": "87691ea1-f9a4-4841-8c4c-3e8a4563ad60", "value": "8e43add0886d834e856cdbda15be486bfbb368359d21cf8d3550bc854978878a.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f093bc-9f68-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787540458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540458, "uuid": "ecfc865b-684f-4f7d-9998-df2dc6592a58", "comment": "Malware payload", "value": "bdebeab7f553f2b70d71232d2956c147", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540458, "uuid": "14a89c1d-2f1c-4729-82d5-05d6ae49e30a", "comment": "Malware payload", "value": "8ea1f58124ea4b58cc7334381c4c01ae851cf844de33761a1ac79c64a24c4690", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540458, "uuid": "de6996e0-0820-4279-924c-ec98678ddb6d", "comment": "Malware payload", "value": "4660f9fd23e452813c084625f244f045ce2ee452", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540458, "uuid": "862690f2-1bf8-41fd-bfc5-0d396dcb2e6a", "comment": "Malware payload", "value": "d163490e11d8b352673afb5e1e767f3d46c872c27c5c0a3807003110e2e2944230a928c2f1b414b99216c8047095d9ff", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540458, "uuid": "8cf0a2e8-2bc0-41af-b929-cec03a4a19a8", "value": "T154A1F936778670399BE511EAA07BAB2CB53E9214340B4063D7ADFCD23C60A5A4097F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540458, "uuid": "3dc595a1-5514-4a6e-9e1a-710084d2994f", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZqciqepKED7B6YI:IVJYtoA1ffqzr/Jcs0Bbqkego7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787540458, "uuid": "e33b92b9-40b3-48d0-a2b6-10b2579fc577", "value": 4687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787540458, "uuid": "82e3df39-bd6b-4679-95ea-c0727188ecf2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540458, "uuid": "8fe7cabf-bcd2-4062-b485-dc019d4f7a73", "value": "4pi3llms81.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e0bd35-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787574818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574818, "uuid": "2d220450-e8b2-4503-985b-fb58ee9e9f73", "comment": "Malware payload", "value": "72235834e3cb7e468edb8252d5ed634b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574818, "uuid": "2a47bbe4-f93e-49c3-85f7-27c01344300a", "comment": "Malware payload", "value": "909332d884fb5233ead6b7a574251fefcd12a98491562f267275359967bb72f3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574818, "uuid": "f7b6ebb8-62bc-4bed-ac00-c07c833601b5", "comment": "Malware payload", "value": "e17fcc6afb9245a2558650fc5610d857dcbe3e34", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574818, "uuid": "ff9ce4a5-4303-4bd3-b414-5eaddc88e03a", "comment": "Malware payload", "value": "a888fd8217df861a8d33ec716302bcca8c13f58b5896ff4e8ec8b667dbc2db662cd9e3a378e3c01c94838b3bc51966a3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574818, "uuid": "b5e27bc6-1799-430f-84f4-a4c5ae0efd17", "value": "T1D556DF47F784992EC0F7A37105791332160B4C26CB539A87B95C727C3AB7AE41E8A6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574818, "uuid": "29e7f6a0-b1cc-4bf8-8bb6-8cc2d85edd0c", "value": "98304:s4NCQrudiw4ULDD8bJunxQbQyYU8n3pyn0o3wsjmuwcdnmy/RtCXaHM5Bo:lwQrud1RDgexQbQT3py0o3wsznmyuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574818, "uuid": "c57a313c-219d-4541-a99f-21391903b73a", "value": 6072924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574818, "uuid": "0f67a376-8b0e-4d2a-9698-84d7e031f83d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574818, "uuid": "9b2434b4-0972-45ec-a080-e2278e6f68f2", "value": "V6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc34d7fc-9f97-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787560974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560974, "uuid": "500c27b7-772b-4c84-b667-743f5cbb35a4", "comment": "Malware payload (Mirai)", "value": "73510a43917288056b18c30c726c58b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560974, "uuid": "745acde8-06e4-443b-884e-4180ccb030f4", "comment": "Malware payload (Mirai)", "value": "91586ada5fde2c340ff9790f9a3804843a2e501c252f06cf4e11156bf3095268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560974, "uuid": "22fd2470-0ecf-4ff2-a912-b15b7818e3a5", "comment": "Malware payload (Mirai)", "value": "2f51444c8aafe96681622bc193ed0a04495cb704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560974, "uuid": "57539411-7a3f-48d2-8627-5cda102e49f1", "comment": "Malware payload (Mirai)", "value": "cdc2554c9b0a4ca4882958f55f441ebbcef00a0a2d7d70e1139d881b4a01b3b9e07462e336a20905cfe588383403d451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560974, "uuid": "3b1c06c6-3d51-43e1-8de8-2b71e105b0a4", "value": "T1A0836BC0E243D8F5EA5704785136F33BAB37F53A012ED697D769A932AC72500E5263AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560974, "uuid": "81094d0e-5e18-4522-a433-7f3f31132eb5", "value": "1536:zxhDW6hnZhVMQ7fVRSY9m59BFMla57zua6Nt39GpGTvvI1Nqp436zcZF77MUue:zxhD1NZX3DVRSB5ilE7ChNt39GYTvvIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787560974, "uuid": "9db88122-a558-45f1-993b-7ab2a16992f3", "value": 84180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787560974, "uuid": "d87023b1-6bed-4635-8c5b-bc78c6fb3082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560974, "uuid": "be95ec2c-ae27-4be1-a96f-fadc33b30d2c", "value": "qtm.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb0ba33-9fae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787570878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570878, "uuid": "6d86fd10-84b4-4482-827b-9639dfc7aca9", "comment": "Malware payload (Mirai)", "value": "86d12f2e5514a733661545f54b9ca592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570878, "uuid": "ad24b6d9-dc27-4868-8ea4-972b789267f6", "comment": "Malware payload (Mirai)", "value": "939a999e03e1f80f3eb8e4e04b93c42339261e463e16582c2cccda1a28b57a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570878, "uuid": "e454ed96-2240-4313-97d7-cf74a8c76b79", "comment": "Malware payload (Mirai)", "value": "84d10b8d93e98109ae35463c39031e012bf771fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570878, "uuid": "1f4c7b62-72d9-4e04-8756-9a89fc4527c5", "comment": "Malware payload (Mirai)", "value": "4ec06a844ae381f7c147e10920a042b70afb85eb8a8601497e404cc953d4e085bb4fdf024c4cf87108961ef00549c779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570878, "uuid": "e2f19c11-1580-421c-ace1-7b6e4a2d847d", "value": "T106543A43AE455ADBF81FCDB0897DC3D22DE1A0CB51E1A93A65BC89CC7F6B10A05D3498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570878, "uuid": "1614338b-47ba-4ee1-949d-c06421f494ef", "value": "6144:3mOTHZ4dk8JfLRYPhSxnhWLWDwu98c5Oq:3Kd9jnesv8QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787570878, "uuid": "6fea3ea7-27e8-455c-be49-379063f8d0ff", "value": 283728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787570878, "uuid": "66a11988-c87e-400a-906e-9def62d26c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570878, "uuid": "f89ad097-c895-4fbe-80e6-f0ad2d759185", "value": "kushnet.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57049291-9fb7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787574521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574521, "uuid": "797b399a-7125-48d0-b9fa-c88422540ee9", "comment": "Malware payload (RemusStealer)", "value": "5d4ecde643ebcda6840262c1c6847b82", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574521, "uuid": "5eea4b2a-119a-48b7-bd75-403f2e96743a", "comment": "Malware payload (RemusStealer)", "value": "93b3b14f5406c44950b843be7008ee50cd73eb4aefd8b15762f88f7d07701b76", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574521, "uuid": "cfd2e2ae-7f6e-4258-939e-6eca964895a3", "comment": "Malware payload (RemusStealer)", "value": "70eddb5cf2cecb2a2663927ada82ed89cf5edaad", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574521, "uuid": "25012567-9f72-4d95-a980-da5483fe5b02", "comment": "Malware payload (RemusStealer)", "value": "38132d9e3e996768bde985f63413ed158321bc16cf95bf015a84e7abd24a174762d341baa8f456b8404dd0c22b8ef12a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574521, "uuid": "b65603b2-001a-481c-a963-8f3e65a9b2a2", "value": "T19965F025F4543A22EC4CC6F009B02DA803E57D7A132B97C8227635AFA767F7C9E64935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574521, "uuid": "12b9cfcf-c50b-488e-b0ed-6630e0051055", "value": "24576:BHcLlHwSofZFY+gHUgZC4jQT757Aj1Cf2qewXedmkzvg6hMpz:BHc18f7YbHTcxAj1COZ8kUqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574521, "uuid": "67d85d6d-015a-40e0-a82b-5da1a398b9bc", "value": 1437076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574521, "uuid": "75948cd7-6b92-4549-86b3-e2b063df3a7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574521, "uuid": "ae222618-3061-4bb1-b3ae-f5b1a82f1a3e", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f027e7-9f62-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787538171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538171, "uuid": "51dec091-bd79-4b61-bef1-b8043ab23556", "comment": "Malware payload", "value": "e46a8764c57e563f8a22c0c74ca6325c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538171, "uuid": "79659275-bd63-4ded-91bd-f1f129223b75", "comment": "Malware payload", "value": "94085218124980d6cbc38b0829d34c5d74744c41482ff17aab7007e5a42d05e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538171, "uuid": "1872dd71-6772-4ca6-8f90-d10a25c68cdc", "comment": "Malware payload", "value": "2c3d98189680c7cc0e246ce171160d9d235df2b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787538171, "uuid": "779ce078-9107-440a-937b-af8b131f7d2d", "comment": "Malware payload", "value": "68b3773baedd20d27eb51eb538894b7dc42184055695862f0d44748856c99d0a58d71238e6a615f48f12427aa342d1e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538171, "uuid": "29f2240a-347c-404d-9d03-85db972a7c71", "value": "T1D93170DB09102A301142DA8E33B63148B68EB1FB295FC7D49D594DEE92897CDF261F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538171, "uuid": "350270b0-b980-4723-8698-66df17d6870e", "value": "12:UNu6N+DqMM6zwDNNi6N8hicbFM6FbWRLvpX6pJAsHPcbsDQH2Gi6QH2Ga8zetK67:N+P8hDcLJAy2GE2Ga8QKdqGocrPdWXH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787538171, "uuid": "e4f09ca8-34e8-4651-84a7-d2b7cd09b1a2", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787538171, "uuid": "b9673ce1-28b9-4979-b3ea-801e0689eadf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787538171, "uuid": "6fff7d3c-474f-4da6-99bf-cc8b4ad135b0", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5c2a4f-9f67-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1787540063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540063, "uuid": "7c96ec4a-f2be-42ad-a439-299ea80254f9", "comment": "Malware payload (AgentTesla)", "value": "1b083757f85325a703a63917103cc36c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540063, "uuid": "951aa68a-1602-46a2-b1ac-387bb78dc3e0", "comment": "Malware payload (AgentTesla)", "value": "941ad06660c3a0da851a946455178407ae0725ef88f6b6a91f4fdc7c666cebec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540063, "uuid": "f2c6a54d-fb12-4163-b504-d4257a68b9ee", "comment": "Malware payload (AgentTesla)", "value": "985f29c294b91469250feaeede53e4f4ec4d846d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787540063, "uuid": "52e3ac4a-b195-4a28-8628-ee10eaa5fbd8", "comment": "Malware payload (AgentTesla)", "value": "5e41b4c2d1f1a70e909c7bf9b4e0336bfd2a031209bfc0eb6619076c0850fe32c14ab21a1977f662b01666de07e5e6bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540063, "uuid": "f6ec1938-f403-4b48-811d-5deeb4645f32", "value": "T12542C048527F760FE061F889B48FE664269DD0F4FA958390AF35A600B910594AF437FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540063, "uuid": "5566c91d-73df-40e2-a216-ca6a531b6890", "value": "384:c9UmM+TsblVPPM6D2wOKCyoF03CE037YNe4CRM+:c9A+Elp06uKMA037Y3CRM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787540063, "uuid": "423373aa-ba5d-4633-ab8a-034985e515f0", "value": 12424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787540063, "uuid": "33043478-ff11-460b-921e-a9fc1a3fafc7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787540063, "uuid": "14d9bf48-0043-46ba-96c1-5f43999d0cea", "value": "POAOSMACCN26081501.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08535a7c-9fd0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585126, "uuid": "ae7b0f9e-4185-4d7f-962f-6eb41ff38647", "comment": "Malware payload", "value": "e741267b205ed03e1b9f4d882edd3783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585126, "uuid": "b68b42e2-238e-435a-ac59-e0c01671d820", "comment": "Malware payload", "value": "9495f36a13f71bd3c42c2b757a14d8a4d80dc50b74309f1ce8a81c703322e000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585126, "uuid": "6e112a98-3567-4a7f-a762-8e37e94e9c4a", "comment": "Malware payload", "value": "cf6ff1abfe9847a46b36564ec36cb5c6eb37f8c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585126, "uuid": "76a561b0-e462-45bb-85b1-0532e10728f7", "comment": "Malware payload", "value": "2a4bb389f0d72c4b7dbd2727f97618887518fe4d1fadc2c3b3571ba1598a6ffd049697e244955c3ce78475813a2b6f58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585126, "uuid": "74d9fdc8-95d1-4cb5-bd82-ddaf9395f9e4", "value": "T162531A98F840DA35CFD075BAF61D02DD73130FA8E2DA71158E219A353BEB9194E3B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585126, "uuid": "10e82fc9-3c1d-479a-a826-fa82057107a9", "value": "1536:w1wgCkczlNmozb/r6NPoaM3IpXHO93C2QGzIxp+yEL44FJ0r:wGUGOHO93C2QrpZCF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585126, "uuid": "07eb961a-b2f9-49f5-a162-fa1b4c9848ff", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585126, "uuid": "46ea823e-1c74-4ae5-8cab-fa4b8f4d16b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585126, "uuid": "2df0a1a2-9f91-471b-80ff-4859d489f511", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9939732b-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543708, "uuid": "989c8af5-cced-4b88-8631-e3f56de2b734", "comment": "Malware payload (Mirai)", "value": "531c0deac93b2aec0fd7212181281b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543708, "uuid": "3652fce1-de8d-42ae-b999-3180bbf74c9d", "comment": "Malware payload (Mirai)", "value": "95871105a8ca339c39ede4b2da1e2d30989b5a91395b808ba81f3cf9f7ed0b14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543708, "uuid": "36bbf98a-c293-4c16-ba47-b5114ced4728", "comment": "Malware payload (Mirai)", "value": "e60884465478ec7abfe803f992180977e4233311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543708, "uuid": "a87270f0-cedc-47af-ba0e-dc45100cfde0", "comment": "Malware payload (Mirai)", "value": "58f46a73e0dbe728d7e73f04a76a52009644538ca0b72f8a17964cdea9aeb7864214748e18e603d274950cf4a70fe390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543708, "uuid": "bb1fbbf8-0f4d-49e6-959d-30c27b5ad79b", "value": "T190C3A50F7E218F6DF35982714BF74E3496893B962AE18546E27CE9101F602CE641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543708, "uuid": "5a27a0b1-a64f-4ccc-82af-d3a6d1bf04e3", "value": "3072:FsTHFbgNnCJecNO7kbPE69LxdtD2AheZCWDI:Fo3tDVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543708, "uuid": "35fc7d19-2d01-4989-8267-9714e10c581b", "value": 129588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543708, "uuid": "d0758151-afb5-4856-96f7-a2b406d9eba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543708, "uuid": "3f4a922f-bafd-4e21-b872-0d7a3307e357", "value": "raul.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c340a925-9fc7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787581574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581574, "uuid": "1e190e61-f66d-45ed-af9b-c6e8430ca891", "comment": "Malware payload (Mirai)", "value": "035c2e1e3046c87ca2f3e824897592ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581574, "uuid": "99a1d14e-c0c9-4d0b-bdea-7389eb9ec612", "comment": "Malware payload (Mirai)", "value": "95f5156abcddb7fba0f4adb0915769fbad23256ac6344c791f10fdf08a1057ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581574, "uuid": "76532978-5910-4b78-96b2-65c7db915db1", "comment": "Malware payload (Mirai)", "value": "bbbf913790b9e60001c2211811e493c95e1a532a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581574, "uuid": "6e2abcc4-9d88-4bcd-81e2-a94055d55d4b", "comment": "Malware payload (Mirai)", "value": "3d9e9a69cc93c9c7ecf92161d8f4f1d02d96676b39f7b100114bc0aa881a3fab5874882407f071a20292b929bbdc43c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581574, "uuid": "9b25eed0-c5da-44ee-ad08-0d4e425625c2", "value": "T1CB43F2994B281CE8E1B645BA1F714F5A2FB20DB0E1F0EC42F5A3D99BD5820B0346759F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581574, "uuid": "542e8ade-7739-4c45-bc38-2e8ae2291438", "value": "768:DkF5caqiQWpLSgKpmMFW68ewv4BRIlpDRZCDOI2N78eojN8KHSlRAw3rcJgGlzDt:DkrzxltmB8eM4BRspdwDyNweKjwAVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581574, "uuid": "e10be84d-9204-4115-a706-941017d2ba48", "value": 55648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581574, "uuid": "deb7c5f9-7b1b-4841-89d0-23fd316d3c76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581574, "uuid": "2f77722f-478b-4ae4-b522-92a8dd4019a7", "value": "daredevil.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c5b557-9f7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1787548214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787548214, "uuid": "fc5255eb-875b-484f-83a7-e993a40559f6", "comment": "Malware payload (ValleyRAT)", "value": "994961e91e77bcf700ea2e355bacf983", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787548214, "uuid": "2338246c-0e46-45d8-885c-1a5b960a8c4a", "comment": "Malware payload (ValleyRAT)", "value": "97b2010e1866b7af4757962833bfb30e16ce03685591d4339b6c9eacb2cae281", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787548214, "uuid": "230b620f-511e-429f-ad23-a65a22cfeacf", "comment": "Malware payload (ValleyRAT)", "value": "4f6f82cdf8a0465462fcda4823aa186b1f278ac9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787548214, "uuid": "557f73d5-9e35-4318-89f6-2f2246b6021c", "comment": "Malware payload (ValleyRAT)", "value": "2211ce3c16b7fc38726183f0b12bf696fe9923899d8f264fa0ccd313017bfbe6c5880da8fc0dbe021495d9399ff5fd09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787548214, "uuid": "d3b9c979-0c17-4342-8f90-7e01fda36baa", "value": "T1B6847E11B5818131E9AE0934B835DBA75A7DB8710BE0D4DFA3C44DAE9E207D1EB3871B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787548214, "uuid": "9456bcb3-f796-4863-ae41-fa4655b7a84a", "value": "ed719d06b435e943e2137e8d090ae910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787548214, "uuid": "966636bc-5271-450f-8b86-7f815931487e", "value": "6144:2cZZ+x7m+cWCDq7ZNIFTRhUE1Tk6++a3/z3mDAa/SnkuVNyEAYEQHQpo:vQc8nIFTRp1TkhhGWVk0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787548214, "uuid": "f6b6798f-218d-4d7d-ad20-4870c6e889cf", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787548214, "uuid": "ebcd467f-df14-4bf0-9f8d-6d7e658250a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787548214, "uuid": "54ec9f3d-539b-45f4-b93d-991161509dac", "value": "994961E91E77BCF700EA2E355BACF983.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89746e92-9fdd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787590926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590926, "uuid": "a2c7b3a0-2827-42a8-a8e5-3de2b3dd3aab", "comment": "Malware payload", "value": "822d9758adbd2401eb16b7c0f13acfc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590926, "uuid": "15792f51-e632-4ac1-8170-4909941be351", "comment": "Malware payload", "value": "97f5bd9347bb579899de04cd24947af7ea65f9c69fa91cf24435e71205c76a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590926, "uuid": "46731919-ab93-4d65-a7f6-761bbe195650", "comment": "Malware payload", "value": "337f3655e80e1071bdcb9985e8838cca39f3c280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590926, "uuid": "2b717648-b593-40dd-bca5-11b0a43082c3", "comment": "Malware payload", "value": "6fc2f60dbfca05580fa7a389a72bfa249c1bb89c3e904737b081b62f2b5d90f851cc375a3703b97e54c59250105eb15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590926, "uuid": "6c44b65b-33d4-4dc9-a121-43f96d8ba67b", "value": "T187D52394B8F614B4D432CBB28FD3E56DB06A7799CBA04DA77BCD69000C53994AC3A371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590926, "uuid": "184e073b-ebde-4f6e-84b5-7e92855c9532", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590926, "uuid": "d0ee6db3-e2bb-4e1e-ab50-458e2f27650a", "value": "49152:4DXHyo3M7/KHRDOWcxlFfRin12KXQZpcnUiqA7ZnFjhSo95lpea6p:iio3MTUB0Rc15Upg7ZnFjh95Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787590926, "uuid": "2cf9e22f-813c-4c5d-94cb-0827a6e6df06", "value": 2953216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787590926, "uuid": "ea464888-ef77-410b-b190-a15505ea6416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590926, "uuid": "534b9a64-bc26-4a93-9721-adf48b0aede1", "value": "97f5bd9347bb579899de04cd24947af7ea65f9c69fa91cf24435e71205c76a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8911e3c2-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543681, "uuid": "3c472af2-d98e-43c6-8d4d-21cf21d3b285", "comment": "Malware payload", "value": "9687d2fcb154a8abfee8180bb3f22471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543681, "uuid": "1c0d14d9-7aff-4b1a-afb6-429f5e7d1ddb", "comment": "Malware payload", "value": "98e8621d5c2822da0ccae779f5025f56ea690e955d55ae9af7c8cad9a2658599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543681, "uuid": "6c3ba472-4678-4c22-aa5d-51ab1e5453a1", "comment": "Malware payload", "value": "804f984228333ca6192547b523f69b706ec14785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543681, "uuid": "b7764d1b-0598-4737-84fa-c3ac784e7fab", "comment": "Malware payload", "value": "b053c0ef29032a4afaf91bd6846f52804c9897e48b0161c8a5393bc6967f5e1d6012064b121320d3947c41ea104838fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543681, "uuid": "6f93df31-1bf4-49e3-a5b8-1a6a9df3a86a", "value": "T14C934B02BB194F43D0971DF01B7F1BF087A5BEA158B5D588751AFE8943B09F2A017E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543681, "uuid": "2bc8b38c-8485-4b92-aaa0-5a34928ec47d", "value": "1536:59kDIPJCZGv+tDM7pYZgmqpoJljzKVqjJdGPbsrOY:59kDIhCk2M7AgRAlygdGorV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543681, "uuid": "f12bcfc0-9c3e-4728-aae8-b9e8e4fe1603", "value": 96884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543681, "uuid": "6a8cd796-9a1e-429e-b338-753a1a536d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543681, "uuid": "3e644e9c-38cd-4520-8a69-0fddf6a7b4db", "value": "raul.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c20c54-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787574821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574821, "uuid": "7c1b325e-bf61-4ad6-af88-5027c3a7b571", "comment": "Malware payload", "value": "3226c33fe9d259612936442773abfce4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574821, "uuid": "241fc60a-2c7e-4808-b9be-7dec1be32de3", "comment": "Malware payload", "value": "9947cc375f9244b282552e5655f9a685d8b6701918b89e0847916287a388e475", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574821, "uuid": "3b0489de-dc7e-4f84-9134-61aa40233b20", "comment": "Malware payload", "value": "ad17cee875aa6c557deb7215e8192a79b6d07efb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574821, "uuid": "560044ef-79c1-4b5f-980b-3dff6dd42c3c", "comment": "Malware payload", "value": "64f6bf51ad7d89e3d00ef63f9e9162bcb039ecb3a2f6b7764f2b9c41032097d29211beb635d9cd358755b86ef4babf3a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574821, "uuid": "e78f6117-dd96-4889-b7bb-93a48f4b29ad", "value": "T1B3A523E2B304953BD97BCA37859A236227654D2086933B0B15C0393E7D3738A9F6DEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574821, "uuid": "07c04aae-f106-4d4b-9a21-c07d0f8591c0", "value": "49152:PfaVgCD3lO/f91qEMlSG+2Dm+MAzFo36rn8149y84:aVgC7lO/f9MEMlBUB1Cyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574821, "uuid": "bacfabb6-97b9-428e-b44e-a6e9626e6f46", "value": 2268055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574821, "uuid": "e40af015-eb5b-4e30-b0d4-55af8398109f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574821, "uuid": "47ca6c0e-6922-424d-8f4f-a21571cf5219", "value": "zarin-gold.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a29978-9f9c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787563088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563088, "uuid": "268bdc1e-58fb-4285-b7f4-c2f2d01821f6", "comment": "Malware payload (Vidar)", "value": "4ab288fc3542766da93160e8d6e397eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563088, "uuid": "d43033d2-8a20-44e5-a11e-2ec6ff5c1f4b", "comment": "Malware payload (Vidar)", "value": "9a28edaa4609393576ddf09ad843c6e349ac88510e01f3c92039f88160845270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563088, "uuid": "4d8b1c97-9be2-4fd5-8494-ab0e683416d8", "comment": "Malware payload (Vidar)", "value": "508ed858c5461060449d701def064079db84e566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787563088, "uuid": "62e141e2-1c39-4c05-baaa-52b75cf09afa", "comment": "Malware payload (Vidar)", "value": "73e47525647f09dc5c109f5a53c3d06394b60bc884963ae01ccb9f787a17091ab78404eb93897ab3cd180e2485204973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563088, "uuid": "13640814-46a3-4978-95d9-10b7aaf70b78", "value": "T11AC36C597753E0B2E44D2375623E377DCEB09E353CA0CAAFDF803D0A9E29190525A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563088, "uuid": "a486acfc-e0bc-467f-8330-3895ceae9a07", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563088, "uuid": "f6151101-142f-41f8-a133-0b0838b7a5a6", "value": "3072:FEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf0vX3D:W3h0aMJ+Hw3Pgen79/svH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787563088, "uuid": "c4aac0f8-96a4-4bc4-a7bc-0e06b11a1b9e", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787563088, "uuid": "2fa70482-2156-495c-ba9c-38ac88a853e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787563088, "uuid": "c6ead0cd-82a0-4f08-94ca-2b42c593c127", "value": "9a28edaa4609393576ddf09ad843c6e349ac88510e01f3c92039f88160845270.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b3be6d-9ff9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603099, "uuid": "cdf4c5d4-dc99-4b2e-9ec8-4de126309665", "comment": "Malware payload (Mirai)", "value": "1430d331e5f28684b7cf8214f9abf6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603099, "uuid": "26d6c364-5e78-43fa-8c25-efa69f4d62bd", "comment": "Malware payload (Mirai)", "value": "9a9c5c666ef384460c68200de9badf75910be4dc2101b8eb62448ccd52cf2e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603099, "uuid": "fb20f2b2-818e-4e84-9784-e701c53e98fb", "comment": "Malware payload (Mirai)", "value": "7b62bf03a450639986c9b9c6aa8dce64d2bec4e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603099, "uuid": "0a4dfcba-1ee6-41c2-bf61-4d524a60b5cc", "comment": "Malware payload (Mirai)", "value": "0d19a67dae5509d2358bc3e2cf55e8835fcfa225026507afbe6533478f5308080f11a2c3be93e14d7b0dd69a45bbcf31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603099, "uuid": "dd976a62-ac13-4093-9af8-edd517b3c3f3", "value": "T1CC144B02776D0403D3632DB43B3B13D1939FE4A321A4E604790FAA996FB2D31A696DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603099, "uuid": "ef9b6495-1e21-4c79-8d5a-01d497cfdae9", "value": "3072:sekY2fVanUgtQNRxidVCsneTsSxn0u1EssMZc/T03ImIys61X1h5oxuy:sD1VaUgtQbxEVFneQWndEssMOgh5oxuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603099, "uuid": "fe8dd5b8-f294-47e2-9bce-3a27c7a74168", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603099, "uuid": "55341d73-11f1-4edb-8a4e-749f27e12a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603099, "uuid": "2863313f-6743-46f1-a785-fc04a0428389", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c31cb5d-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543686, "uuid": "e38bf849-9010-47ec-aa0b-968fd923f465", "comment": "Malware payload", "value": "307ca742ea9c1a4c4fe76e8f987d2e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543686, "uuid": "a37bc326-2204-4552-ba32-55ecdaf7483a", "comment": "Malware payload", "value": "9bc1d08072255a5ec2db10fc75df1dd9e73097a75cd9150cfe875ebd6712f17c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543686, "uuid": "1f4d5c4c-4358-4941-8196-61d1cf6b9d15", "comment": "Malware payload", "value": "e06d10f01c83246145c82803a23e8fe62570751f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543686, "uuid": "341e2777-7fe0-4bca-aa36-c36f55ea6c3f", "comment": "Malware payload", "value": "45ccd1381521ecde3ff51235a62b3297c8c250532280a9df0da9120b5336598d9ccecbd3629fdd4805eb1697af27573c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543686, "uuid": "3526e2f8-8957-47ef-828d-8ee53b735c09", "value": "T13874C537F292E17CD18BB1B43ACA8ED3F560B0F00261645B6299453B3E22EA44F5E7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543686, "uuid": "6da17b97-5974-4450-974f-33913b78f866", "value": "6144:b2+pszxplj28ODnXnQvz2ZegCFXlifBr8sZa/T:b2zxn28OzJmXVsZa/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543686, "uuid": "8fe74fb0-fe79-4855-bfa7-8d4cdac1d075", "value": 348856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543686, "uuid": "b15ed7d2-16cb-4af5-84b8-a60f4a554ef2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543686, "uuid": "322891b9-76d5-4b6f-9ebf-10ccbe9cd0cc", "value": "_cffi_backend.cpython-312-x86_64-linux-gnu.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b87976-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787598778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "0346b12e-b8d3-496a-ade8-80989a37360a", "comment": "Malware payload (Mirai)", "value": "75296fbb05aa05c98e386a7c7edd048c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "ecfc80d5-e75d-484d-87b1-6a4d5c4e1525", "comment": "Malware payload (Mirai)", "value": "9bc48e9fbc56e1b9c9643f1221d518b85498be7ced8dd40301194e7a63a1fbb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "ac7e7206-56d3-4170-b7be-90e5ab99289c", "comment": "Malware payload (Mirai)", "value": "ef30b2d6a97478bbb4de9893d84c5ed10aad6835", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598778, "uuid": "18714a31-9f87-4c1a-b76b-7b6768a271bd", "comment": "Malware payload (Mirai)", "value": "353e9f5b2bc34f5b820c89d347c23cf4796dee9cff1208388ec9ccc7c8d74e28aa1f2f5c172fc7f765366826e349990d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "285cce84-65cf-4d0a-9b2c-5ff4d1ef9eaa", "value": "T18492D16F9454A0C4D6614837E6ECDACBA2B60BFDE3F4307517A85A2CF26624023B605F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "6366f90d-cbe4-4655-9b24-29c73237415a", "value": "384:y3CFDQy54M7zLnmZFiPThj6r8CKozfdchYC+Gyx2QSHWOCrjchymdGUop5htm:qCmyqM7zLnmZQLh+IWfdzFG/QPOCHcsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598778, "uuid": "ca479b39-f759-48dc-baa0-99e4bfba640c", "value": 20524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598778, "uuid": "c3c7bd99-b5c9-46df-909e-6345d575b577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598778, "uuid": "5b21b8bc-7ff0-4a81-83fe-ba5a7d4cc5cd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33015749-9fee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787598083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598083, "uuid": "c2934ceb-d79a-4df3-95c3-f98f3f2bb555", "comment": "Malware payload", "value": "d0bf5139aa5276a5e0c232c148302bb3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598083, "uuid": "b34ae1df-6ae5-4599-8f56-6974686426e9", "comment": "Malware payload", "value": "9bd6b5300b97ab253ea6f3377176f5658f9f78bea5d534fdbe71a24ce96831f9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598083, "uuid": "752d56ea-90a8-4722-b20d-50a65115c1dd", "comment": "Malware payload", "value": "87239d0c2b9aa328963ae635608519af23458a5d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598083, "uuid": "9fc38a7e-f071-480c-8bf9-6f9a586eea41", "comment": "Malware payload", "value": "58b98f9d617031433e9e24b1937fb8476a5b763faae2d0dda368f02afbd36e4aa8b5f1fe42a134fd8c356689c677e764", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598083, "uuid": "cd5ca94f-b530-4e26-abb8-675ffebdab9f", "value": "T181554BBCCAA672FA5BEC07821D3126CE4086985721259F7B21CFDF1DEEA5B4C0C93915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598083, "uuid": "3b8a1a7a-d835-4637-9f74-7db986617c07", "value": "768:YShJ6vYSLFJZKrdCPwjrXUdvvODXpISo6rNxMVHbMjTT+hoShGucCzFdLyJ5Pk6K:wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598083, "uuid": "caf55078-ebe6-452a-8709-03fbdf149514", "value": 1298909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598083, "uuid": "d8fd5bee-2453-402d-a779-22d2bd6e521c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598083, "uuid": "35df1fc6-ba20-49c1-b269-aa5e9cf73b82", "value": "z28scan_copy_20260824085.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac37f5d4-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787578100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578100, "uuid": "b894f7ed-23d4-4750-b182-96dd67b9bb91", "comment": "Malware payload (Mirai)", "value": "1e2f0e96e4b936318e51c96d5cc9a88c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578100, "uuid": "517f7e5e-93f6-4ae7-a76c-97ff21a42f96", "comment": "Malware payload (Mirai)", "value": "9c3cda2706df64ffbc82d166c54513e1ae021dca243a49e5e505ee4c8341f90e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578100, "uuid": "474a4d30-a0f6-493a-917c-66565accaa1a", "comment": "Malware payload (Mirai)", "value": "89f4087c78df8d168b340d962c0c49ec178bb5d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578100, "uuid": "e62a72df-8b58-4870-9e4f-43806cdbd14a", "comment": "Malware payload (Mirai)", "value": "7529ab81f8d67b9c9fa61f1d36d8ca5c02c5300c5900c6cea970465dec05cf9aaca13b4f077760368ba86f91849cced9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578100, "uuid": "335300af-7eab-4c25-9bb0-b476d3953424", "value": "T15DE34A0AB8C094FDC499C2744B9EB532DD32B5596138B65F27C46E323E8EE216F5CB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578100, "uuid": "9f573b73-aa83-49f2-b817-c8542570e5d2", "value": "3072:zecGsABNOov7fM2oWFA9D0VFgr9hA+0fy:mJz0oc0ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578100, "uuid": "74aa11e9-3497-40e4-a48b-f5f630448493", "value": 147352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578100, "uuid": "27244373-f261-4b59-b1cb-febb4e1de1d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578100, "uuid": "b823c5bc-7658-4185-a5d3-cecd82d00372", "value": "daredevil.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7a9a08-9fb9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787575548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575548, "uuid": "c6e5c6c2-f217-4d3c-b825-a26acd61574c", "comment": "Malware payload (RemusStealer)", "value": "ede29aad5b1ccb498125ce6de31095b9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575548, "uuid": "aaa89f74-286f-4adc-af17-c1646119b1a7", "comment": "Malware payload (RemusStealer)", "value": "9dba35a99fdb8ece94c944267dbfd1321101c47c650d41f94ecf7f9f283e9db1", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575548, "uuid": "720ed1a9-8dfb-40f0-acb4-4508d323eaca", "comment": "Malware payload (RemusStealer)", "value": "d3ab83d5d8bb5aa42da44eeac60270513299169d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575548, "uuid": "ea762e3b-88e0-4884-86b1-53c1c0a504af", "comment": "Malware payload (RemusStealer)", "value": "9336ba4eae729f5c5f3484a1f130a02f4dd0fe46e7bce1326bee7bff1c0c5411ab8454e3a5beb2a89b0391fd1b699250", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575548, "uuid": "1d21befd-17be-4b3c-baf3-b93026f9a455", "value": "T1EB265B037A5665A4D0C55F35806B0612B734BC99C33573EB2E94EAB02F273C36EB6B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575548, "uuid": "b10312f7-127d-4521-b5e1-94bbd0b3a1a5", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575548, "uuid": "bb6ddc3d-5f68-4f94-b551-8433716e34a0", "value": "49152:bjDppohrn2lVIfahkFkODiu5p74+9eHPoA0HYbmJVb1+XnSgiebDiQwdKD1A:Mrn2mahDuXxesHHV8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575548, "uuid": "aaed8ca2-1de1-4085-9908-f39aef26797c", "value": 4828160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575548, "uuid": "9c01ce05-f0b6-44c5-b975-7b5f50c6e208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575548, "uuid": "39e563bd-49f1-4de2-a828-9bcd8d7041c9", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a02d2b-9fc7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787581317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581317, "uuid": "b4c76546-8dd4-4427-9bc9-5cde799f8dec", "comment": "Malware payload (Mirai)", "value": "99ef6817e5a7ce060512cbaf18452206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581317, "uuid": "469f7aff-a43c-48ed-9707-e3ef2d6eacb4", "comment": "Malware payload (Mirai)", "value": "9ed802164ad6e3782665fbd4e127c056568928988d94e370c6666c052bc2ed93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581317, "uuid": "dbff4ca3-84c6-41f4-bc97-4e92456a689b", "comment": "Malware payload (Mirai)", "value": "3afa607cc06210f4e28b59f61bd81240927396d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581317, "uuid": "7413cb12-eb29-43d9-be84-f0b2a8271381", "comment": "Malware payload (Mirai)", "value": "588321fdcf7e3735cf44aa9c8cf1fe6596e235ff0dcca7b00532d6e2aabe9ddfe1d09f47d6d7dd600406688ed72e332c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581317, "uuid": "1f23da33-c323-422d-b8a5-f736bc8fa2a2", "value": "T1B29308917CF3A156C6C3863FEB4F920A3322619782CD7522FD1D4B642FCA11A87B7991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581317, "uuid": "73e0a744-bd5b-41f8-80eb-c3ddb26e3b91", "value": "1536:+6zvz8oPV7e/f4Doeu2Xy3c31ZpjUwrIFHU1HkFHpdQTu1EssMZcywT03ImIys6o:+yhPV735Xy3c31ZpjUwrIF0FkVP2u1EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581317, "uuid": "6bfdc4fc-d7d8-4537-9d38-733f6dc4e51d", "value": 96624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581317, "uuid": "e141e720-8bb9-4463-b1d3-83de94c01c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581317, "uuid": "77ffc821-b04a-4f36-a60c-bb3559953446", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609461fe-9ffc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787604172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604172, "uuid": "d0b63ba5-ea60-4400-b580-8cb833a969a8", "comment": "Malware payload", "value": "2c027dc77ba6fbc27104f6d185fa45b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604172, "uuid": "179562e1-dc28-4873-815f-18b59acd8b6f", "comment": "Malware payload", "value": "9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604172, "uuid": "ed02c40e-bcff-4d30-b2a8-060dc24ea18b", "comment": "Malware payload", "value": "ba022b75133742449e75284df7180592df98aa3c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787604172, "uuid": "d05af906-140d-4902-ac0d-95639f533ad4", "comment": "Malware payload", "value": "762c55351dd8d6da9bb6d617d548bf3ddb748632dfcbf603461b65bdc36907b36a2e591b39ed25167ac27fdc4bf7dcd1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604172, "uuid": "a528d974-fd46-4616-83e1-bf145034f0e0", "value": "T11B31709E04142A716402C99E7363354C669DE2FB2D9FD7D0EC4E4EA983897CCF1A1F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604172, "uuid": "102f4235-f446-49fa-8fa4-9f6a45f10a80", "value": "12:UBMV76BMJ7vk6H7ZsgUg6KL6KPt8uNt6TAxicn6Iix6Ii29s7X76lBuwM6q1576J:+MVsMJ7ZRpYk29kjUXXXPQkUv7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787604172, "uuid": "41cd2b57-b762-4a03-8a64-ab3f4313abff", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787604172, "uuid": "d663270e-29fa-4549-b103-c42d32adeb3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787604172, "uuid": "5b65ff32-4835-40be-ad7b-af096e62d564", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21cfd60-9fbb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576472, "uuid": "86d7e737-3381-4232-a01e-604f049a07b8", "comment": "Malware payload", "value": "466453f124e2ac3e35d252ac3c23b0e5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576472, "uuid": "dd64f080-e86d-4e1e-8707-a76a634ede8f", "comment": "Malware payload", "value": "9f288a6b4086fb6e09291f2b65f27734307ad6a089539ce6fb049379172cc854", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576472, "uuid": "d80012cf-7a5a-4b68-b0bb-e288dd974eb3", "comment": "Malware payload", "value": "d9a1247eea5187c9268ef37f63a5ab44713cf2b1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576472, "uuid": "63b14e75-f345-4235-960b-eeebe14d1cc3", "comment": "Malware payload", "value": "e89ea038b1854a78c9abfa82ad824e9f411bdda7281c7a7dc500ab685db44ee05b5af33855798ac39b06305aa21a0ab6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576472, "uuid": "1a35fcd7-352d-408c-9cc7-67a1ec3d054e", "value": "T1264506C3EC957608D4E8BC767FDBE501F9F25571A2E0A58F2143A0043E1B8ADD6CAB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576472, "uuid": "eae09ce0-6771-4c87-8f3d-58a53acdaf68", "value": "768:DwQEf/eT1fVqDG/WQWKfak4k1PZi2uS7aBr6dcVuGVLCp2FawPwUfyutTwdA+CE3:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576472, "uuid": "61cb55b0-7b9e-4703-87a4-b3e3d70af1d4", "value": 1210304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576472, "uuid": "bb86a6a3-7a05-4699-b7f8-0a89c87822f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576472, "uuid": "aba1f3d6-a0fc-4113-94ab-020e31a11a20", "value": "z73scan_copy_20260824085.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddc5821-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543689, "uuid": "7d0addaa-c8da-4757-88a4-2303ff2d6261", "comment": "Malware payload", "value": "13b8702742c88c90cd02f9f3b1969cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543689, "uuid": "9201f38b-416f-4aa3-b020-7a4dc525f715", "comment": "Malware payload", "value": "9fdef11e64a74cd402931d7f8834e999825c0e0e91355f0f7b571c9c24588313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543689, "uuid": "196d5bf7-8d41-414c-b34e-639c6b9fcb53", "comment": "Malware payload", "value": "0752547cf8d82b49c7d9e546356efd6e09024294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543689, "uuid": "a5b39e95-8c28-4a67-8de2-d6c7495b1958", "comment": "Malware payload", "value": "8df328d453e67095a3b07344956740778f91a85cb8d31b5e31eb7a2948a7d61b27dfe21adf23774d3111181b88f45192", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543689, "uuid": "64c47da6-0e05-422d-adb5-1b7501ef804a", "value": "T1A4937C23AB954F86E00776F1A1F19D744F33BC2B48671DFAA526EEE90083AC87542375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543689, "uuid": "9c4e3ea4-a659-41c8-a9cf-6101d322ff66", "value": "1536:Bjt6Xzi/qqIiCXtMUhTnrvSTGfGCwacbYmlUnqgtsRTX031TY7shEC98:Bjt66DU7hTnr6TGfGRacbJkqgCR+TasC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543689, "uuid": "7e63e0a5-2381-4840-a2fe-2f5238592916", "value": 95844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543689, "uuid": "865b091c-87e6-40f4-947f-b687f58e3956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543689, "uuid": "a9fd38b6-68f8-46c0-ba79-cd7c4bc08eeb", "value": "raul.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcf8b51-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543558, "uuid": "ed89e041-6711-45aa-b86a-827737d5c45c", "comment": "Malware payload", "value": "780f365fe0efc77e1b8eb2adfe08c0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543558, "uuid": "1d097373-1176-4273-accc-75fbe8f0b1e0", "comment": "Malware payload", "value": "a05c09bb81aae3816a243b6dc7fa16a72a5fb94437d019025b30f6161a23758c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543558, "uuid": "4b316bd1-4051-4b0e-a13f-1ed49221a863", "comment": "Malware payload", "value": "625879751ca4acddf5228b898a5038d2c22436ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543558, "uuid": "eee80133-cbc3-4c8e-a4d1-41adca42d63c", "comment": "Malware payload", "value": "dc4dc3fcfb2e2a3a714e677fade140b74c9c328f81b3b116dafa4c202fff458c3bb843c9aee1c040b2867932cfca741a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543558, "uuid": "00055052-d13a-489a-a96e-ed6c5e16133f", "value": "T1A2D49E23F9A02938DD9EC43043CE45B65776F4250756B5E707A0A6313D62EE3AB3BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543558, "uuid": "ca80c941-ab31-48bd-869e-77740500c838", "value": "12288:eJGHyWs/1eOzeVDz19LMR8BZUp1VdaqNTysWShfjJz:rHyWsUWeV19LMRmmVd/NGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543558, "uuid": "ba4331c4-c092-4ad6-ba41-31d0fae83748", "value": 631768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543558, "uuid": "7509b983-69e5-4a9c-aa66-870a91c55389", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543558, "uuid": "c3b9733f-3c24-497c-9356-27bd80e698d9", "value": "_bcrypt.abi3.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1528a3e0-9fce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584289, "uuid": "b597470b-eb97-405c-88c1-a85f1622ef89", "comment": "Malware payload (Mirai)", "value": "b5469bd7f08ce3b86e2340aa7a9a9b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584289, "uuid": "6099fc87-80ab-4e3c-a6e7-4eb43c5e5d34", "comment": "Malware payload (Mirai)", "value": "a0b75119400607673c69a70f9ced1a9b459b2cec49c3985a9143ebb64c3553dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584289, "uuid": "7b97bd9a-379b-41a9-9e89-454236f0ebfa", "comment": "Malware payload (Mirai)", "value": "6f216c33478362785c86944215eb5ce126cd8c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584289, "uuid": "e1d2882c-9c89-4168-afcb-1a13fd6cb1af", "comment": "Malware payload (Mirai)", "value": "1bd8b62f53b33a1995f71378fb1d2d960998c81231bcbc81011621c1c61c2fc8f82e5e1119c61c7108d8fc6e7d848658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584289, "uuid": "ef53be22-1ff3-4d94-ab3b-889e53481603", "value": "T15F8302A0E05E72DAC9219438D40EC501B9A1E560B7F6F79334885B65EDF12CA1F3E74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584289, "uuid": "cb230a15-a461-4ce1-bbad-61f2f50d3ffe", "value": "1536:0Sb722VO7LBcrtiZcubVMou336LyfjkhFIWbtv72upfZ:0E722VsButiZFUjLkhaWbNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584289, "uuid": "a6ae6bfa-d86a-40fb-81ed-71ca0dcc7a17", "value": 88400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584289, "uuid": "5c01b163-f9eb-4293-8281-6d0b9f039645", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584289, "uuid": "615f7a7f-1c70-4bc0-9284-9f18e37a64fa", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c578afac-9fec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787597469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597469, "uuid": "e3ffde89-cc27-448e-8867-76367100582e", "comment": "Malware payload", "value": "dabee65d0f22b4bf8f10342b72714e20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597469, "uuid": "f92608c3-fcfc-4eb6-8b1d-b08190a3d980", "comment": "Malware payload", "value": "a10cfa5f8b511c281adebc60c0c34b62f37dd589c4cb136ca578d82c0067a9d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597469, "uuid": "4dc33e6e-caff-4780-b2e5-c80a6d3b4631", "comment": "Malware payload", "value": "2285312da4e0508f043bc590ff5b0c31478d55ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597469, "uuid": "0381908c-754d-41ab-be18-4f60cf43460b", "comment": "Malware payload", "value": "f59d3baedd016e5702f60ff30a2c10ab45b563d3ff9882a45ed38cf81a056c51ad985caefce88a9a901948d33f7fb31d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597469, "uuid": "bf158e47-e380-46cf-90c9-a4a71bf0db69", "value": "T11EB63389B3A604FCE89E913F92E9825767A270B7436883CB67E00D514F272D5EF35B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597469, "uuid": "d9c315a3-c43d-43b5-b921-642459a1bd41", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597469, "uuid": "d41bfdc8-0fee-434e-9803-944b52ce40a9", "value": "196608:wOE0W8/LaeA1HeT39IigQTauDXURuA3dSYEQVdlCE7:wOjW8o1+TtIiL2uARuA3dS9QVrCE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787597469, "uuid": "b327bd9b-78e9-4c1c-9d32-dc7f209d4100", "value": 10744101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787597469, "uuid": "f766465e-6045-4427-98d6-dbaa128df0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597469, "uuid": "3734e5fb-80ed-4291-8c5b-7b8a5e400ad7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b9ddb4-9f5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787534810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534810, "uuid": "1ab64baf-3ea5-4e85-b11d-2996d53914ea", "comment": "Malware payload (Mirai)", "value": "59b8244d671888094fd4d03a5e1f460f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534810, "uuid": "a74eabaf-4596-47a0-beff-cd1b14e3cddb", "comment": "Malware payload (Mirai)", "value": "a2232cd0627028b5dceb4deb513f885d9dfef0fe5ef52ed9a006e9c69834031d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534810, "uuid": "f8d18c8a-2464-425f-a18f-21c77a5cf357", "comment": "Malware payload (Mirai)", "value": "099485d3fe29c8b5860ad0295da74452947dbe97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787534810, "uuid": "c1356069-1766-45c9-8d3a-64bfebd04607", "comment": "Malware payload (Mirai)", "value": "2bc60f3c3206157bce71369f1d7e8800e862cf09f7c944961e29a39b8028ca0cc1865652edd65732c0352fe6054c3404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534810, "uuid": "393517e1-a5c2-454b-9114-90cc64ba6cd5", "value": "T1FB9302972B3EBCE0E83302B8D2A549CAA7EC1445E59F83751DE4711E92B20CE5E257C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534810, "uuid": "f8f430b1-3bb2-48bb-8982-e396a97701be", "value": "1536:gMPVsIDtgKyQ0O0PcCZOolZZIsxGK3N0mO3rtvfrtJNXsLO1u7O8XT:gMNzge4PcOOUZZD/0N35vfRJRsLOIOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787534810, "uuid": "b1afc24d-a2ff-44d2-aee6-5986e1bb44c4", "value": 95428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787534810, "uuid": "c1dbfeb8-7d0d-4d98-811d-df88de911217", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787534810, "uuid": "33bf6757-7518-4ddd-8acb-cd5f4b45a990", "value": "a2232cd0627028b5dceb4deb513f885d9dfef0fe5ef52ed9a006e9c69834031d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a1e554-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585680, "uuid": "5f970e45-b6c4-4375-89f6-b10f0e314435", "comment": "Malware payload (Mirai)", "value": "af3bd30bf8e41ab18024d8b217363773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585680, "uuid": "1421fa4d-7780-4bc9-824b-a50408142b95", "comment": "Malware payload (Mirai)", "value": "a2901d935af19fc75533750e8948dc291b57fa4dbbc62ee7917823320ac927e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585680, "uuid": "e8fda019-1384-42ca-a7d8-fafd098f45ee", "comment": "Malware payload (Mirai)", "value": "ad20adf0430d5bc928ad7aaac243adffe4d59ec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585680, "uuid": "bd85efec-dbe9-4eaf-9b6e-bff6e09ff9e1", "comment": "Malware payload (Mirai)", "value": "f71ec9f9a4ab8b8ef0eb341586c69853149b84634cd2f031caeffcd9e0cef3a05a314250a589e2d1728cf40cd148cc74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585680, "uuid": "319ebedc-fda8-420c-b9c1-5c5795ab83d0", "value": "T17DB312AD37478C66FF5C4672A5104BC01A71CF6BB20392FB283AD592A773B81252F046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585680, "uuid": "75c5e18a-749c-4ae5-be32-8ecc79c24820", "value": "3072:HE0S2EhExtdWNOuuQ8vNnrc+5OeEM6fTkhpFHnFAqAUV1sq:k0S2EhExtdWNcQiNnrc+Pv6b6RFZl1sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585680, "uuid": "16b045ea-4af1-4ce1-b552-7fbd0c533a18", "value": 117396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585680, "uuid": "1e1aa3a6-98d9-4a01-baf9-91e4e799f69b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585680, "uuid": "31c375a7-1382-449f-b2ff-43232401439b", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07cbd3e-9ff8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787602615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787602615, "uuid": "5d0d47bc-eab5-45f4-bfcb-77a3348e2baf", "comment": "Malware payload (Mirai)", "value": "c1aa080ee9caaf7ae28aed2d161ee743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787602615, "uuid": "16364119-21b0-40bc-a79a-9ee4874e4e58", "comment": "Malware payload (Mirai)", "value": "a458d1a2770a455c1360388fd13bcffd69989835c3c0993917d863a996566b5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787602615, "uuid": "23b4ba9a-64f8-4990-9b45-89cf5cd9ea3e", "comment": "Malware payload (Mirai)", "value": "826da7078016bdee42a0b1119d2cfdeac4690a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787602615, "uuid": "6684a6db-94ab-436a-a94d-e09cfa3ff20e", "comment": "Malware payload (Mirai)", "value": "8f52f79516b22811790d0db82e88de288fff9d66891df4b941a81157b5fc8ef9cdb7123542a7990c4ed74fea93344a84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787602615, "uuid": "d4103d5c-8204-41df-95ec-77d71d9dd151", "value": "T130146D1378E190FDC9D7C1398B9FA01AD632F41B1128B21A774D7E652F4EE306BAD684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787602615, "uuid": "6e09e0a2-734f-491f-8461-5a2f05f9cdbd", "value": "3072:jtb5AbwCqMg8lKTouDZ1Q2M/vz7Re/6RAGRznlu1EssMZc/T03ImIys61X1h5oy:jt6ERJo+C5e/i5n2EssMOgh5oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787602615, "uuid": "32a49919-e85b-46a2-bb27-5233482f7b01", "value": 196600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787602615, "uuid": "6a7a4914-0cd3-4c1e-b374-1794969db914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787602615, "uuid": "555418f9-2476-47f0-9205-3d3e28fcd5ec", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d5633c-9ff5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1787601119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601119, "uuid": "3cae9667-538a-470d-9059-aa3c97561395", "comment": "Malware payload (AsyncRAT)", "value": "bc02159ff52160379afd976481ab54d9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601119, "uuid": "1e675c8a-2109-40f5-9342-ec3c15cf7f16", "comment": "Malware payload (AsyncRAT)", "value": "a4e921a7afacd5c9d8037425088e87847b0171e8985adc659cdb32d265db2684", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601119, "uuid": "45c5efc4-36d5-4d82-8f57-000e42c171d7", "comment": "Malware payload (AsyncRAT)", "value": "f406685a84605b12d907a3571f68619d8bb74ada", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601119, "uuid": "280e1fef-7fa0-4f6a-946e-ce0cef1555f5", "comment": "Malware payload (AsyncRAT)", "value": "1ecf8ddacd48f2b58e2106f4929a577d97d70d95f2ff99fbacb8ac117091190624a379b53b46858054de1b7bf3d3c8cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601119, "uuid": "edfdd187-426e-4933-8466-fc9ef3776b22", "value": "T123C22B0833E4C572E2FD4ABE8C33E5108B79A55B9A23D75A5FC490AD29237CD8A14FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601119, "uuid": "d200e872-d23f-4f33-868e-605f976dbbd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601119, "uuid": "a943cc53-31e7-42a3-ba3f-48439b89a9bf", "value": "384:kgSVEEMiNPWmvHtZARPn9jLH9qbuUsQbQxnCJfJBndnjJVKA:kgSVXFdt+vIbgBiBncA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787601119, "uuid": "cf041989-6272-4f46-81ef-4d1d4961de61", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787601119, "uuid": "6b42c944-d350-4820-8502-140beafe02be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601119, "uuid": "851b09d0-3a9b-4cdf-90a7-cece08e60287", "value": "FLY88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670e1992-9f8e-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnappyClient)", "timestamp": 1787556938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787556938, "uuid": "1c0218c4-9e48-4e8c-9503-4b4f7b351dab", "comment": "Malware payload (SnappyClient)", "value": "93171cad8945848d4ab88f2a2cdb7817", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787556938, "uuid": "81064f0d-b3b4-4b85-b5ae-9f820c032d63", "comment": "Malware payload (SnappyClient)", "value": "a5869df51a258135f00fcad0dc5656315c19f1b02372f6477a1897acbb4c1f62", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787556938, "uuid": "92b55f87-4181-4af7-ac13-b506b2f8d274", "comment": "Malware payload (SnappyClient)", "value": "20f5924902baac0c1a70cc1106f958e22b9b1b4d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787556938, "uuid": "2cc0c141-1565-482c-8885-e1894255bd26", "comment": "Malware payload (SnappyClient)", "value": "df4fef0d268f3a6379e25f1a4341a1a63e7ee2c1122b4418c3704dcef23caa857b0c48ea207c1c27c1bf760dddc2a5cc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787556938, "uuid": "40fd54d7-bb66-478f-857e-1f48e4ea7951", "value": "T18366331233E38035F9A2173284678621AF16F8F945F820464CF5E45F697ABCEA8377D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787556938, "uuid": "cdec8015-9567-4b25-938f-947a30aa9e29", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787556938, "uuid": "dfb16983-9137-48cd-9aa9-bf4e40dea0af", "value": "98304:zXpYfOlIOreiGvbJjgYUDusqFrQxg4xnKl/6pf1z7pNWFj4s9pnB7u2DYenL1dNK:z6+GiGTNf3r8g4xSytIj4cB7tvL1zcld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787556938, "uuid": "50ba215a-bac7-4d22-95ad-2498574ccc33", "value": 7012088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787556938, "uuid": "c59b00d2-9b3d-4b2a-880b-af62287b9f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787556938, "uuid": "0f8232f2-e502-4087-9a93-24734afffd29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8d9e8d-9f6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787542481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787542481, "uuid": "a87b6b95-f236-4f78-9019-941edba81675", "comment": "Malware payload", "value": "4261d09d972832e3e0265cb44ce345c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787542481, "uuid": "2999e497-59dd-4bb4-b80d-5a2854ca0b2b", "comment": "Malware payload", "value": "a7f4fedcea3abe8987508d00f29834b8872e4e4e5059159eb19460d474b37cdc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787542481, "uuid": "91b07dc8-2df8-48aa-aa00-927883cd0234", "comment": "Malware payload", "value": "fac26b8978e3c13d7fa5c287252f686b793ec7c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787542481, "uuid": "22d5fb3d-9e1f-46f1-a267-c3d564117705", "comment": "Malware payload", "value": "1b1e3e04390d115e49346c8089c6b7f5276e0ded3744fc3e7da17d8ee9cdf0985ab0fe00a876e5544ecec3bd9a5d919c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787542481, "uuid": "0094a735-f879-46a3-bb7a-74d4f510ccd4", "value": "T15E83A622784559B825CCDE6C49FB5C502739800BCA0A2D2CF05EE5D83F76A78F5F92E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787542481, "uuid": "d59a9023-c4d1-4f19-b370-d206d05319f6", "value": "768:moJjXKfWEDcQPyT9r86roAhF46UwsdWA+7j1waEo604:mOEDcQPyTuvb6jGuRwaEo604", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787542481, "uuid": "a629006c-399a-40b0-a460-99e4dc7755a8", "value": 81334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787542481, "uuid": "2745f4af-4eaf-43ed-b871-38eacfa8f9a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787542481, "uuid": "f8b5756f-6b49-49c6-bd47-c5f86b3c18a9", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1ae00d-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576653, "uuid": "6ceee547-41f3-419b-bd1d-d788647b470e", "comment": "Malware payload", "value": "ad15f40771aeb982ad0b1ba84d4c90f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576653, "uuid": "6d875cf9-53f3-4101-a326-14f58c93e7b4", "comment": "Malware payload", "value": "a81fe4c2a51958d1f6cefdef18905590ad507281dca2c87d73b6a26ea99327a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576653, "uuid": "eb3863ca-f204-4b70-97d9-86c8f059f6b1", "comment": "Malware payload", "value": "8660d2489d23afa2216825805bf70560bd3cdd1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576653, "uuid": "d5dab1d8-7dbe-421c-b31d-af764f3a3533", "comment": "Malware payload", "value": "3fafbf29b36b7439c91658cf26a262bd25fcc2e4ab6d466e5e02c3c76835faab1901e2d17a56b9b2017619543d8740f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576653, "uuid": "ef8b2e3d-0e2a-4b22-ac33-5af393dc6854", "value": "T1D272BF9DC4A57B8FCFDD2E7C15A427702D41F090632E8F4DA3158CC5B31A606B88D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576653, "uuid": "deca73e2-d389-4098-acd0-a2a9d417db90", "value": "384:cxjFfh7KRhyAYjiJiwSKT5Yye6eoxyGgxRWGVCz+uyQMlx:cxjFp2Ixji0wSo5eY0bWWBQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576653, "uuid": "84164477-7683-4ae0-86e2-794ddaf44607", "value": 16908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576653, "uuid": "8009e0de-eab6-4f60-8aa0-ac06028391f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576653, "uuid": "c5c41bb0-a25e-4f11-a6cd-7945ee3710fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c280636-9fc5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787580569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580569, "uuid": "961ff084-47b4-4c53-9737-d15156ba4704", "comment": "Malware payload (Mirai)", "value": "5aa4408c4eab8ce6bc092a35c6e533d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580569, "uuid": "52195a86-a8dd-421d-8cd8-1c53327627ff", "comment": "Malware payload (Mirai)", "value": "a8475accf7afb3b9dbed6b81fd941842f8e5c158b7db1cea9fd6875518d2ec56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580569, "uuid": "f3349ed0-d43c-4364-b9b4-296cdeafea81", "comment": "Malware payload (Mirai)", "value": "ec0c547458e87b11a3457b0a0ab31f8197fbf870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580569, "uuid": "7857beac-ad7c-4f3d-a229-17f30c9a61ef", "comment": "Malware payload (Mirai)", "value": "6c48a2e49c51a6efcc2abd4d9fdfebccb9279085f7209c9cfdff40ca072f59c2dc6a352a821aad07c60cf4397b43e9ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580569, "uuid": "36fa24d5-7456-420d-938e-53a509767c93", "value": "T1FA143855BCA29A12C6C3467BFB4F414D372A639AD2DD7103BC1E6F203F8A45B4A7B181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580569, "uuid": "c24284ef-9a20-44ab-8d5f-9f76995ba7db", "value": "3072:ho6H4g5tzB265xNNiA7s9dUEtu4KSMVsLqD/hLPFiOuu1EssMZc/T03ImIys61XU:h1Yg5tzB265xjiA2d7c4KbVsQhbFiOzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580569, "uuid": "0603e5ec-43aa-4679-b3e5-202b111c7e12", "value": 195276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580569, "uuid": "1c03fd4c-5279-44c7-847e-f7e1fb0fd1f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580569, "uuid": "79e3b2ca-b56a-495d-ad44-3703d153b140", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882cacbd-9faa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787569020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787569020, "uuid": "cfbffcf0-3471-45da-8ad7-fa87cb9d901d", "comment": "Malware payload", "value": "06c32b427b048441358504522d64cbc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787569020, "uuid": "6f0ad510-0084-4d60-aba1-aa7cc02c7d33", "comment": "Malware payload", "value": "a9b140ffc2de43182aa2dc35cf325eebdf5f0571a72a58ec85635ae10c266a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787569020, "uuid": "103e6e09-f3e2-40a8-b539-c1ceb922074b", "comment": "Malware payload", "value": "3a0fa3624add523935e3008b91927716e44e5807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787569020, "uuid": "ceb7900a-b125-4b12-92ce-c54d8e81ce8e", "comment": "Malware payload", "value": "6709082fa1a5300086467c51dd4c68d67afdc84b39af66e214d91044efe201122a7c167a1e2d021c966d9d79fb6dec48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787569020, "uuid": "104ad751-eb86-4ad4-841c-467d23b2f433", "value": "T141D523A6A9B66934D837C3728FC3D57EB06C7B468A624D97F6CC2A004D03A546D3B371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787569020, "uuid": "fa84ecf4-7bb2-44f3-84c0-c68d95589713", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787569020, "uuid": "e6ae7e02-d751-4223-b600-0812821aa9a8", "value": "49152:GxCsQd75HFFFwtti7zoc3cc55PePaB+iuCr+MSyoPKccvZmU0fUg7VwN:zdZzFw8zr3e1iuCtL4CTC7Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787569020, "uuid": "12039f5f-f832-4066-9396-83568a8f1956", "value": 2943488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787569020, "uuid": "899c323b-a916-4278-b285-62a5147abdf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787569020, "uuid": "8b4c9f75-3006-48f9-80f2-06758b4cc10c", "value": "a9b140ffc2de43182aa2dc35cf325eebdf5f0571a72a58ec85635ae10c266a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b52196f-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579360, "uuid": "c45b6ea4-58a0-4fbb-8fd1-321740f4540d", "comment": "Malware payload (Mirai)", "value": "462c898d857dd58bb2068fa6587b9d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579360, "uuid": "7790cdbb-2af8-42d8-885c-8e6ae444aad9", "comment": "Malware payload (Mirai)", "value": "aa9bea4aa63ef58b0122822d0acd93b0c2c01b46c9841d0e13dabfcb508f835a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579360, "uuid": "e3bf1c9e-6e56-497f-a438-d5032299eb87", "comment": "Malware payload (Mirai)", "value": "a607389926fbd33c09f05e00b654cca46836e047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579360, "uuid": "3dc26638-df86-4c2e-9f32-134e3a508b7d", "comment": "Malware payload (Mirai)", "value": "7d64dd29308d3ce25246c3111f837f3db10985c2b44f75e6e85493571b3a02269b316570a3b0b59c11c47c839c30a565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579360, "uuid": "ea87311a-1908-4b49-8b4d-e30bdc81f21a", "value": "T12EE3FA96B8818B11D5C151B6FE0E124E37131BB8E3EE72039E146B69778ACBF0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579360, "uuid": "51c73284-f3a2-43d3-8d80-3f97cc39f2ba", "value": "3072:0hxoBKm1Fg6uYvZPXCyMrra3qKYzA2jfGh:0hxoMNYtXbMnatIjfGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579360, "uuid": "57b609b3-f664-4550-ba83-01e44ecef16a", "value": 150268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579360, "uuid": "09f4f103-4a0e-49a8-8d45-4ea0c1da62ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579360, "uuid": "1b96e3ad-bca8-4f9c-8cc4-5fdc305066bb", "value": "daredevil.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecd257e-9ff3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787600384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600384, "uuid": "85c671fe-11a7-43ca-9512-13160f1976a9", "comment": "Malware payload", "value": "2a84400795f3aee784c2b348d6b7fec9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600384, "uuid": "c49b3ef0-baac-4954-849b-67036ad631b8", "comment": "Malware payload", "value": "ab4c9f360c6d5f3e0d9a90c713d4ccfb2780ef52da41a028d6516cf9ea5e9238", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600384, "uuid": "b78a2d3d-703a-4916-b20e-cba7e7859179", "comment": "Malware payload", "value": "37972ddd9e93ad2399c871253753cf12ffc94009", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600384, "uuid": "ae2b8a37-9ab9-42a3-a0fa-a5158747eec3", "comment": "Malware payload", "value": "43eea951b9ba37329e3d7d002870ab35f62203c95d10db0cf71a53630ca735763299541b0093d8e91751fff7857bad91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600384, "uuid": "c8dbe10a-3dec-4efb-b058-e84af7b36098", "value": "T17941FAFE7052B762DFA68E05F260F674B217E1D571CF3A8CF98C6993CC46840726AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600384, "uuid": "664e4e27-d863-4e97-9385-cf355e840ab7", "value": "48:4CCpOCmhpi0p2BpaUGzp2V22G9TezXqD90ooW6urVr4xz4jpyVdhmh:yQFcAf36urVr4xz4jpyVdhmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787600384, "uuid": "2f52794a-1252-4ab6-bc58-86190416f060", "value": 2121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787600384, "uuid": "95ac54b9-5c83-4184-8e60-cbc1415f5479", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600384, "uuid": "ed1b8a6e-e8b7-4bc2-aca8-a320e7780bc6", "value": "totolink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae01b25-9f65-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCAgentRMM)", "timestamp": 1787539174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539174, "uuid": "cabd2d97-1766-44f4-b47f-da8591174b52", "comment": "Malware payload (DCAgentRMM)", "value": "e2fe7d1e45100c861e5775d120c53ecf", "object_relation": "md5", "Tag": [ { "name": "156-251-11-63", "colour": "#51B27B", "exportable": true, "hide_tag": false }, { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zhuohao2-oss-cn-hongkong-aliyuncs-com", "colour": "#48F4A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539174, "uuid": "692f1db7-cfd3-403b-9e6c-e28625923350", "comment": "Malware payload (DCAgentRMM)", "value": "abb9decacf6925cc39d9626b8cf925ee4518b8ff0f8c66885847c6c74c690b16", "object_relation": "sha256", "Tag": [ { "name": "156-251-11-63", "colour": "#51B27B", "exportable": true, "hide_tag": false }, { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zhuohao2-oss-cn-hongkong-aliyuncs-com", "colour": "#48F4A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539174, "uuid": "fc6aea4f-5d42-4c61-a26e-8a4d3dd3381d", "comment": "Malware payload (DCAgentRMM)", "value": "03f59387741fadd7d8294cc1717960211bace3ec", "object_relation": "sha1", "Tag": [ { "name": "156-251-11-63", "colour": "#51B27B", "exportable": true, "hide_tag": false }, { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zhuohao2-oss-cn-hongkong-aliyuncs-com", "colour": "#48F4A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539174, "uuid": "9d057832-21ba-433c-9e70-cc9e5b271247", "comment": "Malware payload (DCAgentRMM)", "value": "2cdccf654d6f8f2d39de236b91093ade864406ad4de1c3a9f3d24f4191fd9a0fa62a76d5664b2ff93f95d0c0de7eb21c", "object_relation": "sha3-384", "Tag": [ { "name": "156-251-11-63", "colour": "#51B27B", "exportable": true, "hide_tag": false }, { "name": "DCAgentRMM", "colour": "#52F6F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zhuohao2-oss-cn-hongkong-aliyuncs-com", "colour": "#48F4A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539174, "uuid": "21490deb-a9dd-4032-90b1-f967110ad5a6", "value": "T1A0D73319D6720C7CEA205674CA12852473AB38C0176BD7D74391A6A74E3F5A8EF3B3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539174, "uuid": "b8f1e65b-ee15-4096-8624-23db0fb0096c", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539174, "uuid": "1b0b4164-2f9c-4f65-b7e1-c2ed6a32032b", "value": "1572864:4ACf3ZC8CpuGpBt8XNRhsOgkgED+SvwM2VzK/7:4l3ZrCpuGpBt8RsOOEfvb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787539174, "uuid": "c449ede9-8e23-4609-aa57-b697051aecb9", "value": 61491524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787539174, "uuid": "1d08ee22-0e3c-420a-bbae-32a3764a6ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539174, "uuid": "77dfc495-11ff-4e9c-bc5e-146a3ed34c56", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8309c2-9fbd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787577352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577352, "uuid": "4ec1d99f-ed26-4448-a716-6f384905eb06", "comment": "Malware payload", "value": "b3d0ce9c83ada3a789b217da6966d550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577352, "uuid": "5ed7134a-9452-45cd-880d-2e16aaf98514", "comment": "Malware payload", "value": "abf0bf993105455eac47f8b16447958299ad95ad16857a94f5ae6bacf97c3e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577352, "uuid": "9970ab57-d0b3-4557-9c7f-20a6be974948", "comment": "Malware payload", "value": "9df9ff6123b29b7ebb19faca6d8d4882f5e566b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577352, "uuid": "a852ad3b-d853-4690-9881-b49b8cd9e509", "comment": "Malware payload", "value": "63a61ca28eaaa92b7cd1945397ed33ec4a8b2efefcadc08d2ecb367f8169d62ee23966ad417684b05580a514b5fd1566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577352, "uuid": "649379a6-f4c6-4f13-acfc-4b8a3285e1ac", "value": "T14F17339CB68119B2E5FB623D8665CA66B17072001F42C3FF0BF11A253E7B3654D792E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577352, "uuid": "efb15fa4-087c-4847-b927-efac7cde8360", "value": "d5b1104f7bf955d6b89a47291d5b603b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577352, "uuid": "b30eb6ac-b3c1-4ca3-8d87-c9527f88f9e3", "value": "393216:+n7LMnipgIfUKOcFXEAphVtnIwQSg+SPmfzC+LtZivF7d3pl4vC6:S4nA58KPFRphDBo+1zFLtsvF7WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577352, "uuid": "ade8965f-915f-481b-83ef-006bac38b61b", "value": 19728373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577352, "uuid": "f67f5b47-52e2-4322-b8b7-0577e47f25a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577352, "uuid": "6c8d4b01-ff3f-482a-8ec0-5a6468f83a21", "value": "Velocer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fddec67-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543692, "uuid": "ff59818d-6a39-487e-8a93-e4d708737259", "comment": "Malware payload", "value": "b23961d92dd297696dc0708f9fdbf0cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543692, "uuid": "9ef217cc-4d56-4312-a42e-c857db2f70eb", "comment": "Malware payload", "value": "ac28bfc0d7037af9aed40d633a824f061d23374f86a4e2f422841a7cdc2f2bda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543692, "uuid": "7ad711d8-9b15-490f-9566-1f76b4c5a880", "comment": "Malware payload", "value": "8391195f5805e0bd94846ae502f87d93670feae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543692, "uuid": "8a84d7ca-7c3d-4792-bb25-5fea89fd6abc", "comment": "Malware payload", "value": "587f9ade61fc2117cafa798e007ad972aeadd2d89c1d0d99a6da23b2c5c1bab2023a580a4d34b2efda454910ea0fa0ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543692, "uuid": "8d71a19f-d861-4b79-94bc-0076a4057288", "value": "T1B8935B86BD01CF3FF41FAABA449708267535FE6518821B61A273BCE3AD610E22D53F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543692, "uuid": "b8304bbb-c417-4ffc-b3c4-d301a1709e0c", "value": "1536:cRVWR11yelssP1zVTrdkMMmmLQzr8631WYUF167aZ:cGaezVtJESrE1maZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543692, "uuid": "6a8a60bc-7816-4e9f-b992-56df4df3ad00", "value": 97052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543692, "uuid": "3fd3af7a-3916-4785-984f-7347fa7ec723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543692, "uuid": "3b2f7e7a-4afc-4642-9b24-f209b8c8b0f6", "value": "raul.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ab8b2b-9f88-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787554337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554337, "uuid": "2c5a0369-7c3d-43c2-9cbd-38e53c2a5c1a", "comment": "Malware payload (RemusStealer)", "value": "f1c8fcd0a068217c9d35ce071980d9a2", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554337, "uuid": "98350011-b5d8-4d67-8494-bb82fc57fec1", "comment": "Malware payload (RemusStealer)", "value": "b007e3f21dc382e21ffdc64e665444bc9494d1d67b82bc7ddf415ba2288af648", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554337, "uuid": "443db3f8-d4c2-4693-b09f-c0db6c40efbb", "comment": "Malware payload (RemusStealer)", "value": "3972771753570b92203c2010d5e54f9af059bd80", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787554337, "uuid": "9b27a68f-dc91-4214-a2bb-258cc759b362", "comment": "Malware payload (RemusStealer)", "value": "ac99cf0254601c72711c7bd4edcfcac5a74fcbb543241264f1c112cf4f9ac336d88d55e9a05998f4a1573408ed613d94", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554337, "uuid": "5ecc2b81-a550-4228-b148-45989245247a", "value": "T1BF75231513E956A8D17263B189F2C23395307C159778D79F12E8AC8B7F33A9AE836313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554337, "uuid": "badf6cfc-304a-4c95-91ed-61860ca357d4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554337, "uuid": "cba9dbc0-8961-40f8-9b8b-085d7c6125a5", "value": "24576:jpyxNQfNF6PADvlQIVsoegaX0cH0AQMV/qB0DO+mDtGzJNaCFh9AXOFif/HO4r:jpKmlFuWlxegAHvQMFqB06+mDAzJNaU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787554337, "uuid": "90205064-eee3-47f4-a1d5-d41ca37bac1a", "value": 1560064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787554337, "uuid": "b51af2d0-a400-4119-823b-687acea0ff50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787554337, "uuid": "f8403a2c-396e-4c65-bd8f-95871c7c4458", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87d50a5-9fcb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1787583328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583328, "uuid": "b8164976-3582-4971-bcf8-055415ef6640", "comment": "Malware payload (Prometei)", "value": "e4f3efe56ba5deffef1def18a737d976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583328, "uuid": "52aa596b-4918-4937-96f5-86b28adda290", "comment": "Malware payload (Prometei)", "value": "b1fc8450f566d6a85851e0c1e4b8a9a9f643847f35cd9264a3bfc2d44e4b7c61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583328, "uuid": "07bf987d-2451-4ba4-bc47-c8db6c652262", "comment": "Malware payload (Prometei)", "value": "cecc16876328ae3a14755bbafdbbff83cf439538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583328, "uuid": "90591db8-b5ce-44b1-92e9-79884d11d5ff", "comment": "Malware payload (Prometei)", "value": "0ec1bc0321ebe23dff41c240d5a0c0255538c3c56efac83840981c6d06a5074e1a0cbf6b3fb4ba096e1ff9222fcd2aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583328, "uuid": "4ba78f54-cd8e-4cda-84ed-45aaed37a6a7", "value": "T1C49423F4D3779B9AC5872A758B7AE381C6747E555BC70849B3ADE9330138322AB50C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583328, "uuid": "5de1a824-c45d-4d3c-9c0d-19790edc876b", "value": "6144:3584cmYYMg0EzyNP34/Aam6xbQJPlViUWxUzgFjVyBXH/0r1HTUcm6hEZ:35843YYXyi4am6OPj7WaaVyJH/0ZHTBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583328, "uuid": "cf807375-65cd-464f-a129-caffe038406f", "value": 436123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583328, "uuid": "2c9e07d2-9dfe-4be3-9436-635bf66be02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583328, "uuid": "7f2a6df5-ad50-465a-b2dc-232e50b410f6", "value": "b1fc8450f566d6a85851e0c1e4b8a9a9f643847f35cd9264a3bfc2d44e4b7c61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3422f2-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543685, "uuid": "1eeea093-e9b3-4bcd-983b-d3f8956123a3", "comment": "Malware payload (Mirai)", "value": "455839981635aa556393ff142e9bb9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543685, "uuid": "e2907074-9740-4e66-8c9b-ff8c006eab33", "comment": "Malware payload (Mirai)", "value": "b2070ddbecc03dbb26cdc2a72df88e9fc5f6bb7215ea3e12d0d1035704553bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543685, "uuid": "19473f11-5e87-41b1-ae07-318c32404ca2", "comment": "Malware payload (Mirai)", "value": "87ba33b6e251ac0098e03952934846825516b445", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543685, "uuid": "2edaad02-cedd-4d91-a871-dc4b3f0b05da", "comment": "Malware payload (Mirai)", "value": "92c3007058d610c7de24c81e1e0e302a19ea294de25118a5d0002b41de353c957d3dc15c7f04bb9beb97e9893672a565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543685, "uuid": "5a3c2709-89a3-4f8d-9f5f-7af53819d9a0", "value": "T15FA328067D42DF03C5E522B6B6AE45CC33126BF8D6EA3142ED267FA1378A4DA0D36750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543685, "uuid": "f3bcafb3-6ec1-4af0-a923-9cfae9016407", "value": "3072:HHSHQYiLfHOaoPVqeerm9U0e8HYphosHO7:HHjnuNerf0e84zO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543685, "uuid": "7e24854b-ca7d-434c-ba26-56eb78bebdd7", "value": 98960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543685, "uuid": "a170d8d0-7e65-43b4-a4d8-b63bafe674e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543685, "uuid": "6a430d5e-4e7f-4c0a-b6f2-e73313026e60", "value": "raul.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcb288f-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787598802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598802, "uuid": "d490ee7a-35c3-4692-b773-3be67676d796", "comment": "Malware payload (Mirai)", "value": "6f014db52e5bbb144e4be521bf278176", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598802, "uuid": "0c7919fc-0ae8-4a3c-8ae5-f54c7bab9272", "comment": "Malware payload (Mirai)", "value": "b20f09da61ed52f5603e0c549a5b3880e32e4d34ccaf3f4b1628c76a939e799b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598802, "uuid": "62841b9c-1cef-4fc0-957c-25ee639e6900", "comment": "Malware payload (Mirai)", "value": "7f9a412bdb37af235c4c9b40e38649b849a7a716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598802, "uuid": "e3f57c0c-f5b6-4e36-a0b5-3acae5e05a2d", "comment": "Malware payload (Mirai)", "value": "a848cfcd4392d8256bc5af8cdd85737b5f433bdf846feb409222844bcd9105643aaec0d5a623d7ad76a20b857ee66cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598802, "uuid": "26976207-e2cf-45d7-834b-17bb9c8b7eb6", "value": "T141132986FCC24A3FC2C013B9A66E5A4E3761E3E4D2CB76079E54577236C620F1D6AD84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598802, "uuid": "67042d10-2382-4b8c-89ed-54fa00d83882", "value": "768:XG2/l2Q2SsD3pDi9ZbyE2hk4G+6ZQ+QVgOJUCmJdtBNCw3oOM:X3+SsDUJn2hPq8VgOdGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598802, "uuid": "4fc2f9f9-a2d1-41cc-a4ab-1da3b3406a22", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598802, "uuid": "6902ab00-8748-481b-8c51-181c438f7e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598802, "uuid": "27d7dbc5-a03e-4ca1-b7c3-bc8bea666e6f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e05c65-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787575185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575185, "uuid": "71af9c1a-a4d9-41a8-827b-0e3e8093eefb", "comment": "Malware payload", "value": "ce9fa7467362ea1adf08bfc3eddc1bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575185, "uuid": "e53eb170-5f14-4d85-9f64-d53a27542dd1", "comment": "Malware payload", "value": "b253cad8bb709ecc99eb053e81b1ed3212e095356deb2177d30b0dd5be75f3e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575185, "uuid": "6cdfc63d-ce8c-424a-82e9-5075a8767100", "comment": "Malware payload", "value": "48bbd35b54e9eed7ba1985ec48f36361f2167657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575185, "uuid": "d25ee84f-e8c1-4aa1-ae45-7e4f8bcff6d4", "comment": "Malware payload", "value": "adf30e5553c68726c424aeb8b5c879ab34f74f34b037f547f56bfd400a6d8c318e025e92311004c0e96ee03455a270e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575185, "uuid": "584cc96b-3bc5-4b9f-b572-c3ad977f16ac", "value": "T133D523997DF31674DC36C379CE82E4BEB22A33094AA54E573ACC1D004E23A445E7677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575185, "uuid": "760b5415-29d4-4291-ada4-35ab21ebb126", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575185, "uuid": "7601c8e0-3a73-4464-be4d-ce2b55e30b21", "value": "49152:zmG1yHk8LSHxScEX42xi8qCLMo0WWhrJgWv2lC9bq2/gIEfMLMNUnQWTv:zt1+VsUcEo2xhqCwoTWhrJgWEC42/ZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575185, "uuid": "b23e3ecc-b37a-4f01-815a-3e17ed2a633f", "value": 2982400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575185, "uuid": "b349e9d0-d26e-42fb-9f3b-33f75b6d9948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575185, "uuid": "4d5d5bfb-ca79-4ce5-9ae5-53a0d557f091", "value": "b253cad8bb709ecc99eb053e81b1ed3212e095356deb2177d30b0dd5be75f3e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a726547-9f51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787530611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530611, "uuid": "e325772b-ec48-41e8-836d-e9a2437fdf95", "comment": "Malware payload", "value": "12963effa8bc7ee2ed797e53bb036edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530611, "uuid": "4da5e973-9f7c-4055-9dd6-57f5ffe9ae33", "comment": "Malware payload", "value": "b2db7036c63d9d801907122be93c11d32657fc7890149d38c5050a83a48fa711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530611, "uuid": "91bb3942-c3b1-46e4-a5cf-f41646cb0549", "comment": "Malware payload", "value": "c8651674d0ce3e1756458d5edf7f8f6753e8d567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530611, "uuid": "4037017d-4d05-4e53-8b6c-275adf050160", "comment": "Malware payload", "value": "44474885eea1916ba7071ac6fdd1db803934ca4b33b54236abff79923a744aa8405be6b8878951cfd5c2f83452ec9908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530611, "uuid": "f4a41cbf-e68e-47b6-bbe5-d6bb129797d9", "value": "T12DD5238CFDE60DB5E432C3B752D3653EB229774685B88CA726C863115E12A297C7B334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530611, "uuid": "2d5e6990-cffc-4454-bab0-3bdbb151bfbc", "value": "5a2ed47d8c6c6433dbc831d38c92042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530611, "uuid": "33e462e1-3cee-4c7e-bbb0-2e0d6f1f9384", "value": "49152:WXxlJn9YPH5RkC0zoh811Pgi4ScXwjJhU4O1VOH4ZcmdK1VPlx00iPvcL7dm2:WvJG5Rr0chEgi4SvsOH4fiJxc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787530611, "uuid": "f0595105-9c7b-449d-ad18-fd2714b72bd2", "value": 2987520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787530611, "uuid": "cca2698d-7f4d-42f0-9181-4feae64e75e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530611, "uuid": "f4126f69-7792-44e9-962e-24788eede415", "value": "b2db7036c63d9d801907122be93c11d32657fc7890149d38c5050a83a48fa711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e774b39-9fcc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787583499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583499, "uuid": "00e92ec6-6fde-4d5b-a5aa-a6c720290f19", "comment": "Malware payload", "value": "46563ec842a8531db8f7caffaf695108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583499, "uuid": "f9377806-9096-4170-bb84-b8d37c1daf49", "comment": "Malware payload", "value": "b4c1bbdbdea9aaa9f6564bfe7e21d7b88164a63500ff7c534571a9f95e1ed395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583499, "uuid": "4a591cae-b938-49ab-9fba-80148696ba9e", "comment": "Malware payload", "value": "f8653ac52e416bfb533941d25052aaa8eb77d361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583499, "uuid": "baefd0a4-875e-40a0-8ccb-7c9af4fd9ada", "comment": "Malware payload", "value": "f13020baf47f1c5039f6717559c4be3c84016b6db26592866ad27d183b10592fc8116488cb5c2f760a0cd1478b42c89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583499, "uuid": "b3741b70-33a2-4db5-83d3-336631de6383", "value": "T131545E69B3144C66F9ABE138CD468373F3B2B00593A593DF677069763FA2122B329741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583499, "uuid": "e9344d0c-4360-40c8-b915-574739a96736", "value": "ab30dfbb357afe895dc38b8a8fa3dad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583499, "uuid": "410e34f0-188d-499f-8e00-603f35749c67", "value": "6144:meRkl8may597Ml2RrLIjXyK9KgYI+n4UyaQ1ES3xLNgNCf7Fu4wz/:meRkl86GlYLIjXBGL4zZESJNgNwJu4w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583499, "uuid": "5864334d-dd0a-49c3-8ce6-150d5786ee26", "value": 303120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583499, "uuid": "5c623e5c-8f51-4aa0-99c3-16221ef196fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583499, "uuid": "e6c8ccf0-23c1-4061-832d-da310593ef59", "value": "stage3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfb7628-9f85-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787553165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787553165, "uuid": "4e0aa52f-2370-4843-ae7e-2dbe8da2f9ce", "comment": "Malware payload", "value": "3741579bbc3272bffc2e00e493695e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787553165, "uuid": "a58d78b9-d461-4d8b-b2dd-c71a5976068b", "comment": "Malware payload", "value": "b4ce5927fe12c1e2a017715f227e58c76258e0d459f22569bf2160fc953e221f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787553165, "uuid": "c9a2cd5f-c3f9-4e96-b6ff-48e67f7cc45c", "comment": "Malware payload", "value": "d95ffd99c658cb4c0d02dea3b795fb11292f116a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787553165, "uuid": "190caad2-cbcb-4d78-8e9c-4124371defbb", "comment": "Malware payload", "value": "f619718d8ecc610fe7b5f81fe751b8165861453d97123a4696bd5bdebfc83ce2c8b48ae6d353776c22873f8ef3dcfa29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787553165, "uuid": "87e32e02-b396-44db-9b47-27311734c20c", "value": "T1B9D52298B9BA2A74C437C7B28F53E47EB15C778586A09E5BB3CC28119D436986C37370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787553165, "uuid": "929f3660-d7cf-4e05-9c53-e81bc3526137", "value": "fe230628262faec735b6f015758b7519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787553165, "uuid": "09156947-20f8-4628-aad7-2fbfc7cec914", "value": "49152:hqfJUFw/Y9kdofIqk4Z7drXN9n5Zg4NJLrKSCZI3rqxntAbnmR62k6uHkxNEfNYZ:hOU6/S7dJ95ZDJLn7MntAbnmR7gk/Efg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787553165, "uuid": "e8805e64-f478-4c61-b425-153c5ecb6cda", "value": 2917888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787553165, "uuid": "a4012a54-f62a-49ba-a484-3f0b5ad6bba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787553165, "uuid": "c0c295dc-409b-4fdc-9129-9823a596ab42", "value": "b4ce5927fe12c1e2a017715f227e58c76258e0d459f22569bf2160fc953e221f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d4259a-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543694, "uuid": "f495f94d-718e-4acc-8603-cc21a64daea4", "comment": "Malware payload", "value": "87b3538ef395d7180dc62e5c8920081f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543694, "uuid": "8d3c5fee-a15a-40eb-87c8-66825be0e375", "comment": "Malware payload", "value": "b68c2a6af863c98b91e172f21f4593f37d2cf25a39a3e216617e58124f0ada26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543694, "uuid": "bae80352-aebf-49e9-87dc-8e4c22df9409", "comment": "Malware payload", "value": "bb4f9dc188f38f8825c9c6204d9121f9e77a09b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543694, "uuid": "6e810d80-2a30-4a29-84fa-48acd81daec4", "comment": "Malware payload", "value": "234b168f02a409b5d53c79a5d45f91614e97c4e3576cc3c8f7d0b7ebbe24eda6a68de4140b04ea3637a46e511dc926f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543694, "uuid": "b6d9e8b6-a330-477d-9d54-12122ab19fe8", "value": "T192C3E709BFA10FFBE85FDC7301E90B1A258C6D1716B63B767534E858F24A18B0AD3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543694, "uuid": "ed11d8bf-422e-4d67-8613-36744255da3e", "value": "1536:YaDeho+HPtElSuLBina17EjtVvlb91VPwdQOADL27Jqlk0DrcDHnBGVRIdpCNHGf:nK6E1ud17EDwdQOQ2oeLBGVRIFO090M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543694, "uuid": "461c46ba-e36f-4feb-a514-263a07e9c00c", "value": 129764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543694, "uuid": "882b7ae5-b79f-4bdf-86cc-fa1a1644ea70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543694, "uuid": "9f2ac211-6511-49c0-aa26-5ddd7ae6aa30", "value": "raul.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bf5984-a013-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787614212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787614212, "uuid": "02a1d4b7-e44e-4aad-a680-974c520e50be", "comment": "Malware payload", "value": "22fc0bb170ee22e071dd0773cd30adb2", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787614212, "uuid": "04d9f2fa-b2c9-4ae2-999f-6290991b5e74", "comment": "Malware payload", "value": "b8128e8b6060252381314a8d3033d4ec51ab09f72e591897a63d85d4040534c3", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787614212, "uuid": "387f35e6-fcae-4eda-a791-6baf14fc15f7", "comment": "Malware payload", "value": "617a3d61068732141d7840602491795656686d1d", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787614212, "uuid": "7f2a3555-1b5a-49ed-b871-8fed93986edf", "comment": "Malware payload", "value": "ca77a7eed405cc1d827445b394fe3aa45b52df289601b68fcf029832862e3f318cfbde102e3969655d611032f894f13c", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787614212, "uuid": "a485624e-5657-451d-8f0a-ef821395b4e5", "value": "T121314F9F51241B311102DD8E73A27159618ED6EB289FD7E0DE090FA982886CCF222B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787614212, "uuid": "c6a8949a-04b9-4c68-847f-93dca3cf1618", "value": "24:s0r4ziFLxczxSWSjEgG/xf38JMB0qMwdgEwflcb:Pr4zYVV2/x0GBbMwdefl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787614212, "uuid": "db80e23c-ffd0-43ae-a075-0fefe35e9342", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787614212, "uuid": "86a21800-3115-4c9d-8e76-b2943f95b11c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787614212, "uuid": "ccca2497-5d1b-4fe9-b5d9-205b2ea2ce39", "value": "b8128e8b6060252381314a8d3033d4ec51ab09f72e591897a63d85d4040534c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7346d82-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1787551167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551167, "uuid": "a7391114-f69e-45d7-88e4-a47c05ab3056", "comment": "Malware payload (VIPKeylogger)", "value": "3bf6c2fb529e57c7a3e7e7a78b2d74e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551167, "uuid": "5d3286e0-58b1-4656-a4ab-921eec22521e", "comment": "Malware payload (VIPKeylogger)", "value": "b828157a7e6831d28589cb14fef8e9637c20b9c305f9c92d19a19746ed4ce2c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551167, "uuid": "0ff60d74-7da6-4304-8e8d-182f2a0ba4ff", "comment": "Malware payload (VIPKeylogger)", "value": "781b10d3a4272395d3e4d1c04e673449437d42d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551167, "uuid": "4c98434c-f3ed-4032-846d-56868abf9224", "comment": "Malware payload (VIPKeylogger)", "value": "41a02084022f1c33fcb66ac4df9e5d213b7bba61d8f504dff3843a1564bec2f0a13c5eb4b8b8ab52f4e86068d710d7a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551167, "uuid": "5699c8ec-c043-4c27-ab3a-a07942012287", "value": "T16783EC4559967080A3776BBFA22B98D4E777076702841857B87C7880EFF1D09EEE0CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551167, "uuid": "157a50ee-96e1-412d-89f2-a981e557c936", "value": "768:YcrSPg4w185ip6/buzwqF//oSh+BXPtMnsSoxpPk6U42w40M1p3XaLCljf3ZFakS:Xgkp6/owPDDBDgDFt9d+kE7z+XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787551167, "uuid": "95149eff-8372-45a4-87a1-996186e36f3c", "value": 87282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787551167, "uuid": "f2de202e-5cf6-42b7-9e5b-e03a7a321665", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551167, "uuid": "e8b29983-2354-475b-a39a-494476374c01", "value": "Final Reminder - Tradeshift Offboarding_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566e5ff1-9f5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787535436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535436, "uuid": "07f2caf1-319b-4518-ab33-ae9b53740bd4", "comment": "Malware payload (Mirai)", "value": "38e99e727b8e8d9efb7282d2484c4ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535436, "uuid": "7ce46fdb-135b-463f-ad26-a5dfd39ba7b5", "comment": "Malware payload (Mirai)", "value": "b8f880f65a7023dd21c418f0bf70e9c342c7d72e594fbc416689aaf40467fcc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535436, "uuid": "a066348c-6a12-4f61-b5e9-9d3ebc81c635", "comment": "Malware payload (Mirai)", "value": "746c8ba5d5788b6763613c53146c4d1c32ce1320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787535436, "uuid": "e2b14214-7a92-4c55-b0e2-a4c9d90d843b", "comment": "Malware payload (Mirai)", "value": "c6e371df73eced662dd797c10f65b01a8b20d33f494b4a3b4090afe0923f488805052525491f2291b76f7a520fb0b7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535436, "uuid": "aabec144-78a3-4749-8bba-68a24b7eb7e4", "value": "T107547C45AF646EFBC41ECE310A2EC30621DD588BA2F9B73AB678CD4CB55A30915F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535436, "uuid": "bbf42d2e-c973-4082-a748-6f291a89a538", "value": "6144:YfXTvXkWuXk4XlTmu532/ote4CMSGXtAc1RCdNQLcA8xbLtLLBP9wB:Y/T09ldQsCMSG6YxQtLF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787535436, "uuid": "8b0bd83d-8fa9-46e8-ad2f-5e57c213eb8b", "value": 287384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787535436, "uuid": "2c4f1618-e457-4f24-b8c1-b65f15df3f4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787535436, "uuid": "c58cbc06-5ec1-4d7c-baa7-50a8073fd26f", "value": "415c91ff2b7098268f56db653448aa5a5ac7db9692e58b997b721a83bc3b8e6f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b47b4b8-9fd5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787587359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587359, "uuid": "abc6219d-9480-4e88-b9be-47749d23687d", "comment": "Malware payload", "value": "1bab483411938183916160326ce17e69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587359, "uuid": "e283a0af-39ac-47e0-95dc-cf055323e38d", "comment": "Malware payload", "value": "b949007bb4e1adcd2026c61f79d379dc349bfec86fdad8baddeea64356159ca5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587359, "uuid": "c0c74328-bbc1-403f-a62a-82599308992d", "comment": "Malware payload", "value": "94d00b47c201a94e77fa43ca456b6e8c8a5a16c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587359, "uuid": "16ee6b99-ae3a-498f-8db7-fdee3af8d6d4", "comment": "Malware payload", "value": "d1aa091feebd388eee7080b6f0dade61b66ba28107df49e141fba7c3ba3720fb4ddd5842b8e0ce950d1ad4d58f14494d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587359, "uuid": "daf52631-47a7-4fef-88f1-f501002afd35", "value": "T1E1C27D966A867C44BEC94A3E4CBD1B1D6DF5C3D1324942AC3D8A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587359, "uuid": "0c2aafe2-b45c-42d2-b365-acf82e6ac9fc", "value": "768:r8vCB+25j6es8RoH9FYpMSUpi+20qUpi+20YQX:r8l25Johd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787587359, "uuid": "1c3a7625-4830-40bf-8809-b182baf7f938", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787587359, "uuid": "f1050c7b-a51c-4fec-909f-748e1126edd7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587359, "uuid": "6d7f08c1-413d-4f7c-acf7-11069797bd51", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d689b407-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536939, "uuid": "b54a21ad-78a5-4c51-9284-4406f0d3609f", "comment": "Malware payload (Mirai)", "value": "439cb3a82dd4251397a33d8a1269fd75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536939, "uuid": "d246c5e0-fc97-44fb-aedf-8bbc289f728f", "comment": "Malware payload (Mirai)", "value": "b94c5392ef73b9b3a8a930005f2d48d273e3179553131bc294562ac64c7effa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536939, "uuid": "eb893c84-fde7-410e-bf18-f1bd6bc4ad1c", "comment": "Malware payload (Mirai)", "value": "09cc740a50092b970428b1a7afde17687cac791b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536939, "uuid": "ab1a4b8a-13da-4c8f-b188-672cbd2f8f8c", "comment": "Malware payload (Mirai)", "value": "8d78ff2ed96255e4d283ce503b670f2c50222bca80b5af006d914a88631142d2517686232f20b9de35c90cd9ac3a783b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536939, "uuid": "2bb2434a-8993-459b-8786-5079cb804a3a", "value": "T1A2143A95F890DE52C6D5267AF96E518C331313B8D2DAB106CD244F38B7EB85E0F3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536939, "uuid": "b40e2158-1715-46ce-8625-9fadaf007a96", "value": "6144:sRlL8s/kMmKTUQ4g8O592I0zMp0No9MpM1J5km:2lP/kMTTUQ4g8O78UNMi15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536939, "uuid": "ad0398d4-939c-4546-98a4-f30f16d68899", "value": 198320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536939, "uuid": "56d183bc-b3c8-4cbc-8b61-f6eb5c13134b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536939, "uuid": "831695d8-1a35-49a5-98e7-39f11653b205", "value": "bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb777b3-9fdd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787590959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590959, "uuid": "3d812068-799d-4f7f-babe-30f65d5591ee", "comment": "Malware payload (Vidar)", "value": "72e83993135fefb794e68bf3f051bfa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590959, "uuid": "09e94536-bf4b-4948-a1c1-5ebb092aedd6", "comment": "Malware payload (Vidar)", "value": "b9c86f9be2c5c29796f1ffbe53636400add4e4329350d2d839928542cc05786d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590959, "uuid": "0a3c8bbc-1316-409d-8f6f-16c6ada3e0f3", "comment": "Malware payload (Vidar)", "value": "ee043791c94bea70054e147b5f8ed80ea1c9ff0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787590959, "uuid": "5d4830d8-b0ab-40d4-bfee-614605d4d2e1", "comment": "Malware payload (Vidar)", "value": "39944bc22ac6741751792f5ee812e8577dc30d0eb05ac77257a8ed7ce6c01a02ed5edaa6fb14ef0cc4cd61b93686d35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590959, "uuid": "ada64b19-7660-42d9-a598-051181b7570f", "value": "T192183303FD9580E5D8568B35C9BA8553BB32BC8D9B3A33D32E5066382F793D06AB4315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590959, "uuid": "8e95f7ad-2c15-4fdc-8be6-c4f27d1c92be", "value": "1c1ad2adeb06878a984583db245d2aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590959, "uuid": "3c46c746-7fd2-40f4-9fd2-cdc065e03a43", "value": "1572864:uWP0oyyek/qPkhT8kqaMLJnqR/nVMtuhEQc8K5AuFwZTluS96vlWQxMTEJ1Ln9S:VRyvk58krqnqR9MqEB8K6uB6oTu0Ln0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787590959, "uuid": "9ee51f02-e89b-42a4-9b9f-7bd8cdf395c9", "value": 93137520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787590959, "uuid": "98cfa039-4af1-43e1-9796-cafbdaa35efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787590959, "uuid": "129f3542-a36e-4810-bd49-56e972ffc2b9", "value": "b9c86f9be2c5c29796f1ffbe53636400add4e4329350d2d839928542cc05786d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1432d4c0-9fce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787584287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584287, "uuid": "d6a2ed08-9cf7-456c-ba15-e4371603e080", "comment": "Malware payload", "value": "871a51614feef33df37c0ada52533b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584287, "uuid": "567a5e72-b5aa-499f-96dc-3f10e5bd2a75", "comment": "Malware payload", "value": "b9e7f7e5f474a4c99a83fb34880bcc168a3585126d06281333443abd6c05650e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584287, "uuid": "dea504d9-ec65-4535-94da-2bfd501d739f", "comment": "Malware payload", "value": "65f2efb17de1b9663fb28e670f67fcdfcd90d2b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584287, "uuid": "d3a67da8-5b5e-437a-8414-9da2839204e1", "comment": "Malware payload", "value": "3d7af13bc42f52a35e7d70e22158ee9f5235980a5fd7b94f2a5f9e5ce142f4aecc42c8fb0238acaaa72fdb2fe09e4100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584287, "uuid": "f1f3c0f6-8484-4c1c-8445-5b9def48ab72", "value": "T13DD34C37B709AF63C77D52B40EF2CA39D6E1264109E29095B312DF1C6E351A92C2EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584287, "uuid": "a4c45f3c-d6da-442b-ac80-0dfbcfb45cec", "value": "1536:AdnBJOm5YE3N9SdYEcZOepIugAiT9nWD53C9iIUKiPdXRWoyRFZ3d4rr6:AR5xHEKlIJJT9itCxUKizW73+f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584287, "uuid": "b1e6edf0-1366-47e1-a601-48db7bb56c18", "value": 140512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584287, "uuid": "b98cb7c4-cd6f-4686-a92f-8967e7cc38cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584287, "uuid": "a2c4333e-8cef-4d11-a4f9-3f7149dda26c", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d409c1-a004-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787607860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607860, "uuid": "06aa8bec-6193-4c2d-90d9-dee34014432a", "comment": "Malware payload", "value": "894ede3740869d35162555f974f0b9e7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607860, "uuid": "eba1efa1-1ae6-47f8-af54-da29cf533742", "comment": "Malware payload", "value": "ba15814980b4e622b00a3d4fc739681edea7549b3ae0c99de79d2365da590264", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607860, "uuid": "73d4b18e-0695-4380-9a3a-a471aff1f11d", "comment": "Malware payload", "value": "0cb7f67a42d45518ad926b8d0d0fcc4a55b76bf8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607860, "uuid": "b25d6b03-4556-4bcb-b9b1-3e995852eda2", "comment": "Malware payload", "value": "69f65142d58063667988839dd2a5fdc6cc1b2bc2958e5fdf29362e43ec56c14ea9b67d0317d7e21425e0ad29b2b499cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607860, "uuid": "53111c6c-329c-4f13-9258-4cd0aa5022de", "value": "T1C2235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607860, "uuid": "7a03d648-525f-4b0c-b7ce-bf550af65086", "value": "768:9+iJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9+/cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787607860, "uuid": "11cb387a-19a8-4b96-8d76-d315f54a172f", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787607860, "uuid": "4c33be3e-c4ef-4d78-b6ec-b2e5f6d20f71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607860, "uuid": "ffd3eb1e-d854-494f-9be0-272f8789be68", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8562d4a-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536915, "uuid": "436df9db-babe-4978-94bb-b120a7b22e91", "comment": "Malware payload (Mirai)", "value": "7732c5edaf32ce1f4527a54712a8c43a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536915, "uuid": "2b9714bc-86fa-41e8-8cec-3ab740892016", "comment": "Malware payload (Mirai)", "value": "bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536915, "uuid": "4672d57e-f800-484b-bfbd-1d1253a39ca9", "comment": "Malware payload (Mirai)", "value": "292dc0088344c3afe6fd07ee2baec744d2c50825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536915, "uuid": "d011c205-5fec-41c7-813d-f25a1c2f297c", "comment": "Malware payload (Mirai)", "value": "963b781a67b14d762a13de2e12e51d9a7ed9b8941a981b93dd7616d659a7014da64a33ec711ece796c9a6e99572006e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536915, "uuid": "53f44044-14a3-4fd9-947e-35e31a03c34c", "value": "T1D88302810A19DCF4C0FB753BFE5656919B049FB4A33370F0652AA9807E618FB17B609A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536915, "uuid": "f57dad48-c02c-412a-8c7d-c86bff78cef4", "value": "1536:D7JFmTfIiqP4nhugNxJOKp071RHQpTb7FSNxrpJA9ECspB4Ef7:D77kIiY8hugwQubwpRSNxrcqtpB4ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536915, "uuid": "ad9631af-5eac-475b-90ee-5332c4037c1d", "value": 88120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536915, "uuid": "4874aa9f-0d47-4025-939e-62e49a921078", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536915, "uuid": "d50e9b96-d1fe-406f-874f-6b4f293238e2", "value": "bb7d7c7f6dd3c346fb58a182fe62e5ff4e34b02efe8b13d686d98bf9adb575ce.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bcc127-9fd1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787585546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585546, "uuid": "9885b9a7-bdce-403b-885c-614caeae52a8", "comment": "Malware payload", "value": "62a5720ff6e7264aa3836eb9706f85c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585546, "uuid": "3b87b687-c152-4f6f-9101-f22df6b5c3e7", "comment": "Malware payload", "value": "bc6cb72c52a29f3f250446456f41d68c789a56d92bbf19e735cf1f10c33a19ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585546, "uuid": "7fe52eb3-b7c0-445d-bcd9-a7046e336ba3", "comment": "Malware payload", "value": "a6cc54acfd22f12bb1490a528cc0501474ba8073", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585546, "uuid": "bb33c8b9-5b01-4f13-902d-42248fc26b0b", "comment": "Malware payload", "value": "501143927b5e7d82381eba014dd2ffa99e9a54381a4691fb171025d900a8516684b655ece7dd1fcf1275621f66211cc9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585546, "uuid": "9fbc59ba-9041-4f92-9912-0d07167c1905", "value": "T184236C6526857C15AA99C4371C7E2F0CBDAD43E6320852DE7FCE3CF28C4A69DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585546, "uuid": "e2658879-db17-4da4-ba32-57a9ae39a183", "value": "768:4csr0a1ldO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2hbcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585546, "uuid": "0bdbfb4f-c3ba-46e4-9228-5e6aeec3cefa", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585546, "uuid": "a82f5bad-c626-460e-95f7-763a2a00e5cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585546, "uuid": "9003b55f-1077-47fd-9c46-563c958e4cf3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326373bf-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787579184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579184, "uuid": "9e2c159d-411b-44c8-a5c5-69eefef4df60", "comment": "Malware payload", "value": "95d454d47ae2437e6281a4da8c533095", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579184, "uuid": "cc17bc24-fd23-4ad3-90e0-9a756efca762", "comment": "Malware payload", "value": "bc804bda57f853dab5efe5dad9926b361211b32c5fb5392833bcb62fc609a722", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579184, "uuid": "60bbecb0-a79e-42ce-8a71-b5eed3e189ec", "comment": "Malware payload", "value": "e4975c6368ac4313a6afa61da4a721492252b7a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579184, "uuid": "24c3a567-191e-4569-af60-14cb280e8fb4", "comment": "Malware payload", "value": "b1335cb9a38369a86967c32867b6a77cdc238ba7456bf6367e2454623f7f9541e5652f6a4e3de39d7b6b75445bbdc137", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579184, "uuid": "9a03565c-6525-4952-887c-6c6d17e10a91", "value": "T10EC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579184, "uuid": "303645a3-bed5-473c-92b7-f8bb06257cd4", "value": "768:P/8vCB+25j6es8Rk29FYpMSUpi+20qUpi+20YQX:H8l25Jkgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579184, "uuid": "5da362ef-0e28-4292-89ab-c373d8dafbc9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579184, "uuid": "8a65f78a-0b43-4eec-963b-d13911229bc3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579184, "uuid": "8bde1fad-0599-4762-8604-9e424007119e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ad00ec-9f96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787560617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560617, "uuid": "05f381e1-fbc2-411f-a85c-6eca5b9f076a", "comment": "Malware payload (Mirai)", "value": "89d3564004c4ad5cbaf0eea61c25c5e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560617, "uuid": "d4b615dd-12df-49e5-8be7-18b21bf79915", "comment": "Malware payload (Mirai)", "value": "bc852a450ebe388f8c170f37293bb6a2ec9c5b8bf0e205325db435890588967b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560617, "uuid": "7e6dedaf-fbfd-4b09-a5ba-836d19e4f775", "comment": "Malware payload (Mirai)", "value": "a4c2ea9aa2e74246c62dfce2fed2588c38031cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787560617, "uuid": "734972e7-85ea-42c0-a4e2-b0b39ea79de2", "comment": "Malware payload (Mirai)", "value": "3c6357c1ccb27c09959b9804da88a9655d57770545f5262081e0b9a75fe326a39565a2df5e8b7082f533b7f043b905c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560617, "uuid": "29c4c965-a39b-47ae-85bc-e9a557742b01", "value": "T150B31A86BD814A12C5D613BEFA2E118D3323177CE3DF72129D106F2467C692B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560617, "uuid": "b3514d22-df19-491b-9be2-d4d9391c78ae", "value": "3072:y/2DlVYCf0qVqBOQnOfGTqxggUMj32obvqaSsvaf5ozlWDFKE:dmC9dKOeTqxggUg2obiaRacWBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787560617, "uuid": "dd12959f-7ccd-4881-b4c8-1520c3790c11", "value": 107912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787560617, "uuid": "c2a0a78b-1b73-487f-9453-3c49fd2e57e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787560617, "uuid": "452c2ba9-a636-4e78-99ec-17991b509070", "value": "qtm.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c725e31a-9f90-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1787557959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787557959, "uuid": "9a04b8c5-52ab-4aea-b43e-f2128ec07a81", "comment": "Malware payload (AgentTesla)", "value": "0bb9a60bb42e953682bd0ae016704075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787557959, "uuid": "aa9faaa9-7dd4-4388-bac8-41f85cf23049", "comment": "Malware payload (AgentTesla)", "value": "bd21fdda899e4f6c30256dfdcae7190019c67d75a843b7812469dcd5cb6d5199", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787557959, "uuid": "1661c823-90b0-4c3c-b971-abe5184f7458", "comment": "Malware payload (AgentTesla)", "value": "bb136bd9235afdc77928bbb61a84924bec427458", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787557959, "uuid": "d7c55caa-e84f-42fe-a463-ab2975bd0025", "comment": "Malware payload (AgentTesla)", "value": "c8e533441a218f5d9153031dd4d8768080ff66c0e7c7c6fd962939fbe5648cbfd7b8474b00c7305134031842fa8b743e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787557959, "uuid": "6fb40bc4-7939-470c-b888-ff61afb0a90c", "value": "T1C206F6855714E57669AD532CF6BE85306A0923C740C8DF2D307C830BBBB399BA36DAD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787557959, "uuid": "bec135f1-6718-4893-8612-5b0f86de1e19", "value": "98304:m5BSboAmBT63KzkvwzQpPfZTYu9ao1awik+uLR7ZNSM/oPmPrhhLd:mrSbTcT63SMIQtZyIik+qV9/omPrhhLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787557959, "uuid": "dc2d1958-9767-4952-876e-bbae20ba45fa", "value": 3763773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787557959, "uuid": "021aaaca-0c33-4d14-9b6f-601915c0843f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787557959, "uuid": "b162790e-8d40-4506-9d36-e9ecb819bfb3", "value": "cubkcyhj.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508fb934-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576657, "uuid": "ded0be42-191c-40db-9145-b3e5c5cf49fc", "comment": "Malware payload", "value": "c6a98f5e9a1c998248f3595dcf0203da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576657, "uuid": "c6d4f894-4ba2-4c66-a9f4-1d3095c48cbf", "comment": "Malware payload", "value": "bd659b795fa6b5afd7e2d63341a5f598cb02055d6d4e8721abcee9698bc53236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576657, "uuid": "42091093-4d3b-4112-8ab1-7366115186b0", "comment": "Malware payload", "value": "eb4ed64efba1a0e1344b0f3860df220c1301949b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576657, "uuid": "9d8c253c-1e84-418a-8e51-54116d8c41d4", "comment": "Malware payload", "value": "8fc02b028f7fe2f835bf10c78f729c0347a2fd4c21734edc6f5dd7b7fb12258669cb3b495e16480c414c2b8fcf70bd61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576657, "uuid": "57a3cf05-f7d6-4684-8359-188e7e0a9e23", "value": "T14ED21A3AEB724913C4D499B895F3832CB9F9425F647D4A163C6B0EC4EB91AC06113FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576657, "uuid": "d7c906f7-3183-4a64-8b7d-98e768a43034", "value": "384:6ysT8AllDko1OxoUmdKzN57tSezXasmFFU+pph1K7R2h:6ysTZ3OxoHqBNeO+3K7Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576657, "uuid": "7f2d20bc-d18b-4af5-8fcf-525bfb765510", "value": 28836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576657, "uuid": "d2dd5fc0-a8c6-4877-9641-78e5ef9b95e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576657, "uuid": "721d4607-70a9-46a9-965c-384c95aaf523", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907915fb-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787550995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550995, "uuid": "c79eedb4-5d56-46c5-8a37-dce602705e07", "comment": "Malware payload", "value": "b7d3d0fcfa60f0850b9ae0156a806469", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550995, "uuid": "9840f91c-8440-4523-be5a-37caf8dafd47", "comment": "Malware payload", "value": "bd98461bf7164df0a282703db44122fb887a910094a1e257fe17a13629f0d956", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550995, "uuid": "f682d3e2-ec4b-40b8-beb0-83ce111b1da3", "comment": "Malware payload", "value": "f3dbcb7eaa5df2ad26448d112db6a4d067400ae1", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550995, "uuid": "9fa44b69-bdbd-497e-8792-bb8d07595a68", "comment": "Malware payload", "value": "d38ec4480b54f4ecdaf1955ee9654b57ec343a91540561bba0bfe789e359ecc71876a6c69f3decf4b2b08e5dee91a9da", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550995, "uuid": "562de207-b027-4380-8a01-d745414b8880", "value": "T1ED14A0C09392D16B165F8D122F067BC9BC68D5EFE0D45B06F084BE4EA6A821BC5D4BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550995, "uuid": "4f204580-85d5-41ce-a53e-ff3a902925b8", "value": "3072:8HKwNHatZDKHl3lPmm8SOXqt8og5s5xPs0i7lwDHH9Haon2Lbuqdy4tRKhFL9Gg8:ONHwWdlPzg0BDHxobuqdRKhFwglk0EK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787550995, "uuid": "8a81dcea-9cea-4e60-b72c-897e414a5206", "value": 196559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787550995, "uuid": "3af00e8d-3009-412a-9fe0-e8a3893d23ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550995, "uuid": "31021007-3281-4b94-b71a-48d242e9f9ca", "value": "New PO-3D Drawings DWG.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1a000-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576666, "uuid": "5ded0f61-1ef4-46b0-b5b7-376ea07c6bb5", "comment": "Malware payload (Mirai)", "value": "8c088b5dd869b8c682ebaebfbc616367", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576666, "uuid": "1f5e5a21-1d20-44d6-841c-26cf286fb76b", "comment": "Malware payload (Mirai)", "value": "be5d432f96af021393acf6bee8d2f7c1f246dd21165ef5feb74d5aeff7a9b0d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576666, "uuid": "71d65151-0080-469a-9b93-c1af818e0815", "comment": "Malware payload (Mirai)", "value": "b0623121c6b392b4d5fd4009a7fed062319cc0fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576666, "uuid": "0c0ea204-47af-4f87-8378-7659755028bc", "comment": "Malware payload (Mirai)", "value": "86fdec12572b24b5c5701ffb493aa40e5925dcf32175c6e0ca5c3b56041fd1cea9818fddecd7903165f019cef2a594a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576666, "uuid": "d8d437eb-a9de-4721-9edf-7ed50c1b89c7", "value": "T1D492D0258257AB82C5B204B6A1254E8BFE3A9131F1EB30402271B774DBD7142FBF225F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576666, "uuid": "6e651a82-fb1c-4a25-be5e-d2daffa16e43", "value": "384:bs8o6sY6ut0jEumRVPIrMOkuB4we03wrUUt8mdGU55YMowfi:Hxt8mrP9OkuqwegEJt83U03wfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576666, "uuid": "1c77f61b-3245-4767-9b62-daa085c13e84", "value": 20712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576666, "uuid": "2ac9508f-7f04-4eda-836e-91c3eb6f8690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576666, "uuid": "bba2ad6a-12e5-4f26-8dbd-c2588ed1502f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545a0223-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576664, "uuid": "54fa167b-2f1d-413b-ba5a-fb5ffbb67f22", "comment": "Malware payload", "value": "d7d70e2f0bf2fc3eff2f3b4fe0712687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576664, "uuid": "de6a24e5-f22b-49b8-a54e-a10668d76d92", "comment": "Malware payload", "value": "bef057527f8fbbb1ef79860ae831cfcc11b6e28dddeac6424cf7e7b70c14a491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576664, "uuid": "1872e8e1-dd2e-4967-a1b0-d04ea7c50d57", "comment": "Malware payload", "value": "4c1bf3091ba91c82492636900d72df58eb3647f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576664, "uuid": "54633990-673c-4380-b7fd-c57dd68a6ca2", "comment": "Malware payload", "value": "759154e0d675fee5834f483317af8b822d06846cc5d9f416ce7f23c7be08c72336e5b778fa73de9f5438c9f795aa0958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576664, "uuid": "88dc1e82-7104-434c-84ce-0aed90ff8830", "value": "T16472ADE7A026F5F1C531BA7A18140AC4EF6368253913870706E473BDDDB5AC86924FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576664, "uuid": "2f069c6d-9df8-4f5f-b4d9-71d9494ea59f", "value": "384:QLu2HCUhIQKNdoNoSgdYiPsknUxaVXALppkXP+Gxm:gtHNIQK0ilP/dNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576664, "uuid": "40265458-b3b0-47e4-8aab-5bbbfc6af38b", "value": 16756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576664, "uuid": "c785a851-9a99-44fd-82c1-b7f6e837ae03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576664, "uuid": "72279865-0d1d-4339-bb90-90463fd63b75", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c24aba3-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1787582609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582609, "uuid": "21540026-4cc2-46b4-8254-6e7beebf92b1", "comment": "Malware payload (Phorphiex)", "value": "57110faf7b60dde206d2d6a6fbf6ebce", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582609, "uuid": "78fefe51-f9e0-49f0-beb4-69965bc31e7a", "comment": "Malware payload (Phorphiex)", "value": "bfd7b0764cac3148805c3d8d13e8a07b2f3e030a40f52c5796c8cb3c0548750b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582609, "uuid": "682a1f8b-a157-419c-8eee-4046f2a93c6c", "comment": "Malware payload (Phorphiex)", "value": "8b490ccf90ae7b737177cf537a8a47eb27c8e964", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582609, "uuid": "6027b603-9f2c-4d41-b6e9-afb4e0dbd9ca", "comment": "Malware payload (Phorphiex)", "value": "3d133a010ef644c908cad91e74b75753145f62a1454070e13ebb1309c4b47a5956f9bb150c7fbd504f8158853b67dabc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582609, "uuid": "ff59f50b-546e-4a18-9d6b-dfa4fef01e40", "value": "T114223B2A6E890231E3A048B456758B8F553C56737387B3EBF3339A490FE5145D440AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582609, "uuid": "7f8ee10b-3b6c-4664-988b-5246f6700793", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582609, "uuid": "ee0e2186-715d-4f2c-ba38-05233412b9b1", "value": "192:uecolWLwz8KBatdx+e5CPFJxTEZmFhSorccGFGp:u5oB85wxPFwZKMFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582609, "uuid": "3e30d3c5-47a2-4016-b0be-05e15e3c3f82", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582609, "uuid": "13c7e6de-0682-46b0-a8a7-368640b419d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582609, "uuid": "e7b6bbdb-ba6c-4e89-88c0-3b180d1eb7bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84352d4d-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787598648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598648, "uuid": "040ccb1f-6832-4481-b3f7-91edc4b4f613", "comment": "Malware payload", "value": "1d6bf691e97bc84b9e8336a71999300c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598648, "uuid": "6ed5bf82-bb3d-424f-b15a-f3bfc6ee3d26", "comment": "Malware payload", "value": "c1353b26a025f7cb9c5b232f87e9d1f40ae92f87ceca592e6326f1296f419ca1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598648, "uuid": "aaaab40c-ca6e-43e7-adab-a121cf677782", "comment": "Malware payload", "value": "25aa2de8cc67542647812e4b6d057064e985a92b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598648, "uuid": "617ef49a-b7c0-445d-8279-18e6419b09d5", "comment": "Malware payload", "value": "d0ec34e7aa4ce780e5c5093354bb37c06b22058f2af4acabc59c80a1cb78eac3a6a909af250cf0fd25cb16aa0e2cb831", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598648, "uuid": "94768634-6d09-4b90-bf12-5d4887f2b024", "value": "T10FF0F46A041A35378B23CD28CB484646B22BEA8098D2374BF2A00D1AA801E8273952E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598648, "uuid": "9ff5ee74-25ba-4765-a6fc-7d307a72a54f", "value": "12:381kUM8YFEqROpdzh3g9ivFU1AwTh3lHFU1Alh3QHFU1AyGh323FU1A2wh34r0Ae:3D8Y+M4dzxg9mS1A+xBS1AlxQS1ABxgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598648, "uuid": "79531779-074b-4293-b9af-8707d562502b", "value": 587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598648, "uuid": "1afa83ac-16b1-4192-ac21-37afcda4c05a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598648, "uuid": "119cb95e-1bba-47fb-8cf1-5cd5b0733f59", "value": "boss.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b670ca0-9fd4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787587037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587037, "uuid": "ed7a2536-7c8e-4cd7-8792-3abc7ed85559", "comment": "Malware payload", "value": "7ee900d9853699e17b5872db14d15df9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587037, "uuid": "edc4d292-9637-4e29-89ed-9847c98f4893", "comment": "Malware payload", "value": "c20e18f5a2efcdb5a128991570c50bb57236d9b09667cc5cfece1f9ada6e2129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587037, "uuid": "bc0ea242-7615-42d8-aa4c-07c19eb4f281", "comment": "Malware payload", "value": "96ef7491e05edc24a64797e65569f32a31e0ee4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587037, "uuid": "99ffd2fa-6724-474c-9020-d00f02fd246c", "comment": "Malware payload", "value": "bb05a942aa3c70a388e7f5450ae3b1c9d3950fad825aab6b3396b35029d1fe1b82c4f40bb9182c266ba7d77787d94eef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587037, "uuid": "b4d4a054-4e07-4184-b974-278325666671", "value": "T160551E8ED8919BF8B3A6F773521AD6225CF6344780328631CF457E395F02F24A524EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587037, "uuid": "da8655ce-5fa8-4023-9457-c23a73cf654a", "value": "12288:DKnr3gPi2qT/Q6hGT692vl9Iem6m9gEBi:DKr3gCTY6sUeBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787587037, "uuid": "ca637abb-bdab-414d-b9ad-2d197e6122af", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787587037, "uuid": "43d58166-93d1-4a52-a514-d920d0067e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587037, "uuid": "90db2e9f-5a6e-41ef-910a-8344151818e1", "value": "ea5b61bc8d140124753c3ec265b5542e0dc5323bfc613e365339a4819808360b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cbd0e4-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576661, "uuid": "98191d5f-d7ac-41f4-a6f3-f945397bdf53", "comment": "Malware payload", "value": "07b6a1fc1f2ba6ce901ec0aa7abf7a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576661, "uuid": "bd7d677b-af1b-4680-9bc4-3254e4c282dd", "comment": "Malware payload", "value": "c33601b5d1bc12a29b51c500b60d1bd61c36c8919c108c5dffb8c7f5b56321b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576661, "uuid": "7e7cc9c9-ffdc-4bea-b782-358aa58e9818", "comment": "Malware payload", "value": "c073b4efb255a40cfd081aea9e54f123b78c6778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576661, "uuid": "e66404ab-1c06-453e-8127-7732d32f8ebe", "comment": "Malware payload", "value": "d5db62051aaac2128ab821f764e5c40eea4668e581cef465e9d251d90333a6562167fe17b5b5b7162dd5015c3c20b2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576661, "uuid": "d9830fae-8905-4510-8049-6c5d4df16ed8", "value": "T12372BF67D3E60508C27D50721C6F3D082D65D20AF18C99F77AEC707B1022B663D2D69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576661, "uuid": "0edfdf68-b908-4d42-8061-86c2c7837c27", "value": "384:My94BjdrDUZRY9A+/xV1c76N3Cau1q6oANaNJawcudoD7Uqe4cDMmz5tIHv0F:594BOp+S2N3C1Y6KnbcuyD7UDMuGP0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576661, "uuid": "41bd7365-3a7e-4245-a736-ac0bb23f22b8", "value": 16036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576661, "uuid": "216b2f09-f3cb-4610-8ff5-9ee2f1a49ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576661, "uuid": "65319eb3-7a60-4307-a196-086bd5f13f4a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c4bbd1-9fae-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnappyClient)", "timestamp": 1787570579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570579, "uuid": "d064d442-332a-4d6e-895d-6ac7384b4987", "comment": "Malware payload (SnappyClient)", "value": "81bc38164e22acd98cf0a5d5f1dcfd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570579, "uuid": "cc158fe2-7bba-48ae-99bc-974eb7f86f7b", "comment": "Malware payload (SnappyClient)", "value": "c4bdfb0eb41ac6ea16b24ae5ce9d0a06c17f1259bc08416ddac1a08e3dd10741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570579, "uuid": "c8cb95f9-8452-4781-abaa-27719de709c7", "comment": "Malware payload (SnappyClient)", "value": "58d0eb16607ac6cdfe0e4b5d6cd6cc10b6d78044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787570579, "uuid": "0b05e284-3642-4643-bea2-649a9024cb03", "comment": "Malware payload (SnappyClient)", "value": "9dec1de8697676e598eda3c19c745b184409d666547545a9d3126be12e8d44d3c6385804e373450c48f90a2039e8ab04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570579, "uuid": "fbb5fde5-ae97-49c2-80d7-7fe208e6b29d", "value": "T1B3963312736351F0CBF987728E5F8B2BD5A2D9855B885E87D64B4E0F2FAB051120F4CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570579, "uuid": "e7e74f14-4657-4739-a74b-2c28ba3edab6", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570579, "uuid": "bd380b5e-d28e-413b-865b-fc7d6c39979b", "value": "196608:+p2t8q219RyqpGLyBvQyGfdL2g+2aeEj/i74b14ghyYG4CFItRu:+pHtRyqswSZJ+2ZEj/isJzCFItRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787570579, "uuid": "37c657d7-3c7d-4386-9db9-5bab0fc5ab81", "value": 9347433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787570579, "uuid": "599d592f-25be-4f1e-9473-45b3aea8b0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787570579, "uuid": "8bd90db6-f133-4c55-b294-ac0ce98efcc4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9198244e-a00f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787612415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787612415, "uuid": "30c58eef-76cd-4c52-a07e-10b9d0a3a097", "comment": "Malware payload", "value": "db9ce65907781e8d85f3c6507701ab0c", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787612415, "uuid": "cc5e2d1b-10f9-4a27-8de3-d8a1849e63b0", "comment": "Malware payload", "value": "c51e5bedcf9d77535405e0a93b9c38d956a07a66f0f99462033e6069f01aa162", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787612415, "uuid": "652cd1a3-69a4-462f-bec8-732c582aa2b0", "comment": "Malware payload", "value": "9414e02d14731f2142d13bea2601eb712126dbaf", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787612415, "uuid": "7828f542-0754-4e71-946d-dce5df488c8d", "comment": "Malware payload", "value": "50f34b1546412fae7e6deaa86161c26780bd3cd18aae7664293f8c769d11d4dda237de00370039dcbfe7a0be6282135d", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787612415, "uuid": "6715385f-d5aa-4146-a4d6-7342d406e91d", "value": "T10931869F442019311502CAAE7767358D628EA1E72CAFC7E098594EE9829C78CF352B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787612415, "uuid": "118494b0-550c-4bd3-add1-fa1222fe9c16", "value": "24:G2mO+UGSGPN4PZEtgQgaRtlBk85RhaYCo9y3dm:iJ94Bzhap285REYtGdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787612415, "uuid": "f290dc79-6eda-4c7b-9cfe-af53e4c12b31", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787612415, "uuid": "17a341cd-e8d6-4090-a34b-63704c1ede26", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787612415, "uuid": "010aff40-f5b9-47a6-a2b5-61ae0d61ecad", "value": "c51e5bedcf9d77535405e0a93b9c38d956a07a66f0f99462033e6069f01aa162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0043cf86-9fc9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787582106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582106, "uuid": "2f60561f-c58f-49bc-9a56-540ba13cc79d", "comment": "Malware payload (Mirai)", "value": "e6fa7da28a3aa53837b32f3d3761e3d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582106, "uuid": "ca657650-b4b5-4bd5-87b3-6d615cc83da5", "comment": "Malware payload (Mirai)", "value": "c61d0e71d8984a4b759a7e04408826a1a85db1e79b28f8f955bcaccc93d465c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582106, "uuid": "efb1c5dc-ba7b-47c6-b9ec-5939e1fd548f", "comment": "Malware payload (Mirai)", "value": "653254385f34998c5b1ed9d71c11b3780ac72053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582106, "uuid": "2298a831-455a-4eef-b4bd-6b1e57698e4e", "comment": "Malware payload (Mirai)", "value": "9de28cf3f41f98b2f6592182ff3abee2549b32cbe6f4c636162a9c2dfbc85ecb3299d81c26c994d413e3a95c2c7b74c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582106, "uuid": "91dada00-342f-467b-a44c-e8536277089b", "value": "T1B7244C52AAD24A13C1D3177AFBDF41063323E65693CB7306F92CABB43F8625A4E63541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582106, "uuid": "4a3710b6-9260-48c6-8875-493c2481af06", "value": "6144:A3xAoL4VpAnUsd2g0OPjF3TEanVsChKjFZOgEssMOgh5oQ3b2ZM/9/B:iAoL4VpAnUsYg0OPh3TEanVsChCEssMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582106, "uuid": "0b6e6e22-03f2-47a3-bbea-59f358d9f491", "value": 216750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582106, "uuid": "3b7b158d-fe9b-4016-a2e3-2e04dcc55ceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582106, "uuid": "d2b1887a-e981-457f-90b2-b80682206440", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaf3f4d-9fb7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787574561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574561, "uuid": "e3a93e43-1666-41b6-9e7c-9d70d93d4c1f", "comment": "Malware payload (RemusStealer)", "value": "d0b03f88e764bb691eb230f4f1079131", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574561, "uuid": "b12c5b87-4f52-4911-94a7-601c8a3f4f61", "comment": "Malware payload (RemusStealer)", "value": "c68b757774aa3ed96cfff4b2a3b5bbca511c17f2bc281ce9b17f49f6831fb4b1", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574561, "uuid": "67f2aad8-f9da-40c8-9377-b0a0b4719756", "comment": "Malware payload (RemusStealer)", "value": "c0f0cec15fce3ecf6fc9333bd2a32e7b3ac74a57", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787574561, "uuid": "27af618a-9649-459e-9529-a566db6435a0", "comment": "Malware payload (RemusStealer)", "value": "23ddfbe0734f965cd5dd7ef6747e9f8d896f1ab7ab867664ce4bc4a905215658d63d436f088d5f2a0236a3c3537aa0c9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574561, "uuid": "11889cb2-317c-47ad-bd24-d8abfe36fe65", "value": "T1C34649137A98A1B5D4E6E23596665250F730BC4C8B3133D72EA2AEB81F333C16E78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574561, "uuid": "6f7a266d-b12e-4972-bed4-08b0f3dd4aa7", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574561, "uuid": "511dfa38-bd74-41df-ab1a-f3a81ab2833a", "value": "49152:sLIXm9xYZFuf+QHHr2dDYwtuWwQSg2+bLYD18:8YZF8Edk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787574561, "uuid": "54141b32-729f-4ffb-8a33-afb76819d42c", "value": 5375488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787574561, "uuid": "b4710be3-044d-4486-8665-4c2b65602996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787574561, "uuid": "e96434e6-d768-46a8-a53f-5c1d2719cba6", "value": "setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e1f2a-9fef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787598776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598776, "uuid": "241915be-ecd8-40bc-8fa6-e984670cba76", "comment": "Malware payload", "value": "cd7c06f2de324054ca0b86042539e86b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598776, "uuid": "807e2fca-f640-4685-8179-e141bb32f789", "comment": "Malware payload", "value": "c722abf3b2b1c1167babcee38fb6ae40369e3e4bf5f16c3940647234a89a2987", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598776, "uuid": "5575b410-df4a-489a-a3af-5117d2e833bd", "comment": "Malware payload", "value": "e3a4b04eade0f53eeb6abdf778006932a84ea9df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598776, "uuid": "0884f91c-9410-4220-9f58-c94215bd9de1", "comment": "Malware payload", "value": "5aee90c0ece0af58a43ad196554e4e1eda58cd086f84ef4e23bd04956e8debb615548087ef4c8fe4ed64d18b3e3590a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598776, "uuid": "9f1ae78b-2012-4986-9a21-67e06e774656", "value": "T16941D1E8A460F6A3F1ADEE25722D92944442989F608D3E0DDD82BD31C8CC814F1ECF16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598776, "uuid": "c49f761b-49e2-4233-923a-a795f1ab7bea", "value": "48:QJCyv7vsM7cHzV1HzTtLHYaH0KCrj1XkCqxCUP9PGw9PRftyGY/GsnlBYAB5mfZz:QuhkIdLdpvjsPVM84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598776, "uuid": "2691e83e-45f0-4e63-88c8-49b07dbea65a", "value": 2182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598776, "uuid": "d3e7ba59-eaf0-4a02-a051-ee834bd061d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598776, "uuid": "c87d8ff7-535a-4f7c-aeae-ecc9e40467e6", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7961df1a-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787550956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550956, "uuid": "cab9456a-24ef-4292-99e1-883ff6632f16", "comment": "Malware payload", "value": "c352c595e330832ec460496a72877e10", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550956, "uuid": "4a6d9fcc-022d-48fd-88a5-589f88d024c5", "comment": "Malware payload", "value": "c7ef96dd4e55c807332fe99fe877530d7fccb7a6cfe0e39dc870d9e06964cac2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550956, "uuid": "b17dcdee-5aad-4c97-9528-f0f3a52fd14a", "comment": "Malware payload", "value": "cc3076e1bd73dd6b86e41c10a5bccfa56df1bc8b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787550956, "uuid": "8089c4ca-5478-4f07-874d-59531e1985cd", "comment": "Malware payload", "value": "75ab385321896b645d0e447f5a395fa547811506c92a65e3b279c9d8cf152c3fbca10ce8a69b1ea6a0e1cae10cb03484", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550956, "uuid": "a2e13345-ae54-4fbd-a669-39b20d64b633", "value": "T1C94321148593B6405373A36BA72F9CD4E77B076B01410D0BB9BCA880AFF2D19EDE1976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550956, "uuid": "86085ca3-151b-4aac-a0f1-a1cac0fede70", "value": "768:6pCutb/uYxT44Itt4enzXCwzCPgGEntCCVSIK2ZiXzgwzM9YOdcKXaShvQYVPqfU:6Mud7PI5eknKRu41vhjyuXl/3ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787550956, "uuid": "ba94ba55-7018-49de-8e7c-d7123677adf1", "value": 58789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787550956, "uuid": "acf4c573-e269-4178-8fc4-1f509c93c5c3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787550956, "uuid": "aeaa3024-79e3-48b1-9f40-10096e168c7d", "value": "Document_pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d08a12-9fc6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787581035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581035, "uuid": "b85c07c4-6fa4-4ee9-b6a4-870eb692bbfc", "comment": "Malware payload (Mirai)", "value": "5c162987be69c1fd2603e7f1d5f97ac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581035, "uuid": "83ec5faa-2d81-4643-9b9d-25690e74d4bf", "comment": "Malware payload (Mirai)", "value": "ca738cf38e647ada0e29ed2648d56c9626f049533a3a261de31fdd018f1e5ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581035, "uuid": "0696469f-a53c-418d-8460-c16df331dbd2", "comment": "Malware payload (Mirai)", "value": "942e2b3eab9023c384e515bb846abe026462d275", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581035, "uuid": "dee47c51-1be5-4b6e-a17d-9b0fe4bf5598", "comment": "Malware payload (Mirai)", "value": "6afeca4b62c4af5d17fd5a2b8dcaf4d125b49fe41ded1e9fd5c7057f1ec8283f50ad16954c2e618d2ebf4daac4b13c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581035, "uuid": "a08ab3d9-c608-427e-bc28-bfc4e0be37d6", "value": "T1BA93189AFC405B11D5D622B6FE0E114A33134BFCE3F971039E245B2A278A96B0F77915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581035, "uuid": "a7f8e71a-a6d5-4752-ad6f-113a1a734fe1", "value": "1536:8Nn5Tv3n9Pi12ABbl099O2O2ezLC8ekSFya43JBDWexWlOVyOiFDFZvGCCYkT:yvALBbaO2n3kSUa43JBXUVDFZvGP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581035, "uuid": "004d24dc-5294-471e-b92c-2f4db9c4996d", "value": 91684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581035, "uuid": "606a78cb-65a1-4b51-80b7-6e1778f35ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581035, "uuid": "1fae311a-3441-41be-824a-cac713587b3c", "value": "daredevil.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69efdec8-a006-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787608483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608483, "uuid": "a762f100-bfaa-4fcd-9daf-a418af13f30f", "comment": "Malware payload (Mirai)", "value": "13f0de5691a918dfd6713fbfb2bd32c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608483, "uuid": "7ccc6d31-bae0-4dd7-af6d-0290b48933b0", "comment": "Malware payload (Mirai)", "value": "caec10a5adfdec9ec202c091306a7af005e38f5b8cd0f59d0dfa5e3b41b343c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608483, "uuid": "15865e91-f56e-4822-b4d7-69f8b8829ab2", "comment": "Malware payload (Mirai)", "value": "bcc34d14b3680a1ed2d9007e1069a0a5684091a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787608483, "uuid": "33334fa3-c97e-4e3e-8bb5-c93a4c1c0c75", "comment": "Malware payload (Mirai)", "value": "46e9c9e607754a874fae557848c59ec8eeb3ab36a5e76333d5aa4221e91a26474219679112f313b59720d7e7b280f0eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608483, "uuid": "4b29717c-9abc-448a-bb31-5d1ff64f264e", "value": "T1C234E9096FB20EFBD86BDD3B06E91A06248C641722947B35763CD528BF0A54F4AE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608483, "uuid": "c71e5d71-bf9c-43ec-9106-72512f210aa0", "value": "3072:O1M4HYHWgMKp22mWuDM6+UThTdvDvmdiICSHPLBu1EssMZc/T03ImIys61X1h5on:2ncuDM9kBVjmM6vLKEssMOgh5oeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787608483, "uuid": "a4bca504-71b7-4eec-9652-cc8639862655", "value": 251812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787608483, "uuid": "25e2cdaa-84b8-466b-aa24-24521846a16b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787608483, "uuid": "785862ae-a88f-4a09-9269-c005f963877b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893d40bb-9f77-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787547117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547117, "uuid": "77851692-2816-48c5-b50f-ce9808040c6f", "comment": "Malware payload", "value": "f40f549eff44146673fbb3324f013c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547117, "uuid": "28bbc0f7-7b01-4779-b1fa-2885d65ad39e", "comment": "Malware payload", "value": "cb65f0e3cc600d43b6961e8f51d01c1286500fbaa76b1f6aaa576a36ae7567f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547117, "uuid": "27b05aa5-422e-41cb-9016-1b9b4ecc21ab", "comment": "Malware payload", "value": "9d87dc2db7b47f50d8dac0436410a84d55313f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547117, "uuid": "98f8e2ab-2004-4232-80b7-5b41885c9eea", "comment": "Malware payload", "value": "cb1c94a5574f64182211a5bb93578d6ae08405caabf220e4af76bdd31f2418ee9424cf50e6559b7851e37f381df1da31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547117, "uuid": "8735020c-b0cc-4937-bf69-18eb5770235b", "value": "T1B7D523897CB60875D433C3B29F92F46E702A3B454B318D9BBBCD2A009D22A655C37779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547117, "uuid": "1477cb2d-aae0-4b00-afb1-4e0d0aa2b0e5", "value": "58f4b17816a07f7a36dd14e504d515e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547117, "uuid": "8872e9ae-cffc-4015-857d-af1069451244", "value": "49152:jki9aNi/xJuayg/S7BOjOZKbPolFclPujFNSbnobqLD0UjxZOYh/VyCw+ZVZ+xXc:jF9Gi5lyesB+DbDoILD04LOSdyCFZ3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787547117, "uuid": "e845d460-6c45-49cf-abca-c00baf76e1b4", "value": 2968576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787547117, "uuid": "ff02f973-a50f-4c4f-ba42-7edf8ab886eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547117, "uuid": "fcb8df71-0a2f-4d0a-ad3c-9f1bbdce23b9", "value": "cb65f0e3cc600d43b6961e8f51d01c1286500fbaa76b1f6aaa576a36ae7567f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce3a9b8-9f60-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537218, "uuid": "7d0e6174-362c-4d54-9a5d-85c61ba36a95", "comment": "Malware payload (Mirai)", "value": "97811e532f64bb65ea81b9ac5b281b00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537218, "uuid": "472cb091-53dc-4dbf-86fe-5c6fb31d055f", "comment": "Malware payload (Mirai)", "value": "ccdc4a015bb2a334f7ed236b6b8ba4f40eaf66208e62d09b20a73f99fab1df41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537218, "uuid": "5ae86398-c207-4e05-bf60-d47a21a39504", "comment": "Malware payload (Mirai)", "value": "b989b80bfc6f3fad5c12ebd5ee6298232c440e65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537218, "uuid": "3046cb00-2991-4f6f-8276-39e0c1154bad", "comment": "Malware payload (Mirai)", "value": "e5511ed8b5e8244114e6b778c31ae16fcb8cda21a8d5c54eec733e953f093550777169336eaedc8669f88646dca8567b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537218, "uuid": "29613229-73aa-4bc3-bd06-4f116c3c7522", "value": "T127B302CDB3849F62E8555EB72E06E1D4F744CBCCEA775CC18A830905BA10A39ECD2E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537218, "uuid": "11c2ad34-1e64-4eb5-b6bf-dae73d1edbad", "value": "3072:rVC5HsgFWpa8hmyf53d6YqKkDgXiPxGNK79vTU+4u+qgwR:rVC59FWQ87f53QYqSU7do0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537218, "uuid": "7b318bfc-7975-416f-878c-36247fb22f6d", "value": 111540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537218, "uuid": "8cc17a2d-9dbe-4138-94eb-d8c3b37a25be", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537218, "uuid": "7659aab9-4532-4f42-9cbd-515065ee9edb", "value": "ccdc4a015bb2a334f7ed236b6b8ba4f40eaf66208e62d09b20a73f99fab1df41.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf9e45-9ff4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787600807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600807, "uuid": "8bd572a1-ec3c-4736-aa91-86cad04d2210", "comment": "Malware payload", "value": "e5fc0547a1a8802d3196abd82c35ff6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600807, "uuid": "4cee4a55-7a24-420c-a923-4e2503993750", "comment": "Malware payload", "value": "cee5f4234344c49796812e11c5b14c68089c09ee1c772e71ff1cc296a26925ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600807, "uuid": "25ff883b-9b54-40bc-ae03-9d9180f2bb14", "comment": "Malware payload", "value": "59828c00d5f8cd488184d85c4ef17aaca0830c3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600807, "uuid": "3a666537-f732-4721-add5-e4cbe7bca085", "comment": "Malware payload", "value": "ab0deaf6df8a3df97227aafcb2cbb0b09c262b55841329c9bd47d3ae0a8d2017652eb9e9c9f240f4f43940daebfc05b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600807, "uuid": "b8f95d97-0891-4eea-84a9-7731652b4859", "value": "T177410A146AE60714E2B3CB3D6CBAF21189767C46EE51CFDD019191885424614F975F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600807, "uuid": "5378c3cf-ff52-4532-9c54-86d611a11123", "value": "24:8E/BHYVKVWf+/CW55irVueUMkW+wlRgUoIbPOF3+/QT4I02YhX:8A5acoueHGwlRgBIbPOF3fMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787600807, "uuid": "6e52db1c-4204-4f11-aa8c-3254731dd26a", "value": 2226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787600807, "uuid": "e963076e-8116-4c5d-a143-f2e1c803077b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600807, "uuid": "4508cd87-ad75-44e0-8f2d-bf5d762f2a4c", "value": "Invoice.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61d3b33-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787577741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577741, "uuid": "4d784122-06fd-4aed-9d96-4fa7bdafd322", "comment": "Malware payload (Mirai)", "value": "c5de64fc280147912277807df6a332d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577741, "uuid": "cb1c1e5d-3bf3-47e5-9c00-8f9e6a2ef163", "comment": "Malware payload (Mirai)", "value": "cef0d49988aedc32523afd71fee671e90fb9c8d7f15990b69f36dd7caaf8a07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577741, "uuid": "51f1ea5a-8a4a-4c04-84da-0e61bd9d05b8", "comment": "Malware payload (Mirai)", "value": "74d0bcce25dd9b35ab5794073e70fe07aa1bf132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577741, "uuid": "e8b16545-1d5b-4d4c-8cd2-253010affc78", "comment": "Malware payload (Mirai)", "value": "14e92a771e771ef5a0c1ac19079dfadb360e1dd5a80d1dbdb2a0959886c91827a4cd5aeba1bd28107b18fefb97e7d10c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577741, "uuid": "9c94e972-bb16-419c-b797-9d6aa7510e6e", "value": "T17E33F24C82C82EC2FF6B7DF19D95F5D417AE5A2625E58C9331E4C72A2641CB21B60ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577741, "uuid": "1f49e9fe-95ec-4cab-9713-5ca694733c16", "value": "1536:KPUjhMYitTyka+ars3CBpXAb2B6gQ3afM4u+qgw09V6:x3STynrsyBpggmiM4u+qgwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577741, "uuid": "9502a1e8-f60c-4ca8-ac8b-b36c7097b858", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577741, "uuid": "e136159c-6c9a-4335-ab2e-27879ce0deb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577741, "uuid": "e0d60477-123c-4b0f-850c-78ba3e755220", "value": "daredevil.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226ab155-9fa3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787565843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565843, "uuid": "f18ba96e-a9e9-4821-abec-bc5dcc9b7930", "comment": "Malware payload", "value": "47fa2f4b5cdd1ae737e2443a3e6dd5a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565843, "uuid": "2be201c7-7156-43b3-83b3-8ccb440408ff", "comment": "Malware payload", "value": "cf6b1f52c77fd661789023e16a3bac1b757818ff814b4e2db25a577b5f4e795e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565843, "uuid": "998ffb87-a69d-4950-9b41-9becae5c708f", "comment": "Malware payload", "value": "d331d971a8c26b354be19f92d863f9f77cba9603", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787565843, "uuid": "9df017b8-1c04-48f7-a889-90fa4f72d426", "comment": "Malware payload", "value": "33b7b208748417b25e7d800585eccd7f59f8abd496a881cd190b95ab7f4f47de2aedb862b6f26661be35fb3a2cd690eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565843, "uuid": "3ca7ec39-1f6f-481b-8b3e-4f84f032188e", "value": "T16BC28D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3CB19C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565843, "uuid": "1823a5fc-2ed6-40ef-af94-d279a2ec0ee9", "value": "768:Hu8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:O8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787565843, "uuid": "e0efae94-47cd-42ae-8291-aaf0ba0f0048", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787565843, "uuid": "f83d0f79-6a04-49a5-8ed8-68de835a0016", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787565843, "uuid": "a0892754-b4e9-45cb-ad08-4549eaedab5f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1ef4ed-9fee-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787598071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598071, "uuid": "5d94db57-4785-4afd-a0b1-21f8edff9407", "comment": "Malware payload (RemcosRAT)", "value": "450cf39e41e6a5073255ad52311fa404", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598071, "uuid": "9a9d1b93-66e9-494c-82e5-0ecd7cc6cc72", "comment": "Malware payload (RemcosRAT)", "value": "d28dc0f5aed61adab3547ea9ffba04b4280460a80ed1181b27de4836c4ca655a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598071, "uuid": "bd07037f-69c8-4016-b9f6-0407b630882b", "comment": "Malware payload (RemcosRAT)", "value": "35da7e4697286dcf6ad1bb2dbb96bbf449129bfb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787598071, "uuid": "452b1ea4-5ce9-4c67-9b5a-97f0201f86d8", "comment": "Malware payload (RemcosRAT)", "value": "0cb32c38db612f2b5ceecd954d5996fb3ce83581fb9b370b0f271e85425bdd813b210b13e1c789de4b5968d168b63eb0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598071, "uuid": "1ef86290-9708-410b-9fc2-77cac717c27b", "value": "T127538FA21F28C0E32D5DB05860C1DFEE86767127B9B94D0717649BA2CEBD1CB3E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598071, "uuid": "b08bd5d4-b031-4ec3-be20-209ea7b36d42", "value": "768:NF0vBjjL4Z2zYUR9/4X2MJx/ptFzvBa6gZkabcSxgObucgSKTonmYN3Jw6bYcZEV:ojM9Kms8gTOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787598071, "uuid": "50ab742a-9f6c-4f0e-97b9-efd1f4c27136", "value": 64455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787598071, "uuid": "cc67abfe-2b94-4fe1-98a2-3342d1dd351c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787598071, "uuid": "62036d39-cccd-4553-8f00-a883190ef038", "value": "rNo0998006967505633.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28028c6c-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787577878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577878, "uuid": "04b78d25-7d05-4ef4-9517-e9f4e6359b77", "comment": "Malware payload (Mirai)", "value": "cfa097f61260891ea641322f321209d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577878, "uuid": "3acbf3df-f1cb-4cb7-a8ec-3da4978a5877", "comment": "Malware payload (Mirai)", "value": "d487bd1fa0855abac116c4ce865a3077e5fa2a32c33c94b3196b5a7932f71936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577878, "uuid": "5addf877-1458-415a-9163-7ca45669dd27", "comment": "Malware payload (Mirai)", "value": "fb99c040f8c55c86907f75d97b594e84b35a8feb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577878, "uuid": "3ab30158-34eb-4601-aaea-425723ed640b", "comment": "Malware payload (Mirai)", "value": "c00cb2f72ddce79e0be0be42176de9389305ade89480970b884dfb75a57e2fa9bea4380018b8f33bf79242c512bc6868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577878, "uuid": "721f95b4-579e-4d10-b371-69d4517a5e4e", "value": "T1EE145C1378E290FDC9D7C1398F9FA016D522F41B1124B21A778D7E652F4EE30ABAD684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577878, "uuid": "3ee493b1-173d-4732-932d-86680c0e5843", "value": "3072:knrspPoMhAnK6Q8leUtLwSDLKY/LjNfS0U5ILlD6TAu1EssMZc/T03ImIys61X1n:Kr2ouiS7UfTlcThEssMOgh5o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577878, "uuid": "a5cae8b3-1a52-4311-8f6c-0662e55bef8a", "value": 196600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577878, "uuid": "80a0e435-231d-4f54-83a7-bc4f7ccfc179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577878, "uuid": "64b2e79f-bae7-40cf-a8ff-d57cc3e05095", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29ac596-9ff4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787600927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600927, "uuid": "7fccfb5b-fe59-479f-9b29-0ad2dfe86f1b", "comment": "Malware payload", "value": "5ca5a606709ffe95c5e826d176f5dc59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600927, "uuid": "75a93ae7-eda9-42e1-a889-570dde3a3666", "comment": "Malware payload", "value": "d4d2b7e99fdc2ce7eca14986a189d974bb24e42fea69b4bf6424301146d869bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600927, "uuid": "d91aa269-7877-44c0-aa53-0270c6a9b00f", "comment": "Malware payload", "value": "24f0cc1e3394cb1058fa6e9589246f3d3be42d41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787600927, "uuid": "b4980774-ac8b-478e-ba9d-b6fd504fd3da", "comment": "Malware payload", "value": "87b41aa61ad9cbfb52b88ce494e487c4251708c8b0bec08769e34f285d9486d51d0221fc111fe8f1211d05eabe6edeeb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600927, "uuid": "30b2f8c5-63f2-47dc-aa29-c07998b92cea", "value": "T1A701863683643139CA7270302C118701402F45835314A37351F729952E5AB92132D0A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600927, "uuid": "05233d50-03ea-46ad-ade9-d253dd356ee7", "value": "12:5jO4Nr5Yim1Mgj3HOw0a0lUwV55lycpd90vUMEsP77ZF/g7rJPdNQuaz:9DNaMaXOwCUu8cz90vUMEK/ZKZPdip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787600927, "uuid": "c2dd8ac3-2d12-4f0a-9b9b-a9f7eb542d1f", "value": 805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787600927, "uuid": "b411e106-3792-40b0-a723-84a6691440d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787600927, "uuid": "d08ed88a-cc52-4331-8fec-645acced5426", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ab9db0-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536909, "uuid": "2a11f9c2-9aa0-490d-99b6-55ebabe1fbaa", "comment": "Malware payload (Mirai)", "value": "5383fafb2a59cb9cc9adaa9b33d955b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536909, "uuid": "18469f14-eab2-4feb-9ee0-c2c3202c5f3b", "comment": "Malware payload (Mirai)", "value": "d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536909, "uuid": "f8e473cb-0f21-4911-b921-4b23262dddef", "comment": "Malware payload (Mirai)", "value": "f8c7b0d79aab5c25a2854a8ecdffc1335df51ea1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536909, "uuid": "68178be9-9d13-41a1-85ff-834fd1aa5f9a", "comment": "Malware payload (Mirai)", "value": "8ef6fdc0b9fa570c9d62dcbfdf17490573fa52868c401ae9ac603829b6d25c473b8986e9ecc614f4c520e97b2bcdfdd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536909, "uuid": "4d7276cc-47fd-41d4-ae84-6b7ffa45c3ea", "value": "T1DDD312AC4D4A4F67FDC252B7E420C71EB06063BE1BCA4BAC5B691FC07925567E390624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536909, "uuid": "cc43bb90-3c5a-4188-9e9f-147ace244d57", "value": "3072:8NwRzIOrjSf2aefnwoJFf7Fr9xThx7fmuCn/yqVh/cI3TR8fzCi2:8a5IOrjSOaGwIN9Vfmu+/ya/Byzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536909, "uuid": "dc0e7919-ec2c-4fff-8836-235139788c95", "value": 140060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536909, "uuid": "62c88178-ef76-433c-941c-43bef17f5504", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536909, "uuid": "fd1d02fa-cfcc-47e6-a4fe-30a511f53805", "value": "d59b4af4b28f7afdf09b74283360075f07d82f56fd91d0f66870e914c06886a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35e01e0-9fc0-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1787578622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578622, "uuid": "d85cdfdb-f1d6-49c1-ae1f-5859a0403da5", "comment": "Malware payload (ConnectWise)", "value": "d2ec5f59910df2ea39273b0911d6f1c5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578622, "uuid": "0ab2d749-e1f6-4fea-960f-9102fff1a69f", "comment": "Malware payload (ConnectWise)", "value": "d5a73042f74b42cf6ccca6679ae3d029beb458c2647a44878d51d2bd840d60de", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578622, "uuid": "deed7351-6734-4b05-abf0-40638da20d5f", "comment": "Malware payload (ConnectWise)", "value": "9c811a9ef6c6169157067d8422abf2e95d84357f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578622, "uuid": "b085671d-5378-4f22-a294-fd8bc681be4e", "comment": "Malware payload (ConnectWise)", "value": "901ee6b46fc988f8f233f344191ce953f961075ddeda37e7b6b4dc363db27c3c1ca34a7cca52784c92432f9aeb172daa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578622, "uuid": "9b3da1c2-4622-4c88-930f-1a2f39ce24e5", "value": "T125D61211B3D594B5D0BF0638D83A92656B35BC008B66C6AF6394B96D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578622, "uuid": "d47ba185-4495-45b7-a4a9-c791a855ff09", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578622, "uuid": "b66f2a2e-11ce-4ff2-a57c-116f72d3d3af", "value": "393216:Dq5VDBCDx/QEGq5VDBCDxOq5VDBCDxDq5VDBCDxr:DpqEGp4p9pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578622, "uuid": "4622edcb-bf62-4572-b280-1133e313c8cb", "value": 12807224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578622, "uuid": "9ba77b1c-292e-4202-9966-6726a004201c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578622, "uuid": "1a84b138-7d14-4f8a-9bd4-3df89cbcd190", "value": "d5a73042f74b42cf6ccca6679ae3d029beb458c2647a44878d51d2bd840d60de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20874c53-9f53-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787531480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531480, "uuid": "ac6acd6b-1a6a-45ad-ae72-151289926dd6", "comment": "Malware payload (Vidar)", "value": "fbe2ca5895aaadc3a2a91a5438f45b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531480, "uuid": "14563f51-a99c-4e0f-9a21-035d13f1e204", "comment": "Malware payload (Vidar)", "value": "d62088168d53fa9bdbb5c442bf093da8b53e69f71ae72c04f864e3aaf201cc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531480, "uuid": "80a5d49a-5fed-4681-9d38-cffeeab16ef6", "comment": "Malware payload (Vidar)", "value": "2daf0937e6a2105f5d99a05f40635748aeea7801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787531480, "uuid": "80f78432-579a-4d2e-9f4c-c89a743085e3", "comment": "Malware payload (Vidar)", "value": "c8a580900a0ba5b5e2e9030adbb30cd04c73533f41733b784347a67e8a617942b9a668d1efa83db80f2e10a7a9d09bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531480, "uuid": "4747fbe5-6b28-40e1-9ea0-72ba671f2504", "value": "T153366B03EEA548F9D296D73588774242B764BC499B3533D32E60BA742F363D0AE79B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531480, "uuid": "de6514ee-453e-47f3-9bfc-0bd83ab39152", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531480, "uuid": "0b7f7e12-3620-42a4-b401-077bb98a7f56", "value": "49152:uFKpz7i7FAlc03DCBGcm+a1h6TczyJPj4RRHrYvAaab:uc3XND1aJrCOkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787531480, "uuid": "0f829ad3-dd41-4583-9020-5a2ea0bf741d", "value": 5003367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787531480, "uuid": "9308f125-a433-4728-8edb-7a17d91e8623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787531480, "uuid": "7eadc5a3-5b00-44c7-88c1-0946a16196c3", "value": "d62088168d53fa9bdbb5c442bf093da8b53e69f71ae72c04f864e3aaf201cc9c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eefa52-9f9b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787562486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562486, "uuid": "cae2a49d-3181-4621-900a-296543b5b0c6", "comment": "Malware payload (Mirai)", "value": "f2c9eb97ce0374f871aef3e21d9984c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562486, "uuid": "bb0862eb-0625-4821-8b03-8539c23d9d79", "comment": "Malware payload (Mirai)", "value": "d65a280b0afe28b6e51484988c3b6dbe86372a5dd47b4fef1a5fa1836f4a300f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562486, "uuid": "6d072966-611b-4b67-abf9-9e211628b8c4", "comment": "Malware payload (Mirai)", "value": "bdcf46e13ebbac3850812c83bfd77d7379a7acc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787562486, "uuid": "f563aae8-dbbd-46bf-b2c0-d9f4b6b4576c", "comment": "Malware payload (Mirai)", "value": "3e1d1e9238d2107f88a8f647a1c5f6a740124a31a75a6f70a9be11f53e6755e513b4e28d8709d8a6f93cf5f842691bb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562486, "uuid": "52f0f91b-db1e-49d8-a6c0-4657b5d4f935", "value": "T18FC31A46A9419B12D5D732FEFBAE408933136F78E3FA7112D9205F5023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562486, "uuid": "3e6faead-4da4-4702-8745-01e8e4226a47", "value": "3072:tD4Ha7I8qVGBOgnVfGPc2R2AGIK6fnzaagfLhl/5Qxrk+Ffhbe0bZWgrv:ma72J6VePc2R243vzaagfLhl/5uk+Foo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787562486, "uuid": "61cc264b-6e9e-406d-bc99-123cd24ca33b", "value": 127412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787562486, "uuid": "1d9b19c9-0e06-46dd-8e6d-be8e8266f4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787562486, "uuid": "57b43a05-07c2-41fd-80a2-855358456d27", "value": "qtm.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f62f1dc-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576763, "uuid": "bef91990-84b9-4fa2-af15-de63bf38e7a2", "comment": "Malware payload", "value": "861a3c348401e7de151326a2251055e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576763, "uuid": "4f7772b5-cccc-4759-806e-ba2a7f4a6667", "comment": "Malware payload", "value": "d7066697d8e7c6b4b5e7724bd52ecf2ff44a7797502fa1e7c9f969397180275e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576763, "uuid": "25cd6c37-d98e-4a18-84b0-78eb60061aa0", "comment": "Malware payload", "value": "022e8d10418f439108a864fa4991ec627b71035a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576763, "uuid": "750fcdf6-ab5b-49be-ac67-3b155e555f09", "comment": "Malware payload", "value": "c683a9c8274016e94a351e5740822417fcb89b207cc758fd0b2af706498035680fc5b793993bfce272416bd0d3add50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576763, "uuid": "1483d8f0-ea25-420d-8fb6-22fb6c1bf5a0", "value": "T132518F82761647D675CE9385805FE8ED7700807A12BE03E1B8CF4E4D13B9D8851E5F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576763, "uuid": "8cd930fb-f871-4f3a-b97a-14e1b3aa2c10", "value": "48:Ag2mHPahENGYM+FLR2kmNh6HjAkkumWiF9MZo4KAPQXC:Ag2mHPaKNrlFLFmNh6HRkumbsZHKAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576763, "uuid": "7e1a241a-5a8f-431e-af77-7308fe6e4950", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576763, "uuid": "b6375f49-211d-4736-a7dd-60b0d1b9fc44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576763, "uuid": "cfe3a6e6-56a1-4f41-8faa-84e02fd1b05a", "value": "bleh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54c015b-9fc6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1787581121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581121, "uuid": "237c6f1d-f279-4f58-b80f-3a5bb7e513ea", "comment": "Malware payload (Phorpiex)", "value": "0bd71ac304fe9cb9d97df31b5988f5e6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581121, "uuid": "fff22c52-3965-4f30-9e08-c1ccc1c57bbf", "comment": "Malware payload (Phorpiex)", "value": "d90d1bd6eb379fa5e2e910be754d95c5f395e804bd00799f5fcf74e02eeff972", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581121, "uuid": "01d4f555-5bfe-4f86-943e-8091e1eece5e", "comment": "Malware payload (Phorpiex)", "value": "67343c5261333a79810bd5dbb493f0315d6189e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581121, "uuid": "bb97ab81-eda3-4db1-be62-6e17499ed9f6", "comment": "Malware payload (Phorpiex)", "value": "1cad6a949e3909f092d9418726c1b703699286a7c9f95da8536746b5200820908052eda392e15b1b0bbf1e9a47697bbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581121, "uuid": "009e0b22-e150-4f6c-8174-1a56020c8e2f", "value": "T152824B0FB9424326D0E11070A676867BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581121, "uuid": "ec8f92b1-2164-4f07-9b41-d7b7c0a7d21c", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581121, "uuid": "f7532a44-ac8b-406a-b6b0-b3009cc1ed52", "value": "384:+I6I8vVaF6OeYUQQlmLu94gXTczlmxav8U9cyl:+IPvUQQt9U8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581121, "uuid": "65a926dc-e126-4397-af4a-61e855e696f3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581121, "uuid": "a736f58f-f057-499d-9abd-bb5b4b685b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581121, "uuid": "72280bb5-0962-4062-b661-65352067d906", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad7dd27-9fbb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787576272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576272, "uuid": "617891be-d787-43fb-b9b3-d41539f2d7bb", "comment": "Malware payload (Mirai)", "value": "ab85e9ba4c8898fd7a23688525d99ebd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576272, "uuid": "989231b6-72ee-4113-a7d1-976ad1abcac3", "comment": "Malware payload (Mirai)", "value": "da694c704985acd7cf42630f79ac1c3e1d1d41759367bc9d600c0bbeaadca96a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576272, "uuid": "25bb47c9-8671-46c9-84b5-cab9b2751680", "comment": "Malware payload (Mirai)", "value": "0e86fd307abc4a58f143d36c97c7607b132cee3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576272, "uuid": "446bbd60-b2ef-403f-9c94-3c909ae3370a", "comment": "Malware payload (Mirai)", "value": "7f40c1d28cc480ca25db2ebd58e103c83e819e3e103060517d00189795b5e4b98ba3a4fa84f5704346eacef77346c79f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576272, "uuid": "39bdcc44-5708-48b4-9c2a-f3fb6a48957d", "value": "T12734D85E2E228F3DF2698B3487B74E25975962C722D1D640F16CD1102F2029EA56FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576272, "uuid": "725a92f0-2af1-4512-887b-ad1d36760d4f", "value": "6144:oH6ju27c0lfQxtLCCNdUjaHGzdvLKEssMOgh5o0y+mZ8:axZb8OEssMOgh5o0G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576272, "uuid": "116ce920-1a5c-4f65-af2e-9c3de2ddbf31", "value": 247716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576272, "uuid": "66e75d87-63d7-4f21-b956-3d82534bb9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576272, "uuid": "1e591deb-b7b2-4d65-b825-87b5912ca1c9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c68d2f-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576831, "uuid": "299e23fb-5025-4eb7-8e3d-d4c6eec7320c", "comment": "Malware payload", "value": "700cb597ce5a14af55ea02c7898b41e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576831, "uuid": "268d8ecb-6e0e-4708-bf80-be1384d51017", "comment": "Malware payload", "value": "db9f61bd497d5847be5cbed3ec6c1b9160854d8c46490a861ab19fd3f6b5eeb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576831, "uuid": "045e3d5f-5162-4cce-b97a-f47f41f63071", "comment": "Malware payload", "value": "89f6dd7b37a0e8060d3aa5c5120f93b391f135eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576831, "uuid": "28323b24-5ee8-4743-8372-fe478d6339e2", "comment": "Malware payload", "value": "dd92966d53562187725d5a2b0762ebf6aa745dc3c775598c7c06e14377eb6f916e443786f685dca685c10ff26867f891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576831, "uuid": "e1d8edae-23d2-48ea-a5e8-266d05543dfa", "value": "T1EE733A62BC41D542C8982779AB9F83D93343B3B8D2DE3502EC02D72915DE6C90F3EA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576831, "uuid": "be82bba2-2978-44f2-aab9-3d7f8fea5518", "value": "1536:XmdA23WYicbLQtG+QIndnszm59MLtlzHyJ0SCbTMEOqC:XmqGiOLQtGTI2zm5mjfg1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576831, "uuid": "1a3663cf-4ee9-43c1-989a-d7018f404c7d", "value": 78192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576831, "uuid": "a569990c-6e11-4657-b88d-13292d7f6ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576831, "uuid": "8c9ca684-8a0c-4c33-be0e-7f85a8052b4c", "value": "db9f61bd497d5847be5cbed3ec6c1b9160854d8c46490a861ab19fd3f6b5eeb9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c596e462-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787584155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584155, "uuid": "3a740f5a-0168-4020-99cf-e0f88e1e72b0", "comment": "Malware payload (Mirai)", "value": "47d6a4409eff807da564bfd6a1c2b4f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584155, "uuid": "7dbab2c5-8b64-4621-8fbd-cd30bfbcf767", "comment": "Malware payload (Mirai)", "value": "dc03e8e7f1208c7593d6411c5e10e50bbae1c761faec519c903fa6b179c19688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584155, "uuid": "f95362b1-1eb0-4a11-9db8-8c0a2c0dbe80", "comment": "Malware payload (Mirai)", "value": "b6886d2cb3729362fa766536b89b914254ca3d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584155, "uuid": "5eb1bf2e-1308-4526-8f8b-f002630ee943", "comment": "Malware payload (Mirai)", "value": "1e92983cad4f5ed78c6eb0160d2de9b4cc520ea999ce30b63c83fcb0d5d7fed6d7f32710ef0a7d3787f256f4d5cedf7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584155, "uuid": "9904da8e-1a5e-4203-a9ab-dbf6b4c6ba32", "value": "T154B3120883CE2916D411D8B71D1DD3B797BE5FD76A508BF3B844DA0438335CAB54A6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584155, "uuid": "ccef35fa-be25-40f4-b194-cbb6fa0ed7f9", "value": "3072:bVC5wBfQA049W0Nn0Wcna9A+Avd4u+qgwi:bVC5OfQun0MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584155, "uuid": "9d08e4df-e94a-493f-9a8a-4bb15e754c49", "value": 111524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584155, "uuid": "cadebb2c-d8ec-468c-8040-aaf8d0a12f3d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584155, "uuid": "ee7da75c-059d-4492-94d7-987951e39ae9", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a456f18-a001-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787606202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606202, "uuid": "ba9650f3-1ad3-40e8-b5fb-63bd15fb398d", "comment": "Malware payload (Mirai)", "value": "1cc44396e372fe8c6e35a4424d6ef39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606202, "uuid": "2aae9e89-98db-46a6-9f19-ab03f79f72cd", "comment": "Malware payload (Mirai)", "value": "ddd4725b035f19eb316e983c1e91fb02865fe9878d3b7ca57b1de9000bbd1cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606202, "uuid": "b002deeb-0056-422c-830e-65df98ca5e20", "comment": "Malware payload (Mirai)", "value": "f542b5b4752a3942f0e7350b5485ce109dfeab8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787606202, "uuid": "45239f09-a729-491b-93de-72499fb55448", "comment": "Malware payload (Mirai)", "value": "d9e46ef5fff05fad8f538cc5ff4cfc7322a79de0103c1101d76ab63a96f5fa74cbd37175313d688c2ac65dec8ebf5ef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606202, "uuid": "82f0b78b-0b70-4d65-b249-f0903247ca63", "value": "T15B140952ACD29B12C6C2457EFB0E514E7313676AD2CE7212FD2C6B703F8A47B0A7A445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606202, "uuid": "4ecc6ce6-3683-4596-b640-6d0137c302f0", "value": "6144:7+mOvUk0NhCCTl+6V3FjfXRsIa7FS4sAZAzEssMOgh5ov:HOvUk0NhCCTl+6V3FXaIa7o4KEssMOg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787606202, "uuid": "021f36da-e187-4b7f-bee5-104d56a97d73", "value": 203760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787606202, "uuid": "e719f6be-dbae-45de-b9ed-f348fa4f7a38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787606202, "uuid": "540527c9-2a6d-43bc-a0d5-2f92f3a841cd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b326bb80-9fd0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585413, "uuid": "30e00bc0-8910-41ef-98f0-0cd36ac0b87f", "comment": "Malware payload (Mirai)", "value": "1c17dfb3b726c4429136f0197aea77a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585413, "uuid": "8789a2c6-9f0a-46f7-bc3f-2918e436d22e", "comment": "Malware payload (Mirai)", "value": "de1e368d7350622484b986abd7e4a515285e88411954e744d005bebc5a1929d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585413, "uuid": "4dfb08c2-ee9f-4e19-9c00-ad618b377b60", "comment": "Malware payload (Mirai)", "value": "ac491ed49858948edebf177da2db4f70ec3c1d57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585413, "uuid": "d4921f0a-2288-491a-92d8-e35c617005d0", "comment": "Malware payload (Mirai)", "value": "0fcd0c20bfaa7e0bf03c67c1ee4a25f74da8f0b735315f880146b0551778188d2f67383c36fe9379c7d7ad0e242f1ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585413, "uuid": "0ff0f40f-6af9-4e67-9992-fc116c024c46", "value": "T17B93024A7207712BF160ED761B7CCA49FE18AC480BD31B2514B8727AC9516CDA733DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585413, "uuid": "9d1561fb-3d95-42a6-a088-cdc97d0d7b48", "value": "1536:wMPUixK4UmWy8WofLQBIEg/7sxuq9TB/QrHB4bWD5MCNx1DDBs3MKf9:wMsCXUa/vwgA8B/QrHy63xDs3MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585413, "uuid": "dfa29fdc-c092-4091-a6c8-405f0bb1cffd", "value": 95420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585413, "uuid": "ed0d059a-0655-4819-b4ba-6a60da154606", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585413, "uuid": "c5fac731-e9a1-46e8-bd61-d3d90997e073", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ad8c5f-a005-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787607961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607961, "uuid": "d396ec05-7e06-43e7-8bb9-5b0dfbb07729", "comment": "Malware payload (Mirai)", "value": "48f7394edb387960e90fca6be8a43fe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607961, "uuid": "33013a5a-9147-4f2e-82b1-c99bee49ca92", "comment": "Malware payload (Mirai)", "value": "df4997d19239b1adb12274e20a09dbd9ddd903bb171afea96a469878377fe525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607961, "uuid": "d9b145c7-ada0-40e8-8442-b1bbb81d3cb3", "comment": "Malware payload (Mirai)", "value": "cfc632d1738df9b4c997d7fadbd37f1ac8042400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787607961, "uuid": "1028a13b-1273-4db0-bd7b-4fe204520572", "comment": "Malware payload (Mirai)", "value": "d1dfc568cf03b65c3b85208d2fc8487134b5f6cc7f0766561d7b51102ada1323f220c1142c610dbded806710d0caeac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607961, "uuid": "dfdcc790-2661-4f84-9431-03d25be73f1f", "value": "T16C93F8917CF3A156C6C3863FEB4F92093322619782CE7522FD1D5B602FCA11A87B7991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607961, "uuid": "c74be537-a828-4f9e-8648-9a53eab894c0", "value": "1536:rZ/hoCc4V3bHxxW452pxu3e2P5AIKHqkI/TnejM3nTu1EssMZcywT03ImIys61Xu:Vhc4VRWpxu3e2P5AIKHJITnS0Tu1Essf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787607961, "uuid": "716be810-8bf1-440a-b9bd-88dac8a15fac", "value": 96680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787607961, "uuid": "46e6ff71-44df-4663-bd40-5d1a84fa7184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787607961, "uuid": "51ccb731-13af-4cf5-93b6-2a9acbfc22cd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e0917a-9fcd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787583852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583852, "uuid": "4937e536-fb5e-4a85-ad52-ad9dbf49d807", "comment": "Malware payload (RemusStealer)", "value": "cb48742739aa32b2b74513b770c2f25d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583852, "uuid": "b74390d3-cdf1-4309-aa54-ddb3a8b1d7bd", "comment": "Malware payload (RemusStealer)", "value": "e0052883762cdd3cec6ab5ebbdc0f34eb3a718d67b1a55b2717d9ae6b28944e8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583852, "uuid": "63aae9d8-aa55-4b01-8935-2a11e99f49db", "comment": "Malware payload (RemusStealer)", "value": "357a46248aa130baf9f9a8a23cb77aa8592f9412", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583852, "uuid": "22a40418-e254-4c8b-8900-cdbeb5aa17a6", "comment": "Malware payload (RemusStealer)", "value": "6e275cae2204fb658b0c70d43bb0e576b11fcf27a1763ae448bc9c4ad00c57d4a2035d6b2980d8b612e3d3df768ad264", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583852, "uuid": "24347fd0-66e2-4626-a261-090a5ac2b622", "value": "T195264B03BE5655A4D0D59F35816B4612B738BC88C33573EB2E94DAB02F223C36EB6B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583852, "uuid": "55da75eb-c57f-439e-b21b-c04f8d335c56", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583852, "uuid": "16d270fe-03cd-4393-961e-12222d3bc5d2", "value": "49152:yjD09VDm+fYyFvRs0wHcsVQDzURPBepto50VlXV3PC0xC5DOnSgiebDizwYTD14X:DfYy40s5IpWyLV3zw5tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583852, "uuid": "4bfb7583-8bdf-483b-9a9e-ba30f07870c1", "value": 4832680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583852, "uuid": "d336830a-91a1-440f-96de-0177740aca19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583852, "uuid": "dd406c8d-b9c0-48fc-806b-93556c4d5282", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0eb7fd-9fd2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787586102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586102, "uuid": "0d58508b-a8b4-4444-a048-f1b4263cdd81", "comment": "Malware payload (Mirai)", "value": "2bc8d2ea5bfdeb8da6b1fb5908bdbcd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586102, "uuid": "ed0564a3-a0a2-494b-a913-5b35df81bccd", "comment": "Malware payload (Mirai)", "value": "e01e53f0eff39e22fdfbd50fd17bdc39f5db20eddf4c7f6d1b61271f6f63c8a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586102, "uuid": "fb88f4aa-47f8-49b7-801a-5e2daf5c0946", "comment": "Malware payload (Mirai)", "value": "225b5b234cdbcbad3e031a65633d905924145b7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586102, "uuid": "77272326-3c7c-490b-bccd-b15b3cc15246", "comment": "Malware payload (Mirai)", "value": "005109f0d76f24de12d4407c6387078388188280e3c889f4b9fe617a5830961c00055a8bc820470ef2e6a9dbdcfdfed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586102, "uuid": "36f93650-8c3a-445f-9450-4138e2be73ae", "value": "T17E6364292A21EFFDE16E823047F39E70935926D637F1C680E26CC7485E7029D189F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586102, "uuid": "88f0b70f-4c2a-47a1-9fd6-3a7611c73674", "value": "1536:KHPHixpBuQ0aChFaLhtBrRZV/Pr1lZGnbPWDrBg0P2h8eBVn:/T65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586102, "uuid": "352e4ecb-3aaf-4f41-b88a-107fd1c30418", "value": 69872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586102, "uuid": "6366b482-4bb8-40cf-b680-08b11afb67ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586102, "uuid": "78717ea5-9cea-4cb1-89b4-7966f526c70f", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0323317-9f78-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787547612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547612, "uuid": "9bd94bb3-b5c2-4a31-a842-267c4ab0ec69", "comment": "Malware payload", "value": "0e7dbccb488bb8997775f9036fa9616c", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547612, "uuid": "03f8bc73-aaca-4331-af02-d960bac0568b", "comment": "Malware payload", "value": "e049d6a60e0c67689f78c66143528b369c4c0605b798b507e3f0dac2591fb545", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547612, "uuid": "cc3a6546-c59e-4b1c-aef5-cb7629d2732d", "comment": "Malware payload", "value": "4a0aa6b5efab737116a4e234eb9dd483a0b1b1ba", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787547612, "uuid": "fb3661a4-1c9d-44db-8cc1-4cedac9d8e65", "comment": "Malware payload", "value": "493c00a69c0e8cea811dec77557bd8266da5da02627c6064f312dd4cc689d515e0f59122729115d6d99c60359951bc73", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547612, "uuid": "07adf2ee-337b-436a-a60b-ee715baada4c", "value": "T13A3143CE14140E312542CA9E77B33548B28EE6FB2C5FC7D4D9491EA982487DCF291F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547612, "uuid": "005bc20b-dfac-47a1-903f-ec1911b2b79f", "value": "24:fWah8TSP2PYamP22T3TAJcAqOiTEcTii/dT89hFrZvVD:eah84YpmPRT3TAJcnbTEcTiWT8DFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787547612, "uuid": "303d34b3-f055-4301-86ea-e431c4d9b311", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787547612, "uuid": "ed9c35ba-7814-407b-b0f3-374ee1df5002", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787547612, "uuid": "17291868-b145-408c-9259-e314fd5d21ad", "value": "e049d6a60e0c67689f78c66143528b369c4c0605b798b507e3f0dac2591fb545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e650252c-9fc5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1787580774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580774, "uuid": "37e18bdc-d2c6-4262-9ccb-6bee4412e96b", "comment": "Malware payload (Vidar)", "value": "9bdb1a4f2b2dabd70c7a224ba42f2162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580774, "uuid": "bc20d6a7-ec34-433f-b78e-bdb4ce7efaad", "comment": "Malware payload (Vidar)", "value": "e04ed993f5c6e172ccbca82ce20f070194a9e7eb510c70701f2ff673b61b4863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580774, "uuid": "7317ff34-1a64-452d-a4c9-45220d3dd121", "comment": "Malware payload (Vidar)", "value": "7b101ff94ae1c96c8bc32dec7be85fd670ad3ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580774, "uuid": "c9f4883a-dce0-4a3f-a6a2-995d62e4edc7", "comment": "Malware payload (Vidar)", "value": "926dd58f4d33ac2c4a13ed72a5dbe1555b1234d7dcabee5402cbabb1888af39022743ba04a568bf49e8b7099f08a7248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580774, "uuid": "d86fe129-a341-4f17-bbda-1cd6ea002dfb", "value": "T138666C03BDA545A8E4AA9738CAB74652B775BC88873137D72E10B6383E337D06E79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580774, "uuid": "f03f3723-0b04-48ac-9fc9-dce8f1525701", "value": "1c1ad2adeb06878a984583db245d2aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580774, "uuid": "ac1ff7cb-dc2f-4de9-b306-06a4e57cccd8", "value": "49152:gHsoGueBHr6FwaVRXwwQvgd8/KWpGLihJlIXf2gGtMmPW9LmzQlrC6mjVDryrTmZ:w0FWFn1oHl2f2tM2gqrXxqHbmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580774, "uuid": "c3f74061-f6bb-4c0e-9020-bd007719906b", "value": 6822928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580774, "uuid": "aa9e7857-8ba6-40e5-bdcb-6dfaee2b17c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580774, "uuid": "605dc7cd-2660-48f3-91fc-15a171dd28fd", "value": "e04ed993f5c6e172ccbca82ce20f070194a9e7eb510c70701f2ff673b61b4863.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0941da8-9fb5-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1787573919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573919, "uuid": "0249d557-a6d6-4efc-8ebf-fca4684a6c4c", "comment": "Malware payload (MassLogger)", "value": "0a898ce55b2e5404d7c1bab841fa6de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573919, "uuid": "9a94c689-79b3-4289-be9a-6143ded2921c", "comment": "Malware payload (MassLogger)", "value": "e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573919, "uuid": "de54446e-556a-426e-879f-98bce7003461", "comment": "Malware payload (MassLogger)", "value": "498691b47fb699f0589fa0130d61dfecc9fb747e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787573919, "uuid": "07944c6c-a315-4b34-b893-c487ac122a83", "comment": "Malware payload (MassLogger)", "value": "9224b2ed4fea0c336e180bd7d61ac739e7216af7e885c54ab7c683105a789aff8d3389a2bae72b013a632c71ad0c7ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573919, "uuid": "93115720-6769-48ba-9b6c-a43658ae7452", "value": "T146C52304A64ED513C8634B7605E1F43102B65E4EA972C6ABBFE87DDF39337898491B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573919, "uuid": "bdfbf4c9-ff1c-40cd-8570-6fd79c340210", "value": "49152:ccEyjKrgywL4wf6AN49lAdv7+azqKbPpFt7MD3L75f108ZuyLAR0fzv4VJajqViz:ccE3FwL4wbC3u7+az3bTNMDU8IVPaee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787573919, "uuid": "6368b0e0-fd0c-451b-807f-add151fb80bf", "value": 2706432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787573919, "uuid": "24676e4f-a72f-4d54-80e6-a9048674e149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787573919, "uuid": "2003362a-3bac-42ef-a85b-e8630086d36e", "value": "Proforma48846599458494_____pdf.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9231e56b-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787582781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582781, "uuid": "613ecd90-f8cc-4d47-b30f-2a2adc276aed", "comment": "Malware payload (Mirai)", "value": "aafb590f5ea6a1bab7afa928054096ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582781, "uuid": "2c61120d-e869-453a-aa31-a2ba2ad954d3", "comment": "Malware payload (Mirai)", "value": "e216b69e4e2e4faebaee321cb343e17dbf2b62449b072d66ac557ba2a88199a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582781, "uuid": "21b14eb0-115e-418e-821f-74ba3f11282e", "comment": "Malware payload (Mirai)", "value": "c4a8b32e5b3ea780ed2a6b6cd570b9ee7b2b617b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582781, "uuid": "739735c9-ce21-4590-a376-64ec7262acc7", "comment": "Malware payload (Mirai)", "value": "cea0382db3c16eefb9bdbb72bcf96feaf40ed047783acced08e6be0d72c1cb0374796a6aa09f81e030af2d0ae2f4da01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582781, "uuid": "67d115ad-ec15-4b5c-b274-1a084a9053e3", "value": "T1FFE318DBF800DDBAF40AE336485709057130B7E119826B377257397BED3A1A92467F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582781, "uuid": "700a534b-d6cc-4ece-a1e3-3cd284883ab4", "value": "3072:oNNd9AYfg+tlqHAq6R+LrUNFhs4nMsPE+oaqVHjbimL2sgwyAykS:KJAYfgClqgq4G2FhssMw9oaIL2MyAvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582781, "uuid": "b1d59bce-770e-4693-8d53-c28f8d7e05d9", "value": 156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582781, "uuid": "c7fdac50-329f-4737-9117-0b10061fe65f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582781, "uuid": "51c79d7c-debd-499a-8944-2e6ea0e8dfd4", "value": "daredevil.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9da968-9f61-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787537812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537812, "uuid": "e798e162-3701-415b-ac8d-4edec0aa710e", "comment": "Malware payload (Mirai)", "value": "bab50a1e788deb4753a8c2e519976cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537812, "uuid": "664a29ef-6ae9-452b-8e40-7c26b66330f1", "comment": "Malware payload (Mirai)", "value": "e2c334f483fc20d52e55da2f613d9103fa02a6751f33922e54cf504785f904d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537812, "uuid": "acaa65a3-1b12-4a84-8ea6-3ecd9a780c7e", "comment": "Malware payload (Mirai)", "value": "d677fd0dda5711c8d1fa72699e45d7f61c1e46a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787537812, "uuid": "ab979219-4597-4dde-a1f9-9d7da57264dc", "comment": "Malware payload (Mirai)", "value": "3a902a42c244c99c72d013e5a415af07229ff234843f34fbfe906e7b1958db620ebb246552575633492c9eb37bac534b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537812, "uuid": "6c0fff41-6be7-4ad4-85ff-20ce01f1ee2b", "value": "T1D29302078EE9263892D865710D7FEC6B180083CE6FD61ADA57F828B145A9BFF1F44306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537812, "uuid": "bb0cedf1-60ad-4ae2-b4f1-24d89ed8b01c", "value": "1536:xoPhAoAXUe06OdEr+Kr2OsuHC0F17xtS0n1NGEP//micAcnvvE3EF41DLZxnouyC:xuAoAETErxti0FVzFGPAcvvE3p1txour", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787537812, "uuid": "de3fa1b6-a668-4b68-8c27-af5b1e04ab5e", "value": 97276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787537812, "uuid": "9e2f9197-75fe-4e03-8167-dc17bab61a0d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787537812, "uuid": "43b9453f-1e6b-4bf7-9414-5363f25baf29", "value": "e2c334f483fc20d52e55da2f613d9103fa02a6751f33922e54cf504785f904d8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375c5b8a-9f84-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787552563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787552563, "uuid": "434052bd-027d-4218-954f-ed1e646e4b31", "comment": "Malware payload", "value": "b24872db72aaad2eaf6cee5e03e63ae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787552563, "uuid": "d3522df4-a308-49de-90e8-a6255a3b3174", "comment": "Malware payload", "value": "e3ad7e3933cffbaf14dece08f9a90dbd2fad9ac41bc029eb9b1a6cc14f0878c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787552563, "uuid": "4ce6a1fa-0248-4ee8-b085-f3b73791cb67", "comment": "Malware payload", "value": "45f8dbe023a461faff28c81ee7cc37b02cf6e4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787552563, "uuid": "9e985a46-6afc-4c64-bbf0-76619e8125f9", "comment": "Malware payload", "value": "0e99d7ec01ffee1ffe80896521ed8a28e8a56fdfcc09cb6be0a43b179e3b6e336b48c1119e58a9853d03f6d849525923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787552563, "uuid": "441f6dd2-20c4-48df-bdaf-1a8bc0505a23", "value": "T166076B0BFB5099EAC459823548AA83917B70FC855F22A7D33A4CB62D2F737C45EB8714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787552563, "uuid": "4130d6d9-ae04-484d-a962-e08456b83733", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787552563, "uuid": "c7c309d4-9ef8-4dc3-bf14-c69c061e07c2", "value": "98304:FKhlJvEyhPAC2M2paA7tgb0CDTxcUFy0y50U7To0ssjPrpVIpwRAaER0iozy8ZKd:FWvEePA9MqjpCDDgjPyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787552563, "uuid": "caaae5fd-843a-4e68-886a-148267a35d61", "value": 17992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787552563, "uuid": "9a65e84e-3336-4ab1-873a-da982a519449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787552563, "uuid": "cb337816-94bc-45c4-bd12-ecb659f20823", "value": "telemetry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22463ff-9f80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1787551132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551132, "uuid": "5c81d2b4-7cc0-4d81-8867-e4f44e6e5717", "comment": "Malware payload (Formbook)", "value": "5e24cdc5c64e552e7909f0775472c216", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551132, "uuid": "009e7625-9c25-45a0-ad89-9f11d9c2823e", "comment": "Malware payload (Formbook)", "value": "e458c85a829563ca5a5cbd56b50e321af87500ad0c93b185c4531e8e74a53e24", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551132, "uuid": "d1ba5410-f0b9-44b4-b115-958bd8dad98d", "comment": "Malware payload (Formbook)", "value": "4d3d0cc55da0dea10820e54d8e35c0358e0a5314", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551132, "uuid": "6064335f-d1ba-4f73-877f-3527317c673a", "comment": "Malware payload (Formbook)", "value": "3056d05f6cc92e40cd3123590584855e0dc3a7e615d370aeae4b9ce4d60729c4c4d141fa3b6e8e9c3da7dc0ca3264c3a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551132, "uuid": "e9c2b69b-a8bc-44da-ad9d-02ec4c6739bd", "value": "T1D40693865BC0E6367B30679C67769838A40A47AB14C5CB2130AED608373FDDB633DAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551132, "uuid": "443a9f42-df91-4bcd-8bca-a717ad15a769", "value": "98304:sXgVKaL+uGis3PZL4Iwe6J5Mx4F6hqO4xPBHZXm5mCbNw+WnSVeWtaoXnbELCwhf:HVWLZ3PBPYJIO6KHamEw+3VeoRQLC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787551132, "uuid": "6fc7b3e2-7a2a-4c41-982b-198743219f9d", "value": 3806003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787551132, "uuid": "22dd6850-894f-43f7-995e-c93f063dbb99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551132, "uuid": "549d1224-41bf-4720-ae43-082742bbce5a", "value": "Purchase Order TMS-002498.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8d2242-9f51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787530861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530861, "uuid": "657f7669-3473-4ba5-8e65-ac24368ff38b", "comment": "Malware payload (Mirai)", "value": "4123ddc5bec9a65b4cd84653f4dec16f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530861, "uuid": "33b3937b-06b1-4423-9d23-794a812f4c10", "comment": "Malware payload (Mirai)", "value": "e46b7dfe2ab10669bb7ee95337fb91507709ac8516653ac063d39acaa1f8b72a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530861, "uuid": "e9a5f50d-842b-4fe1-8ed1-9b124babb396", "comment": "Malware payload (Mirai)", "value": "1bb7a7830bf525ecaf716ad01fa9eef7876a1318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530861, "uuid": "d7bfd7e7-04c5-42a9-8d3d-0c3293e355fb", "comment": "Malware payload (Mirai)", "value": "e70c3641ae1ad724b18b6332ae39355a5c6a1f30789e6f709adedabb808752ea8139b72c1af6bb516c583ece61234265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530861, "uuid": "9a137e64-84b2-4422-9bf1-91a5fc79bc1a", "value": "T17C83029221E61371CDE4643AECA29EA3CEC963EC4D503F3984044B577AA73565737E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530861, "uuid": "c2481cf8-93a9-4b41-b969-ba6a103feb2c", "value": "1536:w7VAB/MhsSZYx5KVVG2bDt1DB6Di5qTupKI38thYfg:w7M3xMVrDtL6DSqyYI3YY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787530861, "uuid": "7c2294a2-4a62-4e74-8af1-672ca477c11f", "value": 88052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787530861, "uuid": "25e8878c-7b83-40fb-9c3c-23c7399d967e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530861, "uuid": "b1760215-2c9b-4912-a76a-d36f14073f33", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bc38c4-9fb8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787575181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575181, "uuid": "7b31c567-a577-403c-b9b8-46901026e314", "comment": "Malware payload", "value": "a282e3b8e63d93f0a40ae7b94d970962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575181, "uuid": "5dcbe3bf-74c2-4efe-9a6c-b0034fcf6fdb", "comment": "Malware payload", "value": "e488a033b19604aa5d3a4b7ab2f130bc03ed9eff5eefb063635ab00e0ad62d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575181, "uuid": "141c8bf9-bb94-4816-8898-a6dd18f3df42", "comment": "Malware payload", "value": "af081219d9a1daf885521460228eca48535f0e40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787575181, "uuid": "82240a3b-e1b3-4d1f-80ab-71654e2f73ee", "comment": "Malware payload", "value": "e1e6d5f376e49e75cfa18cd67ffebeab9e605204af2dfe117bb435076fa08dc9fad11f081df3ba866e87e2097251463a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575181, "uuid": "15ae84cf-6ab5-4ef4-ae35-0a951900c7d7", "value": "T122D308A6BC42D84AC4D8667AEB6EC3C8334B63B8D3DD3011EC06C62459CE5D94F3AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575181, "uuid": "2a255105-c49d-470e-b112-1165ea8edd3e", "value": "3072:XmqGiOLQtGTI2zm5mjfg1rJy949gFvnHJtWbAq:X4jQETI2zm5mjfqJt9gtH/iAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787575181, "uuid": "e75d3c72-72fa-4b97-93f7-e80de549ff96", "value": 131768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787575181, "uuid": "63ec5e2a-68b6-4c7c-82f3-4df4d7ef3ef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787575181, "uuid": "f70507bd-99fd-4daf-85db-0720930673c9", "value": "e488a033b19604aa5d3a4b7ab2f130bc03ed9eff5eefb063635ab00e0ad62d8e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551b60fc-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576665, "uuid": "248718fc-4833-4b4d-a31c-679602639c1c", "comment": "Malware payload", "value": "46d758604055f9683714750ed65a1baf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576665, "uuid": "3d5762a7-34f2-4d7a-a086-1ba6217e8386", "comment": "Malware payload", "value": "e61f27b4c26ee54df5d8bf2149cf4ba8b2a61a4ba5217140b218f28499945eb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576665, "uuid": "742515b1-7302-4d8c-b1d8-d02a2308e7d4", "comment": "Malware payload", "value": "142f7eccd157b3222ecfe489a25bf7fbcfd68c0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576665, "uuid": "c8489521-f657-4c4c-b89c-2fa49f130a1c", "comment": "Malware payload", "value": "6dd4e4d9b775f5795c9f7b77f1d5b019e09c6d44256fde56eb7b65cd0ac3b93ba5f1511f78a0084797c9e3b8f7f1d974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576665, "uuid": "f12c60f2-e723-4099-8261-7caf5cdaf266", "value": "T12562BF23E1A70BC0E75D903A0CBEBC8F1418E00CE71C55A6A7A872BEC552F653C0DAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576665, "uuid": "170cbe8c-c9d8-45af-8e68-4394df9e37df", "value": "384:MiZeCivRadYdy/nfBD6AKzLxHgKK0VVa0ANaNJawcudoD7Uqe4cDMmz5tIH7:YCiEP5omKK0VVa2nbcuyD7UDMuGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576665, "uuid": "e3e1333a-107a-4dc6-8cd6-541cdc87b2ef", "value": 15888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576665, "uuid": "762ed03b-81d9-448d-8573-5094ef435930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576665, "uuid": "4956c422-b53b-429b-a3d6-c60e7ed6566a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800aa194-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576737, "uuid": "467d353d-79aa-4708-a0ba-cb0a21f3a6c4", "comment": "Malware payload", "value": "3023a22c58d340bd3948d252a39cd804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576737, "uuid": "ae4c3a8a-678a-4662-a5eb-51d932d05b0e", "comment": "Malware payload", "value": "e6ed912ddfbf851e3d75ee4ed51fe8019024fa65a68f76e94b31077598693fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576737, "uuid": "e1395a82-af92-427b-990e-c62f28a94887", "comment": "Malware payload", "value": "84ca556abb79809e20077216b179ba6662c6c767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576737, "uuid": "e93780b5-6bfc-48de-93fc-1d138d052459", "comment": "Malware payload", "value": "e8867e692670dd2df88d9bcc42794d48f9d4dadee4fda28eadf98536d1662f74340ca14abf46202f5ed40e8422ca4cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576737, "uuid": "fe418b90-2fe2-43d2-bea2-59ce3b7ed95a", "value": "T12DF20946B69254FCC58FC53087ABE572F9327CA802353E3B1788F8711E71D212ABE665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576737, "uuid": "e8d962b9-5279-40ba-8c8d-34d5f5638668", "value": "384:eGMam0/SyNG64Pn2wQkONJRV81sFSR4rR7A1Ab:RF/lNfon20MRO1s6yaAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576737, "uuid": "877d9536-0f0c-479b-8a32-e6aafd76ff95", "value": 34424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576737, "uuid": "2d291c65-8622-480d-93ee-6ef4d754e84c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576737, "uuid": "0e3db154-2c4e-47d4-af87-c3e5b0ea7dd0", "value": "musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531a14d6-9ffe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787605008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787605008, "uuid": "1ad19a7b-ea43-4c64-913e-2bfd419958f4", "comment": "Malware payload", "value": "1445b5c477b8eb42afac59ece7d00f83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787605008, "uuid": "3099fae6-0636-48c3-96d7-d1e9d25768c4", "comment": "Malware payload", "value": "e87e97d3604ac46b46af03541af99968f268d9cd338d498318d878cb465d8610", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787605008, "uuid": "7790234e-dccf-42a0-ba3f-b0bf37d6e4a7", "comment": "Malware payload", "value": "9fd877893633f65f28742c1518adc0fbf1d5246b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787605008, "uuid": "a682f76a-bbe0-4910-841b-036553eb599d", "comment": "Malware payload", "value": "c168472bb65709ef1b1126381d5c718754aeca1cfe31bd024a14c4f15ba32198f35dacb01b1270db0f3c813c5fff8632", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787605008, "uuid": "e876e218-cdb7-41d7-8f66-f66744afc96b", "value": "T15DC27D966A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787605008, "uuid": "135e8b77-b9a3-4bf8-825d-4babdec43626", "value": "768:s8vCB+25j6es8Rp9FYpMSUpi+20qUpi+20YQX:s8l25JPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787605008, "uuid": "206656d9-2d6f-4784-91ff-04e50836b839", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787605008, "uuid": "0c825c03-a56f-47be-8d6d-37a9c11f6d91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787605008, "uuid": "592f9ea2-26bd-4441-9217-e463c906cd57", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dc5532-9f94-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787559426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559426, "uuid": "6ede4ee5-80d7-47cb-b798-cf28c24b97a0", "comment": "Malware payload (Mirai)", "value": "adf293722f09cb05774f0abd9941b55e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559426, "uuid": "8cdc24d6-5f82-47f8-82c6-d66160936595", "comment": "Malware payload (Mirai)", "value": "e935435d050857463d493b12575e58c21313d71ca5a7d9946d944bac517f9369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559426, "uuid": "93695efc-718d-489a-aae6-95cc745fefee", "comment": "Malware payload (Mirai)", "value": "3f7f09783b8b7d70819e1787940d10c8d024ace6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787559426, "uuid": "6374c5db-3d3d-4de6-b2a3-0dc9271c4425", "comment": "Malware payload (Mirai)", "value": "dbf5bfde7f774766f18039bb669984150bbddebf871f8297df31c9b6c58cb8641d14e4eacfcd79a1f3382f7163298fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559426, "uuid": "8cdddfec-3866-4f1b-ba4e-c306b348ceb1", "value": "T1A7A32A92BD825623CAD022BBFB6E418D372653A8E2EF72179D215F2137C681B0D77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559426, "uuid": "6fe4626d-f733-46c1-a0f5-8863117d62a1", "value": "1536:XpevElm3et4qGrO3csmjFCYn330qGgFXFXIkAvKybQytGBH4RJjUAnUZfdCnJx:Xp8zeKjFCYn330qFFLUlbQyIAUef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787559426, "uuid": "9417ff7c-a0e7-41f1-b669-295315c2fc74", "value": 99732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787559426, "uuid": "b3d90b3b-8363-4d1d-9737-f1b6dfee7185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787559426, "uuid": "87053d6a-87fc-49fa-a15f-bc703c2c1e2c", "value": "qtm.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d4405-9fe8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787595649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787595649, "uuid": "b2790bb1-42ba-46cf-bb6c-ab0e888baaec", "comment": "Malware payload", "value": "cb5c77ae93629961ece951bc6def3d57", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zapret", "colour": "#A941E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787595649, "uuid": "f544ffc7-5496-4a50-981f-3bca5c121ec3", "comment": "Malware payload", "value": "e9af23e5212e38604fd00de454c5dca0f192d976a24e7f7d8480140c9fe8fa38", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zapret", "colour": "#A941E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787595649, "uuid": "34fb819a-e160-4ab0-884c-f079ca29f2eb", "comment": "Malware payload", "value": "b04342e1333a759cd8cfe4bce5973d07226438d3", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zapret", "colour": "#A941E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787595649, "uuid": "03d6b95f-a218-49a1-9aeb-57077540d863", "comment": "Malware payload", "value": "50b9173e4b75952d1f9657b33861884404022ca7fc6f84029c15228f091ed6739b47b6dd7c050d94d0fde7ce53107d75", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zapret", "colour": "#A941E0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787595649, "uuid": "675b1ee6-9eb8-4d5e-8fab-b904f09d6789", "value": "T1BE7733AC75B5BA6AF1D4437BC6852CB6DF2CA540E39C3DAB8E2041477D8310E5F2AC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787595649, "uuid": "895c5908-f260-496a-9c27-48b635741c9c", "value": "786432:KQPqp4OySCU7DFrckpCtXnP0Fg6fSlO0e4NXbCAC9i:KJpD6KDFrIXP0fSdXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787595649, "uuid": "d5f0528f-a2ed-4151-851c-1e4f1b68b7da", "value": 35346074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787595649, "uuid": "59e2f962-1495-4c63-915c-cd2b1e449082", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787595649, "uuid": "53bc2152-6a81-4025-8320-ebf13548ba82", "value": "DiscordZapret.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53807b6e-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579239, "uuid": "e8daf14d-21cd-4ece-8d30-2fcf0a05f637", "comment": "Malware payload (Mirai)", "value": "fe7a8c1a1577d5f84e8a551ee399d39f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579239, "uuid": "93819d8d-e837-4ce8-bf61-6de6fe0061a0", "comment": "Malware payload (Mirai)", "value": "ea20bd7652788d744617278a7cee02ad0ce781d0b8471c787ec3511522aea23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579239, "uuid": "662d95d2-393b-4f40-9446-32874e8479d3", "comment": "Malware payload (Mirai)", "value": "5b0289ecbb0ed5877a8e1388a940181d23eaafaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579239, "uuid": "11c75084-d05d-4933-b2b4-31949257f610", "comment": "Malware payload (Mirai)", "value": "09df406cf607a4bee6c79ba7dbd423e19c7c194d781e9309689d20ea4376da7ca5c492ec0d189842752ec21938f4051c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579239, "uuid": "0067b9b1-bda7-433a-b1f8-725436d50605", "value": "T123530A5DE783D8F1DA4305F0105EFB3A6931D9F11260DCABDBD0BAE5AD626826016F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579239, "uuid": "7cd40696-fde7-43f6-bc9a-8aef705c8fac", "value": "1536:JZ6F9+imP65b4eZpv8m8uIw0/DdpUS31gC1SDr:Ji9+imC5b4ipv5j6LKC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579239, "uuid": "30160972-3fd1-4b84-9532-7c22875bf614", "value": 66228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579239, "uuid": "356ae7c0-b2a5-428c-ad6d-2bb28b1e9cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579239, "uuid": "ac1a0a5c-1da8-4680-9656-6cf356d0e05d", "value": "daredevil.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74478758-9fd4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787587025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587025, "uuid": "0b94baad-b148-4124-b6ed-0e7a7d130c71", "comment": "Malware payload", "value": "1e7afaa8ae07d25002358c8a453a12ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587025, "uuid": "e8f06c58-cbac-4e66-b2c4-db36c547d59a", "comment": "Malware payload", "value": "ea5b61bc8d140124753c3ec265b5542e0dc5323bfc613e365339a4819808360b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587025, "uuid": "80026b3b-c7c6-467d-a53f-ec7a328b5c0b", "comment": "Malware payload", "value": "ddb4822820a3e1c5d21d6f82eec557c0b7ef7e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787587025, "uuid": "9450fb35-5cf5-4d3d-9d0c-8e4348de0624", "comment": "Malware payload", "value": "e1c065dd3bfabddf011fef17357aea8ef09a04a186fbae95b95cf62efda887010951cab2941a9fcf7b7b2317eab2ba07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587025, "uuid": "0b1d7926-5509-44a3-a8ad-277f8e0c227f", "value": "T18974234662D7678CDCDE9834039931C3AE0F777CB985E77A90AED9AE33609348E45848", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587025, "uuid": "2ec5d9cf-da86-45d5-955a-e4c64c3f53ce", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587025, "uuid": "1f986e9a-aae7-4ae9-aff3-70d27a8f129f", "value": "6144:Ni17fe5lQvi+WglLT7SfvujsJOYasCbKY0qEluDeVplyomdL0L09yXRy3oy2UVIv:Nm7fekvi+WgLT7Sej6OYHCbK3qguU+dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787587025, "uuid": "e3cabe52-e0b3-43bf-9a22-57b72798c8db", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787587025, "uuid": "a3b2d0c7-6498-4808-9297-ad2ba3dd2109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787587025, "uuid": "59fe984d-f201-4232-a010-06fe3bb687fb", "value": "ea5b61bc8d140124753c3ec265b5542e0dc5323bfc613e365339a4819808360b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4270a82-9fbf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787578220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578220, "uuid": "7b1072ca-ec89-495e-95f5-e9d2f13139bb", "comment": "Malware payload", "value": "5cfe7255d417f09812e36e4059f8eefa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578220, "uuid": "d532de7d-bbfc-4d7a-81b1-33725490dd0d", "comment": "Malware payload", "value": "eacdd45f881888d24e377b8de292525ca3d3fee28eec1c218a09ff95f1cdcffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578220, "uuid": "6c78590e-7909-4518-8d01-25fbb5f378c5", "comment": "Malware payload", "value": "396e5ae9fb737854671a3a6ee098b9d7b15d2ea2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787578220, "uuid": "80c98c36-379a-4a48-8ca9-35bb94a8e924", "comment": "Malware payload", "value": "7c03384808ac1b0b0e360f515f8e30555c057c4d05256c006d11a326aa0ca8f5ac397462800eb7a908c753f37149c6f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578220, "uuid": "80dfcd87-7186-43d7-85bf-7e3a0a256b11", "value": "T11117BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578220, "uuid": "d72b5248-26d4-4411-b6e4-60e6506ba604", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQr:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787578220, "uuid": "9de4cba9-4643-4b45-8648-8d475be58746", "value": 19660800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787578220, "uuid": "8df558f2-d353-4fa0-8947-f7938e41321c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787578220, "uuid": "f3a40c9d-ae82-44ce-9bbe-aa0318ae5c12", "value": "eacdd45f881888d24e377b8de292525ca3d3fee28eec1c218a09ff95f1cdcffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81251ba2-9fc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579316, "uuid": "b0392cd0-6dbe-4981-8f6a-bb67437263de", "comment": "Malware payload (Mirai)", "value": "ec5269a5a2e52468e3b6fd6edeb3a539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579316, "uuid": "c441410c-7203-4c56-897a-eaf1a55d7b7d", "comment": "Malware payload (Mirai)", "value": "eb05c12761cf7d2da32e0d6c1079e41f4239c94300d87e39c678bd345dc25b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579316, "uuid": "1f9ebd12-d5f5-4ea9-a84d-acc6f34bf2a2", "comment": "Malware payload (Mirai)", "value": "22fc0066595205826e83a26fa90907a259aca543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579316, "uuid": "8b51787b-c4b1-4d55-8965-bd6c799502a0", "comment": "Malware payload (Mirai)", "value": "81aee1b1b9d5d10bbe25c660f6d2f1771e3b695ed2f79bcd0b3a28df4eb4831689184e128740e5d769224cf9d0279844", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579316, "uuid": "10f75bb5-7dc8-436a-8f92-54177408b8b4", "value": "T16623023D4243A950D765C83FFF9A0AD15553DA2963EE702779BD009964CC883E8AAC3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579316, "uuid": "24756d27-e77b-4d27-8f0b-bec2ddadfaf4", "value": "1536:soUrbpI9Faqm52bid8x8bfnPxWypX8z8azS:s9S4bUwfnPVeTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579316, "uuid": "a5c89c81-1e95-421a-a292-6278d9393a3b", "value": 50096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579316, "uuid": "f23a9f51-e3c7-42bd-b7de-20fabe6cb3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579316, "uuid": "606da03e-c57b-4ce4-93e5-92abdbe4de3c", "value": "daredevil.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b735ba6b-9fc6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787581125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581125, "uuid": "f3134f4a-9eb0-438e-ab81-f30fa09d3251", "comment": "Malware payload", "value": "34876af8546607f5a23b0825bde97657", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581125, "uuid": "c5b51339-e952-4f34-b438-4f7445ad5a9a", "comment": "Malware payload", "value": "ec7553c8ad8bc66b568410fb9ac7ea36bd772f7f1694875f40e5a099d0c3bda3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581125, "uuid": "0545252d-f19b-4441-b6eb-bd271e4d3e85", "comment": "Malware payload", "value": "bec125f733f140e337d29371bffc56079e28a4ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581125, "uuid": "a5c4c347-55eb-451b-b940-e9ee5c7f8264", "comment": "Malware payload", "value": "d1d744babbb07dda9440e14efbdf480c503be0710d2f570d2281d34e688626f3b2f4a45f0e983887bbbddb8467257a5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581125, "uuid": "9f1a0fc6-fee5-407d-b607-754891604bb7", "value": "T13F235C651A857C14AA98C4361D7F2F0CB9AD43E6320452EE7FCF3CF28C5A6ADA10572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581125, "uuid": "be551ab8-0485-4297-b5fc-0b1c4170eb45", "value": "768:M6Utd8/h9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581125, "uuid": "05b8ab9c-7ddc-41ef-ba52-081817970dd6", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581125, "uuid": "c6879db5-f4a6-41c6-b15e-a3e5be05a8aa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581125, "uuid": "938d1eae-1cd7-4a2d-a592-3febe1a61a23", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39617344-9f65-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787539252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539252, "uuid": "06f74700-2433-4ffd-a256-af1a3bef9a7e", "comment": "Malware payload", "value": "8c74474792c4d3543fdd68eb2bec6dab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539252, "uuid": "ac658595-ad9a-49b4-9bef-bea2eaac3989", "comment": "Malware payload", "value": "ec7d6391bf3af891650c3dc82a7001aee36d33ff3b6034aaf5b2449ec8c9da7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539252, "uuid": "7efcff1b-d206-4f3d-9ed4-5b7ce03fe90c", "comment": "Malware payload", "value": "636ce77190999716c0d67d76f5c00faa599c4c4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787539252, "uuid": "9137837b-b25f-41fb-aa6b-ef22d17e34d8", "comment": "Malware payload", "value": "7aa3e0f82f979a6413ecd916b3caf19e8afa10375f4a4ea0a38fac9281ddb33285a471afbb0042036479e3e2fec5a548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539252, "uuid": "0f00da20-d502-4999-9093-5a4a5a1ec214", "value": "T1F7D4238A77BF3DC6DEA32DAC42E6CB1646D92F9204FEC91448FA419C43D5112C932F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539252, "uuid": "96384657-6371-45b7-9b96-87d3348a8377", "value": "12288:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt78NpI1jSvvkmlkT0teHA78/kV/7UYv:VoG13EsScEPHXMWvDa1kt78govVlkTuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787539252, "uuid": "728025c9-2bae-4190-b150-c005ce79db10", "value": 654210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787539252, "uuid": "334bfee9-98db-4da7-9d9d-2f69ab089ee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787539252, "uuid": "fba62a71-adef-4932-9e74-314a3005ff8b", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f0990d-9fcc-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1787583718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583718, "uuid": "0cfb5b1f-0e8b-4153-9980-0cff45067eb2", "comment": "Malware payload (VIPKeylogger)", "value": "38fb53be0bdfe95f1d898919c4f40ebb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583718, "uuid": "224bdb4b-6573-4d8a-a501-e170b469190c", "comment": "Malware payload (VIPKeylogger)", "value": "ec7e4f760f3ffd94ce20e21fe27858b34c25462176db8eddea8f86e90f95dd35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583718, "uuid": "e689eb27-9e3b-43cd-8e97-884dff6d9684", "comment": "Malware payload (VIPKeylogger)", "value": "1a70abde0f59b56fc067dd7e79b088a5c2140833", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787583718, "uuid": "12382d63-f2f5-4786-acff-df2aea36bf76", "comment": "Malware payload (VIPKeylogger)", "value": "9c2a0a62d5a1851a57b34f4e1c3f325d953580d96610618b932c7518979c6abe7e989ee50b2f24bcbb60fcb3ca29f4a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583718, "uuid": "cd9efcea-a3e1-42e9-8abe-83639487a483", "value": "T1D5A5C7389A83419D1276CF54C2F46436E956B33725AF2D9C18C60F8E46F398B2CB74AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583718, "uuid": "555781da-6793-41f1-834a-fdbc49e36651", "value": "12288:a6G/IQSma1+AEjdPYERFyHFBKXgOuqp+Jf:qxXCpgAJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787583718, "uuid": "1a00b9a2-233c-41f4-82df-c5b1eba7d01b", "value": 2093376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787583718, "uuid": "9f37679c-2698-4305-9ed8-363be021a97e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787583718, "uuid": "ba67a79e-7915-4e94-a3ca-1fcd21433999", "value": "ERAN S\u0130PAR\u0130\u015e 28082026 PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de35716-9fca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1787582612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "41ffd93d-fc7f-4221-96bd-10be7d3874e8", "comment": "Malware payload (Phorphiex)", "value": "9f1919b367486f4028437ccb323ba539", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "cac86ab8-87ec-4e14-a0e3-a0014343d9ca", "comment": "Malware payload (Phorphiex)", "value": "ed431c5a762490d667792f40f99766bd1cca355663766332e181ed5396d67def", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "336db4c9-266f-4c9d-a6ec-72d5ed7cc295", "comment": "Malware payload (Phorphiex)", "value": "dec65ea792cb9ffa3f1a63a8a3e18ca21d88803d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787582612, "uuid": "81955eec-30be-4980-a38f-df94b0c06283", "comment": "Malware payload (Phorphiex)", "value": "8be1ecbd5a848d61e81962d9516f8f46b7422f66d0fb781a9e4b34ad19aa339ff1515bc0136e1ce130b94ec410a4ebd6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "9c8e25f6-4c9e-4f84-849c-413a77c22420", "value": "T104824B0FB9424326D0E11070A676867BDA79A8B633C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "ebd460e1-78be-45c2-912c-154d8ce8f930", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "9162c63b-54b9-448c-9257-b5f31d781fa0", "value": "384:HR6I8vVaF6OeYUQQlmLu94gXTczlmxav8U9cm7l:HRPvUQQt9U8a0Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787582612, "uuid": "3842c74e-a92a-4653-91cc-2254e2e09254", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787582612, "uuid": "651425f8-a809-48ca-82ac-28085d578635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787582612, "uuid": "467ca31f-090e-4bac-b113-d1dc6fe61a25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a22b10-9fc8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787581961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581961, "uuid": "41e70c9a-26af-4984-95f0-651a7913c01c", "comment": "Malware payload", "value": "16f45cedc50f51d5aa7e13d1e9a01533", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581961, "uuid": "12fa212d-dce7-4a54-a5fe-7e746dc4912a", "comment": "Malware payload", "value": "ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581961, "uuid": "5d66ae6f-8c8c-484f-81d9-5ec6ff1b51db", "comment": "Malware payload", "value": "6527bd1cc84fd53349fce5afb33c71a277f4ed36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787581961, "uuid": "b89029cc-7a58-4b87-912c-a921706a8b4b", "comment": "Malware payload", "value": "33dac4f56f023b7d14a812d9ac2547c2b58a29c2455f0f7c086550b29a8952542b80f2a9f5439bab0493d0a427cc0ac5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581961, "uuid": "f58ad3b1-1b6c-4b0a-ba21-4da79fa644d0", "value": "T110C27C96AA867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581961, "uuid": "98de293e-836b-4b73-921d-8a5a99c06640", "value": "768:q8vCB+25j6es8RZ5o9FYpMSUpi+20qUpi+20YQX:q8l25J3+d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787581961, "uuid": "65ce92b4-96c1-402b-acb2-6db4cc7ad313", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787581961, "uuid": "7927b28b-a406-4ea2-a88c-28c86a7e9bfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787581961, "uuid": "7284dced-7abe-4384-9996-eff36e9b002f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c5c0b-9ffb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603818, "uuid": "23db0cc0-fe9c-4bbf-82a9-ad62eaf8c619", "comment": "Malware payload (Mirai)", "value": "75918dcbff1d082be00828a0d6e74b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603818, "uuid": "e85581d3-4280-44ce-97ed-231f79373633", "comment": "Malware payload (Mirai)", "value": "eeb0b68d4dd520776f44644d2da00b3ed3dc55edce73b663b4d4748619065823", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603818, "uuid": "15813781-db1e-4e0a-a9c1-15d71f1de2a1", "comment": "Malware payload (Mirai)", "value": "72b5df02b425432be1679bd256dede393ec86a3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603818, "uuid": "6e709573-bae0-4fe2-ab60-6e9e3576bb9d", "comment": "Malware payload (Mirai)", "value": "cd003cc12916504b1f149c6e01cc1266e944ecd22c298d92fd471e77bb2c6e7e63338f0c009a8ff86f5a01bc389e98a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603818, "uuid": "03184f6e-b0d2-4659-a396-963499adafe8", "value": "T1E6530230A1B3E987C563EB34FE1ED99D9000CF485A123B761BB98159AE71295F71CE23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603818, "uuid": "17d8892a-a02b-415f-a71f-6709f5b6c1a5", "value": "1536:xNMwRj1W6DZg6NjH3bvskfQOGpw3Nup6P4Lkg4azH4:/JzW6DZg6NjLvlQbuoo4LGazH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603818, "uuid": "e70becb3-33c4-448a-a691-6cd71edb949b", "value": 60796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603818, "uuid": "38ad4bac-5c6a-4b7f-a065-d8482411f2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603818, "uuid": "92848422-81cc-4127-86e8-902d1ff33f58", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c04f66-9fc3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787579856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579856, "uuid": "b2178754-595e-4c9c-98a9-aa1230792d95", "comment": "Malware payload (Mirai)", "value": "0e4a12cfa4dee7692b0d16a9eeb21df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579856, "uuid": "acd9d6ed-6592-434a-9185-07a19315ee2f", "comment": "Malware payload (Mirai)", "value": "eecaadd5291b82dfc41ecc4aa3a8c8664c76da196ca587a15087846a498b6498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579856, "uuid": "d138cbfd-6b2f-4712-a3af-ef500b82f629", "comment": "Malware payload (Mirai)", "value": "a5626a14a927af1feedf7997b625169c683fad7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579856, "uuid": "f7e1e986-1798-45db-a053-d388746a0e97", "comment": "Malware payload (Mirai)", "value": "ab25540795f97079b496fac938006174402de848157fc6959334657547b752c4939f34cf89cf51e8c36ebc864f7b6e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579856, "uuid": "6b381e33-8299-42d4-8a26-26f1353f1df0", "value": "T132E36BC069E3E0B1E653497A473B931A5B32D4370219DA11F72E69387F42150E7BBB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579856, "uuid": "eda26770-4b34-41ee-85e7-8275e70b250c", "value": "3072:62tChvbh9YDgS6t88jwf2YE7t4y89XbAzLu1EssMZc/T03ImIys61X1h5om:hChznqL6HbEAzQEssMOgh5om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579856, "uuid": "4ea0219f-d06c-4bc5-8d96-b9d9e96de33a", "value": 148136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579856, "uuid": "3ca641cd-aa8e-4c52-b67e-b065c1898e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579856, "uuid": "a77576ed-ff78-4318-98e5-3606b9e2ab9c", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec4e332-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543556, "uuid": "a8452440-7019-4db7-be9e-cff4f8c5a258", "comment": "Malware payload (Mirai)", "value": "25968c6172db6bd7879e56d846ef5fb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543556, "uuid": "da501300-10d7-40cf-9a2a-eb35663de747", "comment": "Malware payload (Mirai)", "value": "f02b8476bc0e5a38f364da103f1583b17c2742361f46f5640d161092e35a1bd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543556, "uuid": "36988766-c927-41f0-ae0d-dd59ceca86dd", "comment": "Malware payload (Mirai)", "value": "10c8734a97a2c2439b080da5fd7d80a2ffaeb864", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543556, "uuid": "8d22354d-ce4c-4f88-b817-64d24e15f2bc", "comment": "Malware payload (Mirai)", "value": "a1a7e0dc113581ec2238e1890fec99970d4f25db0e291d88acabb64e67c76b98ee32742cf3ec52b56f6da29a6975f2f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543556, "uuid": "5ad79e4c-7670-4cbd-944b-70ec0ccadcdc", "value": "T116934C02BB1A4F43C0AB29F01B7F2BF097D5BDA518B4A4C4751EBE8943B19F16047E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543556, "uuid": "abb662a6-a93b-4f2a-a3b4-dcb55674b668", "value": "1536:GHV4qyijmHZfLy+o0NGlYq5bY1sBJxIz6tq5ZW2bmd:mV1yFtysfqdYAHaWvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543556, "uuid": "a8405b00-3503-4914-8bba-0696cf9a147d", "value": 96812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543556, "uuid": "7789af3f-f3b1-4a5c-8965-57b06ba2a608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543556, "uuid": "be8e4e6b-23b6-429e-a32b-3227c89aca42", "value": "raul.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacdf69b-9ff5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787601317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601317, "uuid": "2dc55fcf-2099-47e9-b904-e2337835b98f", "comment": "Malware payload", "value": "5321dfbea00de03d28e2d9754fd8f7bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601317, "uuid": "a10a8f99-ed09-4fbd-9c6c-f3641cc0d935", "comment": "Malware payload", "value": "f077cc7061c6c9f0c280ec6507a74b00887f1ebe1047d58ddd0160f7de4fc70c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601317, "uuid": "dd0ae41d-b0ab-44ee-a7c3-2fee1252ca74", "comment": "Malware payload", "value": "feb433d92db8d76e17413194bc2703359cd2e83f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787601317, "uuid": "b89f3103-e70b-44f6-b320-050a93fd3e61", "comment": "Malware payload", "value": "457a7c503d0658771ffb8e77e303170f78d9227813390d4b880147522ee4f959899251ded84a15ad51ee32e9ba569054", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601317, "uuid": "2eb01660-1b81-4692-a0f0-95729260306c", "value": "T1D833E11D507619CDE4508EA65A2BF3388AC674A2E7D43D490C78535C148FF20AAFBCDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601317, "uuid": "285fccad-8d0c-4704-a257-67df48f0b4ab", "value": "1536:g2YoK911CATL9YjVzdsHmwelqnGJ273bH53:g2u95TYqqq627d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787601317, "uuid": "b3b6335c-f45c-47b9-be1c-b69c7cc2f745", "value": 52222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787601317, "uuid": "7518555d-c156-4128-9697-be5cd28580ef", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787601317, "uuid": "bfc10432-a5d4-4a43-809e-dcc4f32d9758", "value": "Payroll_statement.pdf.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee9a287-9fc3-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1787579769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579769, "uuid": "b417b9ae-123d-4041-97b6-51f73a6d9137", "comment": "Malware payload (ValleyRAT)", "value": "3cd34e02148b4f44e4c98e53c62e09cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579769, "uuid": "281a8af2-a2af-400f-a71a-e91d1ea0615e", "comment": "Malware payload (ValleyRAT)", "value": "f0b3df423ed7f642bcd0ef9754b97be9a0d359e327c56becb2570f914df1bcb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579769, "uuid": "c9125c25-2b8a-43fd-ae50-1f93e30ed779", "comment": "Malware payload (ValleyRAT)", "value": "1db6b3f94e0fff97ad80c5e07302a8bf65fd2762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579769, "uuid": "fac45143-5b60-4c7e-81db-4ca826d1d016", "comment": "Malware payload (ValleyRAT)", "value": "1b58929c460175d0f673285f2268aa86a45e67e415cf9827d59b232b671a46708d8d8a0eb010a826f40110f4d619596e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579769, "uuid": "18c3f25e-2485-4393-b314-9278843fc40c", "value": "T10A67A413B642CDD3F58A9234C88587F06373ECB1D6A1530F36997B2A3FBE1884E99591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579769, "uuid": "fcb808e3-d89b-4fd8-af7d-399c3e973727", "value": "461926f212e0446fd2ef1c1bca2468e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579769, "uuid": "0b5074d4-6f9b-42f0-8bdd-e759426da995", "value": "98304:5VTuQ2dCu4kpKrqN2niffMeDoze+sn7OHh:7Tn2j0rqN2n+fMeDok7OHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579769, "uuid": "29041e0b-873e-4b36-bef4-9c9c27889358", "value": 30254520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579769, "uuid": "bf8cc63a-112e-4aa3-afbc-b18f947e4257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579769, "uuid": "ae692f8d-e74e-4119-9504-eb0b67a41058", "value": "install_h8.0.04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e241e16e-9fba-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1787576043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576043, "uuid": "c82d782f-2411-4933-a65e-bfb4f24659c3", "comment": "Malware payload (VIPKeylogger)", "value": "c3c7b87c6bb58e43e548e24f08eb1f3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576043, "uuid": "e60165f2-9597-4a27-ae81-66b9dfded334", "comment": "Malware payload (VIPKeylogger)", "value": "f0f181cd31979240cf4cc541dae94214931aedfbb17b852d8871a4946fddb0ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576043, "uuid": "49868e6b-e30d-4c63-98df-249d8aea2ddd", "comment": "Malware payload (VIPKeylogger)", "value": "5bd2d044dccf34eeee3967c33fc216736183c592", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576043, "uuid": "f84e72ae-5426-4240-b628-1bc304ced8d4", "comment": "Malware payload (VIPKeylogger)", "value": "a9fa8ff0743aea8aa73e1908d2c3ba581d3245540a28aa15321e2f25304a1565cb82593ac1c13a54809b2346e7bde563", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576043, "uuid": "7861c3d9-570c-4a55-8c0f-4e5279829cfb", "value": "T1D743FC445983794053333B7FA22EA8E4E676076B00814E0BB97CA455AFF1D2DDDF08BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576043, "uuid": "e4c30883-6029-4e70-a85e-2308333a04a6", "value": "1536:+/8n5ZTxAYq+WU5/qwB7/T4LX9FfSh5yBkn:+/8n5ZTxAYq+WU5/qwB7/T4LX9Fvan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576043, "uuid": "73581930-4e98-4985-a7ff-193d5f5146f3", "value": 58204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576043, "uuid": "dc4e15a4-85c0-4365-bc35-a1f4b5b8066e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576043, "uuid": "a6529786-eeda-4514-9463-6f4e8ecc23a8", "value": "Fiyat Teklif Formu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c5a1c1-9fc3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1787579718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579718, "uuid": "8bcd896e-3665-4ef3-8be8-d2aa3e039d26", "comment": "Malware payload (RemusStealer)", "value": "06637e83487859eca4d80334a5d6a4fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579718, "uuid": "2ccca8da-58ae-4d93-b4cd-8a56a1df1cdc", "comment": "Malware payload (RemusStealer)", "value": "f1bb5a6451b387570a4fdaf71996bbebcf931e142123ac7f673bd0b37049c26c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579718, "uuid": "b65b34b4-7f71-4e05-94f4-9daa935bff5c", "comment": "Malware payload (RemusStealer)", "value": "52c5b3b207666b9b7aa5c45d050435097e0f9ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787579718, "uuid": "9fd32bb4-9aed-401e-a0c0-d60297adcc42", "comment": "Malware payload (RemusStealer)", "value": "34f8a4ef60fd647676bc6bff4f93b949e9350980487cd264601a7d8e64f0b366a51b3bd3af88d4f2598bb29eb381fcff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579718, "uuid": "5a79ab86-2799-463b-bd4e-fbefa6dd2056", "value": "T18EC57E077D9542B5C49AAF3588B68252B631FC0CD73273E32E90AA782F757C15E76B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579718, "uuid": "e094e8e5-c33e-4299-9ad8-9a588ab226fb", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579718, "uuid": "abff1cd6-a7ed-44a6-b5c7-4f76018614b1", "value": "49152:FzoChIGxXGQ6dq/hTQulWuwgTuQW5uZsRw5iHUEFrQF+Qihs5AefBHAQfcgVQ2B6:RyGxqd2blgrQW5uZsRw5iHHFrQFbihsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787579718, "uuid": "207e82ba-4331-4879-8d84-a19fbc8adcc4", "value": 2579368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787579718, "uuid": "ead468c2-31b9-47b7-88f2-c029cb79b16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787579718, "uuid": "7fecfb02-fbb4-4625-b76d-a2b89e9f4ae5", "value": "f1bb5a6451b387570a4fdaf71996bbebcf931e142123a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c14064-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "f2d0561a-e9d4-491b-a876-2b65c82ff3fb", "comment": "Malware payload", "value": "f6f17eefc9bccc26f782d62c747f5a5b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "6916ea0e-1945-4a0e-a952-a686fa53fd62", "comment": "Malware payload", "value": "f1d01d7463d59b556492e9fd6f1af4b41f639cb1d60806dd3a1e5540b0af6386", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "bb4f59a4-c5bc-4904-8cb8-8d6fb313cce5", "comment": "Malware payload", "value": "72c62e461da0fa4795378ddc8d0c474032aaa9b4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576659, "uuid": "e5bd1c24-4c64-4162-a45c-a3443ccb999a", "comment": "Malware payload", "value": "cb19885a546e05d2fbcba52084f1b5c842036d29802c5ca4f00a5a5d8d4923c865940f67dbc108d61cec549f97100795", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "d35454e6-9f16-4e37-baf4-270cb8c0fc9f", "value": "T154B5271E84189338F3E5C8E9854E6E9170F837BC8CF295A8111B4AB15BA57E09FD3B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "05c635c8-f943-4a6d-87ab-1c1d7186bd75", "value": "9f099fb0700d3edfe4ef660a8ade7df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "3c39c7c4-5f93-46ae-845e-f88cda902a94", "value": "49152:f4v0JmSroH4KikP4XjY351pJ3icA7khJyxmS28GFkBBCLRjZ4PTTDS0htTPLSzMF:f4cQvXLXM2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576659, "uuid": "499d289e-601d-4314-be97-6576f28a7eaa", "value": 2292904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576659, "uuid": "871c144e-cf2f-4bfa-b771-f200b7690b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576659, "uuid": "857ee4ef-7a62-4b1c-b317-0c12b86acd59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eb40bf-9f81-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1787551199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551199, "uuid": "2f0ba4fe-bc85-4294-8e01-256064e57292", "comment": "Malware payload (VIPKeylogger)", "value": "5719bb2d8c2bee99e18e330718c76b0f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551199, "uuid": "ae729e9e-7b97-4d4b-9a3a-c6ecc1a7e3e7", "comment": "Malware payload (VIPKeylogger)", "value": "f3dbd82866bce87c5a89df9b2c1606bfe1cdb48c5764da9e2fa82ed2a0cc4f8d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551199, "uuid": "d7f4eca7-6813-44df-bae5-da72e13cb7bf", "comment": "Malware payload (VIPKeylogger)", "value": "ad0d62889d4d9b950c14402ed04dc2528afdbc5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787551199, "uuid": "e1d8eb9b-26c3-46e8-b9d4-75c62b2e96b5", "comment": "Malware payload (VIPKeylogger)", "value": "1de89d66a8ed902f80f53aa8d5722d02f50ccdcd65e640d4fb68665c83c5bcaa51886bfde3a1ab5d7598487a137e762e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551199, "uuid": "a04de627-28b4-4b9b-9070-094bcfea82cc", "value": "T1E9874F6B248C2370AA7C212ABB8D5E9D0273632D4B8355ADB15F3C72C59FD90E981DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551199, "uuid": "482f9a69-9690-4fe4-b6e7-10f3f46e693e", "value": "768:K8rti8rtV8rtd8rt18rtQ8rthx8rt18rtP8rtHu8rtP8rt008rtg8rtv8rtf8rtP:oY/F72BFIQL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787551199, "uuid": "697a111f-12cf-41ae-854b-33ceecae5953", "value": 39407432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787551199, "uuid": "8347feb3-9d38-43a1-85b6-7645e60cc3cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787551199, "uuid": "f8f432e6-a8ee-4f68-8976-59963aabb569", "value": "DHL-AWB-2800294755.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12247881-9f93-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787558943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558943, "uuid": "220c8d78-73ae-49cc-a8cf-a024bd2419e6", "comment": "Malware payload", "value": "6dee6f865da91d18daa9d7803a39bc45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558943, "uuid": "34ae76fd-a34a-480a-a50d-545ed5b2e08b", "comment": "Malware payload", "value": "f4da5e15023114e0dd0dede7df30877784beae270bceadfb795351b39fdce367", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558943, "uuid": "ef1fd81d-b8a6-4647-bee0-8328e72ab5ea", "comment": "Malware payload", "value": "ceb5b748c17d8d24494f53b14f59e6c9a2efdd3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787558943, "uuid": "d70a1afb-cfea-4a93-a522-4cfc642cff44", "comment": "Malware payload", "value": "c2069566b2d4644e96657858f29e15041fe08980bfceaed8126c11420771c09098fe89b4b4f4ebb67cdeadbc3ebb6d57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558943, "uuid": "bc99a4fb-ce96-49b6-b86d-a2d9cd7338d8", "value": "T109C28D966A957C44BEC98B3E4CBD2B1D6DF4C3D1324942AC3D8A3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558943, "uuid": "9726fcf8-2079-477a-a9d5-7aad58d1988a", "value": "768:DHL8vCB+25j6es8Ro9FYpMSUpi+20qUpi+20YQX:DHL8l25J+d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787558943, "uuid": "cc381091-32f2-4d75-ad1f-05ba00dfca01", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787558943, "uuid": "cb62f0b4-5174-4eab-b1dc-30ca4e39f9cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787558943, "uuid": "9d0f93ff-33e1-477a-8248-c853075783ec", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba61c9f4-9f51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787530879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530879, "uuid": "d8177825-90bb-41e3-8e0c-e208df8ac6f4", "comment": "Malware payload (Mirai)", "value": "54f08d245edc2e4a75d61010103fdd8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530879, "uuid": "d6a9bc60-84ce-4a76-9726-e07aecb420b1", "comment": "Malware payload (Mirai)", "value": "f50bc37c7ac1d217de7f571d89b8b6ddac65ad852d36b9a6a148e4e01973d198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530879, "uuid": "4a949e9e-3c49-4181-a376-7a87103c95f8", "comment": "Malware payload (Mirai)", "value": "f1f2065045575fc65bb078047e8b4257b5721412", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787530879, "uuid": "533fac0d-8791-4578-8cab-a486d04ec253", "comment": "Malware payload (Mirai)", "value": "c6afb603cfa7edd729d50894bf7ba971c09471c7a601ef06007abccac97fe86e37d532bc571b3411fe955ba73850e946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530879, "uuid": "e2a41302-a17d-44b2-b0cc-076b8c3e36b4", "value": "T1EF143A95F890DE52C6D5267AF96E518C331313B8D2DAB106CD244F38B7EB85E0E3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530879, "uuid": "e28d0bca-f043-4c99-b2c1-d6a896bf6ad0", "value": "6144:MoN0t/kMmKQUQ4g8OG92vxQMpkN89zpM7p5km:fY/kMTQUQ4g8OU6DZzi7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787530879, "uuid": "ae987f04-411e-4e58-a234-5465e6c5e07c", "value": 198320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787530879, "uuid": "4e02b462-b3dc-4ae2-8420-7e0d93abda1b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787530879, "uuid": "04e04f73-fe74-4a31-adaa-138b9d568782", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4ca72c-9fec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787597536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597536, "uuid": "d88350d2-9780-4a4e-a94c-1207d0ffc3a0", "comment": "Malware payload", "value": "48b2c96b2b5c92e1d7792a60af223b53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597536, "uuid": "a75af995-b0eb-4bca-8f90-5bb75a96e029", "comment": "Malware payload", "value": "f5b850be90148056aa4dcc36802479a73a2966a07e7e66562feeee013ed70de5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597536, "uuid": "badacf08-8dc3-4ef5-9023-39c478e366fc", "comment": "Malware payload", "value": "21b797c7852b64c2da9554290ef4c3a0f406d7d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787597536, "uuid": "0dcf7cf8-d0af-4b60-af91-068343853d53", "comment": "Malware payload", "value": "57c5cd60df840d1ad2d8643097e930ba765ba2439e41acbdbaabe28787fccc653f3cc1286239940c0c985a3291aaa958", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597536, "uuid": "90ab9083-c72e-4b31-9540-6a532ffcf0c2", "value": "T1DAC57B43BC8161B0D999E336D4750251F730B8481B3573D72E46BBB82E32BE51E7AB98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597536, "uuid": "840babba-4383-4646-85ae-6d3d52d5fda1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597536, "uuid": "bb262d88-9b77-4dd3-9f05-b2f5c9c501bd", "value": "49152:3qrhItLA47PFxS1JAdcq6ORxranSgvcU8HnuD1Ac:aU7jIAdcq6gx5jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787597536, "uuid": "4c581a95-cd2d-42c5-a32f-7736deb4cc4c", "value": 2678712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787597536, "uuid": "b8ea01be-cd72-4cb6-a538-e780e0ea8a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787597536, "uuid": "74353275-24db-4006-bf6b-2af92d02cc1a", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0fbea1-9fc5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787580705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580705, "uuid": "e3b75098-374e-477f-a7a7-ec582f43df2f", "comment": "Malware payload (Mirai)", "value": "5555045aa29ae70c798e26ee9e7faa03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580705, "uuid": "42f938e0-a613-4b6f-94b6-db015576b2f3", "comment": "Malware payload (Mirai)", "value": "f6ad4d0dfad475a63f4ea9fadcf44b97aaa38382585abd0bfb2f1ce186e9026b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580705, "uuid": "af7e761c-6213-4893-ad45-b7d24426a994", "comment": "Malware payload (Mirai)", "value": "daf4f077b0bf33160e8a083da4576edb292e5240", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787580705, "uuid": "7f3bcfb2-6447-436d-960f-786e6ca1fbb0", "comment": "Malware payload (Mirai)", "value": "a6b3fb1b87f96d88ed5679121a7be9895e72ff33713758553f906bb75d13476c724c6f214c162f3403e6cbe51a20fa67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580705, "uuid": "654fc498-2493-4cef-a453-1e030204752b", "value": "T1AB934B2119F3A112D6D3A43F47DF421AF16269070188C61BBC3E9D6E7F422A077BB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580705, "uuid": "271fd48d-9ac8-43b6-ae41-3e94871b9d93", "value": "1536:kjbEs6v7qxvNRJhF/TbTuMVlxnLLlv9QLaW2Tu1EssMZcywT03ImIys61XKNAh56:kYG9/XTPPLLiaWUu1EssMZc/T03ImIyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787580705, "uuid": "3ae68dac-c2b1-4753-9edc-f1574e8d8bfb", "value": 92584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787580705, "uuid": "9f41602f-924b-4e6e-8bd6-b1c4783a97db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787580705, "uuid": "d0307201-0d6b-4752-a6d7-9a708eadeb42", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4fa4d1-9fd3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787586691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586691, "uuid": "2ab1c617-98df-4e3e-8a7e-7e0e588e7f4e", "comment": "Malware payload (Mirai)", "value": "3efdc00ed0d2a9777a33b92b29daca66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586691, "uuid": "52329c4f-d29e-41c9-921e-f0abb8ecc56c", "comment": "Malware payload (Mirai)", "value": "f7e1104b45cc7ee10120174be0218abc628e780b2c598d796cd4c50f647f6322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586691, "uuid": "feb3aaf5-da55-4dc4-92fb-ebda46c380ee", "comment": "Malware payload (Mirai)", "value": "f606745e9081d12bdca0cb18965012623a5e1e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787586691, "uuid": "d74256a3-ad9b-4bf8-b7af-7c284996489e", "comment": "Malware payload (Mirai)", "value": "881ef5100dbfffc4ac1b52ca67c26b0b8f11cc5c8e468fac4108ab17cd3d10c887b0e2e9f041b51a4b8a931e19c4df58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586691, "uuid": "73bd35f2-f3f6-4687-82e1-d2a4bf84f0bd", "value": "T1A48312C215405592C2B2343BD2285BE1EEA06B74BBA130B4DC17799D7DE3D2A1EBD1CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586691, "uuid": "476212a7-9003-4e82-81d0-30cb43436bd7", "value": "1536:R7JFmTfIsEgFyOOKpbUZxaD+9WhAV1sp8kcEz69QHRbIrHI0vTk6UcjrrSSD4uXk:R77kIs7EKpQie3V1saBi27I046jj58Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787586691, "uuid": "6406bd05-a5a3-4c0b-a9c7-b7a1619e4bb1", "value": 88104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787586691, "uuid": "2fdfcd2e-1a07-424a-92b1-1113b79ab2a5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787586691, "uuid": "b77060af-536f-46bb-b28b-212c90c091d6", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e6a281-9f5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787536941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536941, "uuid": "b7147f9c-73c4-49ef-b993-4eae45a3ac56", "comment": "Malware payload (Mirai)", "value": "713ef810c0e52f95a848a36fac887880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536941, "uuid": "5ec38b7f-c023-4bbc-b46d-0003b0fe14fd", "comment": "Malware payload (Mirai)", "value": "f878e25084eb4aa2e9f90addbc26bf26a1a64d3f004ce89fbe81476b6e0492a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536941, "uuid": "0a13c368-a530-407d-a75f-50fefe37789a", "comment": "Malware payload (Mirai)", "value": "1deb065eccbaa76b003e7c70b04e10adb6d75b77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787536941, "uuid": "4604709c-f9bf-4566-9c89-127720fcf8a7", "comment": "Malware payload (Mirai)", "value": "7f95a9b0fa4a92b2df61fba649cbe51cf6a8878da996b0f3b938af567f17034cbcc5638d98e35f8a20aa79209c7016d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536941, "uuid": "c17813fd-bb8e-4ccc-9196-0124cbbe2e8b", "value": "T1A2144A95F890DE52C6D0267AFA7D518C330317B8D3DA7116CE108B35B7EB95A0F3A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536941, "uuid": "7af5ade0-3a93-4483-bb39-ce5137b1dd0c", "value": "6144:roArJTah1if9UVcYEEUYDckzjR482pwzihN2B6OT+km:7rwhsfucYEEUSnR48Bc2gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787536941, "uuid": "a4cd30d4-65fd-4f20-8607-7d410b591fd7", "value": 202412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787536941, "uuid": "124fd7b6-f475-4270-917e-09dac9c37262", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787536941, "uuid": "9b21ae1b-15b9-4967-81aa-9dcffa768f1f", "value": "2d35e56e6696dc96cdefe099424ef6432a145f8f7add13ddc0b866c5d8243efb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c787334-9f9f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787564168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564168, "uuid": "d1505e38-f20d-4b66-9ef5-c4bdf1172b5f", "comment": "Malware payload", "value": "70e04b044230d2f2c00d76ed67cbe63e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564168, "uuid": "f336cc28-6d39-4c7e-86c0-eccdc9f867f3", "comment": "Malware payload", "value": "f950e77ec26b79ef19b048f680ea1f7766a556b82fbabcedc18c971c0af63338", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564168, "uuid": "a10a4c3c-2c35-4bcd-ae65-13794f8a3c80", "comment": "Malware payload", "value": "c23b27128caef2e047d1b1c645b3b525803bcc94", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787564168, "uuid": "eacbf70c-1be6-4535-8588-d87e73d027c8", "comment": "Malware payload", "value": "142efcb072a6d96a52115edaa7d6d0c99883023af11f9f59b5d9812c19d6445bd2f01f768e48c0f8dbd480a65812215a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564168, "uuid": "c4531c3c-a8f8-4b9b-890a-c6d3c2ca55c2", "value": "T152C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564168, "uuid": "1c0d48cc-607a-49e9-843d-f0ab55cce399", "value": "768:U8vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:U8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787564168, "uuid": "70a98ccd-6bfa-4aac-aeb6-84b62d108e5a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787564168, "uuid": "0c365b40-1c6d-4863-b095-4fbb361ca593", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787564168, "uuid": "248c613e-bbd1-4019-b035-31644a8eae9d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba438e09-9fcf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787584995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584995, "uuid": "a28eb870-9fc3-4b3e-abb7-7ef7445deb33", "comment": "Malware payload", "value": "bcfa99765e78ad1dd3d5ac7bb9d791d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584995, "uuid": "b8727f69-d382-479f-9bff-82956cc0163b", "comment": "Malware payload", "value": "fa18133093a41ea61ed1d13f408697cb8d21747ce041dce413b1997d5e367a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584995, "uuid": "02faca11-a752-49e2-afa3-4f1a1f1e789e", "comment": "Malware payload", "value": "4e24e1605b7bf0bb3ff637058d805adbf1ff1c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787584995, "uuid": "02508f0e-e520-41aa-99f3-85f389426c68", "comment": "Malware payload", "value": "f7daa9a97f1049d41cd9f8ab833836e21c20cb7fc60c2f7d8152627c92fd992be289b8295f34e63bdd36dafd545feefb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584995, "uuid": "b794a087-0d8b-44be-b497-6f7df46bec8f", "value": "T1F7D30A57FE0C4413C48369781E3B0BEDF324BE5160B99515230A6A6F3B72E326687B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584995, "uuid": "86ef26e5-7f54-48fa-afe3-5e4e7b79eafa", "value": "1536:seB73QqOZQ+5HGj2Q1m7INmsAEBfbGU0yRm3emdNOAfcbn8rkVy:seB73Qnb5HGj2BENzBfbGUj430rUkVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787584995, "uuid": "7c7c9953-cf76-43ca-b9ac-e09ecdf6dbee", "value": 132064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787584995, "uuid": "a14b5389-db59-4e09-89b6-4e07e836348e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787584995, "uuid": "ecc43fdc-61c8-41ce-b1a2-69a1bcc4646b", "value": "main.e500mc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cd2cfb-9ffa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787603458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603458, "uuid": "7de8b95c-3e1e-43bc-8aaa-b531f7a025b4", "comment": "Malware payload (Mirai)", "value": "6f1c64d723539fd67bc63aa6c6469094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603458, "uuid": "119a92c8-d763-4c13-8d9f-164434764709", "comment": "Malware payload (Mirai)", "value": "fa87d394aeef40501a545ec76bc1599c5e4959e9f4b69f1c0f455fbdfbb2b10a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603458, "uuid": "f560f47d-7a0a-491c-bda7-585c14ab5616", "comment": "Malware payload (Mirai)", "value": "327f496d139e0943305c601db81edb96f5335727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787603458, "uuid": "0ff58f91-647e-4839-a890-0c033c58584a", "comment": "Malware payload (Mirai)", "value": "a3ccb5733be594c5aaf2b1cca100fb516d76c9fa123772af2680dede518be0aad889e65a71edae6f774335a3b06075b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603458, "uuid": "7cb15069-e376-4aa1-8e6f-2c8fcd6c7b84", "value": "T1FF243B52AAD24A13C5D3177AFBDF41063323A65693CB7302F92CABB43F8625A4E73541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603458, "uuid": "5a89ed6c-825a-4252-9d58-238c43a994dc", "value": "6144:sprhAZI1tG8zEYyPJkMfFDPgaPhA+1CLhZ6pEssMOgh5oz+bSpM/9L5:qhAZI1tG8zEYyPJkMNDPgaPhA+1PEss+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787603458, "uuid": "eeffb0dd-42ae-45aa-b5f4-d58ea6768780", "value": 216828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787603458, "uuid": "9c0c2f2f-2627-4781-bf13-e857cabd56a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787603458, "uuid": "9df26f22-6871-4084-b86d-ab2c4489b110", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a2ec3e-9fbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787576668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576668, "uuid": "59630be7-b9d1-465b-894a-41b465da513b", "comment": "Malware payload", "value": "8985d3902239e7f05c4c55d958509588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576668, "uuid": "898b9ef8-3743-4338-9580-77bc357d091b", "comment": "Malware payload", "value": "fa94e79e7b8a1a632903ba308e009d5f00016f282c401fcf65248adc8b5256b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576668, "uuid": "2aee772b-9be1-440f-8ad5-a8a078ef7ecf", "comment": "Malware payload", "value": "05492c5c6b2303ccf14767155307ba175ff87ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787576668, "uuid": "aacc2049-5a51-4b8c-a24c-212c79b5d296", "comment": "Malware payload", "value": "1cfb62fb46b508adcf4bcac44b176e376298aaacf182f597199958a4ed6b7bd704958b3bd6071e1f3b647df77eddbd8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576668, "uuid": "60699373-0dbd-47ab-a030-c4029d7f5ef0", "value": "T12062BFA9D2909C67FB7B29F16949F29577FE0F8D1978CED260D0DF9133262209A10CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576668, "uuid": "f4a99637-cb37-4b9f-a7d9-fba19e3cfbab", "value": "384:QmJ4FLkHIa4w+IAN7ib5kLCt7kM4uVcqgw0Oqetyg:NJd4N75m774uVcqgw0ret5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787576668, "uuid": "ec9ee5eb-70b6-4311-a93b-90e38058337d", "value": 15220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787576668, "uuid": "94856fbe-ac55-4c15-9c5d-d8ec8fb9016b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787576668, "uuid": "fdf0d978-9eaf-4b15-9550-8eefb2add25d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb295e9-9fd0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787585432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585432, "uuid": "eddab83e-1523-4f96-b567-b05d48c166ee", "comment": "Malware payload (Mirai)", "value": "250501d8e88804131dc4474b58bf736f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585432, "uuid": "efae7f9d-f138-49c9-9380-1ed46138118e", "comment": "Malware payload (Mirai)", "value": "fac726e1698ee567b2b25106976e103561852a56d63831cf05f66ec05a64be4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585432, "uuid": "3f44f299-1ed5-45d1-80fb-4742b2e9ef0c", "comment": "Malware payload (Mirai)", "value": "29e66b5a648b7611c6f9266e6da8fe7897493886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787585432, "uuid": "b3bbc1b1-0d0a-4e6c-bb23-a8861997dc40", "comment": "Malware payload (Mirai)", "value": "637c8cf0f96c4e09e2a1712bd3f6a0e0132fe2aa252244dea582c1e54f737ad2fc88655298829d795e9eb085096fd380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585432, "uuid": "fa4c1126-4ab0-4fc3-8f75-7260bec738e0", "value": "T1A4145C07B69144FCC19AC474876F9523F931B85D03243D7BABC0AA716E22F716B1DBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585432, "uuid": "1703bd6a-3da4-4567-87ab-1cca13481f34", "value": "3072:GabMqrw6hG15AsAIFJRxsV/bXS3taAylwWm4wi7d74Hyj80d:GasqGPbQV/b8K9m/cdmyjZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787585432, "uuid": "f5846d4f-69d1-4c16-9e1c-568d56661eec", "value": 198912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787585432, "uuid": "101c90d2-51a5-4bf5-8350-435e1f5e9a38", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787585432, "uuid": "ec698150-27de-4958-b9f5-6b61b6863bc8", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b03549-9fa3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787566190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566190, "uuid": "d75ec3be-10aa-46ec-81ba-c059f9471a1b", "comment": "Malware payload", "value": "069626219d4a5287176d22fc957eda7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566190, "uuid": "d5e608f0-cc72-4f3a-ae62-518dc666ead2", "comment": "Malware payload", "value": "fb9830c5d2eb20fba5ee606a3a6489694e38fa9a60fd0af5a39a13a70a1b7ecf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566190, "uuid": "fa5598f3-bb20-49fe-ab57-da60cc52b69a", "comment": "Malware payload", "value": "2ec2df039ffabdfa4e0fb6dea057d8537cabc594", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787566190, "uuid": "dc0447a9-4809-4a5b-a224-798b761d270e", "comment": "Malware payload", "value": "024b79f32521044a1bfbdfa70272cf31afa9ecbc7aa67a535f429a7c03655bb7420aa414818defb7823fd592f17b0211", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566190, "uuid": "8c1470ef-4eb1-4b5a-bfb4-3004b28bb3a3", "value": "T11F236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566190, "uuid": "8df70b04-3656-4c41-b271-c03da179fd02", "value": "768:1r9NyXsZztCyn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:dHusZecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787566190, "uuid": "1f518bc4-7b7b-4996-a4e1-2a1ff9bebc81", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787566190, "uuid": "469e2a3a-c79f-446d-be8b-b9ee5ec3ee45", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787566190, "uuid": "4947ac71-f779-48bb-b04b-03e30eee29a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3905645c-a017-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787615702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615702, "uuid": "6c1b6932-cb3d-4f08-a480-db14f683aa2d", "comment": "Malware payload", "value": "c1a774ce1a8b5aa8ccf6b7c4b1cfd0ee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615702, "uuid": "2a940b20-2bf0-453d-881b-0efdd9d3dc7e", "comment": "Malware payload", "value": "fba00f02ac5abe5b9f7185d74ba753aa12984517fd79ce70a17ffd0ab3fa9adb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615702, "uuid": "554df2ce-41fd-499f-9949-9b4b090da7dc", "comment": "Malware payload", "value": "8a57b2a9cbad582ca6211f7ee7686e6450782853", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787615702, "uuid": "2f263ae9-70bb-44ef-aed4-1f27662abdd0", "comment": "Malware payload", "value": "22a742ddf48928376004d25e82a403d29cefa56fb90aba0eab857b6103d3f7e2933a05b0bc0188473f0837bdd011b06e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615702, "uuid": "03960739-3b7b-4d26-bf1b-0d573263ee3e", "value": "T163C57C43BC8161B0E999E336C4750251B730B84C1B3573D76E56BBB82E32BD50E7ABA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615702, "uuid": "dc289cf2-37f6-4786-af7f-d48b8e5e61b1", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615702, "uuid": "ef05904d-1ffe-489f-bd37-e69fc29f1aa5", "value": "49152:1WGktsilU5fOTaZY4lb3FDMdQnSgvcUzyuD1EC:rfJmqMtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787615702, "uuid": "2080e1d3-cbfe-4ec0-93f3-73aad2dc05b8", "value": 2619832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787615702, "uuid": "246ee598-b740-4109-8ac0-0c1fc02344d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787615702, "uuid": "efaadb43-79cf-4703-80a3-4aa8449b7566", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944aac6a-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1787543700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543700, "uuid": "cef50b36-36b9-4fb5-b1c9-4355eeacd83b", "comment": "Malware payload", "value": "18d4be72c7ab95bcdcdd63dc19447032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543700, "uuid": "b21bf593-a887-42b6-a31e-1ab9bb71ad7a", "comment": "Malware payload", "value": "fc6db036cf7de32720f0ad3daf2d42534cc687f34d3b098a37be5a4a90b5ff11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543700, "uuid": "2638b094-2ac3-4698-bc3d-262a27485b09", "comment": "Malware payload", "value": "07bf27bb5c0a34fabe2d699e0ede990f2ab29bc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543700, "uuid": "e1bac94b-638a-45cb-a230-8221d05f403d", "comment": "Malware payload", "value": "18161d6fa632ea3b65060462501f53cdb32e99df1734abfde62f25295f88178af1e17430c6484ca483692b9530ec4f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543700, "uuid": "d048b2da-d084-4720-a2a5-f2e6edfb08a9", "value": "T162E58C53BCA509AAC09A933189664292BB31FC490F3223D73F50B7782F76BD45E7A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543700, "uuid": "8c5b18b4-f210-43d2-803d-f41a9d3c026b", "value": "49152:5t0FiS79JkviYhMc8nH7oreTzzoBZ/7tO6hoOl8L6sk4DZxN:5GfkKAGErl5FoOquInN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543700, "uuid": "2cc76f4d-f17f-4d5b-97a7-99b5ee59537b", "value": 3253338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543700, "uuid": "9fa4fac0-2b4b-4f12-9acc-81ce0e20411c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543700, "uuid": "8dff50af-4d55-44ca-9d41-4a249a68ac30", "value": "dropper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66c09ec-9fbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787577795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577795, "uuid": "6ec1d141-6ab7-4cf2-bcc4-6f2cb3de9b42", "comment": "Malware payload (Mirai)", "value": "2c77b7dc1ee6d6befe3e1e21e2f5844b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577795, "uuid": "dbcdf4cc-cac5-4e63-b29a-c41126a2dc86", "comment": "Malware payload (Mirai)", "value": "fcd42fc1cf09577a3b3aee335e0bf1ce499b5b0be610af7eda3bb15680403700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577795, "uuid": "adae79cc-f288-40ea-b96b-79aaddd246e2", "comment": "Malware payload (Mirai)", "value": "2405506bf3fc6bd9f25f51cb547bf401d70a6518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787577795, "uuid": "d275c87f-2c72-4720-8631-6c5196f2c566", "comment": "Malware payload (Mirai)", "value": "48ffbb14849966c2cdc92c63015b9bd9ad63f0b2459b42d9eb38f6c899de38a3f5096ee22e1c23a0cf8d7dd336055799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577795, "uuid": "1da5f8d4-0dfc-4710-8502-b920eb67a1df", "value": "T12ED31905730C0447E2A32EF03A3F6BE197EFDAD131E4E645255F9B8A81719325986ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577795, "uuid": "ec26b243-fa5c-4ae9-9688-c6786a1fb74e", "value": "1536:1XoSzEFyyy5L5nqZkZxojI5saQT7kuLsFxocWez8nqyvAUbFnxZK6Zuobzk:7zEoyy9qCxYa2Qhxo7ezrUHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787577795, "uuid": "fb523375-4fe7-4e2a-aa01-ff55edfd04f0", "value": 142032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787577795, "uuid": "dc3925f4-ec53-4245-be4f-bb5fc34e73f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787577795, "uuid": "e912d958-fac0-4a2f-b0f7-e1d13e652c40", "value": "daredevil.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9a4c11-9f6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1787543690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543690, "uuid": "dbdd63cb-6c76-4db6-90c6-eb942fc61441", "comment": "Malware payload (Mirai)", "value": "e7c350506aa41a9755dfddb9d230206f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543690, "uuid": "bcfd3ab0-290f-453b-b991-8605b4aa9c67", "comment": "Malware payload (Mirai)", "value": "fdafaf4366664835f363de8b39cafcaa03ce1136b84c7aba87a9e143478dd7d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543690, "uuid": "5f2e8a0f-31c7-443d-9b95-2dfdd4ef2d63", "comment": "Malware payload (Mirai)", "value": "543610ed84384a7aaedac1026fe15f63c012aa65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1787543690, "uuid": "f11ee5dc-8ada-4613-976d-9e227c384b34", "comment": "Malware payload (Mirai)", "value": "9c29cc5d159b616fa8a197f149c295ccb1bcad21e3ad752585f2b10fc8cbcdc12937863073a663a584ec0db906639448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543690, "uuid": "2086be22-0663-4ae7-9f0f-745e8a88b328", "value": "T10B930741FA87DAF6C50385F080E7B63F9E31BE1E4431C59ADF98EEA9D923AC12505358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543690, "uuid": "4e6110f8-468f-4336-8098-90c5c7723f64", "value": "1536:2rniF7anyy1O9cId5slWhiUcOZoRfKkfYkBxylFupNGmtNe:2LiF74yWO9ckZIfKkfYoyepNGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787543690, "uuid": "c04ec240-a84b-43c5-bfcd-f75b923726a2", "value": 91088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1787543690, "uuid": "9ae8b699-eef7-4bf0-a9eb-7bc41e7671eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1787543690, "uuid": "dca83a39-c82c-4a93-b637-4bfbac147898", "value": "raul.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }